Red team engagements are becoming more and more popular and system administrators are more aware about tools and techniques so avoiding detection is a much harder task. Red teamers from the other hand are always looking for command and controls tools that are using either legitimate traffic or standard functionality of Windows to hide their activities. The native Windows Script Host engine can be used as another method of command and control as it was presented at Bsides Las Vegas 2017 and a tool was released to assist towards this activity.
Koadic Framework was developed by Sean Dillon and Zach Harding and is based in JavaScript and VBScript since it is using Windows Script Host (WSH). Therefore it can be used in multiple Windows environments from Windows 2000 to Windows 10. Legacy systems they don’t have PowerShell or they might be running an old version of ASP.NET so compare to other tools that are based in PowerShell it can be used as a more reliable solution.
Koadic is fast, less noisy and has the ability to deliver payloads in memory as well.
Koadic
Koadic by default is configured to use Microsoft HTML Application as a stager and the only requirement is to set the local IP address. Other stagers involve the usage of rundll32 and regsvr32. Additionally as many other command and control tools it supports encrypted communication for a more stealthy approach.
Koadic – MSHTA Stager
The following command needs to executed on the target from a command prompt:
MSHTA – Execution on the target
By specifying the Zombie ID Koadic can interact with the host:
Koadic – Interaction with Zombies
Koadic is using some of the well-known user account control (UAC) bypasses of Matt Nelson to perform elevation.
Koadic – Bypass UAC SDCLT
A new session will created but this time it will be elevated:
Koadic – Elevated Session
It is also possible to execute commands on the target by using the cmdshell and the zombie ID.
Koadic – Command Execution
This framework has a number of implants that can be used to execute various activities like:
- Gather password hashes
- Bypass UAC
- Perform a port scan
- Kill antivirus
- File transfer
- Execute shellcode
- Perform Phishing
Koadic – Implants
Performing a port scan on a number of targets is easy with the following implant:
Koadic – TCP Scanner
Open ports will appear in green:
Koadic – TCP Scanner Results
It is also possible to attempt to steal password from normal users through a password box. However this will defeat the purpose of being stealthy during the red team engagement.
Koadic – Password Box
The script prompt that will appear to the user:
- Koadic – Script Prompt
Reference
https://github.com/zerosum0x0/koadic
Sep 03, 2017 @ 06:55:24
Wow great stuff!