Skip to content
This repository has been archived by the owner on Jan 29, 2020. It is now read-only.

Ubuntu repository #894

Closed
cegi opened this issue Jan 1, 2018 · 15 comments
Closed

Ubuntu repository #894

cegi opened this issue Jan 1, 2018 · 15 comments

Comments

@cegi
Copy link

cegi commented Jan 1, 2018

Empire Version

From Dev Branch today(because i get "rand" error)

OS Information (Linux flavor, Python version)

Debian testing, Python 2.7.14+,Python 3.6.4rc1

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

I don't understand why Empire add Ubuntu 14 repository in source list to download Powershell instead of just downloading it from Github ? Even downloading the binary release is fine. So any change to the install script possible ? Adding repository break things in my case.
Thanks for the great work

Screenshot of error, embedded text output, or Pastebin link to the error

Any additional information

@cegi cegi changed the title Microsoft repository Ubuntu repository Jan 1, 2018
@xorrior
Copy link
Contributor

xorrior commented Jan 4, 2018

So what errors are you specifically receiving when running the install script? Can you post those errors please?

@cegi
Copy link
Author

cegi commented Jan 4, 2018

Thanks for the answer. Powershell doesn't get installed when using the setup script. I get this :

**sudo aptitude install powershell
The following NEW packages will be installed:
liblttng-ust-ctl4{a} liblttng-ust0{a} libunwind8{a} powershell{b}
0 packages upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 52.3 MB of archives. After unpacking 141 MB will be used.
The following packages have unmet dependencies:
powershell : Depends: libssl1.0.0 which is a virtual package and is not provided by any available package

          Depends: libicu52 which is a virtual package and is not provided by any available package

The following actions will resolve these dependencies:

 Keep the following packages at their current version:
  1. powershell [Not Installed]**
    

i'm asking if it's possible to change =>

# Install Powershell on Linux
function install_powershell() {
if uname | grep -q "Darwin"; then
brew install openssl
brew install curl --with-openssl
brew tap caskroom/cask
brew cask install powershell
else
# Deb 9.x
if cat /etc/debian_version | grep 9.
; then
# Install system components
sudo apt-get update
sudo apt-get install -y apt-transport-https curl
# Import the public repository GPG keys
curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
# Register the Microsoft Product feed
sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-debian-jessie-prod jessie main" > /etc/apt/sources.list.d/microsoft.list'
# Update the list of products
sudo apt-get update
# Install PowerShell
sudo apt-get install -y powershell
*

And replace it (the debian part) with a git clone of powershell, or wget the latest binary release and install it ?

When i download Powershell from github either with git or binary, it works fine.

@cegi
Copy link
Author

cegi commented Jan 4, 2018

Also for those that get the "rand" error when launching Empire, i found a workaround, go in setup folder and run 'pip2 install --upgrade -r requirements.txt' ,i think the install.sh script does not install the requirements correctly on certains systems.

I get an error when running './reset.sh' though.

Traceback (most recent call last):
File "./empire", line 11, in
from lib.common import empire
File "/home/user/Empire/lib/common/empire.py", line 27, in
import agents
File "/home/user/Empire/lib/common/agents.py", line 68, in
import encryption
File "/home/user/Empire/lib/common/encryption.py", line 62, in
random_function = OpenSSL.rand.bytes
AttributeError: 'module' object has no attribute 'rand'

@xorrior
Copy link
Contributor

xorrior commented Jan 4, 2018

The rand error should be resolved on the master branch

@cegi
Copy link
Author

cegi commented Jan 4, 2018

Thanks, if you can change the installation script for debian if no one see any issues about it, it would be greatly appreciated.

Edit : On master branch when using './reset.sh' i get ;

Traceback (most recent call last):

File "./empire", line 13, in
from lib.common import empire, helpers
File "/home/user/Empire/lib/common/empire.py", line 34, in
import stagers
File "/home/user/Empire/lib/common/stagers.py", line 23, in
import macholib.MachO
ImportError: No module named macholib.MachO

Empire launch fine though, no rand error anymore.

@DakotaNelson
Copy link
Contributor

DakotaNelson commented Jan 4, 2018 via email

@cegi
Copy link
Author

cegi commented Jan 4, 2018

Yes i did, with git clone and wget binary release, it worked fine. It's more conveniant to not have to do it each time though.

@xorrior
Copy link
Contributor

xorrior commented Jan 4, 2018

@cegi you can just install macholib with pip. Not sure why it wasn't installed.

@xorrior xorrior closed this as completed Jan 4, 2018
@cegi
Copy link
Author

cegi commented Jan 4, 2018

@xorrior, i installed with pip macholib which did not fix the issue, so i tried 'aptitude install python-macholib' which worked, but now i get :

Traceback (most recent call last):
File "./empire", line 1393, in
main = empire.MainMenu(args=args)
File "/home/user/Empire/lib/common/empire.py", line 103, in init
self.listeners = listeners.Listeners(self, args=args)
File "/home/user/Empire/lib/common/listeners.py", line 35, in init
self.load_listeners()
File "/home/user/Empire/lib/common/listeners.py", line 60, in load_listeners
self.loadedListeners[listenerName] = imp.load_source(listenerName, filePath).Listener(self.mainMenu, [])
File "/home/user/Empire//lib/listeners/http.py", line 19, in
from lib.common import obfuscation
File "/home/user/Empire/lib/common/obfuscation.py", line 10, in
from pyminifier import token_utils as py_tokenizer
ImportError: No module named pyminifier

And after using 'pip2 install --upgrade pyminifier' it still get me the same error.

EDIT : Nevermind, i had to use "sudo" in order to install pyminifier correctly... Any idea how i can know when i need to use sudo for installing pip dependencies correctly, and when i don't need to use sudo ?

And for those that get error when using Empire restful API, you need to use "sudo" to launch empire correctly.

@DakotaNelson
Copy link
Contributor

The tl;dr on pip is that to install globally, you need to use sudo, and to install locally (either just for you using the --user flag, or in a virtual environment) you don't need sudo.

I know globally works with Empire, I suspect (but don't know) --user won't since you'll be running it as sudo, and a virtualenv will also work but requires some setup and maintenance.

@cegi
Copy link
Author

cegi commented Jan 5, 2018

@DakotaNelson Thanks i appreciate the answer,yes thats what i thought, for example if i use as user "pip2 install shodan" i won't be able to use shodan even if i sudo, i had to use "sudo pip2 install shodan" for it to work.

But installing globally can lead to security issues so i will try with --user flag but i know it is sometime tricky and won't work.

@DakotaNelson
Copy link
Contributor

If you look at #771 you can set things up using virtualenvs, which will solve the global install problem, but it'll take some work to set up and maintain. Alternately, I think Docker is live now; see https://blog.obscuritylabs.com/docker-command-controll-c2/ to use that instead.

@cegi
Copy link
Author

cegi commented Jan 5, 2018

@DakotaNelson Yes, i made a script to set up a virtual environnement for pip on Empire and Deathstar and managed to make both works without any problems and without using the installer script. So i don't have the Ubuntu repository anymore, and no dependencies error, everything is fine now thanks.

A question though, is powershell necessary for Empire, i don't know empire yet and so do not understand the connection between it and powershell... Because it launch fine without powershell, and the powershell scripts are going to be run on another device, so except for developing powershell script, i dont need powershell ?

@cegi
Copy link
Author

cegi commented Jan 11, 2018

So, anyone knows why Empire install Powershell ? I don't understand the reason.

@xorrior
Copy link
Contributor

xorrior commented Jan 12, 2018

@cegi It's necessary for the use of Invoke-obfuscation

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants