search

trustedsec / unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
https://www.trustedsec.com
Other
3.74k stars 817 forks source link

All shells caught fail to load stdapi #132

Closed BustedSec closed 4 years ago

BustedSec commented 5 years ago

Related to issue 129 from myexploit. All shells caught from win10 test machine from powershell generated by unicorn fail to load the stdapi extension and are non-responsive. If you'd like I can upload the win10 test vm so you can duplicate the issue

myexploit commented 5 years ago

Just tried v3.8.1 It does not seem to work with Windows 7 64 bit, I get a "Powershell stopped working" error, but it is working with Windows 10.

Using metasploit v5.0.35-dev

meterpreter > load priv stdapi Loading extension priv...Success. Loading extension stdapi...Success. meterpreter > shell Process 4792 created. Channel 1 created. Microsoft Windows [Version 10.0.17763.557] (c) 2018 Microsoft Corporation. All rights reserved.

Windows 7 build

PS C:\Users\IEUser> [System.Environment]::OSVersion.Version

Major Minor Build Revision

6 1 7601 65536

PS C:\Users\IEUser> systeminfo /fo csv | ConvertFrom-Csv | select OS, System, Hotfix* | Format-List

OS Name : Microsoft Windows 7 Enterprise OS Version : 6.1.7601 Service Pack 1 Build 7601 OS Manufacturer : Microsoft Corporation OS Configuration : Standalone Workstation OS Build Type : Multiprocessor Free System Boot Time : 09/07/2019, 1:53:19 PM System Manufacturer : VMware, Inc. System Model : VMware Virtual Platform System Type : x64-based PC System Directory : C:\Windows\system32 System Locale : en-us;English (United States)

Thanks

myexploit commented 5 years ago

The fail to "load priv stdapi" seems to presently affect Windows 7, for VM's I use https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ and go for IE11 on win 7 and Edge on Win 10 build.

Thanks