infosecn1nja
/
Empire
mirror of https://github.com/infosecn1nja/Empire.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added ability to set a script to run on each agent checkin with "set Agent autorun" in module menu. 

"(Empire: agents) > clear autorun" will clear out any current autoruns
WARNING: this requires a DB schema mod to work correctly, meaning you will lose current
agent connection information if run!
1.6
Harmj0y 2015-11-22 17:25:28 -05:00
parent 8aa7918ef6
commit e59844be72
3 changed files with 117 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

142
lib/common/agents.py
View File

@ -474,7 +474,83 @@ class Agents:
else:
return None
def get_agent_functions(self, sessionID):
"""
Get the tab-completable functions for an agent.
"""
# see if we were passed a name instead of an ID
nameid = self.get_agent_id(sessionID)
if nameid : sessionID = nameid
if sessionID in self.agents:
return self.agents[sessionID][3]
else:
return []
def get_agent_functions_database(self, sessionID):
"""
Get the tab-completable functions for an agent from the database.
"""
# see if we were passed a name instead of an ID
nameid = self.get_agent_id(sessionID)
if nameid : sessionID = nameid
cur = self.conn.cursor()
cur.execute("SELECT functions FROM agents WHERE session_id=?", [sessionID])
functions = cur.fetchone()[0]
cur.close()
if functions and functions != None:
return functions.split(",")
else:
return []
def get_agent_uris(self, sessionID):
"""
Get the current and old URIs for an agent from the database.
"""
# see if we were passed a name instead of an ID
nameid = self.get_agent_id(sessionID)
if nameid : sessionID = nameid
cur = self.conn.cursor()
cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
uris = cur.fetchone()
cur.close()
return uris
def get_autoruns(self):
"""
Get any global script autoruns.
"""
try:
cur = self.conn.cursor()
cur.execute("SELECT autorun_command FROM config")
results = cur.fetchone()
if results:
autorunCommand = results[0]
else:
autorunCommand = ''
cur = self.conn.cursor()
cur.execute("SELECT autorun_data FROM config")
results = cur.fetchone()
if results:
autorunData = results[0]
else:
autorunData = ''
cur.close()
return [autorunCommand, autorunData]
except:
pass
###############################################################
#
@ -629,55 +705,34 @@ class Agents:
cur.close()
def get_agent_functions(self, sessionID):
def set_autoruns(self, taskCommand, moduleData):
"""
Get the tab-completable functions for an agent.
Set the global script autorun in the config.
"""
# see if we were passed a name instead of an ID
nameid = self.get_agent_id(sessionID)
if nameid : sessionID = nameid
if sessionID in self.agents:
return self.agents[sessionID][3]
else:
return []
try:
cur = self.conn.cursor()
cur.execute("UPDATE config SET autorun_command=?", [taskCommand])
cur.execute("UPDATE config SET autorun_data=?", [moduleData])
cur.close()
except:
print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
print helpers.color("[!] Warning: this will reset ALL agent connections!")
def get_agent_functions_database(self, sessionID):
def clear_autoruns(self):
"""
Get the tab-completable functions for an agent from the database.
Clear the currently set global script autoruns in the config.
"""
# see if we were passed a name instead of an ID
nameid = self.get_agent_id(sessionID)
if nameid : sessionID = nameid
cur = self.conn.cursor()
cur.execute("SELECT functions FROM agents WHERE session_id=?", [sessionID])
functions = cur.fetchone()[0]
cur.close()
if functions and functions != None:
return functions.split(",")
else:
return []
def get_agent_uris(self, sessionID):
"""
Get the current and old URIs for an agent from the database.
"""
# see if we were passed a name instead of an ID
nameid = self.get_agent_id(sessionID)
if nameid : sessionID = nameid
cur = self.conn.cursor()
cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
uris = cur.fetchone()
cur.close()
return uris
try:
cur = self.conn.cursor()
cur.execute("UPDATE config SET autorun_command=''")
cur.execute("UPDATE config SET autorun_data=''")
cur.close()
except:
print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
print helpers.color("[!] Warning: this will reset ALL agent connections!")
###############################################################
@ -1338,6 +1393,11 @@ class Agents:
# save the initial sysinfo information in the agent log
self.save_agent_log(sessionID, output + "\n")
# if a script autorun is set, set that as the agent's first tasking
autorun = self.get_autoruns()
if autorun[0] != '' and autorun[1] != '':
self.add_agent_task(sessionID, autorun[0], autorun[1])
return(200, encryptedAgent)
else:

