forked from nettitude/PoshC2
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathAutoLoads.py
More file actions
150 lines (145 loc) · 13.3 KB
/
AutoLoads.py
File metadata and controls
150 lines (145 loc) · 13.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
from DB import update_mods, new_task, select_mods
from Config import ModulesDirectory
import os
def check_module_loaded(module_name, randomuri, user, force=False):
try:
modules_loaded = select_mods(randomuri)
if force:
for modname in os.listdir(ModulesDirectory):
if modname.lower() in module_name.lower():
module_name = modname
new_task(("loadmodule %s" % module_name), user, randomuri)
if modules_loaded:
new_modules_loaded = "%s %s" % (modules_loaded, module_name)
if module_name not in modules_loaded:
for modname in os.listdir(ModulesDirectory):
if modname.lower() in module_name.lower():
module_name = modname
new_task(("loadmodule %s" % module_name), user, randomuri)
update_mods(new_modules_loaded, randomuri)
else:
new_modules_loaded = "%s" % (module_name)
new_task(("loadmodule %s" % module_name), user, randomuri)
update_mods(new_modules_loaded, randomuri)
except Exception as e:
print("Error loadmodule: %s" % e)
def run_autoloads(command, randomuri, user):
command = command.lower().strip()
if command.startswith("invoke-eternalblue"): check_module_loaded("Exploit-EternalBlue.ps1", randomuri, user)
elif command.startswith("invoke-psuacme"): check_module_loaded("Invoke-PsUACme.ps1", randomuri, user)
elif command.startswith("bloodhound"): check_module_loaded("BloodHound.ps1", randomuri, user)
elif command.startswith("brute-ad"): check_module_loaded("Brute-AD.ps1", randomuri, user)
elif command.startswith("brute-locadmin"): check_module_loaded("Brute-LocAdmin.ps1", randomuri, user)
elif command.startswith("bypass-uac"): check_module_loaded("Bypass-UAC.ps1", randomuri, user)
elif command.startswith("cred-popper"): check_module_loaded("Cred-Popper.ps1", randomuri, user)
elif command.startswith("cve-2016-9192"): check_module_loaded("CVE-2016-9192.ps1", randomuri, user)
elif command.startswith("convertto-shellcode"): check_module_loaded("ConvertTo-Shellcode.ps1", randomuri, user)
elif command.startswith("decrypt-rdcman"): check_module_loaded("Decrypt-RDCMan.ps1", randomuri, user)
elif command.startswith("dump-ntds"): check_module_loaded("Dump-NTDS.ps1", randomuri, user)
elif command.startswith("get-computerinfo"): check_module_loaded("Get-ComputerInfo.ps1", randomuri, user)
elif command.startswith("get-creditcarddata"): check_module_loaded("Get-CreditCardData.ps1", randomuri, user)
elif command.startswith("get-gppautologon"): check_module_loaded("Get-GPPAutologon.ps1", randomuri, user)
elif command.startswith("get-gpppassword"): check_module_loaded("Get-GPPPassword.ps1", randomuri, user)
elif command.startswith("get-idletime"): check_module_loaded("Get-IdleTime.ps1", randomuri, user)
elif command.startswith("get-ipconfig"): check_module_loaded("Get-IPConfig.ps1", randomuri, user)
elif command.startswith("get-keystrokes"): check_module_loaded("Get-Keystrokes.ps1", randomuri, user)
elif command.startswith("get-hash"): check_module_loaded("Get-Hash.ps1", randomuri, user)
elif command.startswith("get-locadm"): check_module_loaded("Get-LocAdm.ps1", randomuri, user)
elif command.startswith("get-mshotfixes"): check_module_loaded("Get-MSHotFixes.ps1", randomuri, user)
elif command.startswith("get-netstat"): check_module_loaded("Get-Netstat.ps1", randomuri, user)
elif command.startswith("get-passnotexp"): check_module_loaded("Get-PassNotExp.ps1", randomuri, user)
elif command.startswith("get-passpol"): check_module_loaded("Get-PassPol.ps1", randomuri, user)
elif command.startswith("get-recentfiles"): check_module_loaded("Get-RecentFiles.ps1", randomuri, user)
elif command.startswith("get-serviceperms"): check_module_loaded("Get-ServicePerms.ps1", randomuri, user)
elif command.startswith("get-userinfo"): check_module_loaded("Get-UserInfo.ps1", randomuri, user)
elif command.startswith("get-wlanpass"): check_module_loaded("Get-WLANPass.ps1", randomuri, user)
elif command.startswith("invoke-pbind"): check_module_loaded("Invoke-Pbind.ps1", randomuri, user)
elif command.startswith("get-domaingroupmember"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-kerberoast"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("resolve-ipaddress"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-userhunter"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-daisychain"): check_module_loaded("invoke-daisychain.ps1", randomuri, user)
elif command.startswith("invoke-hostenum"): check_module_loaded("HostEnum.ps1", randomuri, user)
elif command.startswith("inject-shellcode"): check_module_loaded("Inject-Shellcode.ps1", randomuri, user)
elif command.startswith("inveigh-relay"): check_module_loaded("Inveigh-Relay.ps1", randomuri, user)
elif command.startswith("inveigh"): check_module_loaded("Inveigh.ps1", randomuri, user)
elif command.startswith("invoke-arpscan"): check_module_loaded("Invoke-Arpscan.ps1", randomuri, user)
elif command.startswith("arpscan"): check_module_loaded("Invoke-Arpscan.ps1", randomuri, user)
