search

mindcrypt / powerglot

Powerglot encodes offensive powershell scripts using polyglots . Offensive security tool useful for stego-malware, privilege escalation, lateral movement, reverse shell, etc.
GNU Lesser General Public License v3.0
164 stars 40 forks source link

Having trouble with your examples #2

Closed lmforget closed 3 years ago

lmforget commented 3 years ago

I read your talk from Dec and I wanted to try it myself. I was hoping to use your tool to do a live demo for my boss.

In my attempt, I am using a VM with Ubuntu 20.04.1. The version of Python is 3.8.5. I added numpy.

I can run with -o and create a new JPEG but embedded payload will not work, I tried your shell code and PowerShell scripts with the cat.jpeg. Furthermore -d does not detect anything in the examples nor the generated files.

I used feh to confirm the jpeg part does work.

What am I doing wrong?

mindcrypt commented 3 years ago

Hello, Can you send me the exact parameters you are using? What is the size of the file you want to hide? Thank you, Alfonso

lmforget commented 3 years ago

python3 powerglot.py -o test.sh cat.jpeg cat-test.jpeg

test.sh is from your examples folder - 11 bytes ls;whoami;

cat.jpeg is from your repo as well.

i ran python3 powerglot.py -d ./ and it did not detect the polyglot in your examples nor my new file cat-test.jpeg

mindcrypt commented 3 years ago

Hello, my friend, I am working to incorporate rules for the detection of polyglots in different formats. Currently, only the presence of StegoSploit is detected in JPEG files (added */ --> after FFD9) Thanks,

lmforget commented 3 years ago

I figured my problem with the first part related to generating a polyglot using your tool :)

I suggest adding exit to your scripts for example test.sh would be now be ls;whoami;exit;

This eliminates the error messages generated when bash tries to process the remaining bytes of the file following the script.

Thanks.