public ActionResult <MSBuildLauncher> PutMSBuildLauncher([FromBody] MSBuildLauncher msbuildLauncher)
{
MSBuildLauncher launcher = (MSBuildLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.MSBuild);
if (launcher == null || launcher.Id != msbuildLauncher.Id)
{
return(NotFound());
}
Listener listener = _context.Listeners.FirstOrDefault(L => L.Id == msbuildLauncher.ListenerId);
if (listener != null)
{
launcher.ListenerId = msbuildLauncher.ListenerId;
}
launcher.Delay = msbuildLauncher.Delay;
launcher.Jitter = msbuildLauncher.Jitter;
launcher.ConnectAttempts = msbuildLauncher.ConnectAttempts;
launcher.DotNetFrameworkVersion = msbuildLauncher.DotNetFrameworkVersion;
launcher.LauncherString = msbuildLauncher.LauncherString;
launcher.DiskCode = msbuildLauncher.DiskCode;
launcher.StagerCode = msbuildLauncher.StagerCode;
launcher.TargetName = msbuildLauncher.TargetName;
launcher.TaskName = msbuildLauncher.TaskName;
_context.Launchers.Update(launcher);
_context.SaveChanges();
return(Ok(launcher));
}
public override void Command(MenuItem menuItem, string UserInput)
{
MSBuildLauncherMenuItem msbuildMenuItem = (MSBuildLauncherMenuItem)menuItem;
msbuildMenuItem.msbuildLauncher = this.CovenantClient.ApiLaunchersMsbuildGet();
MSBuildLauncher launcher = msbuildMenuItem.msbuildLauncher;
Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Id == msbuildMenuItem.msbuildLauncher.ListenerId);
EliteConsoleMenu menu = new EliteConsoleMenu(EliteConsoleMenu.EliteConsoleMenuType.Parameter, "MSBuildLauncher");
menu.Rows.Add(new List <string> {
"Name:", launcher.Name
});
menu.Rows.Add(new List <string> {
"Description:", launcher.Description
});
menu.Rows.Add(new List <string> {
"ListenerName:", listener == null ? "" : listener.Name
});
menu.Rows.Add(new List <string> {
"TargetName:", launcher.TargetName
});
menu.Rows.Add(new List <string> {
"TaskName:", launcher.TaskName
});
menu.Rows.Add(new List <string> {
"DotNetFramework:", launcher.DotNetFrameworkVersion.ToString()
});
menu.Rows.Add(new List <string> {
"Delay:", (launcher.Delay ?? default).ToString()
});
public override void Command(MenuItem menuItem, string UserInput)
{
try
{
string[] commands = UserInput.Split(" ");
if (commands.Length != 2 || commands[0].ToLower() != "write")
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
menuItem.Refresh();
MSBuildLauncher launcher = ((MSBuildLauncherMenuItem)menuItem).MSBuildLauncher;
if (launcher.LauncherString == "")
{
this.CovenantClient.ApiLaunchersBinaryPost();
menuItem.Refresh();
EliteConsole.PrintFormattedHighlightLine("Generated MSBuildLauncher: " + launcher.LauncherString);
}
string OutputFilePath = Common.EliteDataFolder + String.Concat(commands[1].Split(System.IO.Path.GetInvalidFileNameChars()));
System.IO.File.WriteAllText(OutputFilePath, launcher.DiskCode);
EliteConsole.PrintFormattedHighlightLine("Wrote MSBuildLauncher to: \"" + OutputFilePath + "\"");
}
catch (HttpOperationException e)
{
EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content);
}
}
public override void Refresh()
{
try
{
this.MSBuildLauncher = this.CovenantClient.ApiLaunchersMsbuildGet();
this.AdditionalOptions.FirstOrDefault(AO => AO.Name == "Set").Parameters
.FirstOrDefault(P => P.Name == "Option").Values
.FirstOrDefault(V => V.Value == "ListenerName")
.NextValueSuggestions = this.CovenantClient.ApiListenersGet()
.Where(L => L.Status == ListenerStatus.Active)
.Select(L => L.Name)
.ToList();
var filevalues = new MenuCommandParameterValuesFromFilePath(Common.EliteDataFolder);
this.AdditionalOptions.FirstOrDefault(AO => AO.Name == "Write").Parameters
.FirstOrDefault().Values = filevalues;
this.SetupMenuAutoComplete();
}
catch (HttpOperationException e)
{
EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content);
}
}
public ActionResult <MSBuildLauncher> GetMSBuildLauncher()
{
MSBuildLauncher launcher = (MSBuildLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.MSBuild);
if (launcher == null)
{
return(NotFound());
}
return(Ok(launcher));
}
public override void Refresh()
{
this.msbuildLauncher = this.CovenantClient.ApiLaunchersMsbuildGet();
this.AdditionalOptions.FirstOrDefault(AO => AO.Name.ToLower() == "set").Parameters
.FirstOrDefault(P => P.Name.ToLower() == "option").Values
.FirstOrDefault(V => V.Value.ToLower() == "listenername")
.NextValueSuggestions = this.CovenantClient.ApiListenersGet()
.Where(L => L.Status == ListenerStatus.Active)
.Select(L => L.Name).ToList();
this.SetupMenuAutoComplete();
}
public override void Command(MenuItem menuItem, string UserInput)
{
try
{
menuItem.Refresh();
MSBuildLauncher launcher = ((MSBuildLauncherMenuItem)menuItem).MSBuildLauncher;
Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Id == launcher.ListenerId);
EliteConsoleMenu menu = new EliteConsoleMenu(EliteConsoleMenu.EliteConsoleMenuType.Parameter, "MSBuildLauncher");
menu.Rows.Add(new List <string> {
"Name:", launcher.Name
});
menu.Rows.Add(new List <string> {
"Description:", launcher.Description
});
menu.Rows.Add(new List <string> {
"ListenerName:", listener == null ? "" : listener.Name
});
menu.Rows.Add(new List <string> {
"CommType:", launcher.CommType.ToString()
});
if (launcher.CommType == CommunicationType.HTTP)
{
menu.Rows.Add(new List <string> {
" ValidateCert:", launcher.ValidateCert.ToString()
});
menu.Rows.Add(new List <string> {
" UseCertPinning:", launcher.UseCertPinning.ToString()
});
}
else if (launcher.CommType == CommunicationType.SMB)
{
menu.Rows.Add(new List <string> {
" SMBPipeName:", launcher.SmbPipeName
});
}
menu.Rows.Add(new List <string> {
"DotNetFramework:", launcher.DotNetFrameworkVersion == DotNetVersion.Net35 ? "v3.5" : "v4.0"
});
menu.Rows.Add(new List <string> {
"TargetName:", launcher.TargetName
});
menu.Rows.Add(new List <string> {
"TaskName:", launcher.TaskName
});
menu.Rows.Add(new List <string> {
"Delay:", (launcher.Delay ?? default).ToString()
});
menu.Rows.Add(new List <string> {
"JitterPercent:", (launcher.JitterPercent ?? default).ToString()
});
// GET: /launcher/msbuilddownload
public async Task <IActionResult> MSBuildDownload()
{
try
{
MSBuildLauncher msbuildLauncher = await _context.GetMSBuildLauncher();
return(File(Common.CovenantEncoding.GetBytes(msbuildLauncher.DiskCode), MediaTypeNames.Text.Xml, "GruntStager.xml"));
}
catch (Exception e) when(e is ControllerNotFoundException || e is ControllerBadRequestException || e is ControllerUnauthorizedException)
{
ModelState.AddModelError(string.Empty, e.Message);
return(RedirectToAction(nameof(Create), new { id = "MSBuild" }));
}
}
public async Task <ActionResult <MSBuildLauncher> > EditMSBuildLauncher([FromBody] MSBuildLauncher launcher)
{
try
{
return(await _service.EditMSBuildLauncher(launcher));
}
catch (ControllerNotFoundException e)
{
return(NotFound(e.Message));
}
catch (ControllerBadRequestException e)
{
return(BadRequest(e.Message));
}
}
public MSBuildLauncherMenuItem(CovenantAPI CovenantClient, EventPrinter EventPrinter) : base(CovenantClient, EventPrinter)
{
this.msbuildLauncher = CovenantClient.ApiLaunchersMsbuildGet();
this.MenuTitle = msbuildLauncher.Name;
this.MenuDescription = msbuildLauncher.Description;
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherShow(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherGenerate(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherCode());
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherHost(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherWriteFile());
var setCommand = new MenuCommandMSBuildLauncherSet(CovenantClient);
this.AdditionalOptions.Add(setCommand);
this.AdditionalOptions.Add(new MenuCommandGenericUnset(setCommand.Parameters.FirstOrDefault(P => P.Name == "Option").Values));
this.Refresh();
}
// POST: /launcher/hostmsbuild
public async Task <IActionResult> HostMSBuild(HostedFile file)
{
try
{
MSBuildLauncher launcher = await _context.GenerateMSBuildLauncher();
HttpListener listener = await _context.GetHttpListener(file.ListenerId);
file = await _context.CreateHostedFile(listener.Id, file);
launcher = await _context.GenerateMSBuildHostedLauncher(file);
return(RedirectToAction(nameof(Create), new { id = launcher.Name }));
}
