public override void Command(MenuItem menuItem, string UserInput) { WmicLauncherMenuItem wmicMenuItem = (WmicLauncherMenuItem)menuItem; wmicMenuItem.wmicLauncher = this.CovenantClient.ApiLaunchersWmicGet(); WmicLauncher launcher = wmicMenuItem.wmicLauncher; Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Id == wmicMenuItem.wmicLauncher.ListenerId); EliteConsoleMenu menu = new EliteConsoleMenu(EliteConsoleMenu.EliteConsoleMenuType.Parameter, "WmicLauncher"); menu.Rows.Add(new List <string> { "Name:", launcher.Name }); menu.Rows.Add(new List <string> { "Description:", launcher.Description }); menu.Rows.Add(new List <string> { "ListenerName:", listener == null ? "" : listener.Name }); menu.Rows.Add(new List <string> { "ScriptLanguage:", launcher.ScriptLanguage.ToString() }); menu.Rows.Add(new List <string> { "DotNetFramework:", launcher.DotNetFrameworkVersion.ToString() }); menu.Rows.Add(new List <string> { "Delay:", (launcher.Delay ?? default).ToString() });
public override void Refresh() { try { this.WmicLauncher = this.CovenantClient.ApiLaunchersWmicGet(); this.AdditionalOptions.FirstOrDefault(AO => AO.Name == "Set").Parameters .FirstOrDefault(P => P.Name == "Option").Values .FirstOrDefault(V => V.Value == "ListenerName") .NextValueSuggestions = this.CovenantClient.ApiListenersGet() .Where(L => L.Status == ListenerStatus.Active) .Select(L => L.Name) .ToList(); var filevalues = new MenuCommandParameterValuesFromFilePath(Common.EliteDataFolder); this.AdditionalOptions.FirstOrDefault(AO => AO.Name == "Write").Parameters .FirstOrDefault().Values = filevalues; this.SetupMenuAutoComplete(); } catch (HttpOperationException e) { EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content); } }
public override void Command(MenuItem menuItem, string UserInput) { try { string[] commands = UserInput.Split(" "); if (commands.Length != 2 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase)) { menuItem.PrintInvalidOptionError(UserInput); return; } menuItem.Refresh(); WmicLauncher launcher = ((WmicLauncherMenuItem)menuItem).WmicLauncher; if (launcher.LauncherString == "") { this.CovenantClient.ApiLaunchersBinaryPost(); menuItem.Refresh(); EliteConsole.PrintFormattedHighlightLine("Generated WmicLauncher: " + launcher.LauncherString); } string OutputFilePath = Common.EliteDataFolder + String.Concat(commands[1].Split(System.IO.Path.GetInvalidFileNameChars())); System.IO.File.WriteAllText(OutputFilePath, launcher.DiskCode); EliteConsole.PrintFormattedHighlightLine("Wrote WmicLauncher's xls to: \"" + OutputFilePath + "\""); } catch (HttpOperationException e) { EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content); } }
public ActionResult <WmicLauncher> PutWscriptLauncher([FromBody] WmicLauncher wmicLauncher) { WmicLauncher launcher = (WmicLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.Wmic); if (launcher == null || launcher.Id != wmicLauncher.Id) { return(NotFound()); } Listener listener = _context.Listeners.FirstOrDefault(L => L.Id == wmicLauncher.ListenerId); if (listener != null) { launcher.ListenerId = wmicLauncher.ListenerId; } launcher.Delay = wmicLauncher.Delay; launcher.Jitter = wmicLauncher.Jitter; launcher.ConnectAttempts = wmicLauncher.ConnectAttempts; launcher.ScriptLanguage = wmicLauncher.ScriptLanguage; launcher.DotNetFrameworkVersion = wmicLauncher.DotNetFrameworkVersion; launcher.LauncherString = wmicLauncher.LauncherString; launcher.DiskCode = wmicLauncher.DiskCode; launcher.StagerCode = wmicLauncher.StagerCode; _context.Launchers.Update(launcher); _context.SaveChanges(); return(Ok(launcher)); }
