In our final demonstration,
we're going to discuss how you can add an executable payload, We'll then
use the Unicorn framework to generate PowerShell, and we'll need to
decode the PowerShell for use in Luckystrike.
After this demonstration,
you should have a really good understanding of all of the
different features of Luckystrike and how to use it to create
your malicious Office documents.
We'll begin by opening up a terminal inside of a Kali Linux VM.
From the terminal, we'll be using msfvenom in order to create a
fairly straightforward payload.
Our focus in this course is on Luckystrike, so we won't have
much time to get into msfvenom. However,
there is a course already in the Pluralsight library; the focus is on msfvenom.
The different arguments that we need are first to define the payload,
the ‑p flag.
And I'm just going to use a windows/meterpreter/reverse_https.
The next argument is LHOST. This is the IP address of our Kali
machine or whatever host you want the victim,
your mal doc, to connect back to.
After that comes LPORT.
That's the port that it'll use. Then ‑f,
which will be the file type. We'd like an executable. And ‑o, the
name of the payload, the file that this command's going to
generate. After executing the command,
it should only take a few seconds, and you'll have the payload,
the executable in the location of the file system that you're currently at.
We can now copy this over to our Windows machine to be used with Luckystrike.
But before we do that,
I've also set up a .rc file that will configure a handler in
Metasploit for our victim to call back to and will allow the
shell to connect back to our host.
The .rc file is actually a resource script,
and we can use those with msfconsole by providing it
as an argument to the ‑r argument.
If Metasploit was able to process the resource script correctly,
we should see that our handler has been started and is
waiting for incoming connections.
Now we're ready to use Luckystrike in order to add
that payload type to the catalog,
select the payload, and create our malicious Office document.
I've already pasted the payload onto my user's desktop.
So the first thing is to go to the Catalog Options and add
a payload to the catalog. You'll likely want to give this
a fairly descriptive title,
especially as your catalog of payloads grows. This will help you better
remember all of the different payloads that you've set up.
You also have the ability to set the optional target IP,
port, and description. Again, this is there just to help you
keep all of your payloads straight.
For this demonstration though, I'm going to continue to skip those options.
The last is to select the payload type.
We will choose 3, Executable. We now need to enter in
the full path to the executable.
And once we enter that path, we should see that the payload is added.
Our next step then is to select our payload, so we can choose Payload Options,
Select a payload, and then select the payload that we
just created, our Reverse HTTPS.
We have to choose the infection method. And each one of these
options are fairly well documented on the wiki.
The first one is Certutil. This will embed a Base64 encoded
binary into the cells of the Excel doc.
It then saves it as a text file to disk using certutil to decode the payload,
save it as an executable, and then launch it.
Save to Disk is relatively straightforward. It embeds the
executable, saves it to disk, and then execute it.
The last one is ReflectivePE.
This one uses an additional PowerShell module,
Invoke‑ReflectivePEInjection, and will try to
reflectively inject the PE into memory.
This one's a bit trickier and requires more thorough testing,
as well as ensuring that the architecture of the payload that
you've created is going to map with your victim.
For this demonstration,
we're going to choose option 1, Certutil. Now that the payload's been added,
we can go back to the main menu, and we can generate
our malicious Office document.
We can either generate a new file, or since we've already created a template,
we'll go ahead and use that one. After Luckystrike has informed us that
it was successful in creating our document, we can now launch it and
confirm if our executable not only was executed,
but if it was able to connect back to our handler on our Kali VM.
We'll find our newly created malicious Office document under the
payloads folder inside of our Luckystrike directory.
Double‑clicking that will launch the document,
and then we'll need to enable content.
Of course, one of the main ideas behind this is from the victim's perspective.
It's going to look like nothing really happened. So we'll
need to go back to our Kali VM to see if our shell
connected back. And at this point, it looks like we have a successful session.
The next example tool that we're going look at is called Unicorn.
This is available on GitHub and is maintained by TrustedSec, Dave Kennedy.
Magic Unicorn is a simple tool for using PowerShell downgrade
attack to inject shell code straight into memory,
And this tool provides another good demonstration on how we can use one to
create the necessary capabilities that we need to then include in the creation
of our malicious Office documents using Luckystrike.
