Commit a506f2b4a7e65c1e9bb3e998ff0f6272a2f58a78 - powershell-empire

New upstream version 3.6.3 Sophie Brun 3 years ago

6 changed file(s) with 106 addition(s) and 63 deletion(s). Raw diff Collapse all Expand all

-1

VERSION less more

0		3.6.2
	0	3.6.3

-0

changelog less more

	0	12/18/2020
	1	------------
	2	- Version 3.6.3 Master Release
	3	- Added save path to download file message - #414 (@meldridge)
	4	- Updated installation file formatting - #410 (@Pernat1y)
	5	- Fixed python 3.9.1 issue with deprecated base64 function - #422 (@brimstone)
	6	- Fixed dump creds and hash not being logged in credentials properly - #423 (@Cx01N)
	7
0	8	11/27/2020
1	9	------------
2	10	- Version 3.6.2 Master Release

+17

-1

lib/common/agents.py less more

315	315	percent = round(int(os.path.getsize("%s/%s" % (save_path, filename)))/int(filesize)*100,2)
316	316
317	317	# notify everyone that the file was downloaded
318		message = "[+] Part of file {} from {} saved [{}%]".format(filename, sessionID, percent)
	318	message = "[+] Part of file {} from {} saved [{}%] to {}".format(filename, sessionID, percent, save_path)
319	319	signal = json.dumps({
320	320	'print': True,
321	321	'message': message

2058	2058	# dynamic script output -> non-blocking
2059	2059	self.update_agent_results_db(sessionID, data)
2060	2060
	2061	# see if there are any credentials to parse
	2062	time = helpers.get_datetime()
	2063	creds = helpers.parse_credentials(data)
	2064	if creds:
	2065	for cred in creds:
	2066
	2067	hostname = cred[4]
	2068
	2069	if hostname == "":
	2070	hostname = self.get_agent_hostname_db(sessionID)
	2071
	2072	osDetails = self.get_agent_os_db(sessionID)
	2073
	2074	self.mainMenu.credentials.add_credential(cred[0], cred[1], cred[2], cred[3], hostname,
	2075	osDetails, cred[5], time)
	2076
2061	2077	# update the agent log
2062	2078	self.save_agent_log(sessionID, data)
2063	2079

-1

lib/common/empire.py less more

17	17
18	18	from flask_socketio import SocketIO
19	19
20		VERSION = "3.6.2 BC Security Fork"
	20	VERSION = "3.6.3 BC Security Fork"
21	21
22	22	from pydispatch import dispatcher
23	23

+22

-25

lib/common/helpers.py less more

542	542	for x in range(8, 13):
543	543	if lines[x].startswith(b"Domain :"):
544	544
545		domain, sid, krbtgtHash = "", "", ""
	545	domain, sid, krbtgtHash = b"", b"", b""
546	546
547	547	try:
548		domainParts = lines[x].split(":")[1]
549		domain = domainParts.split("/")[0].strip()
550		sid = domainParts.split("/")[1].strip()
	548	domainParts = lines[x].split(b":")[1]
	549	domain = domainParts.split(b"/")[0].strip()
	550	sid = domainParts.split(b"/")[1].strip()
551	551
552	552	# substitute the FQDN in if it matches
553		if hostDomain.startswith(domain.lower()):
	553	if hostDomain.startswith(domain.decode("UTF-8").lower()):
554	554	domain = hostDomain
555	555	sid = domainSid
556	556
557	557	for x in range(0, len(lines)):
558		if lines[x].startswith("User : krbtgt"):
559		krbtgtHash = lines[x + 2].split(":")[1].strip()
	558	if lines[x].startswith(b"User : krbtgt"):
	559	krbtgtHash = lines[x + 2].split(b":")[1].strip()
560	560	break
561	561
562		if krbtgtHash != "":
563		creds.append(("hash", domain, "krbtgt", krbtgtHash, hostName, sid))
	562	if krbtgtHash != b"":
	563	creds.append(("hash", domain.decode('UTF-8'), "krbtgt", krbtgtHash.decode('UTF-8'), hostName.decode('UTF-8'), sid.decode('UTF-8')))
564	564	except Exception as e:
565	565	pass
566	566

