From 3950a4c9f5ed6b7e9c59815ec698125799c5803a Mon Sep 17 00:00:00 2001
From: benpturner <bturner@nettitude.com>
Date: Mon, 31 Dec 2018 00:27:44 +0000
Subject: [PATCH] Updated help pages and core.exe

---
 Help.py           |   4 ++--
 ImplantHandler.py |   2 +-
 Modules/Core.exe  | Bin 36352 -> 36352 bytes
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Help.py b/Help.py
index 3a8eb48..8d5ae33 100644
--- a/Help.py
+++ b/Help.py
@@ -42,7 +42,7 @@ beacon 60s / beacon 10m / beacon 2h
 turtle 60s / turtle 30m / turtle 8h
 ls c:\\temp\\
 pwd
-credpopper
+cred-popper
 resolveip 127.0.0.1
 resolvednsname google.com
 testadcredential domain username password
@@ -401,4 +401,4 @@ COMMANDS += ['invoke-psexecdaisypayload','invoke-wmidaisypayload', 'invoke-dcomd
 
 UXCOMMANDS = ["unhide-implant","hide-implant","help","searchhelp","python","loadmodule","loadmoduleforce","get-keystrokes","back","upload-file","download-file","install-persistence","remove-persistence","sai","startanotherimplant-keepfile","get-screenshot","startanotherimplant","pwd","id","ps","setbeacon","kill-implant"]
 
-SHARPCOMMANDS = ["credpopper","resolveip","resolvednsname","testadcredential","testlocalcredential","get-screenshot","modulesloaded","get-serviceperms","unhide-implant","arpscan","ls","pwd","dir","inject-shellcode","start-process","run-exe","run-dll","hide-implant","help","searchhelp","listmodules","loadmodule","loadmoduleforce","back","ps","beacon","setbeacon","kill-implant"]
+SHARPCOMMANDS = ["turtle","cred-popper","resolveip","resolvednsname","testadcredential","testlocalcredential","get-screenshot","modulesloaded","get-serviceperms","unhide-implant","arpscan","ls","pwd","dir","inject-shellcode","start-process","run-exe","run-dll","hide-implant","help","searchhelp","listmodules","loadmodule","loadmoduleforce","back","ps","beacon","setbeacon","kill-implant"]
diff --git a/ImplantHandler.py b/ImplantHandler.py
index 62dff39..406394a 100644
--- a/ImplantHandler.py
+++ b/ImplantHandler.py
@@ -569,7 +569,7 @@ def runcommand(command, randomuri):
       elif (command.lower().startswith("resolveip")):
         new_task("run-exe Core.Program Core %s" % command,randomuri)
                   
-      elif (command.lower().startswith("credpopper")):
+      elif (command.lower().startswith("cred-popper")):
         new_task("run-exe Core.Program Core %s" % command,randomuri)
 
