Skip to content

Commit dfe2ffd

Browse files
author
root
committed
Merge recent commits from upstream into fork
2 parents b6afd79 + 72e0c81 commit dfe2ffd

File tree

3 files changed

+60
-42
lines changed

3 files changed

+60
-42
lines changed

‎data/agent/agent.ps1‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -441,8 +441,6 @@ function Invoke-Empire {
441441
param($JobName)
442442
if($Script:Jobs.ContainsKey($JobName)) {
443443
$Script:Jobs[$JobName]['Buffer'].ReadAll()
444-
$Script:Jobs[$JobName]['PSHost'].Streams.Error
445-
$Script:Jobs[$JobName]['PSHost'].Streams.Error.Clear()
446444
}
447445
}
448446

@@ -455,8 +453,6 @@ function Invoke-Empire {
455453
$Null = $Script:Jobs[$JobName]['PSHost'].Stop()
456454
# get results
457455
$Script:Jobs[$JobName]['Buffer'].ReadAll()
458-
$Script:Jobs[$JobName]['PSHost'].Streams.Error
459-
$Script:Jobs[$JobName]['PSHost'].Streams.Error.Clear()
460456
# unload the app domain runner
461457
$Null = [AppDomain]::Unload($Script:Jobs[$JobName]['AppDomain'])
462458
$Script:Jobs.Remove($JobName)

‎lib/common/agents.py‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -352,7 +352,8 @@ def save_module_file(self, sessionID, path, data):
352352
os.makedirs(save_path)
353353

354354
# save the file out
355-
f = open(save_path + "/" + filename, 'w')
355+
f = open(save_path + "/" + filename, 'wb')
356+
356357
f.write(data)
357358
f.close()
358359
finally:
@@ -1659,13 +1660,11 @@ def handle_agent_response(self, sessionID, encData, update_lastseen=False):
16591660
# process the packet and extract necessary data
16601661
responsePackets = packets.parse_result_packets(packet)
16611662
results = False
1662-
16631663
# process each result packet
16641664
for (responseName, totalPacket, packetNum, taskID, length, data) in responsePackets:
16651665
# process the agent's response
16661666
self.process_agent_packet(sessionID, responseName, taskID, data)
16671667
results = True
1668-
16691668
if results:
16701669
# signal that this agent returned results
16711670
message = "[*] Agent {} returned results.".format(sessionID)
@@ -1771,7 +1770,6 @@ def process_agent_packet(self, sessionID, responseName, taskID, data):
17711770
})
17721771
dispatcher.send(signal, sender="agents/{}".format(sessionID))
17731772
else:
1774-
print("sysinfo:", data)
17751773
# extract appropriate system information
17761774
listener = parts[1]
17771775
domainname = parts[2]
@@ -1838,6 +1836,9 @@ def process_agent_packet(self, sessionID, responseName, taskID, data):
18381836

18391837
elif responseName == "TASK_DOWNLOAD":
18401838
# file download
1839+
if isinstance(data, bytes):
1840+
data = data.decode('UTF-8')
1841+
18411842
parts = data.split("|")
18421843
if len(parts) != 3:
18431844
message = "[!] Received invalid file download response from {}".format(sessionID)
@@ -1849,7 +1850,7 @@ def process_agent_packet(self, sessionID, responseName, taskID, data):
18491850
else:
18501851
index, path, data = parts
18511852
# decode the file data and save it off as appropriate
1852-
file_data = helpers.decode_base64(data)
1853+
file_data = helpers.decode_base64(data.encode('UTF-8'))
18531854
name = self.get_agent_name_db(sessionID)
18541855

18551856
if index == "0":
@@ -1922,12 +1923,13 @@ def process_agent_packet(self, sessionID, responseName, taskID, data):
19221923

19231924

19241925
elif responseName == "TASK_CMD_WAIT_SAVE":
1926+
19251927
# dynamic script output -> blocking, save data
19261928
name = self.get_agent_name_db(sessionID)
19271929

19281930
# extract the file save prefix and extension
1929-
prefix = data[0:15].strip()
1930-
extension = data[15:20].strip()
1931+
prefix = data[0:15].strip().decode('UTF-8')
1932+
extension = data[15:20].strip().decode('UTF-8')
19311933
file_data = helpers.decode_base64(data[20:])
19321934

