e65e15c982
Removed ls_m and shellb modules for python
2018-03-11 15:23:37 -04:00
5eaf06a434
update shell stager logic
2018-03-04 02:10:55 -05:00
320fe957d1
Added shellcode stager w/ sRDI project from @monogas
2018-03-02 00:12:41 -05:00
927fb957ca
Update comments
2018-02-27 18:00:32 -05:00
8c99cb4c07
Updated based on Feedback
...
Removed variable names starting with a capital and added remove.lower() to match on lowercase true as well as True.
2018-02-23 06:48:12 -06:00
d73f62a22d
Update Comments
...
Re-added comments for references.
2018-02-20 09:42:50 -06:00
20222d9b5d
Update desktopfile to add Remove capability
...
Added a section to improve the Desktop file persistence by letting the use remove previous persistence mechanisms. Checks to see if the FileName exists and if so removes it.
2018-02-20 09:22:48 -06:00
3c29386612
Small modification to trollsploit/wallpaper module
2018-02-18 15:18:04 -05:00
32b5269a37
Merge pull request #978 from jarrodcoulter/feature/desktopfile
...
Add Linux Persistence through Autostart
2018-02-11 23:56:05 -05:00
d8d249758d
Merge pull request #974 from ThePirateWhoSmellsOfSunflowers/allow_minidump_without_admin
...
Modify minidump module to allow non-admin to dump process
2018-02-11 21:53:01 -05:00
1f58041d45
Add Linux Persistence through Autostart
...
Creating persistence by adding the python launcher to the ~/.config/autostart directory. This is based on the CrossRat analysis (https://digitasecurity.com/blog/2018/01/23/crossrat/ ) and the other links in the comments.
Tested in Ubuntu 16 and Oracle Linux 7.
2018-02-09 11:15:04 -06:00
ceb9af77b8
Merge pull request #947 from ThePirateWhoSmellsOfSunflowers/fix_invoke_psexec
...
fix the invoke_psexec module
2018-02-08 21:14:20 -05:00
ce561cb9c9
Fix the logic if both ProcessName and ProcessId are specified
2018-02-08 14:42:46 +01:00
1b7e04a042
Modify minidump module to allow non-admin to dump process
2018-02-07 17:03:37 +01:00
1f9aada0ca
Merge pull request #972 from EmpireProject/powerview_fix
...
Powerview fix
2018-02-07 01:41:09 -05:00
ef7c414ee9
Fix for #940
2018-02-07 01:38:12 -05:00
df0d1927a2
Change Background to True for both modules
2018-01-27 18:56:08 -05:00
184208c964
Merge branch 'dev' of https://github.com/retro-engineer/Empire into retro-engineer-dev
2018-01-27 18:38:51 -05:00
7d04f6e8b8
fix the module
2018-01-19 15:00:02 +01:00
e2ea55835a
Merge pull request #893 from s0lst1c3/dev
...
Module Added: osx_mic_record (resolves #865 )
2018-01-07 19:05:31 -05:00
e6ea80e18e
More robust password prompt handler
...
Some SSH clients used a more verbose password prompt: "Password for user@pfSense.domain.local:". This patch makes the parent process wait for any string starting with "Password" and ending with ":"
2018-01-04 16:13:51 +01:00
94f371fbc2
Module now uses pyobjc script instead of stand-alone binary for microphone capture.
2018-01-04 06:34:12 -06:00
8895e13a6c
Merge branch 'dev' into kerberoast-fix
...
Conflicts:
.circleci/config.yml
changelog
empire
lib/common/stagers.py
2018-01-02 15:42:08 -05:00
10e3370f26
Module Added: osx_mic_record ( resolves #865 )
...
Adds a module that records audio through the MacOS webcam mic. Audio is recorded using a custom binary that interacts directly with the Apple AVFoundation API (source: https://github.com/s0lst1c3/osx_mic_record ). Resolves #865 .
2017-12-31 15:55:46 -06:00
0ed51ae1c4
Removed print statements from screensaver_alleyoop module
2017-12-13 20:02:18 -05:00
049cc5e527
Update to fix error
...
Fixes `!] Exception: Stagers instance has no attribute 'installPath'` when running.
2017-12-07 14:22:22 -07:00
8ddeb63137
Merge pull request #844 from kost/fixemptybomutils
...
Fix empty bomutils folder
2017-12-03 01:21:34 -05:00
6ddba3f0ee
Fixed ls_m module generate function sig
2017-11-30 18:26:47 -08:00
99a9a4a6fa
Renamed osx ls module
2017-11-30 18:24:34 -08:00
5c69be36c1
Fixed ls_m module generate function sig
2017-11-30 06:09:26 -08:00
e39f8d423a
Renamed osx ls module
2017-11-30 06:05:14 -08:00
16e4467557
Added background shell exec
2017-11-29 19:06:55 -05:00
eea19fced5
Added native_screenshot_mss module
2017-11-29 14:52:32 -05:00
87ec0ff9aa
Added native_screenshot_mss module
2017-11-29 14:51:48 -05:00
3558acba42
Swapped native_screenshot module. Now uses python-mss and drops image to disk
2017-11-29 14:10:14 -05:00
d615e99352
Swapped native_screenshot module. Now uses python-mss and drops image to disk
2017-11-29 14:08:12 -05:00
edf040e690
Update get_sql_column_sample_data.py
...
When CheckAll is not true the script didn't assign the str variable scriptEnd prior to trying to add to it with +=.
2017-11-14 14:06:17 -05:00
c13ae0dee5
Updated powerview.ps1 and corresponding modules
2017-11-14 11:18:59 -05:00
a5bbc78b9c
Update Invoke-DCOM
2017-11-12 16:01:52 -05:00
6f239d4fc8
Added Kevin Robertson's Invoke-SMBExec.ps1
2017-11-12 15:45:40 -05:00
d1b968330d
Merge pull request #768 from mlinton/patch-4
...
Create Keys.py to extract private keys
2017-11-08 23:44:15 -05:00
8b6b9ef1c8
Fix flag - listener is required.
2017-11-08 10:44:15 -07:00
6d67f23119
Fix for #777
2017-10-28 11:11:34 -04:00
8c7310adb1
fix broken call to generate by invoke-obfuscation changes
2017-10-26 13:04:15 -07:00
95d8142b39
Remove debug message from xkeylogger module
2017-10-23 21:17:08 -04:00
d04fd95df1
Update keys.py
2017-10-22 19:20:15 -06:00
2c7d62593b
Updated obfuscate function arguments in all powershell modules
2017-10-20 23:16:19 -04:00
3920ef8e74
Create Keys.py to extract private keys
...
Copying the certificate functionality in mimi to also extract private keys.
2017-10-20 15:45:23 -06:00
fb8778a103
Merge branch 'dev' into ntsd
2017-10-20 01:46:45 -04:00
a645d461ef
changes to the invoke_ntsd module
2017-10-19 11:10:39 -04:00
xorrior