search

trustedsec / unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
https://www.trustedsec.com
Other
3.74k stars 817 forks source link

Powershell payloads not working with win7? #89

Closed supergrapeman closed 6 years ago

supergrapeman commented 6 years ago

Generating Powershell payloads seems to work fine on win10, but not on win7. No reverse connection back to the listening meterpreter. Seems to be same behaviour on win7 32bit and win7 64 bit.

Any ideas?

(Thanks for the awesome work, by the way!)

trustedsec commented 6 years ago

Let me take a peek, also can you try instead of /w 1 /C change it to -w 1 and -C? Just want to rule out something. I need to build a win7 box to test :)

supergrapeman commented 6 years ago

Rats, I wasn't clear - sorry.

I meant to write 'generated', not 'generating'. So I've generated the Powershell payloads under Kali, but when they run on win7, I get no connection (but it's fine with win10).

trustedsec commented 6 years ago

Can you try the /w 1 thing above by any chance? If it still doesn't call back let me know I'll take a look

supergrapeman commented 6 years ago

Thanks, I tried tweaking that, and replacing /w 1 /C with -w 1 -C in the powershell_attack.txt which was created, but the result was the same.

When I paste in the command prompt in Windows, it runs, but doesn't appear to do anything, and closes the command prompt. I ran a quick tcpdump to see if it's sending any packets to the box with the metasploit listener, but there was no traffic.

I don't think it's fun and games with Windows Defender, as I've disabled the realtime scan on that, just in case.

Higgsx commented 6 years ago

The same happens to me. There is definitely an issue with payload on windows 7 :) p.s with office 2016

trustedsec commented 6 years ago

Fixed on Windows 7 - it didn't like the masked -e''c but is fine on Win10. New version pushed out and working great.