569	569	if b' SAM ACCOUNT ' in lines:
570	570	domain, user, userHash, dcName, sid = "", "", "", "", ""
571	571	for line in lines:
572		try:
573		if line.strip().endswith("will be the domain"):
574		domain = line.split("'")[1]
575		elif line.strip().endswith("will be the DC server"):
576		dcName = line.split("'")[1].split(".")[0]
577		elif line.strip().startswith("SAM Username"):
578		user = line.split(":")[1].strip()
579		elif line.strip().startswith("Object Security ID"):
580		parts = line.split(":")[1].strip().split("-")
581		sid = "-".join(parts[0:-1])
582		elif line.strip().startswith("Hash NTLM:"):
583		userHash = line.split(":")[1].strip()
584		except:
585		pass
	572	if line.strip().endswith(b"will be the domain"):
	573	domain = line.split(b"'")[1]
	574	elif line.strip().endswith(b"will be the DC server"):
	575	dcName = line.split(b"'")[1].split(b".")[0]
	576	elif line.strip().startswith(b"SAM Username"):
	577	user = line.split(b":")[1].strip()
	578	elif line.strip().startswith(b"Object Security ID"):
	579	parts = line.split(b":")[1].strip().split(b"-")
	580	sid = b"-".join(parts[0:-1])
	581	elif line.strip().startswith(b"Hash NTLM:"):
	582	userHash = line.split(b":")[1].strip()
586	583
587	584	if domain != "" and userHash != "":
588		creds.append(("hash", domain, user, userHash, dcName, sid))
	585	creds.append(("hash", domain.decode('UTF-8'), user.decode('UTF-8'), userHash.decode('UTF-8'), dcName.decode('UTF-8'), sid.decode('UTF-8')))
589	586
590	587	return uniquify_tuples(creds)
591	588

850	847	data += b'=' * missing_padding
851	848
852	849	try:
853		result = base64.decodestring(data)
	850	result = base64.decodebytes(data)
854	851	return result
855	852	except binascii.Error:
856	853	# if there's a decoding error, just return the data

+57

-35

setup/install.sh less more

0	0	#!/bin/bash
	1
1	2	function install_powershell() {
2		# Deb 10.x
3		if cat /etc/debian_version \| grep 10.* ; then
4		# Download the Microsoft repository GPG keys
5		wget https://packages.microsoft.com/config/debian/10/packages-microsoft-prod.deb
	3	# Debian 10.x
	4	if grep "10.*" /etc/debian_version 2>/dev/null; then
	5	# Download the Microsoft repository GPG keys
	6	wget https://packages.microsoft.com/config/debian/10/packages-microsoft-prod.deb
6	7
7		# Register the Microsoft repository GPG keys
8		sudo dpkg -i packages-microsoft-prod.deb
	8	# Register the Microsoft repository GPG keys
	9	sudo dpkg -i packages-microsoft-prod.deb
9	10
10		# Update the list of products
11		sudo apt-get update
	11	# Update the list of products
	12	sudo apt-get update
12	13
13		# Install PowerShell
14		sudo apt-get install -y powershell
15		# Deb 9.x
16		elif cat /etc/debian_version \| grep 9.* ; then
	14	# Install PowerShell
	15	sudo apt-get install -y powershell
	16
	17	# Debian 9.x
	18	elif grep "9.*" /etc/debian_version 2>/dev/null; then
17	19	# Install system components
18	20	sudo apt-get install -y apt-transport-https curl
	21
19	22	# Import the public repository GPG keys
20	23	curl https://packages.microsoft.com/keys/microsoft.asc \| sudo apt-key add -
	24
21	25	# Register the Microsoft Product feed
22	26	sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-debian-stretch-prod stretch main" > /etc/apt/sources.list.d/microsoft.list'
	27
23	28	# Update the list of products
24	29	sudo apt-get update
	30
25	31	# Install PowerShell
26	32	sudo apt-get install -y powershell
27		# Deb 8.x
28		elif cat /etc/debian_version \| grep 8.* ; then
	33
	34	# Debian 8.x
	35	elif grep "8.*" /etc/debian_version 2>/dev/null; then
29	36	# Install system components
30	37	sudo apt-get install -y apt-transport-https curl gnupg
	38
31	39	# Import the public repository GPG keys
32	40	curl https://packages.microsoft.com/keys/microsoft.asc \| sudo apt-key add -
	41
33	42	# Register the Microsoft Product feed
34	43	sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-debian-jessie-prod jessie main" > /etc/apt/sources.list.d/microsoft.list'
	44
35	45	# Update the list of products
36	46	sudo apt-get update
	47
37	48	# Install PowerShell
38	49	sudo apt-get install -y powershell
39		#Ubuntu
40		elif lsb_release -d \| grep -q "Ubuntu"; then
	50
	51	# Ubuntu
	52	elif lsb_release -d 2>/dev/null \| grep -q "Ubuntu"; then
41	53	# Read Ubuntu version
42	54	local ubuntu_version=$( grep 'DISTRIB_RELEASE=' /etc/lsb-release \| grep -o -E [[:digit:]]+\\.[[:digit:]]+ )
	55
43	56	# Install system components
44	57	sudo apt-get install -y apt-transport-https curl
	58
45	59	# Import the public repository GPG keys
46	60	curl https://packages.microsoft.com/keys/microsoft.asc \| sudo apt-key add -
	61
47	62	# Register the Microsoft Ubuntu repository
48	63	curl https://packages.microsoft.com/config/ubuntu/$ubuntu_version/prod.list \| sudo tee /etc/apt/sources.list.d/microsoft.list
	64
49	65	# Update the list of products
50	66	sudo apt-get update
	67
51	68	# Install PowerShell
52	69	sudo apt-get install -y powershell
53		#Kali Linux
54		elif lsb_release -d \| grep -q "Kali"; then
	70
	71	# Kali Linux
	72	elif lsb_release -d 2>/dev/null \| grep -q "Kali"; then
55	73	apt update && apt -y install powershell
	74
	75	else
	76	echo 'Unsupported OS. Exiting.' && exit
56	77	fi
57		if ls /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY; then
58		rm /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY
59		fi
	78
	79	# Disable telemetry
	80	rm /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY 2>/dev/null
	81
	82	# Install Invoke-Obfuscation module
60	83	mkdir -p /usr/local/share/powershell/Modules
61	84	cp -r ../lib/powershell/Invoke-Obfuscation /usr/local/share/powershell/Modules
62	85	}

