Salseo
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Compiling the binaries
Pakua msimbo wa chanzo kutoka github na uunde EvilSalsa na SalseoLoader. Utahitaji Visual Studio iliyosakinishwa ili kuunda msimbo huo.
Uunde miradi hiyo kwa ajili ya usanifu wa sanduku la windows ambapo unakusudia kuitumia (Ikiwa Windows inasaidia x64 uunde kwa usanifu huo).
Unaweza kuchagua usanifu ndani ya Visual Studio katika "Build" Tab ya kushoto "Platform Target".
(**Ikiwa huwezi kupata chaguo hili bonyeza kwenye "Project Tab" kisha kwenye "<Project Name> Properties")
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-c307d4fc69fa5935c998270dcc1356323b75f628%252Fimage%2520%28839%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=33bfb863&sv=1)
Kisha, jenga miradi yote miwili (Build -> Build Solution) (Ndani ya log zitajitokeza njia ya executable):
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-97bc5bee64475386a1c7ede5fc72cb52cb00c14a%252Fimage%2520%28381%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=cbd1f736&sv=1)
Prepare the Backdoor
Kwanza kabisa, utahitaji kuandika EvilSalsa.dll. Ili kufanya hivyo, unaweza kutumia script ya python encrypterassembly.py au unaweza kuunda mradi EncrypterAssembly:
Python
Windows
Ok, sasa una kila kitu unachohitaji kutekeleza mambo yote ya Salseo: encoded EvilDalsa.dll na binary ya SalseoLoader.
Pakia binary ya SalseoLoader.exe kwenye mashine. Hazipaswi kugundulika na AV yoyote...
Tekeleza backdoor
Kupata TCP reverse shell (kupakua dll iliyosimbwa kupitia HTTP)
Kumbuka kuanzisha nc kama msikilizaji wa reverse shell na seva ya HTTP kutoa evilsalsa iliyosimbwa.
Kupata shell ya UDP reverse (kushusha dll iliyokodiwa kupitia SMB)
Kumbuka kuanzisha nc kama msikilizaji wa shell ya reverse, na seva ya SMB kutoa evilsalsa iliyokodiwa (impacket-smbserver).
Kupata ICMP reverse shell (dll iliyosimbwa tayari ndani ya mwathiriwa)
Wakati huu unahitaji chombo maalum kwenye mteja kupokea reverse shell. Pakua: https://github.com/inquisb/icmpsh
Zima Majibu ya ICMP:
Tekeleza mteja:
Ndani ya mwathiriwa, hebu tuendeshe kitu cha salseo:
Kuunda SalseoLoader kama DLL inayosafirisha kazi kuu
Fungua mradi wa SalseoLoader ukitumia Visual Studio.
Ongeza kabla ya kazi kuu: [DllExport]
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-eaa792ed64ebbbbad8406ffd68a135f7d52bccf5%252Fimage%2520%28409%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=fd18dad2&sv=1)
Sakinisha DllExport kwa mradi huu
Zana --> Meneja wa Kifurushi cha NuGet --> Simamisha Kifurushi cha NuGet kwa Suluhisho...
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-455fbb8b7ed1ffe5133920385e2714aeeb047488%252Fimage%2520%28881%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=9873392d&sv=1)
Tafuta kifurushi cha DllExport (ukitumia kichupo cha Browse), na bonyeza Sakinisha (na kubali popup)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-2fde683ec96aef5aed5246e6c486344a3232e639%252Fimage%2520%28100%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=8ddab45d&sv=1)
Katika folda yako ya mradi, faili zifuatazo zimeonekana: DllExport.bat na DllExport_Configure.bat
Uondoe DllExport
Bonyeza Ondoa (ndiyo, ni ajabu lakini ni muhimu)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-5dc69a4e721000997ac2c2edd7d9a5642c6fc0df%252Fimage%2520%2897%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=8c844a6e&sv=1)
Toka Visual Studio na tekeleza DllExport_configure
Tu toka Visual Studio
Kisha, nenda kwenye folda ya SalseoLoader yako na tekeleza DllExport_Configure.bat
Chagua x64 (ikiwa unakusudia kuitumia ndani ya sanduku la x64, hiyo ilikuwa hali yangu), chagua System.Runtime.InteropServices (ndani ya Namespace kwa DllExport) na bonyeza Tumia
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-7510b6e7e73f1de4ecf9b1ed9459d3a619203edd%252Fimage%2520%28882%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=28c1db80&sv=1)
Fungua mradi tena na Visual Studio
[DllExport] haipaswi kuwa na alama ya kosa tena
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-066cf2ec81bc045b14fa0ec883f5f5fa66ce4ce2%252Fimage%2520%28670%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=94e6f9bf&sv=1)
Jenga suluhisho
Chagua Aina ya Matokeo = Maktaba ya Darasa (Mradi --> SalseoLoader Mali --> Programu --> Aina ya matokeo = Maktaba ya Darasa)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-d3370cd6f406a9fd3d825fb769c5447cd21d9da3%252Fimage%2520%28847%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=f4e9c137&sv=1)
Chagua jukwaa la x64 (Mradi --> SalseoLoader Mali --> Jenga --> Lengo la jukwaa = x64)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-541196b64348f28dd11fb9b311fe001b62b102f8%252Fimage%2520%28285%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=e4750cbd&sv=1)
Ili kujenga suluhisho: Jenga --> Jenga Suluhisho (Ndani ya console ya Matokeo, njia ya DLL mpya itaonekana)
Jaribu Dll iliyozalishwa
Nakili na ubandike Dll mahali unapotaka kuijaribu.
Tekeleza:
Ikiwa hakuna kosa linalojitokeza, huenda una DLL inayofanya kazi!!
Pata shell ukitumia DLL
Usisahau kutumia HTTP server na kuweka nc listener
Powershell
CMD
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated