Comments (8)
Okay, I did some testing and it looks like there is some sort of issue with it pulling a large file over via mshta. I am going to do some more testing to address this but it might require a different template for mshta.
from scarecrow.
Sorry for the delay it looks like when the file is being pulled remotely the COM object "ADODB.Stream" times out due to some slowness (probably because mshta uses Internet Explorer Com objects to download content) and loading the base64 encoded payload into memory to then convert. By changing the serialized format and omitting the use of ADODB.Stream it worked.
I am glad it worked for you and thank you very much I appreciate the feedback.
from scarecrow.
So before I can assit, I need to ask you have two different loaders select in both your examples. I only ask because one is excel which would change the situation. Can you please confirm.
from scarecrow.
Can you please clarify your question?
I tried both methods (excel and control) separetely, and the exhibited behaviour is the same, i.e. the HTA file only executes if it is already located locally.
I analysed what's happening in Process Explorer and noticed that control.exe and rundll32.exe do not spawn when calling the file from a remote URL (for control loader).
from scarecrow.
Update: I have a working PoC. I am not 100% what it was by it was related to the rebuilding of the .cpl file on disk. I am gonna do some more testing but I should have an update in a day to address this.
from scarecrow.
Awesome. Would love to hear more about the root cause.
from scarecrow.
Code pushed in 2.1. Please try it out.
from scarecrow.
Just tested it out using the Control loader and HTA delivery, and it worked perfectly when calling it with mshta.exe .
May I ask what the issue was with the original code and how did you fix it?
Thanks a lot! This framework is underrated :)
from scarecrow.
Related Issues (20)
- Windows 10 bug HOT 3
- Windows defender new sandbox HOT 3
- Newest version v4.1 not working with msfvenom payload HOT 7
- Binary loader build HOT 5
- New Feature Request - ProxyAware
- '.exp' files are not the compiled Go files HOT 3
- panic: Call to VirtualProtect failed!!!!! HOT 4
- Delivery HTA with Loaders Control or Wscript not working HOT 12
- cmd.Run() failed with exit status 0xffffffff HOT 5
- Output to the user is incorrect when using the -O <file> option HOT 1
- runtime.cgocall() Issue HOT 2
- Is this project still working? experiencing issues loading several shellcodes HOT 11
- Output Types HOT 2
- Windows executables not in PATH HOT 8
- ProcessInjection crashes HOT 5
- Doc, docx, rtf HOT 1
- cmd.Run() failed with exit status 0xc0000135 HOT 4
- Still having issues with cmd.Run() failed with exit status 255 HOT 1
- Add Go Lib Requirement
- Errors running ScareCrow. Exit status 128 and exit status 255 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from scarecrow.