PowerLessShell: Run PowerShell command without invoking powershell.exe – Penetration Testing

PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawing powershell.exe. To add another layer of crap the payload will copy msbuild.exe to something random and build the payload using the randomly generated binary.

Installation

git clone http://ift.tt/2sWhG3h

Usage

Attacker side

$ python PowerLessShell.py

PowerLessShell – Remain Stealth
More PowerShell Less Powershell.exe – Mr.Un1k0d3r RingZer0 Team
___
.-“; ! ;”-.
.’! : | : !`.
/\ ! : ! : ! /\
/\ | ! :|: ! | /\
( \ \ ; ❗ ; / / )
( `. \ | !:|:! | / .’ )
(`. \ \ \!:|:!/ / / .’)
\ `.`.\ |!|! |/,’.’ /
`._`.\\!!!// .’_.’
`.`.\|//.’.’
|`._`n’_.’|
`—-^—-”

(Path to the PowerShell script)>>> powershell.ps1

(Path for the generated MsBuild out file)>>> payload.csproj

[+] payload.csproj was generated.
[+] payload.csproj.cmd was generated.
[+] Run the command inside of payload.csproj.cmd on the target system using WMI.

Inline command

python PowerLessShell.py powershell.ps1 output

PowerLessShell – Remain Stealth
More PowerShell Less Powershell.exe – Mr.Un1k0d3r RingZer0 Team
___
.-“; ! ;”-.
.’! : | : !`.
/\ ! : ! : ! /\
/\ | ! :|: ! | /\
( \ \ ; ❗ ; / / )
( `. \ | !:|:! | / .’ )
(`. \ \ \!:|:!/ / / .’)
\ `.`.\ |!|! |/,’.’ /
`._`.\\!!!// .’_.’
`.`.\|//.’.’
|`._`n’_.’|
`—-^—-”

[+] output was generated.
[+] output.cmd was generated.
[+] Run the command inside of output.cmd on the target system using WMI.

Source: Github

The post PowerLessShell: Run PowerShell command without invoking powershell.exe appeared first on Penetration Testing. http://ift.tt/2sWjmd7 http://ift.tt/2aM8QhC

Anúncios

Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s