SharpShooter
In recent years, it has become much more common to use DotNetToJscript
to weaponize C# compiled assemblies in other file formats.
A payload generation tool called SharpShooter
has been created to assist with this.
SharpShooter is “a payload creation framework
for the retrieval and execution
of arbitrary C# source code”
and automates part of the process discussed in this module.
As with any automated tool, it is vital that we understand how it works,
especially when it comes to bypassing security software
and mitigations that will be present in most organizations.
We’ll install SharpShooter on Kali with git clone and Python pip.
With SharpShooter installed,
we’ll try to replicate what we did manually in this module,
creating a shellcode runner with Jscript
by levering DotNetToJscript.
First, we’ll use msfvenom to generate our Meterpreter reverse stager
and write the raw output format to a file.
Next, we’ll invoke SharpShooter.py while supplying a number of parameters.
The first --payload js, will specify a Jscript output format.
The next parameter, --dotnetver, sets the .NET framework version.
The --stageless parameter
specifies in-memory execution of the Meterpreter shellcode.
In this context, the term stageless
referes to whether the entire Jscript payload
is transfered at once,
or if HTML smuggling is used with a staged Jscript payload.
--rawscfile option specifies the file containing our shellcode,
and we set our output file with --output, leaving off the file extension.
Once again we must start our multi handler listener.
When that is done,
we need to copy the generated test.js file to our Windows 10 victim machine.
When we double-click it,
we obtain a reverse shell.
Using an automated tool
can greatly improve productivity and reduce repetitive tasks,
but it is always important to understand the techniques employed
and the operation of underlying code.
So far, we have taken advantage of both PowerShell and compiled C# assemblies,
but we can also combine the two
to dynamically load assemblies through PowerShell
without touching the disk.