New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

【工具投毒】K8_Struts2_EXP工具存在投毒木马 #73

Open

Arct1cF0x8B1ts opened this issue Sep 18, 2023 · 0 comments

Arct1cF0x8B1ts commented Sep 18, 2023

起因

打点st2，使用k8哥的工具时，火绒报毒，发现存在下载exe文件行为

[IOC]

117ad9fcbfcd9ce17dd4245709a1fa5a83e0bfbc4cdde0fafb6da7ee63dafbbb
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

VT

https://www.virustotal.com/gui/file/117ad9fcbfcd9ce17dd4245709a1fa5a83e0bfbc4cdde0fafb6da7ee63dafbbb/behavior

文件位置：C:\Penetration\ExpolitTools\Struts2\K8_Struts2_EXP.exe

源文件和被投毒的文件HASH对比：

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment