Added ability to set a script to run on each agent checkin with "set Agent autorun" in module menu.
"(Empire: agents) > clear autorun" will clear out any current autoruns WARNING: this requires a DB schema mod to work correctly, meaning you will lose current agent connection information if run!1.6
parent
8aa7918ef6
commit
e59844be72
|
@ -474,7 +474,83 @@ class Agents:
|
||||||
else:
|
else:
|
||||||
return None
|
return None
|
||||||
|
|
||||||
|
def get_agent_functions(self, sessionID):
|
||||||
|
"""
|
||||||
|
Get the tab-completable functions for an agent.
|
||||||
|
"""
|
||||||
|
|
||||||
|
# see if we were passed a name instead of an ID
|
||||||
|
nameid = self.get_agent_id(sessionID)
|
||||||
|
if nameid : sessionID = nameid
|
||||||
|
|
||||||
|
if sessionID in self.agents:
|
||||||
|
return self.agents[sessionID][3]
|
||||||
|
else:
|
||||||
|
return []
|
||||||
|
|
||||||
|
|
||||||
|
def get_agent_functions_database(self, sessionID):
|
||||||
|
"""
|
||||||
|
Get the tab-completable functions for an agent from the database.
|
||||||
|
"""
|
||||||
|
|
||||||
|
# see if we were passed a name instead of an ID
|
||||||
|
nameid = self.get_agent_id(sessionID)
|
||||||
|
if nameid : sessionID = nameid
|
||||||
|
|
||||||
|
cur = self.conn.cursor()
|
||||||
|
cur.execute("SELECT functions FROM agents WHERE session_id=?", [sessionID])
|
||||||
|
functions = cur.fetchone()[0]
|
||||||
|
cur.close()
|
||||||
|
if functions and functions != None:
|
||||||
|
return functions.split(",")
|
||||||
|
else:
|
||||||
|
return []
|
||||||
|
|
||||||
|
|
||||||
|
def get_agent_uris(self, sessionID):
|
||||||
|
"""
|
||||||
|
Get the current and old URIs for an agent from the database.
|
||||||
|
"""
|
||||||
|
|
||||||
|
# see if we were passed a name instead of an ID
|
||||||
|
nameid = self.get_agent_id(sessionID)
|
||||||
|
if nameid : sessionID = nameid
|
||||||
|
|
||||||
|
cur = self.conn.cursor()
|
||||||
|
cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
|
||||||
|
uris = cur.fetchone()
|
||||||
|
cur.close()
|
||||||
|
|
||||||
|
return uris
|
||||||
|
|
||||||
|
|
||||||
|
def get_autoruns(self):
|
||||||
|
"""
|
||||||
|
Get any global script autoruns.
|
||||||
|
"""
|
||||||
|
|
||||||
|
try:
|
||||||
|
cur = self.conn.cursor()
|
||||||
|
cur.execute("SELECT autorun_command FROM config")
|
||||||
|
results = cur.fetchone()
|
||||||
|
if results:
|
||||||
|
autorunCommand = results[0]
|
||||||
|
else:
|
||||||
|
autorunCommand = ''
|
||||||
|
|
||||||
|
cur = self.conn.cursor()
|
||||||
|
cur.execute("SELECT autorun_data FROM config")
|
||||||
|
results = cur.fetchone()
|
||||||
|
if results:
|
||||||
|
autorunData = results[0]
|
||||||
|
else:
|
||||||
|
autorunData = ''
|
||||||
|
cur.close()
|
||||||
|
|
||||||
|
return [autorunCommand, autorunData]
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
###############################################################
|
###############################################################
|
||||||
#
|
#
|
||||||
|
@ -629,55 +705,34 @@ class Agents:
|
||||||
cur.close()
|
cur.close()
|
||||||
|
|
||||||
|
|
||||||
def get_agent_functions(self, sessionID):
|
def set_autoruns(self, taskCommand, moduleData):
|
||||||
"""
|
"""
|
||||||
Get the tab-completable functions for an agent.
|
Set the global script autorun in the config.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
# see if we were passed a name instead of an ID
|
try:
|
||||||
nameid = self.get_agent_id(sessionID)
|
cur = self.conn.cursor()
|
||||||
if nameid : sessionID = nameid
|
cur.execute("UPDATE config SET autorun_command=?", [taskCommand])
|
||||||
|
cur.execute("UPDATE config SET autorun_data=?", [moduleData])
|
||||||
if sessionID in self.agents:
|
cur.close()
|
||||||
return self.agents[sessionID][3]
|
except:
|
||||||
else:
|
print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
|
||||||
return []
|
print helpers.color("[!] Warning: this will reset ALL agent connections!")
|
||||||
|
|
||||||
|
|
||||||
def get_agent_functions_database(self, sessionID):
|
def clear_autoruns(self):
|
||||||
"""
|
"""
|
||||||
Get the tab-completable functions for an agent from the database.
|
Clear the currently set global script autoruns in the config.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
# see if we were passed a name instead of an ID
|
try:
|
||||||
nameid = self.get_agent_id(sessionID)
|
cur = self.conn.cursor()
|
||||||
if nameid : sessionID = nameid
|
cur.execute("UPDATE config SET autorun_command=''")
|
||||||
|
cur.execute("UPDATE config SET autorun_data=''")
|
||||||
cur = self.conn.cursor()
|
cur.close()
|
||||||
cur.execute("SELECT functions FROM agents WHERE session_id=?", [sessionID])
|
except:
|
||||||
functions = cur.fetchone()[0]
|
print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
|
||||||
cur.close()
|
print helpers.color("[!] Warning: this will reset ALL agent connections!")
|
||||||
if functions and functions != None:
|
|
||||||
return functions.split(",")
|
|
||||||
else:
|
|
||||||
return []
|
|
||||||
|
|
||||||
|
|
||||||
def get_agent_uris(self, sessionID):
|
|
||||||
"""
|
|
||||||
Get the current and old URIs for an agent from the database.
|
|
||||||
"""
|
|
||||||
|
|
||||||
# see if we were passed a name instead of an ID
|
|
||||||
nameid = self.get_agent_id(sessionID)
|
|
||||||
if nameid : sessionID = nameid
|
|
||||||
|
|
||||||
cur = self.conn.cursor()
|
|
||||||
cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
|
|
||||||
uris = cur.fetchone()
|
|
||||||
cur.close()
|
|
||||||
|
|
||||||
return uris
|
|
||||||
|
|
||||||
|
|
||||||
###############################################################
|
###############################################################
|
||||||
|
@ -1338,6 +1393,11 @@ class Agents:
|
||||||
# save the initial sysinfo information in the agent log
|
# save the initial sysinfo information in the agent log
|
||||||
self.save_agent_log(sessionID, output + "\n")
|
self.save_agent_log(sessionID, output + "\n")
|
||||||
|
|
||||||
|
# if a script autorun is set, set that as the agent's first tasking
|
||||||
|
autorun = self.get_autoruns()
|
||||||
|
if autorun[0] != '' and autorun[1] != '':
|
||||||
|
self.add_agent_task(sessionID, autorun[0], autorun[1])
|
||||||
|
|
||||||
return(200, encryptedAgent)
|
return(200, encryptedAgent)
|
||||||
|
|
||||||
else:
|
else:
|
||||||
|
|
|
@ -779,6 +779,8 @@ class AgentsMenu(cmd.Cmd):
|
||||||
|
|
||||||
if name.lower() == "all":
|
if name.lower() == "all":
|
||||||
self.mainMenu.agents.clear_agent_tasks("all")
|
self.mainMenu.agents.clear_agent_tasks("all")
|
||||||
|
elif name.lower() == "autorun":
|
||||||
|
self.mainMenu.agents.clear_autoruns()
|
||||||
else:
|
else:
|
||||||
# extract the sessionID and clear the agent tasking
|
# extract the sessionID and clear the agent tasking
|
||||||
sessionID = self.mainMenu.agents.get_agent_id(name)
|
sessionID = self.mainMenu.agents.get_agent_id(name)
|
||||||
|
@ -1100,7 +1102,7 @@ class AgentsMenu(cmd.Cmd):
|
||||||
def complete_clear(self, text, line, begidx, endidx):
|
def complete_clear(self, text, line, begidx, endidx):
|
||||||
"Tab-complete a clear command"
|
"Tab-complete a clear command"
|
||||||
|
|
||||||
names = self.mainMenu.agents.get_agent_names() + ["all"]
|
names = self.mainMenu.agents.get_agent_names() + ["all", "autorun"]
|
||||||
mline = line.partition(' ')[2]
|
mline = line.partition(' ')[2]
|
||||||
offs = len(mline) - len(text)
|
offs = len(mline) - len(text)
|
||||||
return [s[offs:] for s in names if s.startswith(mline)]
|
return [s[offs:] for s in names if s.startswith(mline)]
|
||||||
|
@ -2221,7 +2223,7 @@ class ModuleMenu(cmd.Cmd):
|
||||||
|
|
||||||
try:
|
try:
|
||||||
# if we're running this module for all agents, skip this validation
|
# if we're running this module for all agents, skip this validation
|
||||||
if sessionID.lower() != "all":
|
if sessionID.lower() != "all" and sessionID.lower() != "autorun":
|
||||||
modulePSVersion = int(self.module.info['MinPSVersion'])
|
modulePSVersion = int(self.module.info['MinPSVersion'])
|
||||||
agentPSVersion = int(self.mainMenu.agents.get_ps_version(sessionID))
|
agentPSVersion = int(self.mainMenu.agents.get_ps_version(sessionID))
|
||||||
# check if the agent/module PowerShell versions are compatible
|
# check if the agent/module PowerShell versions are compatible
|
||||||
|
@ -2236,7 +2238,7 @@ class ModuleMenu(cmd.Cmd):
|
||||||
# check if the module needs admin privs
|
# check if the module needs admin privs
|
||||||
if self.module.info['NeedsAdmin']:
|
if self.module.info['NeedsAdmin']:
|
||||||
# if we're running this module for all agents, skip this validation
|
# if we're running this module for all agents, skip this validation
|
||||||
if sessionID.lower() != "all":
|
if sessionID.lower() != "all" and sessionID.lower() != "autorun":
|
||||||
if not self.mainMenu.agents.is_agent_elevated(sessionID):
|
if not self.mainMenu.agents.is_agent_elevated(sessionID):
|
||||||
print helpers.color("[!] Error: module needs to run in an elevated context.")