public ActionResult <WmicLauncher> GetWmicLauncher() { WmicLauncher launcher = (WmicLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.Wmic); if (launcher == null) { return(NotFound()); } return(Ok(launcher)); }
public override void Refresh() { this.wmicLauncher = this.CovenantClient.ApiLaunchersWmicGet(); this.AdditionalOptions.FirstOrDefault(AO => AO.Name.ToLower() == "set").Parameters .FirstOrDefault(P => P.Name.ToLower() == "option").Values .FirstOrDefault(V => V.Value.ToLower() == "listenername") .NextValueSuggestions = this.CovenantClient.ApiListenersGet() .Where(L => L.Status == ListenerStatus.Active) .Select(L => L.Name).ToList(); this.SetupMenuAutoComplete(); }
// GET: /launcher/wmicdownload public async Task <IActionResult> WmicDownload() { try { WmicLauncher wmicLauncher = await _context.GetWmicLauncher(); return(File(Common.CovenantEncoding.GetBytes(wmicLauncher.DiskCode), MediaTypeNames.Text.Plain, "GruntStager.xsl")); } catch (Exception e) when(e is ControllerNotFoundException || e is ControllerBadRequestException || e is ControllerUnauthorizedException) { ModelState.AddModelError(string.Empty, e.Message); return(RedirectToAction(nameof(Create), new { id = "Wmic" })); } }
public async Task <ActionResult <WmicLauncher> > EditWmicLauncher([FromBody] WmicLauncher launcher) { try { return(await _service.EditWmicLauncher(launcher)); } catch (ControllerNotFoundException e) { return(NotFound(e.Message)); } catch (ControllerBadRequestException e) { return(BadRequest(e.Message)); } }
public override void Command(MenuItem menuItem, string UserInput) { try { menuItem.Refresh(); WmicLauncher launcher = ((WmicLauncherMenuItem)menuItem).WmicLauncher; Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Id == launcher.ListenerId); EliteConsoleMenu menu = new EliteConsoleMenu(EliteConsoleMenu.EliteConsoleMenuType.Parameter, "WmicLauncher"); menu.Rows.Add(new List <string> { "Name:", launcher.Name }); menu.Rows.Add(new List <string> { "Description:", launcher.Description }); menu.Rows.Add(new List <string> { "ListenerName:", listener == null ? "" : listener.Name }); menu.Rows.Add(new List <string> { "CommType:", launcher.CommType.ToString() }); if (launcher.CommType == CommunicationType.HTTP) { menu.Rows.Add(new List <string> { " ValidateCert:", launcher.ValidateCert.ToString() }); menu.Rows.Add(new List <string> { " UseCertPinning:", launcher.UseCertPinning.ToString() }); } else if (launcher.CommType == CommunicationType.SMB) { menu.Rows.Add(new List <string> { " SMBPipeName:", launcher.SmbPipeName }); } menu.Rows.Add(new List <string> { "DotNetFramework:", launcher.DotNetFrameworkVersion == DotNetVersion.Net35 ? "v3.5" : "v4.0" }); menu.Rows.Add(new List <string> { "ScriptLanguage:", launcher.ScriptLanguage.ToString() }); menu.Rows.Add(new List <string> { "Delay:", (launcher.Delay ?? default).ToString() }); menu.Rows.Add(new List <string> { "JitterPercent:", (launcher.JitterPercent ?? default).ToString() });
