vysecurity/morphhta

morphHTA - Morphing Cobalt Strike's evil.HTA

Disclaimer

As usual, this code and tool should not be used for malicious purposes.

Written by Vincent Yiu of MDSec Consulting's ActiveBreach team. Modification of code is allowed with credits to author.

Explorer and SWBemLocator COM Moniker research is by @enigma0x3

morphHTA

Usage:

usage: morph-hta.py [-h] [--in <input_file>] [--out <output_file>]
                    [--maxstrlen <default: 1000>] [--maxvarlen <default: 40>]
                    [--maxnumsplit <default: 10>]

optional arguments:
  -h, --help            show this help message and exit
  --in <input_file>     File to input Cobalt Strike PowerShell HTA
  --out <output_file>   File to output the morphed HTA to
  --maxstrlen <default: 1000>
                        Max length of randomly generated strings
  --maxvarlen <default: 40>
                        Max length of randomly generated variable names
  --maxnumsplit <default: 10>
                        Max number of times values should be split in chr
                        obfuscation

Examples:

/morphHTA# python morph-hta.py
███╗   ███╗ ██████╗ ██████╗ ██████╗ ██╗  ██╗      ██╗  ██╗████████╗ █████╗
████╗ ████║██╔═══██╗██╔══██╗██╔══██╗██║  ██║      ██║  ██║╚══██╔══╝██╔══██╗
██╔████╔██║██║   ██║██████╔╝██████╔╝███████║█████╗███████║   ██║   ███████║
██║╚██╔╝██║██║   ██║██╔══██╗██╔═══╝ ██╔══██║╚════╝██╔══██║   ██║   ██╔══██║
██║ ╚═╝ ██║╚██████╔╝██║  ██║██║     ██║  ██║      ██║  ██║   ██║   ██║  ██║
╚═╝     ╚═╝ ╚═════╝ ╚═╝  ╚═╝╚═╝     ╚═╝  ╚═╝      ╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═╝

Morphing Evil.HTA from Cobalt Strike
Author: Vincent Yiu (@vysec, @vysecurity)


[*] morphHTA initiated
[+] Writing payload to morph.hta
[+] Payload written

Max variable name length and randomly generated string length reduced to reduce overall size of HTA output:

/morphHTA# python morph-hta.py --maxstrlen 4 --maxvarlen 4

Max split in chr() obfuscation, this reduces the number of additions we do to reduce length:

/morphHTA# python morph-hta.py --maxnumsplit 4

Change input file and output files:

/morphHTA# python morph-hta.py --in advert.hta --out advert-morph.hta

Video how to

https://www.youtube.com/watch?v=X4S2aQ4o_jA

VirusTotal Example

I suggest not uploading to VT:

Example of Obfuscated HTA content

morphhta's Issues

HTA File Script Errors

Gave morphHTA a shot with CS's HTA > Executable attack. Confirmed evil.hta works properly. I ran it through morphHTA and got the following error:

Line 1390 looks like so:

I removed the trailing ampersand and reran the HTA. I got the following:

With line 1558 looking like this:

Finally, just a thought (and I'm probably way off on this), but I don't see how the hta would actually fire the payload. At the bottom of the hta, I'd expect to see an obfuscated call to actually fire the concatenated code. I just see more variable assignments:

Good work! I was just needing some CS obfuscation this morning. :-)

Unable to morph - traceback error

Using default generated powershell HTA from Cobalt Strike 3.14 (Release May 4, 2019). Getting the following error:

Kaspersky detect this!!

hi ,first thanks for this great tool, but kaspersky total security 2017 detect the morphed HTA files, can reFUD your tool please,thanks

This script cannot run in cobalt strike 3.14 version

help