       elif (command.lower().startswith("get-serviceperms")):
diff --git a/Modules/Core.exe b/Modules/Core.exe
index df622560f83fbdda4ecca870adf956990508a133..7360f9b66814b618d3a3b3d717c6120bed7b4b4a 100755
GIT binary patch
delta 966
zcmZ8gS!fec6uozv%_i0)ElHXtnVH0C#-!C2Yl$C<Xk9;C8jGzP+G;;4G}BiV7tlzn
zRdH*tYxSpb0imuVf}m1F{ZVm2{BZ-(9|Z+JL<Gg#)(ZOI-MQ!7d)}LO?|a!(QudT|
zXtz||*u6J`(eCq0@ChNtt;hQSLZnJ%)PQl+X$NjsET>^;%wa2m74FUkc-{bjj3)xv
z2s<mxh0>D%ZXmV9hd(G)vIhfnrzEN<qruSA0QqH3Nw4DMR2R!6UvFjwlVUtsLZ!Hn
zlA#!Gq6Hxtw^4@eVLBL!U_V_9h4CRhWdAdLV(X^-a0x0@8jfQX%@3!rmb$|8oQ(xw
zWM&L*6C+O~NZ-Qlg66-RW)scyHteTl#9PqvmrmG3%O83at&7akS~+CXkMc4$kz?Pd
zA7kI?b0x!eNAGBHj=53fk^{xBM-oo_Nsu|A&?0V=U2eb^v|3g?MPvBrF^-E`_9S6Y
zk30c;=#D%!`C=p%+MnV=YQCYIoaUEuT0jthk<*Iva$1m8NhRtGy1~eD;VdFS^-8;a
zBV(7iO3##fu0T>vNfr;SRb>V{)oPqYH`U37Js#fH->Y-q@`r!q4LPE5Tul|x$_Y2T
z|3^PCGn8k`<OYwGRK2Kk@ALU!bLmjD3Tw@K(YPe<C<LRup95L$s70J98iA7r;bwAb
zNANxMX%SpZ16mN5(n~E^zQ)fzy2z?bJsbTJ8<*Wt=@cy-XurU4i$nRvcZ#V2ik8kC
zRwrD6e{@$k(P{TpIE9Y`!#caHu&BoDFI}EjYy<#eb!k|?2*AzD#b(#dt>JH{sU{B8
z;C{N?s$e-iZe5p$*$zelvo2%BfWHX@tc5jD4hCd+8jJ*>X&4E_DRi=}iXOFfS!OJQ
zB=w3)YZ^8{letfvakzhde5XIHlje7r_YY28nYm?7+q&3MR^2#mId9C5h94Do?^++v
z4uINpP5Qd|>iC0I)2H>cNzF%oo^3J*IvnWz&V?TtUM@W--KtNroHoC97NJ?N>xWeu
NJJIy)`-0sS_TQhO@s<Dp

delta 941
zcmZ8gT}%{L6h3EIcE+7$Wx+1X?##~YZid~m5SM_>Y8#`GDjG`_G(ZI6Pc;S&J6vj$
zTBF;5#agYvN!1c!!}g_ZC`#tV7$1z0$b&HkQ(u%ezG{rV*%;Dz03orH+%w;I&iBpz
zIdgNPQf^clJR?nY44sW&Xz2GAoF>FX;oum6Mp3DX+Ax78eT%2exjZa94ICvXggaXR
z?zI6R^I8Bm`TNt(4(UM<dnp<Y;J=g!e~$sW9gdliBCwOq0G=vUO4hMBGr%?}Fp}-y
zq^Kg7R)LL_(&G3PeXbdJg0dWk>4Fx)-)KV9d13b$KcnXyz2wous8NNUz%(`L8TJn7
z+kBlqu(O-yr-{2oC;g)*)cwmTi=OBqN<~W4L(92J@<-xyB(mA+;+#8qk-ctlg>fKx
ziLn~+rgT{uDH3_ktst)vET3Hx{QOQ}u%Of>ZjfxW;SB9FOuug>?>EkMv7M15x@g!~
zjpyjLu|9QwsivLJ@ab8B1x?;6lk!$j5P+Sx$_w&Vh+Qc&rj`_go#WGTi5Rt-y>d5m
zulR#z%+~oMi)N&`VmcT#n4FG&gzM>MbZzNbKTlgWlH_K278mk}lvo1WC>^U=Jz4Vq
z>MUm#bnYy-*`ubSC7Aq`5pQfG4aVxQ(V2=RB;)H+uzSb3kmEMG#OSIex@MmCkZS#e
zPiV}F;C8xYg|LYpTcPUqGH%QSyRxkul2<u+Wu-<H`?=8jC)4AK`5*sCoVrf2icc5a
zm9F4>zDX9Uav-e=9~TyVvSG666KA}ly`cPX5Foz08IJA*DCW<_x9r|p&+ijXwDQM#
z{DH1@n>5qiRRFm@#zChgTZn-V4uF7z@CDeA<zX`x0M3_oCE~~QOHUpB)pHs*(jKwS
zxg^Gv;tLOp?kX>yH4N8hJCDo9PC5<W>{6<xIzDXYx%hJM<>7{nkMZaOXlkx+mM>O&
zUhlp78R?gwUjEzO;7s=^SoG@Mm6~^XXtqBr&E=gp{i|>&tvJ5#-V{n&t>ZuUlDYgA
DvV-kH