nccgroup / demiguise Goto Github PK

HTA encryption tool for RedTeams

Home Page: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/smuggling-hta-files-in-internet-exploreredge/

License: GNU Affero General Public License v3.0

Python 100.00%

demiguise's Introduction

Demiguise - HTA encryption tool

Released as open source by NCC Group Plc - http://www.nccgroup.trust/

Developed by Richard Warren, richard [dot] warren [at] nccgroup [dot] trust

http://www.github.com/nccgroup/demiguise

Released under AGPL, see LICENSE for more information

What does it do?

The aim of this project is to generate .html files that contain an encrypted HTA file. The idea is that when your target visits the page, the key is fetched and the HTA is decrypted dynamically within the browser and pushed directly to the user. This is an evasion technique to get round content / file-type inspection implemented by some security-appliances. This tool is not designed to create awesome HTA content. There are many other tools/techniques that can help you with that. What it might help you with is getting your HTA into an environment in the first place, and (if you use environmental keying) to avoid it being sandboxed.

How does it do it?

This is achieved by encrypting the HTA file using RC4, and then using navigator.msSaveBlob to "save" the file at runtime - rather than fetching the HTA directly from the server. Meaning that at no point is there any HTTP request/response that contains your HTA file in a plain-text form - the proxy will simply see a text/html file containing your encrypted blob. In the latest version of Edge, this will result in the user being prompted to "run" the HTA.

Although not the primary aim of this tool, there are a couple of payload-options for the underlying HTA. Each option uses different techniques as previously documented by Matt Nelson, Matthew Demaske, Ryan Hanson and Etienne Stalmans. The benefit of using these techniques is that your code does not execute as a child of mshta.exe. As mentioned previously, the content of the HTA is not the primary aim of this tool. I'd encourage you to modify the HTA template to contain your own custom code :)

How do I run it?

Run the demiguise.py file, giving it your encryption-key, payload-type, output file-name and command that you want the HTA run.

Example: python demiguise.py -k hello -c "notepad.exe" -p Outlook.Application -o test.hta

Environmental Keying

In order to evade sandboxes, you shouldn't embed your key directly in the HTA. Instead you should get this dynamically from the environment the target is based in. An example of this may be to use the client's external IP address as a key. The benefit of this is that if the code is run in a 3rd-party sandbox, the HTA will not decrypt. In fact, the file-name will not even decrypt, meaning that nobody will know what your payload is/does :)

Some examples of environmental keying are given in examples/externalip.js and examples/virginkey.js.

Bonus

Since the tool outputs an HTML file containing JavaScript, you can simply take this JS and host it wherever you like. This means that if your client's website is vulnerable to reflected-XSS, you can use this to serve your HTA file from their (highly trusted) domain.

Also, Outlook doesn't block .html attachments by default , and neither do some other applications - use your imagination! :)

Detection

Currently it is not detected on VT:

https://www.virustotal.com/en/file/24b86ee6210b2abc446021feacfe25502b60403455aa24a32c80b2e7b0f81a70/analysis/1499880541/

Defense

Although obfuscation techniques may be hard to signature, one way to defend against HTA attacks is to prevent the HTA itself from being able to run in the first place. This can be achieved either through the use of Software Restriction Policy (SRP), Device Guard (on Windows 10 and Server 2016), or by changing the default file-handler associated with .hta files.

Please note that these changes may potentially affect the running of software that relies on HTA execution. Therefore it is recommended that a fix is fully tested in your own environment.

Using SRP:

Changing the default file-handler:

ftype htafile=%SystemRoot%\system32\NOTEPAD.EXE %1

Changing it back (x64):

ftype htafile=C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*

FAQ

Doesn't this drop to disk?
- Testing in the latest version of Edge, this only "drops to disk" in the same way that serving a regular HTA does. It's going to end up as a temp file on disk either way.
Why would I use this when I already have a sandbox detection for $product by checking for domain joined status / printers etc.?
- The aim of the tool is to avoid being executed in a sandbox in the first place. If you pick your keys wisely, the HTA will not even decrypt correctly, nor will $product know it's an HTA file - meaning it cannot be executed by the sandbox.
How do I find an environmental key source without first having access to the target network?
- This is left as an exercise for the reader, however this can often be discovered with some good OSINT. If you are carrying out fingerprinting campaigns, check out WebFEET and BeEF for some inspiration.