public override void Command(MenuItem menuItem, string UserInput) { try { string[] commands = UserInput.Split(" "); if (commands.Length != 2 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase)) { menuItem.PrintInvalidOptionError(UserInput); return; } this.CovenantClient.ApiLaunchersMshtaPost(); WmicLauncher launcher = ((WmicLauncherMenuItem)menuItem).WmicLauncher; HttpListener listener = this.CovenantClient.ApiListenersHttpByIdGet(launcher.ListenerId ?? default); if (listener == null) { EliteConsole.PrintFormattedErrorLine("Can only host a file on a valid HttpListener."); menuItem.PrintInvalidOptionError(UserInput); return; } if (!commands[1].EndsWith(".xsl", StringComparison.Ordinal)) { EliteConsole.PrintFormattedErrorLine("WmicLaunchers must end with the extension: .xsl"); menuItem.PrintInvalidOptionError(UserInput); return; } HostedFile fileToHost = new HostedFile { ListenerId = listener.Id, Path = commands[1], Content = Convert.ToBase64String(Common.CovenantEncoding.GetBytes(launcher.DiskCode)) }; fileToHost = this.CovenantClient.ApiListenersByIdHostedfilesPost(listener.Id ?? default, fileToHost); launcher = this.CovenantClient.ApiLaunchersWmicHostedPost(fileToHost); Uri hostedLocation = new Uri(listener.Url + fileToHost.Path); EliteConsole.PrintFormattedHighlightLine("WmicLauncher hosted at: " + hostedLocation); EliteConsole.PrintFormattedInfoLine("Launcher (cmd.exe): " + launcher.LauncherString); EliteConsole.PrintFormattedInfoLine("Launcher (powershell.exe): " + launcher.LauncherString.Replace("\"", "`\"")); } catch (HttpOperationException e) { EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content); } }
public WmicLauncherMenuItem(CovenantAPI CovenantClient, EventPrinter EventPrinter) : base(CovenantClient, EventPrinter) { this.wmicLauncher = CovenantClient.ApiLaunchersWmicGet(); this.MenuTitle = wmicLauncher.Name; this.MenuDescription = wmicLauncher.Description; this.AdditionalOptions.Add(new MenuCommandWmicLauncherShow(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherGenerate(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherCode()); this.AdditionalOptions.Add(new MenuCommandWmicLauncherHost(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherWriteFile()); var setCommand = new MenuCommandWmicLauncherSet(CovenantClient); this.AdditionalOptions.Add(setCommand); this.AdditionalOptions.Add(new MenuCommandGenericUnset(setCommand.Parameters.FirstOrDefault(P => P.Name == "Option").Values)); this.Refresh(); }
// POST: /launcher/hostwmic public async Task <IActionResult> HostWmic(HostedFile file) { try { WmicLauncher launcher = await _context.GenerateWmicLauncher(); HttpListener listener = await _context.GetHttpListener(file.ListenerId); file = await _context.CreateHostedFile(listener.Id, file); launcher = await _context.GenerateWmicHostedLauncher(file); return(RedirectToAction(nameof(Create), new { id = launcher.Name })); } catch (Exception e) when(e is ControllerNotFoundException || e is ControllerBadRequestException || e is ControllerUnauthorizedException) { ModelState.AddModelError(string.Empty, e.Message); return(RedirectToAction(nameof(Create), new { id = "Wmic" })); } }
public override void Command(MenuItem menuItem, string UserInput) { try { string[] commands = UserInput.Split(" "); if (commands.Length < 1 || commands.Length > 2 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase)) { menuItem.PrintInvalidOptionError(UserInput); return; } if (commands.Length == 2 && (!new List <string> { "stager", "gruntstager", "scriptlet" }.Contains(commands[1].ToLower()))) { EliteConsole.PrintFormattedErrorLine("Type must be one of: \"Stager\"\\\"GruntStager\" or \"Scriptlet\""); menuItem.PrintInvalidOptionError(UserInput); return; } WmicLauncher launcher = ((WmicLauncherMenuItem)menuItem).WmicLauncher; menuItem.Refresh(); if (launcher.LauncherString == "") { this.CovenantClient.ApiLaunchersWmicPost(); menuItem.Refresh(); launcher = ((WmicLauncherMenuItem)menuItem).WmicLauncher; EliteConsole.PrintFormattedHighlightLine("Generated WmicLauncher: " + launcher.LauncherString); } if (commands.Length == 1 || (commands.Length == 2 && commands[1].Equals("gruntstager", StringComparison.OrdinalIgnoreCase))) { EliteConsole.PrintInfoLine(launcher.StagerCode); } else if (commands.Length == 2 && commands[1].Equals("scriptlet", StringComparison.OrdinalIgnoreCase)) { EliteConsole.PrintInfoLine(launcher.DiskCode); } } catch (HttpOperationException e) { EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content); } }
public WmicLauncherMenuItem(CovenantAPI CovenantClient) : base(CovenantClient) { try { this.WmicLauncher = CovenantClient.ApiLaunchersWmicGet(); this.MenuTitle = WmicLauncher.Name; this.MenuDescription = WmicLauncher.Description; this.AdditionalOptions.Add(new MenuCommandWmicLauncherShow(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherGenerate(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherCode(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherHost(CovenantClient)); this.AdditionalOptions.Add(new MenuCommandWmicLauncherWriteFile(CovenantClient)); var setCommand = new MenuCommandWmicLauncherSet(CovenantClient); this.AdditionalOptions.Add(setCommand); this.AdditionalOptions.Add(new MenuCommandGenericUnset(setCommand.Parameters.FirstOrDefault(P => P.Name == "Option").Values)); } catch (HttpOperationException e) { EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content); } }
public async Task <IActionResult> Wmic(WmicLauncher launcher) { try { launcher = await _context.EditWmicLauncher(launcher); launcher = await _context.GenerateWmicLauncher(); ViewBag.Launcher = launcher; ViewBag.Listeners = await _context.GetListeners(); return(RedirectToAction(nameof(Create), new { id = launcher.Name })); } catch (Exception e) when(e is ControllerNotFoundException || e is ControllerBadRequestException || e is ControllerUnauthorizedException) { ModelState.AddModelError(string.Empty, e.Message); ViewBag.Launcher = launcher; ViewBag.Listeners = await _context.GetListeners(); return(RedirectToAction(nameof(Create), new { id = launcher.Name })); } }
public ActionResult <WmicLauncher> GenerateWmicHostedFileLauncher(HostedFile hostedFile) { WmicLauncher launcher = (WmicLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.Wmic); if (launcher == null) { return(NotFound()); } Listener listener = _context.Listeners.FirstOrDefault(S => S.Id == hostedFile.ListenerId); HostedFile savedHostedFile = _context.HostedFiles.FirstOrDefault(HF => HF.Id == hostedFile.Id); if (listener == null || savedHostedFile == null) { return(NotFound()); } string hostedLauncher = launcher.GetHostedLauncher(listener, savedHostedFile); _context.Launchers.Update(launcher); _context.SaveChanges(); return(Ok(launcher)); }
public ActionResult <WmicLauncher> GenerateWmicLauncher() { WmicLauncher launcher = (WmicLauncher)_context.Launchers.FirstOrDefault(S => S.Type == Launcher.LauncherType.Wmic); if (launcher == null) { return(NotFound()); } Listener listener = _context.Listeners.FirstOrDefault(S => S.Id == launcher.ListenerId); if (listener == null) { return(NotFound()); } HttpProfile profile = (HttpProfile)_context.Profiles.FirstOrDefault(P => P.Id == listener.ProfileId); if (profile == null) { return(NotFound()); } Grunt grunt = new Grunt { ListenerId = listener.Id, CovenantIPAddress = listener.BindAddress, Delay = launcher.Delay, Jitter = launcher.Jitter, ConnectAttempts = launcher.ConnectAttempts }; _context.Grunts.Add(grunt); _context.SaveChanges(); launcher.GetLauncher(listener, grunt, profile); _context.Launchers.Update(launcher); _context.SaveChanges(); return(Ok(launcher)); }