80	103	function install_bomutils() {
81	104	git clone https://github.com/hogliux/bomutils.git
82	105	(cd bomutils && make)
83		(cd bomutils && make install)
	106	(cd bomutils && sudo make install)
84	107	chmod 755 bomutils/build/bin/mkbom && sudo cp bomutils/build/bin/mkbom /usr/local/bin/.
85	108	}
86	109

100	123	false
101	124	}
102	125
103		# Ask for the administrator password upfront so sudo is no longer required at Installation.
	126	# Ask for the sudo password upfront so it is no longer required during installation.
104	127	sudo -v
105	128
106	129	IFS='/' read -a array <<< pwd

112	135
113	136	Pip_file="requirements.txt"
114	137
115		if lsb_release -d \| grep -q "Kali"; then
	138	if lsb_release -d 2>/dev/null \| grep -q "Kali"; then
116	139	apt-get update
117	140	sudo apt-get install -y make autoconf g++ python3-dev swig python3-pip libxml2-dev default-jdk zlib1g-dev libssl1.1 build-essential libssl-dev libxml2-dev zlib1g-dev
118		elif lsb_release -d \| grep -q "Ubuntu"; then
	141	elif lsb_release -d 2>/dev/null \| grep -q "Ubuntu"; then
119	142	if is_libssl_1_0; then
120	143	LibSSL_pkgs="libssl1.0.0 libssl-dev"
121	144	Pip_file="requirements_libssl1.0.txt"

123	146	LibSSL_pkgs="libssl1.1 libssl-dev"
124	147	fi
125	148	sudo apt-get update
126		sudo apt-get install -y make autoconf g++ python3-dev swig python3-pip libxml2-dev default-jdk $LibSSL_pkgs build-essential
	149	sudo apt-get install -y make autoconf g++ python3-dev swig python3-pip libxml2-dev default-jdk "$LibSSL_pkgs" build-essential
	150	elif grep "Fedora release" /etc/redhat-release 2>/dev/null; then
	151	sudo dnf update
	152	sudo dnf install -y autoconf autogen make gcc-c++ libxml2-devel openssl-devel python3-pip python3-devel python3-m2crypto
127	153	else
128	154	echo "Unknown distro - Debian/Ubuntu Fallback"
129	155	if is_libssl_1_0; then

133	159	LibSSL_pkgs="libssl1.1 libssl-dev"
134	160	fi
135	161	sudo apt-get update
136		sudo apt-get install -y make autoconf g++ python3-dev swig python3-pip libxml2-dev default-jdk libffi-dev $LibSSL_pkgs build-essential
	162	sudo apt-get install -y make autoconf g++ python3-dev swig python3-pip libxml2-dev default-jdk libffi-dev "$LibSSL_pkgs" build-essential
137	163	fi
138	164
139	165	install_xar

142	168
143	169	install_powershell
144	170
145		if ls /usr/bin/ \| grep -q "python3"; then
146		if ! type pip3 > /dev/null; then
147		sudo apt-get --assume-yes install python3-pip
148		fi
149		sudo pip3 install -r $Pip_file
150		fi
	171	# Install Python dependencies
	172	sudo pip3 install -r "$Pip_file"
151	173
152		# set up the database schema
	174	# Set up the database schema
153	175	python3 ./setup_database.py
154	176
155		# generate a cert
	177	# Generate a cert
156	178	./cert.sh
157	179
158	180	cd ..