save-output.cna

# 
# Saves long command output to a file.

# Author:
#   Mohin Paramasivam / Shad0wQu35t
#   <mohin2099@gmail.com>
#   (https://github.com/mohinparamasivam)
#


sub execute-assembly{
	$bid = $1;
	$file = $2;
	$binarypath = $3;
	$arguments = $4;
	
	$print_command = "execute-assembly ".$binarypath." ".$arguments;

	binput($bid,$print_command);
	btask($bid, "Saving output to $file");
	bexecute_assembly($bid,$binarypath,$arguments);

	
	on beacon_output{
		$output = $2;
		$output_check = substr($output,0,16);
		
		if ($output_check eq "received output:"){
			$fileopen = openf(">>$file");
			writeb($fileopen, $output);
			closef($fileopen);

		}
	}
}
				




sub run{
	$bid = $1;
	$file = $2;
	$command = $3;
	$arguments = $4;

	$final_command = $command." ".$arguments;
	$print_command = "run ".$final_command;
	
	binput($bid,$print_command);
	btask($bid, "Saving output to $file");
	brun($bid,$final_command);

	
	
	on beacon_output{
		$output = $2;
		$output_check = substr($output,0,16);
		
		if ($output_check eq "received output:"){
			$fileopen = openf(">>$file");
			writeb($fileopen, $output);
			closef($fileopen);

		}
	}		
}


sub shell{
	$bid = $1;
	$file = $2;
	$command = $3;
	$arguments = $4;

	$final_command = $command." ".$arguments;
	$print_command = "shell ".$final_command;

	binput($bid,$print_command);
	btask($bid, "Saving output to $file");
	bshell($bid,$final_command);

	

	
	on beacon_output{
		$output = $2;
		$output_check = substr($output,0,16);
		
		if ($output_check eq "received output:"){
			$fileopen = openf(">>$file");
			writeb($fileopen, $output);
			closef($fileopen);

		}
	}
}
				
				


sub powershell{
	$bid = $1;
	$file = $2;
	$command = $3;
	$arguments = $4;

	$final_command = $command." ".$arguments;
	$print_command = "powershell ".$final_command;

	binput($bid,$print_command);
	btask($bid, "Saving output to $file");
	bpowershell($bid,$final_command);

	

	
	on beacon_output{
		$output = $2;
		$output_check = substr($output,0,16);
		
		if ($output_check eq "received output:"){
			$fileopen = openf(">>$file");
			writeb($fileopen, $output);
			closef($fileopen);

		}
	}
}
				



sub powerpick{
	$bid = $1;
	$file = $2;
	$command = $3;
	$arguments = $4;

	$final_command = $command." ".$arguments;
	$print_command = "powerpick ".$final_command;

	binput($bid,$print_command);
	btask($bid, "Saving output to $file");
	bpowerpick($bid,$final_command);

	

	
	on beacon_output{
		$output = $2;
		$output_check = substr($output,0,16);
		
		if ($output_check eq "received output:"){
			$fileopen = openf(">>$file");
			writeb($fileopen, $output);
			closef($fileopen);

		}
	}
}
				




sub module-execute {

	$bid = $1;
	$file = $2;
	$module = $3;
	$command = $4;
	$optional_arguments = $5;



	if (!-exists "saveoutput/"){
				mkdir("saveoutput");
	}

	$currentdir = cwd();
	$filepath = $currentdir."/saveoutput/".$file;
			


	if (-exists $filepath){
		berror($bid,"File Exists! Use another filename.");
		
	}


	if (!-exists $filepath){
		createNewFile($filepath);

		if ($module eq "execute-assembly"){
			execute-assembly($bid,$filepath,$command,$optional_arguments);

		}


		if ($module eq "run"){
   			run($bid,$filepath,$command,$optional_arguments);
   			
		}


		if ($module eq "shell"){
   			shell($bid,$filepath,$command,$optional_arguments);
   			
		}

		if ($module eq "powerpick"){
   			powerpick($bid,$filepath,$command,$optional_arguments);
   			
		}

		if ($module eq "powershell"){
   			powershell($bid,$filepath,$command,$optional_arguments);
   			
		}
	}
}



alias saveoutput {

	global('$bid,$file,$module,$command,$optional_arguments');

	$bid = $1;
	$file = $2;
	$module = $3;
	$command = $4;
	$optional_arguments = $5;



	prompt_confirm("Have you reload the save-output.cna script? [fixes repitition of output bug]", "Reload the script in Script Manager before running!", {

		module-execute($bid,$file,$module,$command,$optional_arguments);

	});

}










beacon_command_register(
   "saveoutput", 
   "saves command output to file", 
   "\nSupported Modules : (execute-assembly,run,shell,powerpick,powershell)\n\nUsage : saveoutput filename module command optional_arguments\n\nExamples : \n\nsaveoutput seatbelt_output.txt execute-assembly /opt/Seatbelt.exe \"-group=system\"\nsaveoutput netlocalgroup.log run net \"localgroup Administrators\"\nsaveoutput process_list.txt shell whoami \"/all\"\nsaveoutput usernames.txt powerpick Get-DomainUser\nsaveoutput jaws.txt powershell C:\\Tools\\JAWS.ps1\n");