Merge branch 'master' of https://github.com/xorrior/Empire
xorrior
commit
c65498371f
|
|
@ -474,7 +474,83 @@ class Agents:
|
|||
else:
|
||||
return None
|
||||
|
||||
def get_agent_functions(self, sessionID):
|
||||
"""
|
||||
Get the tab-completable functions for an agent.
|
||||
"""
|
||||
|
||||
# see if we were passed a name instead of an ID
|
||||
nameid = self.get_agent_id(sessionID)
|
||||
if nameid : sessionID = nameid
|
||||
|
||||
if sessionID in self.agents:
|
||||
return self.agents[sessionID][3]
|
||||
else:
|
||||
return []
|
||||
|
||||
|
||||
def get_agent_functions_database(self, sessionID):
|
||||
"""
|
||||
Get the tab-completable functions for an agent from the database.
|
||||
"""
|
||||
|
||||
# see if we were passed a name instead of an ID
|
||||
nameid = self.get_agent_id(sessionID)
|
||||
if nameid : sessionID = nameid
|
||||
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("SELECT functions FROM agents WHERE session_id=?", [sessionID])
|
||||
functions = cur.fetchone()[0]
|
||||
cur.close()
|
||||
if functions and functions != None:
|
||||
return functions.split(",")
|
||||
else:
|
||||
return []
|
||||
|
||||
|
||||
def get_agent_uris(self, sessionID):
|
||||
"""
|
||||
Get the current and old URIs for an agent from the database.
|
||||
"""
|
||||
|
||||
# see if we were passed a name instead of an ID
|
||||
nameid = self.get_agent_id(sessionID)
|
||||
if nameid : sessionID = nameid
|
||||
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
|
||||
uris = cur.fetchone()
|
||||
cur.close()
|
||||
|
||||
return uris
|
||||
|
||||
|
||||
def get_autoruns(self):
|
||||
"""
|
||||
Get any global script autoruns.
|
||||
"""
|
||||
|
||||
try:
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("SELECT autorun_command FROM config")
|
||||
results = cur.fetchone()
|
||||
if results:
|
||||
autorunCommand = results[0]
|
||||
else:
|
||||
autorunCommand = ''
|
||||
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("SELECT autorun_data FROM config")
|
||||
results = cur.fetchone()
|
||||
if results:
|
||||
autorunData = results[0]
|
||||
else:
|
||||
autorunData = ''
|
||||
cur.close()
|
||||
|
||||
return [autorunCommand, autorunData]
|
||||
except:
|
||||
pass
|
||||
|
||||
###############################################################
|
||||
#
|
||||
|
|
@ -629,55 +705,34 @@ class Agents:
|
|||
cur.close()
|
||||
|
||||
|
||||
def get_agent_functions(self, sessionID):
|
||||
def set_autoruns(self, taskCommand, moduleData):
|
||||
"""
|
||||
Get the tab-completable functions for an agent.
|
||||
Set the global script autorun in the config.
|
||||
"""
|
||||
|
||||
# see if we were passed a name instead of an ID
|
||||
nameid = self.get_agent_id(sessionID)
|
||||
if nameid : sessionID = nameid
|
||||
|
||||
if sessionID in self.agents:
|
||||
return self.agents[sessionID][3]
|
||||
else:
|
||||
return []
|
||||
try:
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("UPDATE config SET autorun_command=?", [taskCommand])
|
||||
cur.execute("UPDATE config SET autorun_data=?", [moduleData])
|
||||
cur.close()
|
||||
except:
|
||||
print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
|
||||
print helpers.color("[!] Warning: this will reset ALL agent connections!")
|
||||
|
||||
|
||||
def get_agent_functions_database(self, sessionID):
|
||||
def clear_autoruns(self):
|
||||
"""
|
||||
Get the tab-completable functions for an agent from the database.
|
||||
Clear the currently set global script autoruns in the config.
|
||||
"""
|
||||
|
||||
# see if we were passed a name instead of an ID
|
||||
nameid = self.get_agent_id(sessionID)
|
||||
if nameid : sessionID = nameid
|
||||
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("SELECT functions FROM agents WHERE session_id=?", [sessionID])
|
||||
functions = cur.fetchone()[0]
|
||||
cur.close()
|
||||
if functions and functions != None:
|
||||
return functions.split(",")
|
||||
else:
|
||||
return []
|
||||
|
||||
|
||||
def get_agent_uris(self, sessionID):
|
||||
"""
|
||||
Get the current and old URIs for an agent from the database.
|
||||
"""
|
||||
|
||||
# see if we were passed a name instead of an ID
|
||||
nameid = self.get_agent_id(sessionID)
|
||||
if nameid : sessionID = nameid
|
||||
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
|
||||
uris = cur.fetchone()
|
||||
cur.close()
|
||||
|
||||
return uris
|
||||
try:
|
||||
cur = self.conn.cursor()
|
||||
cur.execute("UPDATE config SET autorun_command=''")
|
||||
cur.execute("UPDATE config SET autorun_data=''")
|
||||
cur.close()
|
||||
except:
|
||||
print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
|
||||
print helpers.color("[!] Warning: this will reset ALL agent connections!")
|
||||
|
||||
|
||||
###############################################################
|
||||
|
|
@ -1344,6 +1399,11 @@ class Agents:
|
|||
# save the initial sysinfo information in the agent log
|
||||
self.save_agent_log(sessionID, output + "\n")
|
||||
|
||||
# if a script autorun is set, set that as the agent's first tasking
|
||||
autorun = self.get_autoruns()
|
||||
if autorun[0] != '' and autorun[1] != '':
|
||||
self.add_agent_task(sessionID, autorun[0], autorun[1])
|
||||
|
||||
return(200, encryptedAgent)
|
||||
|
||||
else:
|
||||
|
|
|
|||
|
|
@ -785,6 +785,8 @@ class AgentsMenu(cmd.Cmd):
|
|||
|
||||
if name.lower() == "all":
|
||||
self.mainMenu.agents.clear_agent_tasks("all")
|
||||
elif name.lower() == "autorun":
|
||||
self.mainMenu.agents.clear_autoruns()
|
||||
else:
|
||||
# extract the sessionID and clear the agent tasking
|
||||
sessionID = self.mainMenu.agents.get_agent_id(name)
|
||||
|
|
@ -1106,7 +1108,7 @@ class AgentsMenu(cmd.Cmd):
|
|||
def complete_clear(self, text, line, begidx, endidx):
|
||||
"Tab-complete a clear command"
|
||||
|
||||
names = self.mainMenu.agents.get_agent_names() + ["all"]
|
||||
names = self.mainMenu.agents.get_agent_names() + ["all", "autorun"]
|
||||
mline = line.partition(' ')[2]
|
||||
offs = len(mline) - len(text)
|
||||
return [s[offs:] for s in names if s.startswith(mline)]
|
||||
|
|
@ -2228,7 +2230,7 @@ class ModuleMenu(cmd.Cmd):
|
|||
|
||||
try:
|
||||
# if we're running this module for all agents, skip this validation
|
||||
if sessionID.lower() != "all":
|
||||
if sessionID.lower() != "all" and sessionID.lower() != "autorun":
|
||||
modulePSVersion = int(self.module.info['MinPSVersion'])
|
||||
agentPSVersion = int(self.mainMenu.agents.get_ps_version(sessionID))
|
||||
# check if the agent/module PowerShell versions are compatible
|
||||
|
|
@ -2243,7 +2245,7 @@ class ModuleMenu(cmd.Cmd):
|
|||
# check if the module needs admin privs
|
||||
if self.module.info['NeedsAdmin']:
|
||||
# if we're running this module for all agents, skip this validation
|
||||
if sessionID.lower() != "all":
|
||||
if sessionID.lower() != "all" and sessionID.lower() != "autorun":
|
||||
if not self.mainMenu.agents.is_agent_elevated(sessionID):
|
||||
print helpers.color("[!] Error: module needs to run in an elevated context.")
|
||||
return False
|
||||
|
|
@ -2466,6 +2468,12 @@ class ModuleMenu(cmd.Cmd):
|
|||
|
||||
except KeyboardInterrupt as e: print ""
|
||||
|
||||
# set the script to be the global autorun
|
||||
elif agentName.lower() == "autorun":
|
||||
|
||||
self.mainMenu.agents.set_autoruns(taskCommand, moduleData)
|
||||
dispatcher.send("[*] Set module " + self.moduleName + " to be global script autorun.", sender="Empire")
|
||||
|
||||
else:
|
||||
if not self.mainMenu.agents.is_agent_present(agentName):
|
||||
print helpers.color("[!] Invalid agent name.")
|
||||
|
|
@ -2491,7 +2499,7 @@ class ModuleMenu(cmd.Cmd):
|
|||
|
||||
if line.split(" ")[1].lower() == "agent":
|
||||
# if we're tab-completing "agent", return the agent names
|
||||
agentNames = self.mainMenu.agents.get_agent_names()
|
||||
agentNames = self.mainMenu.agents.get_agent_names() + ["all", "autorun"]
|
||||
endLine = " ".join(line.split(" ")[1:])
|
||||
|
||||
mline = endLine.partition(' ')[2]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,75 @@
|
|||
from lib.common import helpers
|
||||
|
||||
class Module:
|
||||
|
||||
def __init__(self, mainMenu, params=[]):
|
||||
|
||||
self.info = {
|
||||
'Name': 'Invoke-Script',
|
||||
|
||||
'Author': ['@harmj0y'],
|
||||
|
||||
'Description': ('Run a custom script. Useful for mass-taskings or script autoruns.'),
|
||||
|
||||
'Background' : True,
|
||||
|
||||
'OutputExtension' : None,
|
||||
|
||||
'NeedsAdmin' : False,
|
||||
|
||||
'OpsecSafe' : False,
|
||||
|
||||
'MinPSVersion' : '2',
|
||||
|
||||
'Comments': []
|
||||
}
|
||||
|
||||
# any options needed by the module, settable during runtime
|
||||
self.options = {
|
||||
# format:
|
||||
# value_name : {description, required, default_value}
|
||||
'Agent' : {
|
||||
'Description' : 'Agent to run module on.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'ScriptPath' : {
|
||||
'Description' : 'Full path to the PowerShell script.ps1 to run (on attacker machine)',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
},
|
||||
'ScriptCmd' : {
|
||||
'Description' : 'Script command (Invoke-X) from file to run, along with any specified arguments.',
|
||||
'Required' : True,
|
||||
'Value' : ''
|
||||
}
|
||||
}
|
||||
|
||||
# save off a copy of the mainMenu object to access external functionality
|
||||
# like listeners/agent handlers/etc.
|
||||
self.mainMenu = mainMenu
|
||||
|
||||
for param in params:
|
||||
# parameter format is [Name, Value]
|
||||
option, value = param
|
||||
if option in self.options:
|
||||
self.options[option]['Value'] = value
|
||||
|
||||
|
||||
def generate(self):
|
||||
|
||||
scriptPath = self.options['ScriptPath']['Value']
|
||||
scriptCmd = self.options['ScriptCmd']['Value']
|
||||
|
||||
try:
|
||||
f = open(scriptPath, 'r')
|
||||
except:
|
||||
print helpers.color("[!] Could not read script source path at: " + str(scriptPath))
|
||||
return ""
|
||||
|
||||
script = f.read()
|
||||
f.close()
|
||||
|
||||
script += "\n%s" %(scriptCmd)
|
||||
|
||||
return script
|
||||
|
|
@ -94,11 +94,13 @@ c.execute('''CREATE TABLE config (
|
|||
"server_version" text,
|
||||
"ip_whitelist" text,
|
||||
"ip_blacklist" text,
|
||||
"default_lost_limit" integer
|
||||
"default_lost_limit" integer,
|
||||
"autorun_command" text,
|
||||
"autorun_data" text
|
||||
)''')
|
||||
|
||||
# kick off the config component of the database
|
||||
c.execute("INSERT INTO config VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (STAGING_KEY,STAGE0_URI,STAGE1_URI,STAGE2_URI,DEFAULT_DELAY,DEFAULT_JITTER,DEFAULT_PROFILE,DEFAULT_CERT_PATH,DEFAULT_PORT,INSTALL_PATH,SERVER_VERSION,IP_WHITELIST,IP_BLACKLIST, DEFAULT_LOST_LIMIT))
|
||||
c.execute("INSERT INTO config VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (STAGING_KEY,STAGE0_URI,STAGE1_URI,STAGE2_URI,DEFAULT_DELAY,DEFAULT_JITTER,DEFAULT_PROFILE,DEFAULT_CERT_PATH,DEFAULT_PORT,INSTALL_PATH,SERVER_VERSION,IP_WHITELIST,IP_BLACKLIST, DEFAULT_LOST_LIMIT, "", ""))
|
||||
|
||||
c.execute('''CREATE TABLE "agents" (
|
||||
"id" integer PRIMARY KEY,
|
||||
|
|
|
|||
Loading…
Reference in New Issue