19331935
# save the file off to the appropriate path
@@ -1955,6 +1957,8 @@ def process_agent_packet(self, sessionID, responseName, taskID, data):
19551957
return
19561958

19571959
with open(savePath,"a+") as f:
1960+
if isinstance(data, bytes):
1961+
data = data.decode('UTF-8')
19581962
new_results = data.replace("\r\n","").replace("[SpaceBar]", "").replace('\b', '').replace("[Shift]", "").replace("[Enter]\r","\r\n")
19591963
f.write(new_results)
19601964
else:

‎setup/install.sh‎

Lines changed: 49 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,26 @@ function install_powershell() {
1111
brew tap caskroom/cask
1212
brew cask install powershell
1313
else
14+
# Deb 10.x
15+
if cat /etc/debian_version | grep 10.* ; then
16+
sudo apt-get install -y apt-transport-https curl
17+
curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
18+
sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-debian-stretch-prod stretch main" > /etc/apt/sources.list.d/microsoft.list'
19+
20+
mkdir /tmp/pwshtmp
21+
(cd /tmp/pwshtmp && \
22+
wget http://http.us.debian.org/debian/pool/main/i/icu/libicu57_57.1-6+deb9u3_amd64.deb && \
23+
wget http://http.us.debian.org/debian/pool/main/u/ust/liblttng-ust0_2.9.0-2+deb9u1_amd64.deb && \
24+
wget http://http.us.debian.org/debian/pool/main/libu/liburcu/liburcu4_0.9.3-1_amd64.deb && \
25+
wget http://http.us.debian.org/debian/pool/main/u/ust/liblttng-ust-ctl2_2.9.0-2+deb9u1_amd64.deb && \
26+
wget http://security.debian.org/debian-security/pool/updates/main/o/openssl1.0/libssl1.0.2_1.0.2t-1~deb9u1_amd64.deb && \
27+
sudo dpkg -i *.deb)
28+
rm -rf /tmp/pwshtmp
29+
30+
sudo apt-get update
31+
sudo apt-get install -y powershell
1432
# Deb 9.x
15-
if cat /etc/debian_version | grep 9.* ; then
33+
elif cat /etc/debian_version | grep 9.* ; then
1634
# Install system components
1735
sudo apt-get install -y apt-transport-https curl
1836
# Import the public repository GPG keys
@@ -36,7 +54,7 @@ function install_powershell() {
3654
# Install PowerShell
3755
sudo apt-get install -y powershell
3856
#Ubuntu
39-
elif lsb_release -d | grep -q "Ubuntu"; then
57+
elif lsb_release -d | grep -q "Ubuntu"; then
4058
# Read Ubuntu version
4159
local ubuntu_version=$( grep 'DISTRIB_RELEASE=' /etc/lsb-release | grep -o -E [[:digit:]]+\\.[[:digit:]]+ )
4260
# Install system components
@@ -50,7 +68,7 @@ function install_powershell() {
5068
# Install PowerShell
5169
sudo apt-get install -y powershell
5270
#Kali Linux
53-
elif cat /etc/lsb-release | grep -i 'Kali'; then
71+
elif lsb_release -d | grep -q "Kali"; then
5472
# Install prerequisites
5573
apt-get install -y curl gnupg apt-transport-https
5674
# Import the public repository GPG keys
@@ -59,15 +77,15 @@ function install_powershell() {
5977
sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-debian-stretch-prod stretch main" > /etc/apt/sources.list.d/microsoft.list'
6078
# Update the list of products
6179
apt-get update
62-
wget http://archive.ubuntu.com/ubuntu/pool/main/i/icu/libicu57_57.1-6_amd64.deb
63-
dpkg -i libicu57_57.1-6_amd64.deb
80+
wget http://archive.ubuntu.com/ubuntu/pool/main/i/icu/libicu57_57.1-6_amd64.deb
81+
dpkg -i libicu57_57.1-6_amd64.deb
6482
# Install PowerShell
6583
apt-get install -y powershell
6684
fi
67-
fi
68-
if ls /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY; then
69-
rm /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY
70-
fi
85+
fi
86+
if ls /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY; then
87+
rm /opt/microsoft/powershell/*/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY
88+
fi
7189
mkdir -p /usr/local/share/powershell/Modules
7290
cp -r ../lib/powershell/Invoke-Obfuscation /usr/local/share/powershell/Modules
7391
}
@@ -80,11 +98,11 @@ IFS='/' read -a array <<< pwd
8098

