p0wnedShell icon indicating copy to clipboard operation
p0wnedShell copied to clipboard

Redirection/Output missing in reverse tcp shell

Open cyb3rwr3ck opened this issue 7 years ago • 1 comments

First: Thx for the great tool! Second: My lab setup is the following:

  • victim has applocker and ConstrainedLanguageMode active
  • Code execution exists through ps remoting
  • dll with tcp reverse shell code was downloaded onto the victim and executed via rundll32
  • powercat listener receives the connection
  • p0wnedshell is executed in the reverse shell using InstallUtil -> p0wnedshell menu is displayed

Now, if I select one of the options there is exactly zero output and the application must be closed by ^C Probably it is some kind of redirection issue but the strange thing is that the menu is displayed correctly. Any ideas?

cyb3rwr3ck avatar Apr 27 '18 16:04 cyb3rwr3ck

Hi, nice to hear that you like the tool. I suspect that the ConstrainedLanguageMode is causing this issue, i'll try if i can reproduce the issue.

Regards,

Cornelis

2018-04-27 18:23 GMT+02:00 cyb3rwr3ck [email protected]:

First: Thx for the great tool! Second: My lab setup is the following:

  • victim has applocker and ConstrainedLanguageMode active
  • Code execution exists through ps remoting
  • dll with tcp reverse shell code was downloaded onto the victim and executed via rundll32
  • powercat listener receives the connection
  • p0wnedshell is executed in the reverse shell using InstallUtil -> p0wnedshell menu is displayed

Now, if I select one of the options there is exactly zero output and the application must be closed by ^C Probably it is some kind of redirection issue but the strange thing is that the menu is displayed correctly. Any ideas?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/Cn33liz/p0wnedShell/issues/7, or mute the thread https://github.com/notifications/unsubscribe-auth/ADqH5nuBESTG63dXM65MhwTv6eMzMYEiks5ts0YEgaJpZM4TqoFe .

Cn33liz avatar May 01 '18 19:05 Cn33liz