Project Shebang

[DeXtreme]

Heya fellas, I was thinking about writing script,probably batch, which when run will:

1.Copy a reverse-shell executable(written in python) to the host and make it run at startup

2.Replace the Sticky keys application with a cmd.exe

3.Dump the SAM database

4.Save a rough directory listing of folders like My Documents etc

And whole lot of other stuff i'm yet to think of.


Loaded on a USB stick. I'll have to run it myself of course but is there a way to automate it?

[ThePH30N1X]

Is this what you're looking for? http://www.samlogic.net/articles/autorun-usb-flash-drive.htm

[Kulverstukas]

This is what he's looking for: https://evilzone.org/projects-and-discussion/teensy-dropper-project-details-and-progress/
Autorun is dead, forget about it. HID is the future.

Python reverse shell sounds ridiculous. A regular user won't have python installed and on linux it can just be blocked. I'd go for netcat or at least a MSF generated reverse shell...

[DeXtreme]

This is what he's looking for: https://evilzone.org/projects-and-discussion/teensy-dropper-project-details-and-progress/
Autorun is dead, forget about it. HID is the future.

Python reverse shell sounds ridiculous. A regular user won't have python installed and on linux it can just be blocked. I'd go for netcat or at least a MSF generated reverse shell...

I was gonna compile the script to .exe with py2exe or pyinstaller. Plus i just wanted the feel of writing a reverse shell I've been checking out HID but i'm not sure i can get the hardware. I'll continue reading up on it though

[frog]

I was gonna compile the script to .exe with py2exe or pyinstaller. Plus i just wanted the feel of writing a reverse shell I've been checking out HID but i'm not sure i can get the hardware. I'll continue reading up on it though

That will work, you could have the initial batch file save the py2exe generated directory(which contains the executable, some python c-modules and some .dlls for functionality) to the user's appdata/local(to hide) but you will need admin privileges to write registry keys for the startup process.

You don't need admin priveleges to copy to (C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup>) which will achieve the same result as writing to the key in the registry. It will run when the user logs in. Right now I have a shortcut to the Rainmeter binary lurking in my startup folder.

Next have the batch file generate another .bat that points to your .exe in and save it to the startup folder previously mentioned and that SHOULD work.

Since you will be launching the batch file manually(at least for now), you will be able to start the batch file as admin and you can set things up a lot better. First off read this article about alternate data streams and you will see the potential for hiding your .exe even further. Imagine having your .exe hidden inside of another one, let's say explorer.exe.

The result will be that every time explorer.exe runs your binary will also run, inside the original process! This means it doesn't show in task manager, only the original explorer.exe shows in the list with slightly more memory usage than normal. I haven't tried this with explorer.exe but I know for a fact it works with other .exe's.

Read the attachment.

Also, here's a link for a cheap hid device.
https://www.pjrc.com/store/teensy31.html

Works with arduino IDE, with Teensyduino plugin available for free on the site in the link.

[DeXtreme]

Thanks a lot frog. That's pretty useful stuff. Originally i planned on simply copying the files to the directories and editing the registry but your way sounds interesting. Plus the .exe in .exe info looks great. I'll be sure to look into it.

Gonna have to put a hold on the Teensy though. Ordering stuff from here is murder.

But thanks again. I'll keep y'all posted.

[Kulverstukas]

I have Teensy2.0, it's kinda cheap and cool. Don't bother with the SDcard shield tho, it's useless.
py2exe for a reverse shell sounds like an overkill bro. There are plenty of example code to do it in C/++. Much better that way, and as I said before, there's always Netcat.

[frog]

Thanks a lot frog. That's pretty useful stuff. Originally i planned on simply copying the files to the directories and editing the registry but your way sounds interesting. Plus the .exe in .exe info looks great. I'll be sure to look into it.

Gonna have to put a hold on the Teensy though. Ordering stuff from here is murder.

But thanks again. I'll keep y'all posted.

No problem, just trying to keep the wheels turning.. Where are you at in the world? Just curious about your reasoning on ordering things.

[DeXtreme]

I have Teensy2.0, it's kinda cheap and cool. Don't bother with the SDcard shield tho, it's useless.
py2exe for a reverse shell sounds like an overkill bro. There are plenty of example code to do it in C/++. Much better that way, and as I said before, there's always Netcat.

True.It would be better that way. However my original plan for the reverse shell was to connect back based on my MAC address. So regardless of my IP the shell can still find me. It's mainly for the WLAN at school. People log on and off so IPs aren't constant.
My C isn't that good either so i thought I'd use Python as proof of concept. Maybe later code it in C.

What do you think?

No problem, just trying to keep the wheels turning.. Where are you at in the world? Just curious about your reasoning on ordering things.

Ghana..shipping isn't exactly a breezy down here and the rates are sky high.

[Kulverstukas]

I'd like to see how you will identify yourself in the world with just a MAC...
Python as a POC, yeah that sounds good. Tho I recommend to switch to C on normal basis.

[frog]

I'd like to see how you will identify yourself in the world with just a MAC...
Python as a POC, yeah that sounds good. Tho I recommend to switch to C on normal basis.

If it's on an intranet(the LAN); no problem. Just use arp request packets to find the mac and corresponding IP.

I'm surprised how many people are from a different country than me on this site. I like it.

[DeXtreme]

Yeah it's on LAN.WLAN to be exact.I read up on ARP requests and it looks like it's only good for looking up the MAC address with the IP. The opposite is RARP but it seems it's not activated by default. I was planning on sending a SYN packet with my MAC using Scapy and reading the IP from the ACK packet. Then connecting via Socket with that. Only problem is downloading all the files needed to run Scapy on Windows. The sites seem to be down from here.

[frog]

Yeah it's on LAN.WLAN to be exact.I read up on ARP requests and it looks like it's only good for looking up the MAC address with the IP. The opposite is RARP but it seems it's not activated by default. I was planning on sending a SYN packet with my MAC using Scapy and reading the IP from the ACK packet. Then connecting via Socket with that. Only problem is downloading all the files needed to run Scapy on Windows. The sites seem to be down from here.

There are other packet capture and packet decoding/encoding for python. Here's a couple. You might have to have specific version of Python though.

http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Pcapy
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket
https://code.google.com/p/dpkt/

Problem is there's not a ton of documentation for these modules.

You could also craft the RARP request from scratch using raw sockets, but I think I found what you are looking for; this library can craft RARP packets:
https://pypi.python.org/pypi/arp/1.0

[proxx]

Yeah it's on LAN.WLAN to be exact.I read up on ARP requests and it looks like it's only good for looking up the MAC address with the IP. The opposite is RARP but it seems it's not activated by default. I was planning on sending a SYN packet with my MAC using Scapy and reading the IP from the ACK packet. Then connecting via Socket with that. Only problem is downloading all the files needed to run Scapy on Windows. The sites seem to be down from here.

You are making this very difficult on yourself, I suggest reading up a bit on TCP/IP

[DeXtreme]

There are other packet capture and packet decoding/encoding for python. Here's a couple. You might have to have specific version of Python though.

http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Pcapy
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket
https://code.google.com/p/dpkt/

Problem is there's not a ton of documentation for these modules.

You could also craft the RARP request from scratch using raw sockets, but I think I found what you are looking for; this library can craft RARP packets:
https://pypi.python.org/pypi/arp/1.0

Cool. Thanks again frog.

You are making this very difficult on yourself, I suggest reading up a bit on TCP/IP

  Great advice. Shoulda done this before getting so specific. I am not done read this TCP/IP book i got but a quick question;

Instead of using MAC, could i just query the network's DNS server with my computer name?