fathomless - A collection of post-exploitation tools for networ

项目说明

fathomless

A collection of tools personalized for red teams but also useful for pen testers.

* Modified linux distro that is effective on Win 7 partitions and pre UEFI Systems.
* Custom HTTPS capable C2 server uses a cgi written in Perl and reverse shell clients written in Powershell / Python.
* Simple Windows script obfuscator for A, uses a polyalphabetic cipher to alter b64 encoding.

IAC2

This is an upgrade of sorts to the async-shell-handler.

async-shell-handler

asynchronous multi-shell handler

Includes a server side cgi application and a powershell client.
It performs handeling of systems that ha the async-client
script. This allows the indi running the ser the
cgi to enter shell commands to be executed by clients asynchronously.

The information is exchanged in an encoded format, the secure nature
directly relies upon the use of SSL/TLS.

Install

De for use on a regular Ubuntu 14.04 LTS ser.
To get it working run the installer as root.

use

The info of indi systems is stored in //systems and is
assigned to www-data as owner and group.

cli.pl

This provides a basic command shell to interact with systems running
the client.

To have the server host powershell scripts to be loaded using the exec-script
function place them in //ps-scripts with to correct permissions
www-data as owner and group.

Additional functions have been added to the client that can be called within
a shell session.

* show-help
shows the following function info from a shell session.

* get-info
Displays a summary of current host

* exec-script "name-of-script"
Executes script hosted server side in //ps-scripts by IEX
requires the name of the script filename as a parameter.

* obfuscate "name of text file / script"
Uses a polyalphabetic obfuscation method on base64 strings writes obfuscated
string to file and provides a de-obfuscation key.

* de-obfuscate "(name of text file / script), (key)"
Performs the inverse of the obfuscation function requires the text file with the
obfuscated base64 data and de-obfuscation key as parameters.

* gen-key
generates a random alphabetic string for use with the obfuscate-base64 function.

* obfuscate-base64 "(action:hide or clear ), (key: obfuscation or de-ofuscation), (base64-string)"
The function that contains the obfuscation engine, it works only with clear base64 data.

* byte-encode ( binary-to-obfuscate, key )
Performs byte-encoding prior to con to obfuscated base64 provide key de-obfuscation.

* byte-decode ( file-containing-obfu-base64, key )
performs the reverse of byte-encode, requires the de-obfuscation key.

* askfor-creds
Performs some social engineering inorder to aquire plain-text credentials. This is done
by generating a authentication popup which seems to reconnect to a network share.

* gen-enccmd "your command string"
Generates a PowerShell formatted encoded command. Insure to quote your command
string.

* shortcut-inject "name-of-lnk" "Url-hosting-script"
Modifies the specified shortcut to run the original program and also execute a download
and execute command string. Ex: "Google Chrome.lnk" "]com/hello.ps1"
Requires the http:// or https:// in the URL.

caveats

Depending on your command structure and use of special characters you may need
to encapsulate your command string in a before passing to this function.

* dec-enccmd [Your encoded command string ]
Decodes the base64 string and displays the original string.

Note: depending on the command executed by the client there may be no
stdout, this will leave the client hanging expecting a response and you
will have to restart it to reset it.

to use just run

to exit ctrl-c

If you feel this is a bit too unpredictable you will have to
use echo and tail.

Inside this folder will contain the hostname of the machine runing the
powershell client script.

This will create a folder named after the hostname and it's mac
address.

In this folder will be two files named command and stdout. Their names
denote their purpose.

Created to be used along with gen-obfuscated

For more info

b64 tcp client

Provides a of the tcp powershell client that encodes the TCP traffic with custom base64
encoding. This should help evade some IDS egress detection methods without having to resort
to using SSL, Webserver, C2, blah, blah, blah...

Just a system that can run Perl :D

To use start the Perl listener [->] ./b64-tcp-handler.pl [ specify port to listen on ]

Edit the b64-tcp-client.ps1 script, see below

Get the client to execute on target system somehow, "gen-obfuscated" and wait for your shell.

gen-obfuscated

Generate Obfuscated Code

This is a simple perl program that generates obfuscated vbs/vba code
for use in passing a command to cmd /c while bypassing AV.

To set the options you will need to edit the .pl file directly this is not just a
simple program with preset payloads. It's designed to take in any
type of one-liner you can think of passing to "cmd.exe /c".

Made to be used along with the async-client powershell script, but any one-liner
that get's you a shell should work.

Generated Output of an obfuscated command string:

!generated output

The hash value of the resulting code with the same command string will alter upon
each run.