|
print helpers.color("[!] Error: module needs to run in an elevated context.")
|
||||||
return False
|
return False
|
||||||
|
@ -2459,6 +2461,12 @@ class ModuleMenu(cmd.Cmd):
|
||||||
|
|
||||||
except KeyboardInterrupt as e: print ""
|
except KeyboardInterrupt as e: print ""
|
||||||
|
|
||||||
|
# set the script to be the global autorun
|
||||||
|
elif agentName.lower() == "autorun":
|
||||||
|
|
||||||
|
self.mainMenu.agents.set_autoruns(taskCommand, moduleData)
|
||||||
|
dispatcher.send("[*] Set module " + self.moduleName + " to be global script autorun.", sender="Empire")
|
||||||
|
|
||||||
else:
|
else:
|
||||||
if not self.mainMenu.agents.is_agent_present(agentName):
|
if not self.mainMenu.agents.is_agent_present(agentName):
|
||||||
print helpers.color("[!] Invalid agent name.")
|
print helpers.color("[!] Invalid agent name.")
|
||||||
|
@ -2484,7 +2492,7 @@ class ModuleMenu(cmd.Cmd):
|
||||||
|
|
||||||
if line.split(" ")[1].lower() == "agent":
|
if line.split(" ")[1].lower() == "agent":
|
||||||
# if we're tab-completing "agent", return the agent names
|
# if we're tab-completing "agent", return the agent names
|
||||||
agentNames = self.mainMenu.agents.get_agent_names()
|
agentNames = self.mainMenu.agents.get_agent_names() + ["all", "autorun"]
|
||||||
endLine = " ".join(line.split(" ")[1:])
|
endLine = " ".join(line.split(" ")[1:])
|
||||||
|
|
||||||
mline = endLine.partition(' ')[2]
|
mline = endLine.partition(' ')[2]
|
||||||
|
|
|
@ -94,11 +94,13 @@ c.execute('''CREATE TABLE config (
|
||||||
"server_version" text,
|
"server_version" text,
|
||||||
"ip_whitelist" text,
|
"ip_whitelist" text,
|
||||||
"ip_blacklist" text,
|
"ip_blacklist" text,
|
||||||
"default_lost_limit" integer
|
"default_lost_limit" integer,
|
||||||
|
"autorun_command" text,
|
||||||
|
"autorun_data" text
|
||||||
)''')
|
)''')
|
||||||
|
|
||||||
# kick off the config component of the database
|
# kick off the config component of the database
|
||||||
c.execute("INSERT INTO config VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (STAGING_KEY,STAGE0_URI,STAGE1_URI,STAGE2_URI,DEFAULT_DELAY,DEFAULT_JITTER,DEFAULT_PROFILE,DEFAULT_CERT_PATH,DEFAULT_PORT,INSTALL_PATH,SERVER_VERSION,IP_WHITELIST,IP_BLACKLIST, DEFAULT_LOST_LIMIT))
|
c.execute("INSERT INTO config VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (STAGING_KEY,STAGE0_URI,STAGE1_URI,STAGE2_URI,DEFAULT_DELAY,DEFAULT_JITTER,DEFAULT_PROFILE,DEFAULT_CERT_PATH,DEFAULT_PORT,INSTALL_PATH,SERVER_VERSION,IP_WHITELIST,IP_BLACKLIST, DEFAULT_LOST_LIMIT, "", ""))
|
||||||
|
|
||||||
c.execute('''CREATE TABLE "agents" (
|
c.execute('''CREATE TABLE "agents" (
|
||||||
"id" integer PRIMARY KEY,
|
"id" integer PRIMARY KEY,
|
||||||
|
|
Loading…
Reference in New Issue