catch (Exception e) when(e is ControllerNotFoundException || e is ControllerBadRequestException || e is ControllerUnauthorizedException)
{
ModelState.AddModelError(string.Empty, e.Message);
return(RedirectToAction(nameof(Create), new { id = "MSBuild" }));
}
}
public override void Command(MenuItem menuItem, string UserInput)
{
try
{
string[] commands = UserInput.Split(" ");
if (commands.Length != 2 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase))
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
this.CovenantClient.ApiLaunchersMsbuildPost();
menuItem.Refresh();
MSBuildLauncher launcher = ((MSBuildLauncherMenuItem)menuItem).MSBuildLauncher;
HttpListener listener = this.CovenantClient.ApiListenersHttpByIdGet(launcher.ListenerId ?? default);
if (listener == null)
{
EliteConsole.PrintFormattedErrorLine("Can only host a file on a valid HttpListener.");
menuItem.PrintInvalidOptionError(UserInput);
return;
}
HostedFile fileToHost = new HostedFile
{
ListenerId = listener.Id,
Path = commands[1],
Content = Convert.ToBase64String(Common.CovenantEncoding.GetBytes(launcher.DiskCode))
};
fileToHost = this.CovenantClient.ApiListenersByIdHostedfilesPost(listener.Id ?? default, fileToHost);
launcher = this.CovenantClient.ApiLaunchersMsbuildHostedPost(fileToHost);
Uri hostedLocation = new Uri(listener.Url + fileToHost.Path);
EliteConsole.PrintFormattedHighlightLine("MSBuildLauncher hosted at: " + hostedLocation);
EliteConsole.PrintFormattedWarningLine("msbuild.exe cannot execute remotely hosted files, the payload must first be written to disk");
EliteConsole.PrintFormattedInfoLine("Launcher: " + launcher.LauncherString);
}
catch (HttpOperationException e)
{
EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content);
}
}
public override void Command(MenuItem menuItem, string UserInput)
{
try
{
string[] commands = UserInput.Split(" ");
if (commands.Length < 1 || commands.Length > 2 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase))
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
if (commands.Length == 2 && (!new List <string> {
"gruntstager", "xml"
}.Contains(commands[1], StringComparer.OrdinalIgnoreCase)))
{
EliteConsole.PrintFormattedErrorLine("Type must be one of: \"GruntStager\" or \"XML\"");
menuItem.PrintInvalidOptionError(UserInput);
return;
}
MSBuildLauncher launcher = ((MSBuildLauncherMenuItem)menuItem).MSBuildLauncher;
if (launcher.LauncherString == "")
{
this.CovenantClient.ApiLaunchersMsbuildPost();
menuItem.Refresh();
launcher = ((MSBuildLauncherMenuItem)menuItem).MSBuildLauncher;
EliteConsole.PrintFormattedHighlightLine("Generated MSBuildLauncher: " + launcher.LauncherString);
}
if (commands.Length == 1 || (commands.Length == 2 && commands[1].Equals("gruntstager", StringComparison.OrdinalIgnoreCase)))
{
EliteConsole.PrintInfoLine(launcher.StagerCode);
}
else if (commands.Length == 2 && commands[1].Equals("xml", StringComparison.OrdinalIgnoreCase))
{
EliteConsole.PrintInfoLine(launcher.DiskCode);
}
}
catch (HttpOperationException e)
{
EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content);
}
}
public MSBuildLauncherMenuItem(CovenantAPI CovenantClient) : base(CovenantClient)
{
try
{
this.MSBuildLauncher = CovenantClient.ApiLaunchersMsbuildGet();
this.MenuTitle = MSBuildLauncher.Name;
this.MenuDescription = MSBuildLauncher.Description;
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherShow(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherGenerate(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherCode(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherHost(CovenantClient));
this.AdditionalOptions.Add(new MenuCommandMSBuildLauncherWriteFile(CovenantClient));
var setCommand = new MenuCommandMSBuildLauncherSet(CovenantClient);
this.AdditionalOptions.Add(setCommand);
this.AdditionalOptions.Add(new MenuCommandGenericUnset(setCommand.Parameters.FirstOrDefault(P => P.Name == "Option").Values));
}
catch (HttpOperationException e)
{
EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content);
}
}
public ActionResult <MSBuildLauncher> GenerateMSBuildHostedFileLauncher(HostedFile hostedFile)