!generated hash

UPDATE

Now has an interactive user prompt just run it from the terminal.

The below can still give you ideas of what commands to run and should help you get started.

Enables execution of a command string on systems while e countermeasures, specifically A based detection. This is accomplished by focusing on obfuscating command strings that typically download a short script in in first-stage/initial access.

So an example execution chain would be:

Ideally most code should be loaded and executed in memory only.

This code is not made to make reverse engineering impossible or even slow it down. It's specific purpose is to evade automated signature based detection. Is this even a problem to respond to in the first place? Is it just your paranoia? Do you even know?

Currently supported methods.
*
*
* hta
* jscript execution

##### target en for use

gen-obfuscated and the async-client mainly use nati interpreted languages. This was done to increases the chance of success on systems with more strict host security. The e of egress security is the reason for the use of randomization, HTTPS and modded base64 string encoding for comms. (yrmv, test/modd/test/etc...)

Ob there is a social engineering aspect to this that is required, this I leave to you (maybe not).

PSobfuscator

The result of porting some functionality from gen-obfuscated into the powershell clients.
Made to run from a windows systems to generate payloads without needing to use the
powershell clients/implants.These are those functions, plus some original content in
a stand alone that can be run from windows to generate payloads to get
initial access.

The obfuscation engine is ported but the only supported methods currently are
, and lnk files along with other obfuscation techniques.

This is not complete and the under utilized functions will be expanded upon, or you can
do you own thing and not have to wait.

A functions.

simple-downloader "Url-hosting-script"

Generates an obfuscated that will download and execute
a powershell script. After execution it rewrites itself into a txt
file with bogus info and opens in notepad.

looping-stager "Url-hosting-script"

Generates a command string for use kicks
of a looping downloader.

gen-shorcut "Url-hosting-script"

Creates a shortcut that downloads and executes the script found in the
provided url.

shortcut-infect "name-of-lnk" "Url-hosting-script"

Modifies the specified existing shortcut to run the original program
and also execute a download and execute command string.

example:

requires the http:// or https:// in the URL.

Only run this on the target system.

obfuscate "name of text file / script"

Uses a polyalphabetic obfuscation method on base64 strings writes
obfuscated string to file and provides a de-obfuscation key.

de-obfuscate "name of text file / script" "key"

Performs the inverse of the obfuscation function requires the text
file with the obfuscated base64 data and de-obfuscation key as parameters.

gen-key

generates a random alphabetic string for use with the obfuscate-base64
function.

obfuscate-base64 "(action:hide or clear ), (key: obfuscation or de-ofuscation), (base64-string)"

The function that contains the obfuscation engine, it works only
with clear base64 data. It's UTF8 so do not use this for
powershell encoded commands.

byte-encode "binary-to-obfuscate" "key"

Performs byte-encoding prior to con to obfuscated base64
provide key de-obfuscation.

byte-decode "file-containing-obfu-base64" "key"

performs the reverse of byte-encode, requires the de-obfuscation key.

gen-enccmd "your command string"

Generates a PowerShell formatted encoded command. Insure to quote
your command string.

example: gen-enccmd "cmd /c ipconfig /all"

dec-enccmd "Your encoded command string"

Decodes the base64 string and displays the original string.

IMPORTANT !!!
Be sure to dot source this script or iex to import these function
into your current powershell session for this to work.

example:

The boot2own toolkit

B2O is a toolkit that generates a live OS from a crunchbang
iso. When a workstation is booted to this li
it's hard drive is mounted and the NTLM hash of the
local admin (RID 500) is extracted. The admin hash is then
le in attacks against a Windows domain network using a
patched winexe binary.

Used crunchbang-11-20130506-i686.iso successfully to
generate liveCD.

Used Ubuntu Server x86 12.04 successfully to compile patched winexe
So use Ubuntu Ser x86 12.04 to compile binary for i686
crunchbang iso.

Confirmed working on Windows 7 only.

todo

* Add Plop boot manager to PXE generation script.
* ha/Copy2ram functionality to generated iso, to aid live USB function.
* Add additonal payloads
* Add UEFI support (meaning there is no current UEFI support)

Demo

The following link has a demo iso that was generated with this kit.
Don't take my word for it and test it in a Windows VM that is apart
of a test domain.

Get demo here.

create an issue through github if you have any problems.

Video

Watch it in HD to see the details.

