Magic Unicorn is a tool designed for leveraging PowerShell downgrade attacks to inject shellcode into memory on Windows systems. It's built upon techniques pioneered by Matthew Graeber and expanded upon by David Kennedy and Josh Kelly. The tool generates a PowerShell command that, when executed, performs the memory injection, enabling shellcode execution.
Unicorn supports diverse payload delivery methods, including Meterpreter, Cobalt Strike, custom PowerShell scripts, and HTA/macro exploits. It offers flexibility in utilizing shellcode, enabling attackers to bypass traditional defenses. The tool provides automatic generation of necessary attack files, simplifying the attack process. Notable is its adaptability to various attack vectors, expanding its utility in different intrusion scenarios.
- PowerShell Injection: ** Executes PowerShell commands to inject shellcode into memory.
- Payload Support: ** Integrates with Metasploit, Cobalt Strike, custom PowerShell scripts, and HTAs/macros.
- Attack Vectors: ** Supports various attack vectors including PowerShell, HTA, macro, and CertUtil.
- Shellcode Integration: ** Enables the use of custom shellcode for tailored exploitation.
- Ease of Use: ** Generates PowerShell commands and attack files, streamlining attack deployment.
- Download Exec: ** Allows downloading and executing payloads via the
download_execoption. - CertUtil Attack: ** Facilitates transferring binaries through base64 encoding and
certutilcommand.
Unicorn has been available since 2013 and maintains a history of updates and usage within the security community. Recent activity includes commits indicating ongoing maintenance. While documentation is relatively concise, the tool's widespread use and documented exploits suggest a reasonable level of reliability and consistent functionality.
Security researchers and penetration testers utilize Unicorn to simulate real-world attack scenarios, assess system security, and demonstrate vulnerabilities. It provides a means to bypass defenses through memory injection techniques, validating potential weaknesses in endpoint security and enabling controlled exploitation for security analysis. It offers a flexible and adaptable framework for PowerShell-based attack development.