Once you've downloaded Unicorn from the GitHub,
you can navigate to that directory and just execute the
Unicorn Python script. Without any arguments,
you'll get the help, and you'll see here that there are a
number of different options for using this tool.
We won't have time to go through all of these,
but I did want to focus on a couple of examples.
First, we have the ability to create macros,
which we'll discuss here momentarily.
The second is our ability to create PowerShell.
To create our macros using Unicorn, we just need to provide a few options.
Much like the previous example, I'll be creating a
windows/meterpreter/reverse_https.
This is a payload that comes from Metasploit. After that,
we needed to find the host, what IP address the victim will
connect back to, the port, and then we need to instruct
Unicorn to create the macros.
After executing this command,
you'll see that it should take a few minutes, and if successful, we'll
have two different files that were created as output.
The first is called powershell_attack.txt.
This is the actual macro code.
The second is a unicorn.rc file, so a Metasploit resource script that we can use
to start the handler. If you open up powershell_attack with a text editor,
you'll see that you do in fact have macro‑ready code.
And while this may seem like the most intuitive first
option of using a framework like Unicorn,
there's actually no way to directly include the macro
code into usage with Luckystrike.
If we wanted to use this output as is,
we would need to manually add it to our malicious Office documents ourselves.
However, if you pay attention to the beginning of this macro code,
you'll see the PowerShell command, along with what
appears to be a Base64 encoded string.
And that's in fact what this is.
So it's really taken a PowerShell payload and just simply broken it
apart for obfuscation to avoid detection and then added the necessary
components to get it to execute as a macro.
What this means is that we can go back to Unicorn and just generate the
PowerShell that we can utilize within Luckystrike.
To do that, we'll use the same command that we previously
utilized, except we'll remove the end macro argument.
This will generate the same two payloads, the unicorn.rc
file, as well as powershell_attack.tx.
Viewing this content in a text editor,
you'll see that we have two PowerShell commands,
both of them using a large Base64 encoded payload.
If you recall one of the requirements of Luckystrike, that if we
utilize any PowerShell within the Luckystrike framework,
it is unencoded.
Our goal here then is to create a PowerShell script that we can
import with Luckystrike. For this demonstration,
I'm just going to decode one of these Base64 encoded payloads.
However,
you could decode both of them and add them to the same
PS1 script to be added to Luckystrike.
In order to decode this payload, I'm going to remove everything but the Base64.
I'm using the second script here, and you'll notice that inside this
script there was some concatenation, so make sure that you've removed
any invalid non‑Base64 encoded characters.
Once I've completed that, I'll go ahead and save the file.
While there are many ways that we can Base64 decode that content, I'm just
going to use a built‑in Linux utility. So we'll count the contents of
powershell_attack, we'll pipe that output to the base64 utility, providing it
the ‑d argument, which will decode the payload. We'll then redirect that output
to a new text file called powershell_attack_decoded.txt. Now if we take a look
at powershell_attack_decoded,
we should see the PowerShell that was contained within that Base64 string.
You can spend some time analyzing this if you want,
but the gist of it is that we have some shell code that will be
staged into memory and executed using PowerShell.
The last thing that we'll do before going back to Luckystrike is to start
msfconsole. That way we can verify that this PowerShell did in fact create
the Reverse HTTPS shell that we expected.
Finally,
the last thing we need to do is just add our new payload type to our
catalog and then create our malicious Office document.
So I'll give this a slightly more descriptive name, Unicorn Reverse HTTPS.
I'll leave the optional information empty.
This will be a PowerShell script.
And when I copied the original text file,
the powershell_attack_decoded over to this VM, I went ahead
and renamed the file extension to .ps1.
We should see that our payload was added.
Now we can select the payload,
choose the infection method type, and finally, we'll be able
to generate our malicious Office document.
From our payloads folder, we can open up the newly created document,
enable content, and much like the previous, it's designed so that the user is
not aware of what's actually going on behind the scenes.
If we go back to our Kali VM, we'll see that we did in fact get our session.
So, as you can see,
while Luckystrike is a powerful framework for managing and creating
malicious Office documents, a lot of the work is going to come in the
different types of payloads that you're able to integrate.
At this point though,
you have a very good understanding of how Luckystrike works,
how to integrate it with other tools, and how to begin to create your
malicious Office document for red team operations.
Great work.