Greetz / Prior Art

Matt Nelson - WbemScripting.SWbemLocator & ShellBrowserWindow COM execution Techniques
Matthew Demaske - WbemScripting.SWbemLocator COM execution PoC
Ryan Hanson - Excel.Application.RegisterXLL COM execution technique
Etienne Stalmans - Outlook.Application.CreateObject COM execution technique
Brandon Arvanaghi and Chris Truncer's CheckPlease tool.
The Empire Project

demiguise's People

Contributors

Stargazers

Watchers

Forkers

vysecurity quikilr rkornmeyer johnjohnsp1 tim1512 subc0ol cartel0x27 un4ckn0wl3z kuteminh11 cclauss jeperez clicknull jbarcia m4sc3r4n0 rootjacker ashr bytecod3r shantanu561993 kbahaxor n4yk minkione koushui m41doror initpwn moriarty2016 samyoyo kazimer zshell songofhack choutofu jothatron ankushgoel27 yehgdotnet h0k5 grukz ericbaranowski yeyintminthuhtut lamkeysing92 zard777 demonsec666 baaslaawe kabadjo yikez978 mehrdad-shokri mrtaheramine christofersimbar gavz suriya73 idkwim poppopjmp carnal0wnage m4dnut celestial-intelligence dsnezhkov decay88 jack2 fckoo tai-euler kingz40o 3453-315h nickhakkz unbaiat shyatup ykankaya kakuye b1gw00d r0cknrolla riviera12345 gitlabsyncint malwar3ninja seemantbisht terrisgo topotam mgcfish hsis007 haga5 s3c qsdj nonfind kingsbig2001 limkokholefork analyticsearch w00t3k akapitbull team-firebugs npaulhus modulexcite slooppe projecthaidar dipsec the-invincible readingcode nmhai qlemaire attackgithub upils t3st0r-git butlerallenj juan157 esmat777

demiguise's Issues

error with HTA file if downloaded but not if wrote and executed on the victim machine

Hello,
when the HTA file runs, an error appears and the script is not executed.

I tried with my own HTA file, and the issue still remains the same.

The OS I used to test Windows 7 and 10, and the web browser is FireFox Quantum and IE explorer.

However, in most cases, if i open the HTA file with a text editor and then save it (just that !!), the script works ...

Do you have an idea about some restrictions that can appened if the HTA file is downloaded, but not occured if the file is directly wrote on the victim machine?

hello nccgroup

i was wondering where i can find "encryption-key"

i have created an HTA file with metasploit
i'll get into the file and send u a text tell me where's the key

hta not working as expected

Not working as expected, generate hta using following command

python demiguise.py -k hello -c "cmd.exe /c calc.exe" -p ShellBrowserWindow -o test.hta

But it returns following error

Does not work on Windows 7 because neither `atob` or `Blob` is defined

Hi there,

Have you tried to execute the generated HTA on Windows 7? atob and Blob are only defined in IE10+, which caused mshta on Windows 7 to fail

Excel.RegisterXLL

How to use it? A -c calc.exe won't work. Same for -c c:\\tmp\\calc.xll, where the xll is created according to https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52. Thanks!

Update the blog post link

The link to the original blog post is broken.

It seems to have moved to:

https://research.nccgroup.com/2017/08/08/smuggling-hta-files-in-internet-explorer-edge/

can not bypass win10

not work

TypeError: 'range' object does not support item assignment

Hey!

Keep getting this error

Traceback (most recent call last): File "demiguise.py", line 126, in <module> hta_encrypted = base64.b64encode(rc4(args.key, hta_text)) File "demiguise.py", line 87, in rc4 S[i], S[j] = S[j], S[i] TypeError: 'range' object does not support item assignment

How to add icon to the downloaded file

Hi!

I am trying to figure out where in the code I need to add an Icon to the downloaded hta file so it looks more convincing.

Thanks for your help!

Firefox (with Chrome installed) doesn't open the HTA

It seems that the new blobShim feature has a slight issue in Firefox when Chrome is also installed on the system. By using a Blob object, the mime-type is inferred by Firefox as a "Chrome HTML Document", which causes it to try and open in Chrome (rather than executing the HTA).

One way round this might be to use a File object in the blobShim instead. Example below:

<html>
<body>
<script>
var hta = ['<script language="VBScript">Set obj = GetObject("new:0006F03A-0000-0000-C000-000000000046"): obj.CreateObject("WScript.Shell").Run("calc.exe"): self.close', '</' + 'script' + '>'];
var f = new File(hta, "test.hta", {type:"application/hta"});
var a=window.document.createElement("a");
a.href=window.URL.createObjectURL(f);
a.download="test.hta";
document.body.appendChild(a);
a.click();
document.body.removeChild(a);
</script>
</body>
</html>

It may also be interesting to play around with the mime-type to find out if there is a way to get Firefox to "Open" the file rather than save it first (this is due to the application/hta mime-type).

custom HTA

how can this be accomplish using a custom HTA or making it run putty.exe for example instead default notepad you there?

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.