| Description | exe2powershell - exe2bat reborn for modern Windows
exe2powershell converts a binary into a bat file, without size limitation (64kB) and with compatibility to modern Windows (7 x64, 8, 8.1, 10, 2008, 2008R2, 2012).
The *.bat produced by exe2powershell contains several "echo" lines (< 128 chars) of the decimal code of initial binary, and finally invoke a powershell command line to regenerate the payload.exe on the remote server through command line.
- exe2bat compatibility : input file lesser than 64kB (<= Windows 7 x86)
- exe2powershell compatibility : input file without size limitation, Windows with powershell (>= Windows 7)
exe2powershell on github with source-code, sample and binaries :
|
|---|
| Steps To Reproduce | C:\exe2powershell\bin>exe2powershell.exe
| __| | | \ / __| | | | |
| | _ ) | |) |__ _ | (_ | |_ | | |
| | \ \/ / \ / /| / \ \ /\ / / \ '_ | ' \ / \ | |
| |__ > < // /| | | () \ V V / / | __) | | | | / | |
|____//\_|__|_| _/ _/_/ _|| |____/|| ||__||_|
[ exe2bat reborn in exe2powershell for modern Windows ]
[ initial author ninar1, based on riftor work, and modernized by ycam ]
[ exe2powershell version 1.0 - keep up to date : www.asafety.fr ]
[] Usage : exe2powershell.exe inputfile outputfile
[] e.g. : exe2powershell.exe nc.exe nc.bat |
|---|
| Additional Information | Kali integrates many Windows binaries used during pentest on Windows Server.
These tools are located in /usr/share/windows-binaries/
Kali provides "wine" by default to run these tools directly.
One of these tools, the oldschool "exe2bat.exe" is present here : /usr/share/windows-binaries/exe2bat.exe
Through this old tool, a pentester can convert a payload.exe or another utility (ftp.exe, tftp.exe, nc.exe, etc.) into a .bat file.
The produced .bat file contains several "echo" lines with hexadecimal code of the initial binary.
Finally, the *.bat file invoke the "debug.exe" binary located in %systemroot%\System32\debug.exe by default in old Windows to regenerate te initial "payload.exe".
Through this tool "exe2bat", a pentester can "upload" a payload.exe only with the use of "echo" and "debug" command in a shell.
But "exe2bat" have limitation :
- This tool use "debug.exe" which is deprecated and not present in Windows since Windows 7 x64 (usable in Windows 7 x86). So Windows 8, 8.1, 2008, 2008R2, 2012 or 10 doesn't have this binary...
- "debug.exe" is an old-retro-compatibility tool kept in Windows (16bits-application)
- exe2bat can convert ".exe" to ".bat" file only if the initial file is lesser than 64kB
Compared to these limitations of "exe2bat", I've created "exe2powershell", the reborn of "exe2bat".
exe2powershell converts a binary into a bat, without size limitation (64kB) and with compatibility to modern Windows (7 x64, 8, 8.1, 10, 2008, 2008R2, 2012).
The *.bat produced by exe2powershell contains several "echo" lines of the decimal code of initial binary, and finally invokes a powershell command line to regenerate the payload.exe.
I think this tool can be useful to pentester who used to use exe2bat, so I suggest you to include it among the other Windows binaries in /usr/share/windows-binaries/.
Sincerely, |
|---|
