Added a cradle that uses Wininet instead of request library.This is useful also for NTLM proxies.
Added opsec pyMM module that uses WinIned instead of requests and imports a minified windows dependency.
It essentially is the same windows dependency but stripped down from unnecessary modules because we use it jsut to access the PEB.
This allows The opsec version to load PythonMM using Wininet and not dropping anything to disk, while the normal pyMM drops windows on disk and does not uses Wininet so there's no NTLM proxy support backed in.
The pyramid server has been also stripped down from the basic authentication because it's meaningless since we are using symmetric encryption and it complicates a bit the usage of WinInet.
Couple extra lines are present at the end of the file, triggering an indentation error. Lines don't appear to do anything, looks more like an accidental partial replication of the two lines previous.
Added a print of an zipped-encoded version of the cradle during pyramid start, that can be easily pasted in a python terminal for scriptless execution.
This introduces:
- server-side and cradle-side chacha/xor encryption/decryption for delivered files and URLs
- auto-generation of Server configs based on pyramid command line
- tidier project folder structure
- minor HTTP customizations: user-agent, URL
- all modules have been updated to work with the cradle/server encryption
- extraction directory for some dependencies can be specified in modules (can be also a UNC path)
This base script allows in-memory loading of a remotely fetched dll via MemoryModule technique.
No external code is required, i.e. you don't need to drop on disk external bindings anymore to accomplish this. All is done entirely in-memory.
Pyramid Base script for executing a socks5 Proxy server on 127.0.0.1 and making it accessible via an SSH tunnel. After executing the base script proxychains can be used from the box there she SSH tunnel landed. This allows to proxy traffic on target with limited privileges (starting socks5 server on 127.0.0.1 does not require admin privileges) and without executing a C2 agent or injecting shellcode, all is done in-memory (apart from few dependencies that are dropped) and in Python.
The script can also be executed without spawning a visible shell by using pythonw.exe, see README for more details.
Diego Capriotti