search

mindcrypt / powerglot

Powerglot encodes offensive powershell scripts using polyglots . Offensive security tool useful for stego-malware, privilege escalation, lateral movement, reverse shell, etc.
GNU Lesser General Public License v3.0
165 stars 40 forks source link

Running polyglot in Windows? #1

Open blockanz opened 4 years ago

blockanz commented 4 years ago

Hi.

How would you execute a .ps1 encoded polyglot in windows? All the examples are for linux which is great, but I'm curious as to how this could work in a windows environment.

Many thanks.

mindcrypt commented 4 years ago

Hi blockanz, you could execute a polyglot in windows in the same way. I did some tests about this. For example, you can create a .jpg polyglot and in windows 10 to execute "powershell picturepolyglot.jpg". This should run. Thanks

dmcxblue commented 4 years ago

Great tool, but I tested a few scripts and I keep coming with errors.

I tried the following:

I used the Nishang Reverse Shell Script No Luck

1.- type beach.jpg | powershell.exe 2.- powershell .\beach.jpg

Then I tested a small script with [Get-process] command and that is all. Please do let me know if I am doing anything wrong.

Here is a SC:

image

Do let me know If I am executing incorrectly.

Thanks!

mindcrypt commented 4 years ago

@dmcxblue Thanks. I checked the tool mainly in linux. I will look at the bugs and tell you soon. Thank you very much.

Gimpy42 commented 3 years ago

any update? I think it might be a nice way to move tool around once inside a network

dmcxblue commented 3 years ago

Well, not the author here but I have been checking it on my spare time, looks like the polyglot characters are just not supported with PowerShell some of these chars are actual functions in PowerShell, so it works fine on Linux since it has support and the terminals are different, IF the user has some sort of support on the terminal or Python Installed this can be used, but still haven't found nothing that can run as-is

mindcrypt commented 3 years ago

Thanks @dmcxblue . I'm researching ways to run polyglots on Windows in a better way. Any suggestions are welcome.