public Task <WmicLauncher> EditWmicLauncher(WmicLauncher launcher) { return(_connection.InvokeAsync <WmicLauncher>("EditWmicLauncher", launcher)); }
public override void Command(MenuItem menuItem, string UserInput) { WmicLauncher wmicLauncher = ((WmicLauncherMenuItem)menuItem).wmicLauncher; string[] commands = UserInput.Split(" "); if (commands.Length < 3 || commands[0].ToLower() != "set") { menuItem.PrintInvalidOptionError(UserInput); return; } else if (this.Parameters.FirstOrDefault(P => P.Name == "Option").Values.Select(V => V.Value.ToLower()).Contains(commands[1].ToLower())) { if (commands[1].ToLower() == "listenername") { Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Name == commands[2]); if (listener == null || listener.Name != commands[2]) { EliteConsole.PrintFormattedErrorLine("Invalid ListenerName: \"" + commands[2] + "\""); menuItem.PrintInvalidOptionError(UserInput); return; } else { wmicLauncher.ListenerId = listener.Id; } } else if (commands[1].ToLower() == "scriptlanguage") { if (commands[2].ToLower().StartsWith("js")) { wmicLauncher.ScriptLanguage = ScriptingLanguage.JScript; } else if (commands[2].ToLower().StartsWith("vb")) { wmicLauncher.ScriptLanguage = ScriptingLanguage.VBScript; } else { EliteConsole.PrintFormattedErrorLine("Invalid ScriptLanguage \"" + commands[2] + "\". Valid options are: JScript, VBScript"); menuItem.PrintInvalidOptionError(UserInput); return; } } else if (commands[1].ToLower() == "dotnetframeworkversion") { if (commands[2].ToLower().Contains("35") || commands[2].ToLower().Contains("3.5")) { wmicLauncher.DotNetFrameworkVersion = DotNetVersion.Net35; } else if (commands[2].ToLower().Contains("40") || commands[2].ToLower().Contains("4.0")) { wmicLauncher.DotNetFrameworkVersion = DotNetVersion.Net40; } else { EliteConsole.PrintFormattedErrorLine("Invalid DotNetFrameworkVersion \"" + commands[2] + "\". Valid options are: v3.5, v4.0"); menuItem.PrintInvalidOptionError(UserInput); return; } } else if (commands[1].ToLower() == "delay") { int.TryParse(commands[2], out int n); wmicLauncher.Delay = n; } else if (commands[1].ToLower() == "jitter") { int.TryParse(commands[2], out int n); wmicLauncher.Jitter = n; } else if (commands[1].ToLower() == "connectattempts") { int.TryParse(commands[2], out int n); wmicLauncher.ConnectAttempts = n; } else if (commands[1].ToLower() == "launcherstring") { wmicLauncher.LauncherString = commands[2]; } this.CovenantClient.ApiLaunchersWmicPut(wmicLauncher); } else { menuItem.PrintInvalidOptionError(UserInput); } }
public override async void Command(MenuItem menuItem, string UserInput) { try { List <string> commands = Utilities.ParseParameters(UserInput); if (commands.Count() != 3 || !commands[0].Equals(this.Name, StringComparison.OrdinalIgnoreCase)) { menuItem.PrintInvalidOptionError(UserInput); return; } WmicLauncher launcher = ((WmicLauncherMenuItem)menuItem).WmicLauncher; if (this.Parameters.FirstOrDefault(P => P.Name == "Option").Values.Select(V => V.Value).Contains(commands[1], StringComparer.OrdinalIgnoreCase)) { if (commands[1].Equals("listenername", StringComparison.OrdinalIgnoreCase)) { Listener listener = this.CovenantClient.ApiListenersGet().FirstOrDefault(L => L.Name == commands[2]); if (listener == null || listener.Name != commands[2]) { EliteConsole.PrintFormattedErrorLine("Invalid ListenerName: \"" + commands[2] + "\""); menuItem.PrintInvalidOptionError(UserInput); return; } launcher.ListenerId = listener.Id; } else if (commands[1].Equals("dotnetframeworkversion", StringComparison.OrdinalIgnoreCase)) { if (commands[2].Contains("35", StringComparison.OrdinalIgnoreCase) || commands[2].Contains("3.5", StringComparison.OrdinalIgnoreCase)) { launcher.DotNetFrameworkVersion = DotNetVersion.Net35; } else if (commands[2].Contains("40", StringComparison.OrdinalIgnoreCase) || commands[2].Contains("4.0", StringComparison.OrdinalIgnoreCase)) { launcher.DotNetFrameworkVersion = DotNetVersion.Net40; } else { EliteConsole.PrintFormattedErrorLine("Invalid DotNetFrameworkVersion \"" + commands[2] + "\". Valid options are: v3.5, v4.0"); menuItem.PrintInvalidOptionError(UserInput); return; } } else if (commands[1].Equals("scriptlanguage", StringComparison.OrdinalIgnoreCase)) { if (commands[2].StartsWith("js", StringComparison.OrdinalIgnoreCase)) { launcher.ScriptLanguage = ScriptingLanguage.JScript; } else if (commands[2].StartsWith("vb", StringComparison.OrdinalIgnoreCase)) { launcher.ScriptLanguage = ScriptingLanguage.VBScript; } else { EliteConsole.PrintFormattedErrorLine("Invalid ScriptLanguage \"" + commands[2] + "\". Valid options are: JScript, VBScript"); menuItem.PrintInvalidOptionError(UserInput); return; } } else if (commands[1].Equals("commtype", StringComparison.OrdinalIgnoreCase)) { if (commands[2].Equals("smb", StringComparison.OrdinalIgnoreCase)) { launcher.CommType = CommunicationType.SMB; } else { launcher.CommType = CommunicationType.HTTP; } } else if (commands[1].Equals("validatecert", StringComparison.OrdinalIgnoreCase)) { bool parsed = bool.TryParse(commands[2], out bool validate); if (parsed) { launcher.ValidateCert = validate; } else { menuItem.PrintInvalidOptionError(UserInput); return; } } else if (commands[1].Equals("usecertpinning", StringComparison.OrdinalIgnoreCase)) { bool parsed = bool.TryParse(commands[2], out bool pin); if (parsed) { launcher.UseCertPinning = pin; } else { menuItem.PrintInvalidOptionError(UserInput); return; } } else if (commands[1].Equals("smbpipename", StringComparison.OrdinalIgnoreCase)) { launcher.SmbPipeName = commands[2]; } else if (commands[1].Equals("delay", StringComparison.OrdinalIgnoreCase)) { int.TryParse(commands[2], out int n); launcher.Delay = n; } else if (commands[1].Equals("jitterpercent", StringComparison.OrdinalIgnoreCase)) { int.TryParse(commands[2], out int n); launcher.JitterPercent = n; } else if (commands[1].Equals("connectattempts", StringComparison.OrdinalIgnoreCase)) { int.TryParse(commands[2], out int n); launcher.ConnectAttempts = n; } else if (commands[1].Equals("killdate", StringComparison.OrdinalIgnoreCase)) { DateTime.TryParse(commands[2], out DateTime result); launcher.KillDate = result; } else if (commands[1].Equals("launcherstring", StringComparison.OrdinalIgnoreCase)) { launcher.LauncherString = commands[2]; } await this.CovenantClient.ApiLaunchersWmicPutAsync(launcher); } else { menuItem.PrintInvalidOptionError(UserInput); } } catch (HttpOperationException e) { EliteConsole.PrintFormattedWarningLine("CovenantException: " + e.Response.Content); } }