8199
if [[ "$(pwd)" != *setup ]]
82100
then
83-
cd ./setup
101+
cd ./setup
84102
fi
85103

86104
if uname | grep -q "Darwin"; then
87-
Xar_version="xar-1.5.2"
105+
Xar_version="xar-1.5.2"
88106
install_powershell
89107
sudo pip install -r requirements.txt --global-option=build_ext \
90108
--global-option="-L/usr/local/opt/openssl/lib" \
@@ -97,43 +115,43 @@ else
97115
version=$( lsb_release -r | grep -oP "[0-9]+" | head -1 )
98116
if lsb_release -d | grep -q "Fedora"; then
99117
Release=Fedora
100-
Xar_version="xar-1.5.2"
118+
Xar_version="xar-1.5.2"
101119
sudo dnf install -y make automake gcc gcc-c++ python-devel m2crypto python-m2ext swig libxml2-devel java-openjdk-headless openssl-devel openssl libffi-devel redhat-rpm-config
102120
sudo pip install -r requirements.txt
103121
elif lsb_release -d | grep -q "Kali"; then
104122
Release=Kali
105-
Xar_version="xar-1.6.1"
123+
Xar_version="xar-1.6.1"
106124
apt-get update
107125
sudo apt-get install -y make g++ python-dev python-m2crypto swig python-pip libxml2-dev default-jdk zlib1g-dev libssl1.1 build-essential libssl-dev libxml2-dev zlib1g-dev
108126
sudo pip install -r requirements.txt
109127
install_powershell
110128
elif lsb_release -d | grep -q "Ubuntu"; then
111129
Release=Ubuntu
112130
sudo apt-get update
113-
if [ $(lsb_release -rs | cut -d "." -f 1) -ge 18 ]; then
114-
LibSSL_pkgs="libssl1.1 libssl-dev"
115-
Pip_file="requirements.txt"
116-
Xar_version="xar-1.6.1"
117-
else
118-
LibSSL_pkgs="libssl1.0.0 libssl-dev"
119-
Pip_file="requirements_libssl1.0.txt"
120-
Xar_version="xar-1.5.2"
121-
fi
131+
if [ $(lsb_release -rs | cut -d "." -f 1) -ge 18 ]; then
132+
LibSSL_pkgs="libssl1.1 libssl-dev"
133+
Pip_file="requirements.txt"
134+
Xar_version="xar-1.6.1"
135+
else
136+
LibSSL_pkgs="libssl1.0.0 libssl-dev"
137+
Pip_file="requirements_libssl1.0.txt"
138+
Xar_version="xar-1.5.2"
139+
fi
122140
sudo apt-get install -y make g++ python-dev python-m2crypto swig python-pip libxml2-dev default-jdk $LibSSL_pkgs build-essential
123141
sudo pip install -r $Pip_file
124142
install_powershell
125143
else
126144
echo "Unknown distro - Debian/Ubuntu Fallback"
127145
sudo apt-get update
128-
if [ $(cut -d "." -f 1 /etc/debian_version) -ge 9 ]; then
129-
LibSSL_pkgs="libssl1.1 libssl-dev"
130-
Pip_file="requirements.txt"
131-
Xar_version="xar-1.6.1"
132-
else
133-
LibSSL_pkgs="libssl1.0.0 libssl-dev"
134-
Pip_file="requirements_libssl1.0.txt"
135-
Xar_version="xar-1.5.2"
136-
fi
146+
if [ $(cut -d "." -f 1 /etc/debian_version) -ge 9 ]; then
147+
LibSSL_pkgs="libssl1.1 libssl-dev"
148+
Pip_file="requirements.txt"
149+
Xar_version="xar-1.6.1"
150+
else
151+
LibSSL_pkgs="libssl1.0.0 libssl-dev"
152+
Pip_file="requirements_libssl1.0.txt"
153+
Xar_version="xar-1.5.2"
154+
fi
137155
sudo apt-get install -y make g++ python-dev python-m2crypto swig python-pip libxml2-dev default-jdk libffi-dev $LibSSL_pkgs build-essential
138156
sudo pip install -r $Pip_file
139157
install_powershell

0 commit comments

Comments
 (0)