{
MSBuildLauncher launcher = (MSBuildLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.MSBuild);
if (launcher == null)
{
return(NotFound());
}
Listener listener = _context.Listeners.FirstOrDefault(S => S.Id == hostedFile.ListenerId);
HostedFile savedHostedFile = _context.HostedFiles.FirstOrDefault(HF => HF.Id == hostedFile.Id);
if (listener == null || savedHostedFile == null)
{
return(NotFound());
}
string hostedLauncher = launcher.GetHostedLauncher(listener, savedHostedFile);
_context.Launchers.Update(launcher);
_context.SaveChanges();
return(Ok(launcher));
}
public async Task <IActionResult> MSBuild(MSBuildLauncher launcher)
{
try
{
launcher = await _context.EditMSBuildLauncher(launcher);
launcher = await _context.GenerateMSBuildLauncher();
ViewBag.Launcher = launcher;
ViewBag.Listeners = await _context.GetListeners();
return(RedirectToAction(nameof(Create), new { id = launcher.Name }));
}
catch (Exception e) when(e is ControllerNotFoundException || e is ControllerBadRequestException || e is ControllerUnauthorizedException)
{
ModelState.AddModelError(string.Empty, e.Message);
ViewBag.Launcher = launcher;
ViewBag.Listeners = await _context.GetListeners();
return(RedirectToAction(nameof(Create), new { id = launcher.Name }));
}
}
public ActionResult <MSBuildLauncher> GenerateMSBuildLauncher()
{
MSBuildLauncher launcher = (MSBuildLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.MSBuild);
if (launcher == null)
{
return(NotFound());
}
Listener listener = _context.Listeners.FirstOrDefault(S => S.Id == launcher.ListenerId);
if (listener == null)
{
return(NotFound());
}
HttpProfile profile = (HttpProfile)_context.Profiles.FirstOrDefault(P => P.Id == listener.ProfileId);
if (profile == null)
{
return(NotFound());
}
Grunt grunt = new Grunt
{
ListenerId = listener.Id,
CovenantIPAddress = listener.BindAddress,
Delay = launcher.Delay,
Jitter = launcher.Jitter,
ConnectAttempts = launcher.ConnectAttempts
};
_context.Grunts.Add(grunt);
_context.SaveChanges();
launcher.GetLauncher(listener, grunt, profile);
_context.Launchers.Update(launcher);
_context.SaveChanges();
return(Ok(launcher));
}
public override void Command(MenuItem menuItem, string UserInput)
{
MSBuildLauncher msbuildLauncher = ((MSBuildLauncherMenuItem)menuItem).msbuildLauncher;
string[] commands = UserInput.Split(" ");
if (commands.Length < 3 || commands[0].ToLower() != "set")
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
else if (this.Parameters.FirstOrDefault(P => P.Name == "Option").Values.Select(V => V.Value.ToLower()).Contains(commands[1].ToLower()))
{
if (commands[1].ToLower() == "listenername")
{
Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Name == commands[2]);
if (listener == null || listener.Name != commands[2])
{
EliteConsole.PrintFormattedErrorLine("Invalid ListenerName: \"" + commands[2] + "\"");
menuItem.PrintInvalidOptionError(UserInput);
return;
}
else
{
msbuildLauncher.ListenerId = listener.Id;
}
}
else if (commands[1].ToLower() == "targetname")
{
msbuildLauncher.TargetName = commands[2];
}
else if (commands[1].ToLower() == "taskname")
{
msbuildLauncher.TaskName = commands[2];
}
else if (commands[1].ToLower() == "dotnetframeworkversion")
{
if (commands[2].ToLower().Contains("35") || commands[2].ToLower().Contains("3.5"))
{
msbuildLauncher.DotNetFrameworkVersion = DotNetVersion.Net35;
}
else if (commands[2].ToLower().Contains("40") || commands[2].ToLower().Contains("4.0"))
{
msbuildLauncher.DotNetFrameworkVersion = DotNetVersion.Net40;
}
else
{
EliteConsole.PrintFormattedErrorLine("Invalid DotNetFrameworkVersion \"" + commands[2] + "\". Valid options are: v3.5, v4.0");
menuItem.PrintInvalidOptionError(UserInput);
return;
}
}
else if (commands[1].ToLower() == "delay")
{
int.TryParse(commands[2], out int n);
msbuildLauncher.Delay = n;
}
else if (commands[1].ToLower() == "jitter")
{
int.TryParse(commands[2], out int n);
msbuildLauncher.Jitter = n;
}
else if (commands[1].ToLower() == "connectattempts")
{
int.TryParse(commands[2], out int n);
msbuildLauncher.ConnectAttempts = n;
