CheeseTools – Self-developed Tools For Lateral Movement/Code Execution

CheesePS

Cheese PS is Command Exec / Lateral Movement framework. It relies on System.Management.Automation.PowerShell to load and run arbitrary code via PowerShell. The tool is natively capable of bypassing common restrictions creating and using PowerShell runspaces on local or remote targets. Must be running in the context of a privileged user (if using PowerShell Remoting).

The tool has been originally made as an enhancement of rasta_mouse CsPosh, but grew enough to become a framework on its own, and can now be used as a general PowerShell injector.

The idea behind this tool has been summarised in the following article:

The main functionalities implemented are:

• BuiltIn CLM Bypass using REGINI
• BuiltIn AmsiBypass that patches Amsi before executing any other command
  • Permits to specify an alternate PowerShell script for AMSI bypass
• BuiltIn WldpBypass that patches WLDP before executing assemblies
  • Permits to specify an alternate PowerShell script for WLDP bypass
• Import modules and script before execution
  • Against a local target: modules are imported via filesystem, smb, or http[s]
  • Against a remote target: modules are loaded directly from the local machine using WS-Management
• Download binary and execute
  • Standard: Transfer -> Write to disk -> Execute
  • Reflective: Transfer -> Execute from memory
• Supports AES Encryption of PS modules, C# assemblies and other executables to evade detection
  • All imported Modules/Assemblies can be encrypted in transit or at rest, and are decrypted just before usage

The following screenshot is a decently accurate schema to describe the tool’s workflow:

Usage:
-t, --target=VALUE         Target machine
-c, --code=VALUE           Code to execute
-e, --encoded              Indicates that provided code is base64 encoded
-a, --am-si-bypass=VALUE   Uses the given PowerShell script to bypass A-M-S-
I (fs, smb o http[s])
--aX, --encrypted-am-si
Indicates that provided A.M.S.I. bypass is
encrypted
-i, --import=VALUE         Imports additional PowerShell modules (fs, smb o
http[s])
--iX, --encrypted-imports
Indicates that provided PowerShell modules are
encrypted
-o, --outstring            Append Out-String to code
-r, --redirect             Redirect stderr to stdout
-d, --domain=VALUE         Domain for alternate credentials
-u, --username=VALUE       Us   ername for alternate credentials
-p, --password=VALUE       Password for alternate credentials
-X, --encrypt=VALUE        Encrypt a script with an hardcoded key
-D, --decrypt=VALUE        Test decryption of a script with an hardcoded key
-n, --skip-bypass=VALUE    Skip A.M.S.I (A), WLDP (W) or ALL (*) Bypass
techniques
-l, --lockdown-escape      Try to enable PowerShell FullLanguage mode using
REGINI
-w, --wldp-bypass=VALUE    Uses the given PowerShell script to bypass WLDP
(fs, smb o http[s])
--wX, --encrypted-wldp Indicates that provided WLDP bypass is encrypted
-x, --executable=VALUE     [Download and] Execute given executable
--xX, --encrypted-executable
Indicates that provided Exe/DLL is encrypted
--xCS, --executable-csharp
Indicates that    the executable provided is C# -
(.NET)
-R, --reflective-injection Uses Invoke-ReflectivePEInjection to load the
assmebly from memory (requires Invoke-
ReflectivePEInjection to be imported!)
-P, --powershell-decrypt   Force use of PowerShell-based decryption
-k, --encryption-key=VALUE Uses the provided key for encryption/decryption
--ssl                  Force use of SSL
-h, -?, --help             Show Help

Note: If executed without a target, the script will execute against the local machine

Advantages of using the tool against raw PowerShell:

• Cleaner, more intuitive command line
• Automatic bypasses (CLM, AMSI, WLDP)
• Avoids to perform outbound connections from the remote target (everything is transfered through WS-Management)
• Supports full encryption in transit

Also see AmsiBypass.

CheeseDCOM

Command Exec / Lateral Movement via DCOM. Must be running in the context of a privileged user. This tool is based on rasta-mouse CsDCOM, but it’s been improved to add additional methods, adapting to the new research made by Philip Tsukerman. There is also an experimental method to “fix” eventual attempts to disable affected DCOM objects via dcomcfg, but it requires some preconditions in order to work properly.

The idea behind this tool has been summarised in the following article:

Current Methods: MMC20.Application, ShellWindows, ShellBrowserWindow, ExcelDDE, VisioAddonEx, OutlookShellEx, ExcelXLL, VisioExecLine, OfficeMacro.

Usage:
CheeseRDP [actions]
Actions:
wait: keep listening for any new mstsc.exe process indefinitely (stop with ctrl-C)
clean: delete the credentials dump file if present
dump: dump the content of the file if present, parsing the credentials in a compact format