search

trustedsec / unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
https://www.trustedsec.com
Other
3.74k stars 817 forks source link

premature program edit when AMSI-BYPASS is set to 'ON' #131

Closed BustedSec closed 5 years ago

BustedSec commented 5 years ago

When trying to generate a payload with

./unicorn.py windows/meterpreter/reverse_https 10.88.99.134 4444

the program prematurely exits with an end of file exception

[] Note that AMSI_BYPASS is currently set to 'ON' which incorporates an AMSI Bypass technique that is large in nature. [] Windows command prompt has a character restriction of 8191 which if you are using cmd.exe as a payload delivery option, this will not work. [] Turn off AMSI_BYPASS=ON in the unicorn.py file located at the very top to turn this feature off which is ON by default. [] If you are calling PowerShell directly, this is not a concern. [!] WARNING. WARNING. Length of the payload is above command line limit length of 8191. Recommend trying to generate again or the line will be cut off. [!] Total Payload Length Size: 63381 Press {return} to continue. Traceback (most recent call last): File "./unicorn.py", line 1315, in format_payload(ps, attack_type, attack_modifier, option) File "./unicorn.py", line 1120, in format_payload raw_input("Press {return} to continue.") File "", line 0

^

SyntaxError: unexpected EOF while parsing

trustedsec commented 5 years ago

Thanks for the heads up, was due to raw_input/input differences in Python2/3. Worked fine in Python 3 but not in 2. Pushed a fix for it in 3.8.1.