diff --git a/lib/common/agents.py b/lib/common/agents.py index 1dec70dd6..f44b41612 100644 --- a/lib/common/agents.py +++ b/lib/common/agents.py @@ -123,14 +123,14 @@ def add_agent(self, sessionID, externalIP, delay, jitter, profile, killDate, wor if len(parts) == 2: requestUris = parts[0] userAgent = parts[1] - elif len(parts) == 3: + elif len(parts) > 2: requestUris = parts[0] userAgent = parts[1] - additionalHeaders = parts[2] + additionalHeaders = "|".join(parts[2:]) cur.execute("INSERT INTO agents (name,session_id,delay,jitter,external_ip,session_key,checkin_time,lastseen_time,uris,user_agent,headers,kill_date,working_hours,lost_limit) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)", (sessionID,sessionID,delay,jitter,externalIP,sessionKey,checkinTime,lastSeenTime,requestUris,userAgent,additionalHeaders,killDate,workingHours,lostLimit)) cur.close() - + # initialize the tasking/result buffers along with the client session key sessionKey = self.get_agent_session_key(sessionID) self.agents[sessionID] = [sessionKey, [],[],[], requestUris, ""] diff --git a/lib/common/empire.py b/lib/common/empire.py index 325daf8b9..f0a6ecfc2 100644 --- a/lib/common/empire.py +++ b/lib/common/empire.py @@ -9,7 +9,7 @@ """ # make version for Empire -VERSION = "1.3.9" +VERSION = "1.3.10" from pydispatch import dispatcher @@ -475,18 +475,24 @@ def do_set(self, line): else: if parts[0].lower() == "ip_whitelist": if parts[1] != "" and os.path.exists(parts[1]): - f = open(parts[1], 'r') - ipData = f.read() - f.close() - self.agents.ipWhiteList = helpers.generate_ip_list(ipData) + try: + f = open(parts[1], 'r') + ipData = f.read() + f.close() + self.agents.ipWhiteList = helpers.generate_ip_list(ipData) + except: + print helpers.color("[!] Error opening ip file %s" %(parts[1])) else: self.agents.ipWhiteList = helpers.generate_ip_list(",".join(parts[1:])) elif parts[0].lower() == "ip_blacklist": if parts[1] != "" and os.path.exists(parts[1]): - f = open(parts[1], 'r') - ipData = f.read() - f.close() - self.agents.ipBlackList = helpers.generate_ip_list(ipData) + try: + f = open(parts[1], 'r') + ipData = f.read() + f.close() + self.agents.ipBlackList = helpers.generate_ip_list(ipData) + except: + print helpers.color("[!] Error opening ip file %s" %(parts[1])) else: self.agents.ipBlackList = helpers.generate_ip_list(",".join(parts[1:])) else: @@ -1614,6 +1620,7 @@ def do_updateprofile(self, line): # strip out profile comments and blank lines profile = [l for l in profile if (not l.startswith("#") and l.strip() != "")] profile = profile[0] + if not profile.strip().startswith("\"/"): print helpers.color("[!] Task URIs in profiles must start with / and be enclosed in quotes!") else: @@ -1998,7 +2005,22 @@ def do_set(self, line): "Set a listener option." parts = line.split(" ") if len(parts) > 1: - self.mainMenu.listeners.set_listener_option(parts[0], " ".join(parts[1:])) + + if parts[0].lower() == "defaultprofile" and os.path.exists(parts[1]): + try: + f = open(parts[1], 'r') + profileDataRaw = f.readlines() + + profileData = [l for l in profileDataRaw if (not l.startswith("#") and l.strip() != "")] + profileData = profileData[0].strip("\"") + + f.close() + self.mainMenu.listeners.set_listener_option(parts[0], profileData) + + except: + print helpers.color("[!] Error opening profile file %s" %(parts[1])) + else: + self.mainMenu.listeners.set_listener_option(parts[0], " ".join(parts[1:])) else: print helpers.color("[!] Please enter a value to set for the option") @@ -2143,6 +2165,9 @@ def complete_set(self, text, line, begidx, endidx): elif line.split(" ")[1].lower() == "certpath": return helpers.complete_path(text,line,arg=True) + + elif line.split(" ")[1].lower() == "defaultprofile": + return helpers.complete_path(text,line,arg=True) mline = line.partition(' ')[2] offs = len(mline) - len(text) diff --git a/lib/modules/situational_awareness/network/powerview/find_managed_security_groups.py b/lib/modules/situational_awareness/network/powerview/find_managed_security_groups.py new file mode 100644 index 000000000..42a47dff7 --- /dev/null +++ b/lib/modules/situational_awareness/network/powerview/find_managed_security_groups.py @@ -0,0 +1,85 @@ +from lib.common import helpers + +class Module: + + def __init__(self, mainMenu, params=[]): + + self.info = { + 'Name': 'Find-ManagedSecurityGroups', + + 'Author': ['@ukstufus'], + + 'Description': ('This function retrieves all security groups in the domain and identifies ones that ' + 'have a manager set. It also determines whether the manager has the ability to add ' + 'or remove members from the group.'), + + 'Background' : True, + + 'OutputExtension' : None, + + 'NeedsAdmin' : False, + + 'OpsecSafe' : True, + + 'MinPSVersion' : '2', + + 'Comments': [ + 'https://github.com/PowerShellEmpire/Empire/pull/119' + ] + } + + # any options needed by the module, settable during runtime + self.options = { + # format: + # value_name : {description, required, default_value} + 'Agent' : { + 'Description' : 'Agent to run module on.', + 'Required' : True, + 'Value' : '' + } + } + + # save off a copy of the mainMenu object to access external functionality + # like listeners/agent handlers/etc. + self.mainMenu = mainMenu + + for param in params: + # parameter format is [Name, Value] + option, value = param + if option in self.options: + self.options[option]['Value'] = value + + + def generate(self): + + moduleName = self.info["Name"] + + # read in the common powerview.ps1 module source code + moduleSource = self.mainMenu.installPath + "/data/module_source/situational_awareness/network/powerview.ps1" + + try: + f = open(moduleSource, 'r') + except: + print helpers.color("[!] Could not read module source path at: " + str(moduleSource)) + return "" + + moduleCode = f.read() + f.close() + + # get just the code needed for the specified function + script = helpers.generate_dynamic_powershell_script(moduleCode, moduleName) + + script += moduleName + " " + + for option,values in self.options.iteritems(): + if option.lower() != "agent": + if values['Value'] and values['Value'] != '': + if values['Value'].lower() == "true": + # if we're just adding a switch + script += " -" + str(option) + else: + script += " -" + str(option) + " " + str(values['Value']) + + script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(moduleName)+' completed!"' + + return script