![video hosted on youtube here]()

Build Scripts

Run these scripts inside the boot2own/ folder to prevent
any odd issue from appearing.
* b2o-compile.sh - compiles a patched winexe binary
* b2o-isogen.sh - generates the li from a CrunchBang iso
* b2o-pxe.sh - sets up a pxe ser the newly generated iso

Compile winexe

Insure that you are using a x86 Ubuntu 12.04 / Crunchbang computer for
compiling winexe for the x86 LiveCD.

First you need to compile a patched winexe that allows
hash passing. Use the following script inside the boot2own-1.0 folder.

If you already have a copy of smbexec installed, rename a
copied smbwinexe to pwinexe and place it in.

boot2own/li/boot-2-own/pwinexe

Note: a x64 binary will not work.

Generate iso image

To generate a boot2own liveCD for yourself you will need to have
a copy of a Crunchbang iso. The build scripts have been sucessfully
tested on image crunchbang-11-20130506-i686.iso

to generate the boot2own live OS from the crunchbange iso use
the following script with the CB iso as an argument.

This will remaster the crunchbang iso to become the b2o live OS.
the iso will be saved to boot2own/b2o-remaster/boot2own.iso

PXE Server

sets up a pxe server on a Beagle Bone black,
Raspberry Pi or any hardware that has a Debian based OS.
The script installs syslinux, dnsmasq and configures it to run
as a PXE server. It then extracts the needed files from the
boot2own.iso image file in order to boot it with PXE over a LAN.

It is preferable to use a device that has a gigabit Ethernet port.

To install run as ROOT

Default network settings in b2o-pxe.sh

eth0 10.0.0.1
netmask 255.255.255.0

Li Options

Tested on hard drives with Windows 7 installed.
* If the hard drive is encrypted B2O will fail.
* If no Windows file system is detected the LiveCD OS will power off.

Boot computer by USB/CD/PXE
You will then be presented with the following options.

[1] Sethc Backdoor

This option o sethc.exe with cmd.exe,
known as the sticky keys bypass. This enables one to
activate a system cmd prompt when pressing the Shift
keys 5 times at the Windows login screen. To reverse
the process just run this option again on the same
computer.

[2] Mimikatz

Option named after the program Mimikatz. It is delivered
using a PowerShell script "In" (part of the
PowerSploit toolkit) that loads the program reflectively
into memory and then executes it, giving you clear text
credentials. For more info read the contents of
boot2own/li/pld2, also visit the program authors
blog and the Github repo that host PowerSploit(read ABOUT CREDITS-B2O).
The Output from this option is stored in a file [ /root/loot ]

[3] In

A script that is apart of PowerSploit toolkit, executes
a reverse https meterpreter shell back to the specified IP
or domain. For this to work you will need to use the
MetaSploit Framework to have a multi handler ready and
waiting for a connection.

Setting up the multi handler:

Use an metasploit rc script

execute this file
msfconsole -r listener.rc

Note : system_migrate
system_migrate is a modified of smart_migrate, it's
priority is to migrate out of powershell to an existing
SYSTEM/NT AUTHORITY process to maintain this permissions level.
If this is not done The patched winexe process will hang as
powershell remains active.

to get this moded module working copy system_migrate.rb to

metasploit-framework/modules/post/windows/manage/

Do not forget to check permissions.

b2o-listener.sh
Optional - if you already have the metasploit-framework
installed and it is in your terminals PATH along with
having the system_migrate.rb in the appropriate directory.
You can use this shell script to start MSF and drop
you directly into a multi handler configured to
recei from b2o's option 3.

Note : In
For author info and program details read the ABOUT
and CREDITS-B2O.

Note : Proxies
SYSTEM will ignore IE proxy settings so if a network uses
a web application proxy (has good egress filtering)
you will not get your shell and may possibly hang up
a B2O execution run.

[4] PS URL

This option passes a powershell command string that downloads
the contents of a target url to a powershell and
then invokes the contents as an expression "IEX".
This can be le by your own custom powershell script
that you wish to be executed remotely there is no need to
enable remoting as you are passing the parameters
through the patched winexe program.

[5] Windows cli

This option passes a command that is executed directly by
winexe on machines, this option is whatever you make it.

[6] Show Credits

Shows Credits

[7] Shut Down Li

Self explanitory

exfil

For the payload options [ 2 - 5 ]
the output/result of each successful execution run is saved in a file

located: /root/loot (in the Live OS)
how to exfil it, is up to you.

For ideas look at my git repo black-hole.

##### Use only with permission from network owners (make sure it's in writing).

#### Might? todo?

* add pdf/usb to gen-obfuscated.
* add the ability to reflectively load binaries/dll's.

项目信息

开发语言：PowerShell

Star 数：138

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of post-exploitation tools for network red teaming.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。