In this demo, we're going to cover the command generation process with Unicorn.
We'll start with a lab overview so you can see the environment
I'm using and replicate it in your own machine.
Next, we're going to explore the options in Unicorn that we use
to generate commands from Metasploit payloads.
Finally,
we'll explore the additional built‑in tools that will help us
leverage Unicorn to execute payloads on our targets.
Let's head over to our lab and get started with the overview.
The lab I'm using consists of a Kali Linux machine, one Windows 10 target,
and the Metasploitable 3 machine running in VirtualBox.
The Windows 10 target is a Microsoft developer image.
Metasploitable 3 was loaded using Vagrant by following the
instructions on Github. There's a link to obtain all these in the
demo files. On the Windows 10 host, I also installed OpenOffice and
Java for the macro attack simulation.
Links to obtain the software are also found in the demo files.
For Unicorn, I used Git to clone the repository into a folder
called Unicorn in my home directory.
Once cloned,
you can run Unicorn straight from this directory. Now that our lab is ready,
we can check out Unicorn's features. By running Unicorn from the command line,
we can view the command options. To run Unicorn,
you type python unicorn.py ‑‑help. After the image,
credits, and guides to each of the options, you can see some example
commands. We have PowerShell command generation, macros, HTML Applications,
or HTAs, Dynamic Data Exchange, or DDE, which Office uses to share data
between applications, assert util method, and multiple options for custom
PowerShell files, and shell code payloads.
Let's create our first PowerShell command.
Before we run that, we'll need a payload.
Unicorn can use the MSFVenom payloads to generate commands quickly and easily.
To see the available payloads, you can type msfvenom ‑‑list payload, and
select the appropriate payload for your environment.
An important note, for Unicorn attacks to work correctly,
you will need to use 32‑bit payloads.
Unicorn is designed for downgrades to a 32‑bit process
through SysWOW64 on 64‑bit Windows systems.
You can run the 32‑bit payloads on 64‑bit Windows operating systems
without any issues. Within the 32‑bit payloads, let's try
windows/shell/reverse_tcp. Before we start creating attacks,
there's one setting we need to change. We're going to turn off the
AMSI_BYPASS by going into unicorn.py and setting it to OFF.
Once you change the option to OFF, as this displayed here, you just save
the file using CTRL+O, Enter, and exit using CTRL+X.
We're making this change because in my testing, the AMSI_BYPASS
either didn't function correctly for some attacks, or it broke
the attack. In the cases where it didn't break the attack, the
AMSI_BYPASS had no effect.
So for our demos, we'll turn it OFF. Now we're ready to generate our
first PowerShell command. For that, we start with python unicorn.py,
followed by our payload, windows/shell_reverse_tcp. After the payload,
we will need to specify the IP address of our Kali Linux machine for
the reverse shell.
In my case, that is 192.168.2.36.
We also need a port number, so let's use 4444.
Once it's generated, we can open the file using the built‑in text
editor for Kali mousepad. In order to run it on our target, all we've
got to do is copy the text of this file.
One last step to prepare,
we need to set up a listener. For this demo, we just use netcat. Now to
run the attack, all we've got to do on our Metasploitable VM is simply
paste the PowerShell command into PowerShell. And we hit Enter. The
window will disappear, and back on Kali, we have our shell. For a quick
recap, in this demo,
we went through a brief overview of the lab environment
we'll use throughout this course.
Next, we installed Unicorn and looked at the available options.
Finally,
we used Unicorn to generate a PowerShell command that opened
a reverse shell on one of our targets.