一种另辟蹊径的免杀执行系统命令的木马,通过https“公开笔记”网站来交互通信交互
By T00ls.Net
-
使用公开笔记网站https://note.ms做中间服务器。uri /ba为一个笔记的地址,每个uri都对应一个笔记。
优点:
- 免杀
- 有效避免被溯源
- AES加密
- 二进制木马不包含c2地址,通过noterce传递c2指令
缺点:
- 15秒执行一次命令(但可直接上线cs)
noterce前端 启动命令:
curl -LjO https://github.com/xiao-zhu-zhu/noterce/releases/download/1.3/noterce.zip
unzip noterce.zip
cd noterce
docker-compose up -d
#端口默认为8888
#可在docker-compose.yaml更改port
- 打开部署好的网站
![图片](https://private-user-images.githubusercontent.com/85468097/237304571-63477782-9faf-48eb-8764-c42073403dce.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MjM4NDMsIm5iZiI6MTcyMTcyMzU0MywicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDQ1NzEtNjM0Nzc3ODItOWZhZi00OGViLTg3NjQtYzQyMDczNDAzZGNlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzIzVDA4MzIyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTBmYWE4YmU3NDU2OGZmNzI4ODA5OTM5MTE3MDRlNmRjN2RhYWY4NjhjNjI1NDhlMjRjOTlkNDc2ZjI2NDcxZjImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.12CF4YR1zIwe9sdKHatkl33DUcc-8Rcu7B13xQy8VBo)
![图片](https://private-user-images.githubusercontent.com/85468097/237304646-ba5d9895-7e73-48c9-8da5-33dcc56541b9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MjM4NDMsIm5iZiI6MTcyMTcyMzU0MywicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDQ2NDYtYmE1ZDk4OTUtN2U3My00OGM5LThkYTUtMzNkY2M1NjU0MWI5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzIzVDA4MzIyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTczNDllMTljMDM5Y2I4NDBmMGQ4NmMwMjFmMmY1MzYyZDRkOTVmN2EwZTEwYWY1ODY5OTk4MWI1MmFjYjNiNDImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.xkyFuRg9iTftCdPWN6uIRpfHSyYgkXyCYe1kiwWpBfM)
![图片](https://private-user-images.githubusercontent.com/85468097/237304906-0ef38e95-6c49-46bf-950a-e1ecd397d990.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MjM4NDMsIm5iZiI6MTcyMTcyMzU0MywicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDQ5MDYtMGVmMzhlOTUtNmM0OS00NmJmLTk1MGEtZTFlY2QzOTdkOTkwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzIzVDA4MzIyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTEyZWQzODdlZDI5ODQ5NGQ0YmM2NWRlOGU2MzJmN2E1MTk5ZGJkMThkZGFjY2FiMzlkNGZlN2I4MTJjOTA4OTkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.SBWapWKS5e2UpH55bt0f1wLEBO1RnBnkbow6kQtTHZM)
![图片](https://private-user-images.githubusercontent.com/85468097/237306165-b58dd11f-e3ff-4272-ac9d-5ec9e6f0b2e8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MjM4NDMsIm5iZiI6MTcyMTcyMzU0MywicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDYxNjUtYjU4ZGQxMWYtZTNmZi00MjcyLWFjOWQtNWVjOWU2ZjBiMmU4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzIzVDA4MzIyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTkxYTAxZWY4YjEzYTM0ZjA2NWViZjViMDMxNWVkOTY1YTZiYjYzY2UyMTdiNmQ3ZDY4ZDA1YjJkNDczN2MxZjUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.zFDyIAyyePVIRSIQiashMolWR1OPfBLQA0amD9-kiE8)
![图片](https://private-user-images.githubusercontent.com/85468097/237306165-b58dd11f-e3ff-4272-ac9d-5ec9e6f0b2e8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MjM4NDMsIm5iZiI6MTcyMTcyMzU0MywicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDYxNjUtYjU4ZGQxMWYtZTNmZi00MjcyLWFjOWQtNWVjOWU2ZjBiMmU4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzIzVDA4MzIyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTkxYTAxZWY4YjEzYTM0ZjA2NWViZjViMDMxNWVkOTY1YTZiYjYzY2UyMTdiNmQ3ZDY4ZDA1YjJkNDczN2MxZjUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.zFDyIAyyePVIRSIQiashMolWR1OPfBLQA0amD9-kiE8)
![图片](https://private-user-images.githubusercontent.com/85468097/237311049-605d988e-f46a-4d3a-9bd0-695a6e719423.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE3MjM4NDMsIm5iZiI6MTcyMTcyMzU0MywicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMTEwNDktNjA1ZDk4OGUtZjQ2YS00ZDNhLTliZDAtNjk1YTZlNzE5NDIzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA3MjMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNzIzVDA4MzIyM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTRmMmQ3MWRhNjQwODg4ODljZGU3MzhhZDdhOWI5MWJhNTA4ODQ2ODQxYmIxMTVjN2ExZmNiODJiNWVjZjE1MDMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.lLjn9s1mudmgsvgCJwgBXB_osSu1MsR63UYgRTcv-vM)