Merge pull request #120 from PowerShellEmpire/dev

Dev

lib/common/agents.py

@@ -123,14 +123,14 @@ def add_agent(self, sessionID, externalIP, delay, jitter, profile, killDate, wor
         if len(parts) == 2:
             requestUris = parts[0]
             userAgent = parts[1]
-        elif len(parts) == 3:
+        elif len(parts) > 2:
             requestUris = parts[0]
             userAgent = parts[1]
-            additionalHeaders = parts[2]
+            additionalHeaders = "|".join(parts[2:])
 
         cur.execute("INSERT INTO agents (name,session_id,delay,jitter,external_ip,session_key,checkin_time,lastseen_time,uris,user_agent,headers,kill_date,working_hours,lost_limit) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (sessionID,sessionID,delay,jitter,externalIP,sessionKey,checkinTime,lastSeenTime,requestUris,userAgent,additionalHeaders,killDate,workingHours,lostLimit))
         cur.close()
-
+        
         # initialize the tasking/result buffers along with the client session key
         sessionKey = self.get_agent_session_key(sessionID)
         self.agents[sessionID] = [sessionKey, [],[],[], requestUris, ""]

lib/common/empire.py

@@ -9,7 +9,7 @@
 """
 
 # make version for Empire
-VERSION = "1.3.9"
+VERSION = "1.3.10"
 
 
 from pydispatch import dispatcher
@@ -475,18 +475,24 @@ def do_set(self, line):
         else:
             if parts[0].lower() == "ip_whitelist":
                 if parts[1] != "" and os.path.exists(parts[1]):
-                    f = open(parts[1], 'r')
-                    ipData = f.read()
-                    f.close()
-                    self.agents.ipWhiteList = helpers.generate_ip_list(ipData)
+                    try:
+                        f = open(parts[1], 'r')
+                        ipData = f.read()
+                        f.close()
+                        self.agents.ipWhiteList = helpers.generate_ip_list(ipData)
+                    except:
+                        print helpers.color("[!] Error opening ip file %s" %(parts[1]))
                 else:
                     self.agents.ipWhiteList = helpers.generate_ip_list(",".join(parts[1:]))
             elif parts[0].lower() == "ip_blacklist":
                 if parts[1] != "" and os.path.exists(parts[1]):
-                    f = open(parts[1], 'r')
-                    ipData = f.read()
-                    f.close()
-                    self.agents.ipBlackList = helpers.generate_ip_list(ipData)
+                    try:
+                        f = open(parts[1], 'r')
+                        ipData = f.read()
+                        f.close()
+                        self.agents.ipBlackList = helpers.generate_ip_list(ipData)
+                    except:
+                        print helpers.color("[!] Error opening ip file %s" %(parts[1]))
                 else:
                     self.agents.ipBlackList = helpers.generate_ip_list(",".join(parts[1:]))
             else:
@@ -1614,6 +1620,7 @@ def do_updateprofile(self, line):
                 # strip out profile comments and blank lines
                 profile = [l for l in profile if (not l.startswith("#") and l.strip() != "")]
                 profile = profile[0]
+
             if not profile.strip().startswith("\"/"):
                 print helpers.color("[!] Task URIs in profiles must start with / and be enclosed in quotes!")
             else:
@@ -1998,7 +2005,22 @@ def do_set(self, line):
         "Set a listener option."
         parts = line.split(" ")
         if len(parts) > 1:
-            self.mainMenu.listeners.set_listener_option(parts[0], " ".join(parts[1:]))
+
+            if parts[0].lower() == "defaultprofile" and os.path.exists(parts[1]):
+                try:
+                    f = open(parts[1], 'r')
+                    profileDataRaw = f.readlines()
+
+                    profileData = [l for l in profileDataRaw if (not l.startswith("#") and l.strip() != "")]
+                    profileData = profileData[0].strip("\"")
+
+                    f.close()
+                    self.mainMenu.listeners.set_listener_option(parts[0], profileData)
+
+                except:
+                    print helpers.color("[!] Error opening profile file %s" %(parts[1]))
+            else:
+                self.mainMenu.listeners.set_listener_option(parts[0], " ".join(parts[1:]))
         else:
             print helpers.color("[!] Please enter a value to set for the option")
 
@@ -2143,6 +2165,9 @@ def complete_set(self, text, line, begidx, endidx):
 
         elif line.split(" ")[1].lower() == "certpath":
             return helpers.complete_path(text,line,arg=True)
+
+        elif line.split(" ")[1].lower() == "defaultprofile":
+            return helpers.complete_path(text,line,arg=True)
 
         mline = line.partition(' ')[2]
         offs = len(mline) - len(text)

lib/modules/situational_awareness/network/powerview/find_managed_security_groups.py

@@ -0,0 +1,85 @@
+from lib.common import helpers
+
+class Module:
+
+    def __init__(self, mainMenu, params=[]):
+
+        self.info = {
+            'Name': 'Find-ManagedSecurityGroups',
+
+            'Author': ['@ukstufus'],
+
+            'Description': ('This function retrieves all security groups in the domain and identifies ones that '
+                            'have a manager set. It also determines whether the manager has the ability to add '
+                            'or remove members from the group.'),
+
+            'Background' : True,
+
+            'OutputExtension' : None,
+
+            'NeedsAdmin' : False,
+
+            'OpsecSafe' : True,
+
+            'MinPSVersion' : '2',
+
+            'Comments': [
+                'https://github.com/PowerShellEmpire/Empire/pull/119'
+            ]
+        }
+
+        # any options needed by the module, settable during runtime
+        self.options = {
+            # format:
+            #   value_name : {description, required, default_value}
+            'Agent' : {
+                'Description'   :   'Agent to run module on.',
+                'Required'      :   True,
+                'Value'         :   ''
+            }
+        }
+
+        # save off a copy of the mainMenu object to access external functionality
+        #   like listeners/agent handlers/etc.
+        self.mainMenu = mainMenu
+
+        for param in params:
+            # parameter format is [Name, Value]
+            option, value = param
+            if option in self.options:
+                self.options[option]['Value'] = value
+
+
+    def generate(self):
+
+        moduleName = self.info["Name"]
+
+        # read in the common powerview.ps1 module source code
+        moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/powerview.ps1"
+
+        try:
+            f = open(moduleSource, 'r')
+        except:
+            print helpers.color("[!] Could not read module source path at: " + str(moduleSource))
+            return ""
+
+        moduleCode = f.read()
+        f.close()
+
+        # get just the code needed for the specified function
+        script = helpers.generate_dynamic_powershell_script(moduleCode, moduleName)
+
+        script += moduleName + " "
+
+        for option,values in self.options.iteritems():
+            if option.lower() != "agent":
+                if values['Value'] and values['Value'] != '':
+                    if values['Value'].lower() == "true":
+                        # if we're just adding a switch
+                        script += " -" + str(option)
+                    else:
+                        script += " -" + str(option) + " " + str(values['Value']) 
+
+        script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"'
+
+        return script