└─$ sudo nmap -sU 10.129.29.242 --top-ports=200 --min-rate=3000 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-22 22:08 EDT Nmap scan report for 10.129.29.242 (10.129.29.242) Host is up (0.50s latency). Not shown: 196 open|filtered udp ports (no-response) PORT STATE SERVICE 53/udp open domain 88/udp open kerberos-sec 123/udp open ntp 389/udp open ldap
####
PORT STATE SERVICE VERSION 25/tcp open smtp hMailServer smtpd 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-06-23 02:09:51Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: axlle.htb0., Site: Default-First-Site-Name) (X) 445/tcp open microsoft-ds? (X) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: axlle.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 50741/tcp open msrpc Microsoft Windows RPC 56294/tcp open msrpc Microsoft Windows RPC 56309/tcp open msrpc Microsoft Windows RPC 62593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 62594/tcp open msrpc Microsoft Windows RPC Service Info: Host: MAINFRAME; OS: Windows; CPE: cpe:/o:microsoft:windows
If you have any outstanding invoices or requests, please email them to accounts@axlle.htb in Excel format. Please note that all macros are disabled due to our security posture.
Attackers usually place their code in the xlAutoOpen function, which is executed immediately when the add-in is activated. What makes this technique dangerous is that only one click is required to run the malware, unlike VBA macros which require the user to disable Microsoft Office’s Protected View and enable macro content. However, XLL files are portable executables that follow the format of dynamic link libraries (DLLs) which many email gateways already block.
*Evil-WinRM* PS C:\App Development\kbfiltr> cat README.md # Keyboard Translation Program This is an application in development that uses a WDF kbfiltr as the basis for a translation program. The aim of this application is to allow users to program and simulate custom keyboard layouts for real or fictional languages.
## Features - Create custom keyboard layouts for real or fictional languages. - Simulate keyboard inputs using the custom layouts. - Secret codes to switch between languages and logging output.
## Progress - kbfiltr driver - Complete - Keyboard mapping - Complete (hardcoded in driver) - Custom mapping in application layer - In progress - Logging - Complete - Activation of logging - Complete - Simulation of other keyboard layouts - Incomplete - Activation of other keyboard layouts - Incomplete
**NOTE: I have automated the running of `C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\standalonerunner.exe` as SYSTEM to test and debug this driver in a standalone environment**
## Prerequisites - Windows 10 or higher - Visual Studio 2019 - Windows Driver Kit (WDK) 10
## Getting Started - Clone this repository. - Open the solution file in Visual Studio. - Build the solution in Release mode. - Install the driver by running `.\devcon.exe install .\kbfiltr.inf "*PNP0303"` as Administrator. - Install the driver as an upperclass filter with `.\devcon.exe /r classfilter keyboard upper -keylogger` as Administrator. - Install the application by running the install_app.bat file as Administrator. - Reboot your computer to load the driver. - Launch the application and start programming your custom keyboard layouts.
## Usage ### Programming a Custom Layout - Launch the application. - Click on the Program Layout button. - Select the language for which you want to program the layout. - Select the key you want to modify from the list. - Modify the key's scancode and virtual key code as required. - Repeat steps 4 and 5 for all the keys you want to modify. - Save the layout by clicking on the Save Layout button. ### Simulating Inputs - Launch the application. - Click on the Simulate Input button. - Select the language for which you want to simulate the input. - Type in the input in the normal English layout. - Trigger language switch as outlined below (when required). - Verify that the input is translated to the selected language. ### Logging Output - Launch the application. - Turn on logging (shortcuts can be created as explained below) - Use the application as normal. - The log file will be created in the same directory as the application. ## Triggering/Activation - To toggle logging output, set up a shortcut in the options menu. INCOMPLETE - To switch to a different language, press the Left Alt key and the Right Ctrl key simultaneously. INCOMPLETE ## Bugs There are probably several.
总的来说就是他们有一个在开发中的应用，不过我比较关注这几个部分
1 2 3 4 5 6
... - Install the driver by running `.\devcon.exe install .\kbfiltr.inf "*PNP0303"` as Administrator. - Install the driver as an upperclass filter with `.\devcon.exe /r classfilter keyboard upper -keylogger` as Administrator. - Install the application by running the install_app.bat file as Administrator.
**NOTE: I have automated the running of `C:\Program Files (x86)\Windows Kits\10\Testing\StandaloneTesting\Internal\x64\standalonerunner.exe` as SYSTEM to test and debug this driver in a standalone environment**