16
lib/common/empire.py
View File

@ -779,6 +779,8 @@ class AgentsMenu(cmd.Cmd):
if name.lower() == "all":
self.mainMenu.agents.clear_agent_tasks("all")
elif name.lower() == "autorun":
self.mainMenu.agents.clear_autoruns()
else:
# extract the sessionID and clear the agent tasking
sessionID = self.mainMenu.agents.get_agent_id(name)
@ -1100,7 +1102,7 @@ class AgentsMenu(cmd.Cmd):
def complete_clear(self, text, line, begidx, endidx):
"Tab-complete a clear command"
names = self.mainMenu.agents.get_agent_names() + ["all"]
names = self.mainMenu.agents.get_agent_names() + ["all", "autorun"]
mline = line.partition(' ')[2]
offs = len(mline) - len(text)
return [s[offs:] for s in names if s.startswith(mline)]
@ -2221,7 +2223,7 @@ class ModuleMenu(cmd.Cmd):
try:
# if we're running this module for all agents, skip this validation
if sessionID.lower() != "all":
if sessionID.lower() != "all" and sessionID.lower() != "autorun":
modulePSVersion = int(self.module.info['MinPSVersion'])
agentPSVersion = int(self.mainMenu.agents.get_ps_version(sessionID))
# check if the agent/module PowerShell versions are compatible
@ -2236,7 +2238,7 @@ class ModuleMenu(cmd.Cmd):
# check if the module needs admin privs
if self.module.info['NeedsAdmin']:
# if we're running this module for all agents, skip this validation
if sessionID.lower() != "all":
if sessionID.lower() != "all" and sessionID.lower() != "autorun":
if not self.mainMenu.agents.is_agent_elevated(sessionID):
print helpers.color("[!] Error: module needs to run in an elevated context.")
return False
@ -2459,6 +2461,12 @@ class ModuleMenu(cmd.Cmd):
except KeyboardInterrupt as e: print ""
# set the script to be the global autorun
elif agentName.lower() == "autorun":
self.mainMenu.agents.set_autoruns(taskCommand, moduleData)
dispatcher.send("[*] Set module " + self.moduleName + " to be global script autorun.", sender="Empire")
else:
if not self.mainMenu.agents.is_agent_present(agentName):
print helpers.color("[!] Invalid agent name.")
@ -2484,7 +2492,7 @@ class ModuleMenu(cmd.Cmd):
if line.split(" ")[1].lower() == "agent":
# if we're tab-completing "agent", return the agent names
agentNames = self.mainMenu.agents.get_agent_names()
agentNames = self.mainMenu.agents.get_agent_names() + ["all", "autorun"]
endLine = " ".join(line.split(" ")[1:])
mline = endLine.partition(' ')[2]

6
setup/setup_database.py
View File

@ -94,11 +94,13 @@ c.execute('''CREATE TABLE config (
"server_version" text,
"ip_whitelist" text,
"ip_blacklist" text,
"default_lost_limit" integer
"default_lost_limit" integer,
"autorun_command" text,
"autorun_data" text
)''')
# kick off the config component of the database
c.execute("INSERT INTO config VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (STAGING_KEY,STAGE0_URI,STAGE1_URI,STAGE2_URI,DEFAULT_DELAY,DEFAULT_JITTER,DEFAULT_PROFILE,DEFAULT_CERT_PATH,DEFAULT_PORT,INSTALL_PATH,SERVER_VERSION,IP_WHITELIST,IP_BLACKLIST, DEFAULT_LOST_LIMIT))
c.execute("INSERT INTO config VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (STAGING_KEY,STAGE0_URI,STAGE1_URI,STAGE2_URI,DEFAULT_DELAY,DEFAULT_JITTER,DEFAULT_PROFILE,DEFAULT_CERT_PATH,DEFAULT_PORT,INSTALL_PATH,SERVER_VERSION,IP_WHITELIST,IP_BLACKLIST, DEFAULT_LOST_LIMIT, "", ""))
c.execute('''CREATE TABLE "agents" (
"id" integer PRIMARY KEY,