Help us understand the problem. What is going on with this article?

pyreboxの作法 その3

概要

pyreboxの作法、調べて見た。
guest_agentを使って見た。

ツールのインストール

apt-get install gcc-mingw-w64-i686 g++-mingw-w64-i686 mingw-w64-i686-dev mingw-w64-tools gcc-mingw-w64-x86-64 mingw-w64-x86-64-dev g++-mingw-w64-x86-64

コンパイル

cd /pyrebox/guest/win
make

pyrebox.confの設定

[MODULES]
plugins.guest_agent: True

[VOL]
profile: WinXPSP3x86

[AGENT]
name: win_agent_32.exe
conf: win_agent_32.exe.conf

[SYMBOL_CACHE]
path: symbols.WinXPSP3x86


quemの中へ持ってく。

win_agent_32.exeをzipにする。
serverにuploadする。
ie8でdownload.
zip解凍。

プラグインを書く。

検体を抽入して、実行する。

from __future__ import print_function
from ipython_shell import start_shell
from api import CallbackManager

cm = None
pyrebox_print = None

def clean():
    global cm
    print("[*]  Cleaning module")
    cm.clean()
    print("[*]  Cleaned module")

def initialize_callbacks(module_hdl, printer):
    global cm
    global pyrebox_print
    pyrebox_print = printer
    pyrebox_print("[*]  Initializing callbacks")
    cm = CallbackManager(module_hdl, new_style = True)
    pyrebox_print("[*]  Initialized callbacks")
    from plugins.guest_agent import guest_agent
    pyrebox_print("Copying host file to guest, using agent...")
    guest_agent.copy_file("/home/user/ctf.exe", "C:\\temp.exe")
    guest_agent.execute_file("C:\\temp.exe")
    guest_agent.stop_agent()

if __name__ == "__main__":
    print("[*] Loading python module %s" % (__file__))



実行

dos窓でwin_agent_32.exeを起動。
qemuコンソールから、import_moduleする。

結果

ファイルコピーは、できた。
実行は、出来なかった。--継続調査。

以上。

Why not register and get more from Qiita?
  1. We will deliver articles that match you
    By following users and tags, you can catch up information on technical fields that you are interested in as a whole
  2. you can read useful information later efficiently
    By "stocking" the articles you like, you can search right away
Comments
No comments
Sign up for free and join this conversation.
If you already have a Qiita account
Why do not you register as a user and use Qiita more conveniently?
You need to log in to use this function. Qiita can be used more conveniently after logging in.
You seem to be reading articles frequently this month. Qiita can be used more conveniently after logging in.
  1. We will deliver articles that match you
    By following users and tags, you can catch up information on technical fields that you are interested in as a whole
  2. you can read useful information later efficiently
    By "stocking" the articles you like, you can search right away
ユーザーは見つかりませんでした