diff --git a/debian/patches/rename-Implant-Core.py.patch b/debian/patches/rename-Implant-Core.py.patch deleted file mode 100644 index 01b9987..0000000 --- a/debian/patches/rename-Implant-Core.py.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: Sophie Brun -Date: Tue, 26 May 2020 10:58:04 +0200 -Subject: Rename Implant-Core.py to Implant-Core.py.dat - -Last-Update: 2020-05-26 - -Description: the file doesn't contain only Python. dpkg will fail during -installation because of syntax errors. ---- - poshc2/server/Implant.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/poshc2/server/Implant.py b/poshc2/server/Implant.py -index abf3d3e..ca0ebe0 100644 ---- a/poshc2/server/Implant.py -+++ b/poshc2/server/Implant.py -@@ -46,7 +46,7 @@ NEWKEY8839394%s4939388YEKWEN - IMGS19459394%s49395491SGMI""" % (self.RandomURI, self.AllBeaconURLs, self.KillDate, self.Sleep, self.Jitter, self.Key, self.AllBeaconImages) - with open("%spy_dropper.sh" % (PayloadsDirectory), 'rb') as f: - self.PythonImplant = base64.b64encode(f.read()).decode("utf-8") -- py_implant_core = open("%s/Implant-Core.py" % PayloadTemplatesDirectory, 'r').read() -+ py_implant_core = open("%s/Implant-Core.py.dat" % PayloadTemplatesDirectory, 'r').read() - self.PythonCore = py_implant_core % (self.DomainFrontHeader, self.Sleep, self.AllBeaconImages, self.AllBeaconURLs, self.KillDate, self.PythonImplant, self.Jitter, self.Key, self.RandomURI, self.UserAgent) - ps_implant_core = open("%s/Implant-Core.ps1" % PayloadTemplatesDirectory, 'r').read() - self.PSCore = ps_implant_core % (self.Key, self.Jitter, self.Sleep, self.AllBeaconImages, self.RandomURI, self.RandomURI, self.KillDate, self.AllBeaconURLs) # Add all db elements def display(self): diff --git a/debian/patches/rename-payload-templates.patch b/debian/patches/rename-payload-templates.patch new file mode 100644 index 0000000..5c694c0 --- /dev/null +++ b/debian/patches/rename-payload-templates.patch @@ -0,0 +1,39 @@ +From: Sophie Brun +Date: Tue, 26 May 2020 10:58:04 +0200 +Subject: Rename few payload-templates + +Last-Update: 2020-05-26 + +Description: the files don't contain only Python. dpkg will fail during +installation because of syntax errors. +--- + poshc2/server/Implant.py | 2 +- + poshc2/server/payloads/Payloads.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/poshc2/server/Implant.py b/poshc2/server/Implant.py +index abf3d3e..ca0ebe0 100644 +--- a/poshc2/server/Implant.py ++++ b/poshc2/server/Implant.py +@@ -46,7 +46,7 @@ NEWKEY8839394%s4939388YEKWEN + IMGS19459394%s49395491SGMI""" % (self.RandomURI, self.AllBeaconURLs, self.KillDate, self.Sleep, self.Jitter, self.Key, self.AllBeaconImages) + with open("%spy_dropper.sh" % (PayloadsDirectory), 'rb') as f: + self.PythonImplant = base64.b64encode(f.read()).decode("utf-8") +- py_implant_core = open("%s/Implant-Core.py" % PayloadTemplatesDirectory, 'r').read() ++ py_implant_core = open("%s/Implant-Core.py.dat" % PayloadTemplatesDirectory, 'r').read() + self.PythonCore = py_implant_core % (self.DomainFrontHeader, self.Sleep, self.AllBeaconImages, self.AllBeaconURLs, self.KillDate, self.PythonImplant, self.Jitter, self.Key, self.RandomURI, self.UserAgent) + ps_implant_core = open("%s/Implant-Core.ps1" % PayloadTemplatesDirectory, 'r').read() + self.PSCore = ps_implant_core % (self.Key, self.Jitter, self.Sleep, self.AllBeaconImages, self.RandomURI, self.RandomURI, self.KillDate, self.AllBeaconURLs) # Add all db elements def display(self): +diff --git a/poshc2/server/payloads/Payloads.py b/poshc2/server/payloads/Payloads.py +index b17bb21..57d1cf2 100644 +--- a/poshc2/server/payloads/Payloads.py ++++ b/poshc2/server/payloads/Payloads.py +@@ -357,7 +357,7 @@ class Payloads(object): + self.QuickstartLog("Python2 OSX/Unix/Win Dropper written to: %spy_dropper.sh" % self.BaseDirectory) + + # get the python dropper template +- with open("%sdropper.py" % PayloadTemplatesDirectory, 'r') as f: ++ with open("%sdropper.py.dat" % PayloadTemplatesDirectory, 'r') as f: + dropper_file = f.read() + + # patch the key settings into the file diff --git a/debian/patches/series b/debian/patches/series index 287ca99..4ef893b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -3,5 +3,5 @@ remove-posh-update.patch dont-use-pipenv.patch remove-git-usage.patch -rename-Implant-Core.py.patch +rename-payload-templates.patch use-cryptodome.patch diff --git a/debian/rules b/debian/rules index 028c884..6edafc5 100755 --- a/debian/rules +++ b/debian/rules @@ -9,3 +9,4 @@ override_dh_install: dh_install mv debian/poshc2/usr/share/poshc2/resources/payload-templates/Implant-Core.py debian/poshc2/usr/share/poshc2/resources/payload-templates/Implant-Core.py.dat + mv debian/poshc2/usr/share/poshc2/resources/payload-templates/dropper.py debian/poshc2/usr/share/poshc2/resources/payload-templates/dropper.py.dat