.net 4 payload generation issues about sharpshooter HOT 7 CLOSED

Can you provide an example command line you're using? I'm not able to reproduce this...

e.g. $ python SharpShooter.py --stageless --dotnetver 4 --payload hta --output foo --rawscfile ./raw.txt --sandbox 4 --smuggle --template mcafee

This generates a v4 payload - you can tell by enabling the print on line 537, where the created output uses Wscript.shell.

from sharpshooter.

Using the syntax above I confirm that the output is .net version 4.0 as the print statement shows the use of WScript.Shell.

However this triggers the prompt for .NET Framework 3.5 installation on a fresh Windows 10 install.

This can be remediated by replacing your SetVersion sub with the one in Vincent's commit 12 days ago here: vysecurity/CACTUSTORCH@9527c13

This bypasses Sophos, ESET etc. but Windows Defender picked up on execution of the output HTA from the above exercise. I'm not sure at this stage what it flagged on.

from sharpshooter.

I'll give the setversion stub a test and see how it fares.

In terms of defender, you may want to review #9. This should be a case of just using some opsec shellcode, or using the encrypter referenced in the issue.

from sharpshooter.

Looks like #9 is the Defender issue - thanks.

Feel free to close if the setversion prevents the .NET Framework popup 👍

from sharpshooter.

Tracked this down and fixed in this commit d9750be

from sharpshooter.

Thanks @SSATKINS

from sharpshooter.

Sorry about adding this to issue 8 but seems the closest to what i'm getting.

Using a fresh span up Win 10 from developer.microsoft.com Build 17763.rs5_release.180914-1434

python SharpShooter.py --stageless --dotnetver 4 --payload hta --output foo --rawscfile /root/Desktop/payload.bin --sandbox 4 --smuggle --template mcafee

I’m getting the following error on my Win 10 VM.

• An app on your PC needs the following Windows feature:
• .NET Framework 3.5 (includes .NET 2.0 and 3.0)

The HTA works fine with Windows 7.

from sharpshooter.