}
else if (commands[1].ToLower() == "launcherstring")
{
msbuildLauncher.LauncherString = commands[2];
}
CovenantAPIExtensions.ApiLaunchersMsbuildPut(this.CovenantClient, msbuildLauncher);
}
else
{
menuItem.PrintInvalidOptionError(UserInput);
}
}
public override async void Command(MenuItem menuItem, string UserInput)
{
try
{
List <string> commands = Utilities.ParseParameters(UserInput);
if (commands.Count() != 3 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase))
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
MSBuildLauncher launcher = ((MSBuildLauncherMenuItem)menuItem).MSBuildLauncher;
if (this.Parameters.FirstOrDefault(P => P.Name == "Option").Values.Select(V => V.Value).Contains(commands[1], StringComparer.OrdinalIgnoreCase))
{
if (commands[1].Equals("listenername", StringComparison.OrdinalIgnoreCase))
{
Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Name == commands[2]);
if (listener == null || listener.Name != commands[2])
{
EliteConsole.PrintFormattedErrorLine("Invalid ListenerName: \"" + commands[2] + "\"");
menuItem.PrintInvalidOptionError(UserInput);
return;
}
launcher.ListenerId = listener.Id;
}
else if (commands[1].Equals("dotnetframeworkversion", StringComparison.OrdinalIgnoreCase))
{
if (commands[2].Contains("35", StringComparison.OrdinalIgnoreCase) || commands[2].Contains("3.5", StringComparison.OrdinalIgnoreCase))
{
launcher.DotNetFrameworkVersion = DotNetVersion.Net35;
}
else if (commands[2].Contains("40", StringComparison.OrdinalIgnoreCase) || commands[2].Contains("4.0", StringComparison.OrdinalIgnoreCase))
{
launcher.DotNetFrameworkVersion = DotNetVersion.Net40;
}
else
{
EliteConsole.PrintFormattedErrorLine("Invalid DotNetFrameworkVersion \"" + commands[2] + "\". Valid options are: v3.5, v4.0");
menuItem.PrintInvalidOptionError(UserInput);
return;
}
}
else if (commands[1].Equals("targetname", StringComparison.OrdinalIgnoreCase))
{
launcher.TargetName = commands[2];
}
else if (commands[1].Equals("taskname", StringComparison.OrdinalIgnoreCase))
{
launcher.TaskName = commands[2];
}
else if (commands[1].Equals("commtype", StringComparison.OrdinalIgnoreCase))
{
if (commands[2].Equals("smb", StringComparison.OrdinalIgnoreCase))
{
launcher.CommType = CommunicationType.SMB;
}
else
{
launcher.CommType = CommunicationType.HTTP;
}
}
else if (commands[1].Equals("validatecert", StringComparison.OrdinalIgnoreCase))
{
bool parsed = bool.TryParse(commands[2], out bool validate);
if (parsed)
{
launcher.ValidateCert = validate;
}
else
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
}
else if (commands[1].Equals("usecertpinning", StringComparison.OrdinalIgnoreCase))
{
bool parsed = bool.TryParse(commands[2], out bool pin);
if (parsed)
{
launcher.UseCertPinning = pin;
}
else
{
menuItem.PrintInvalidOptionError(UserInput);
return;
}
}
else if (commands[1].Equals("smbpipename", StringComparison.OrdinalIgnoreCase))
{
launcher.SmbPipeName = commands[2];
}
else if (commands[1].Equals("delay", StringComparison.OrdinalIgnoreCase))
{
int.TryParse(commands[2], out int n);
launcher.Delay = n;
}
else if (commands[1].Equals("jitterpercent", StringComparison.OrdinalIgnoreCase))
{
int.TryParse(commands[2], out int n);
launcher.JitterPercent = n;
}
else if (commands[1].Equals("connectattempts", StringComparison.OrdinalIgnoreCase))
{
int.TryParse(commands[2], out int n);
launcher.ConnectAttempts = n;
}
else if (commands[1].Equals("killdate", StringComparison.OrdinalIgnoreCase))
{
DateTime.TryParse(commands[2], out DateTime result);
launcher.KillDate = result;
}
else if (commands[1].Equals("launcherstring", StringComparison.OrdinalIgnoreCase))
{
launcher.LauncherString = commands[2];
}
await this.CovenantClient.ApiLaunchersMsbuildPutAsync(launcher);
}
else
{
menuItem.PrintInvalidOptionError(UserInput);
}
}
catch (HttpOperationException e)
{
EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content);
}
}
public Task <MSBuildLauncher> EditMSBuildLauncher(MSBuildLauncher launcher)
{
return(_connection.InvokeAsync <MSBuildLauncher>("EditMSBuildLauncher", launcher));
}