elif command.startswith("invoke-dcsync"): check_module_loaded("Invoke-DCSync.ps1", randomuri, user)
elif command.startswith("invoke-eventvwrbypass"): check_module_loaded("Invoke-EventVwrBypass.ps1", randomuri, user)
elif command.startswith("invoke-hostscan"): check_module_loaded("Invoke-Hostscan.ps1", randomuri, user)
elif command.startswith("invoke-ms16-032-proxy"): check_module_loaded("Invoke-MS16-032-Proxy.ps1", randomuri, user)
elif command.startswith("invoke-ms16-032"): check_module_loaded("Invoke-MS16-032.ps1", randomuri, user)
elif command.startswith("invoke-mimikatz"): check_module_loaded("Invoke-Mimikatz.ps1", randomuri, user)
elif command.startswith("invoke-psinject"): check_module_loaded("Invoke-PSInject.ps1", randomuri, user)
elif command.startswith("invoke-pipekat"): check_module_loaded("Invoke-Pipekat.ps1", randomuri, user)
elif command.startswith("invoke-portscan"): check_module_loaded("Invoke-Portscan.ps1", randomuri, user)
elif command.startswith("invoke-powerdump"): check_module_loaded("Invoke-PowerDump.ps1", randomuri, user)
elif command.startswith("invoke-psexec"): check_module_loaded("Invoke-SMBExec.ps1", randomuri, user)
elif command.startswith("invoke-reflectivepeinjection"): check_module_loaded("Invoke-ReflectivePEInjection.ps1", randomuri, user)
elif command.startswith("invoke-reversednslookup"): check_module_loaded("Invoke-ReverseDnsLookup.ps1", randomuri, user)
elif command.startswith("invoke-runas"): check_module_loaded("Invoke-RunAs.ps1", randomuri, user)
elif command.startswith("invoke-smblogin"): check_module_loaded("Invoke-SMBExec.ps1", randomuri, user)
elif command.startswith("invoke-smbclient"): check_module_loaded("Invoke-SMBClient.ps1", randomuri, user)
elif command.startswith("invoke-smbexec"): check_module_loaded("Invoke-SMBExec.ps1", randomuri, user)
elif command.startswith("invoke-psexec"): check_module_loaded("Invoke-SMBExec.ps1", randomuri, user)
elif command.startswith("invoke-shellcode"): check_module_loaded("Invoke-Shellcode.ps1", randomuri, user)
elif command.startswith("invoke-sniffer"): check_module_loaded("Invoke-Sniffer.ps1", randomuri, user)
elif command.startswith("invoke-sqlquery"): check_module_loaded("Invoke-SqlQuery.ps1", randomuri, user)
elif command.startswith("invoke-tater"): check_module_loaded("Invoke-Tater.ps1", randomuri, user)
elif command.startswith("invoke-thehash"): check_module_loaded("Invoke-TheHash.ps1", randomuri, user)
elif command.startswith("invoke-tokenmanipulation"): check_module_loaded("Invoke-TokenManipulation.ps1", randomuri, user)
elif command.startswith("invoke-wmichecker"): check_module_loaded("Invoke-WMIChecker.ps1", randomuri, user)
elif command.startswith("invoke-wmicommand"): check_module_loaded("Invoke-WMICommand.ps1", randomuri, user)
elif command.startswith("invoke-wscriptbypassuac"): check_module_loaded("Invoke-WScriptBypassUAC.ps1", randomuri, user)
elif command.startswith("invoke-winrmsession"): check_module_loaded("Invoke-WinRMSession.ps1", randomuri, user)
elif command.startswith("out-minidump"): check_module_loaded("Out-Minidump.ps1", randomuri, user)
elif command.startswith("portscan"): check_module_loaded("PortScanner.ps1", randomuri, user)
elif command.startswith("powercat"): check_module_loaded("powercat.ps1", randomuri, user)
elif command.startswith("invoke-allchecks"): check_module_loaded("PowerUp.ps1", randomuri, user)
elif command.startswith("set-lhstokenprivilege"): check_module_loaded("Set-LHSTokenPrivilege.ps1", randomuri, user)
elif command.startswith("sharpsocks"): check_module_loaded("SharpSocks.ps1", randomuri, user)
elif command.startswith("find-allvulns"): check_module_loaded("Sherlock.ps1", randomuri, user)
elif command.startswith("test-adcredential"): check_module_loaded("Test-ADCredential.ps1", randomuri, user)
elif command.startswith("new-zipfile"): check_module_loaded("Zippy.ps1", randomuri, user)
elif command.startswith("get-netuser"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-aclscanner"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-dfsshare"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-objectacl"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("add-objectacl"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netuser"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-domainuser"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netcomputer"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-domaincomputer"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netuser"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netgroup"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netgroupmember"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netshare"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-sharefinder"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netdomain"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netdomaincontroller"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netforest"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("find-domainshare"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-netforestdomain"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-mapdomaintrust"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-wmireglastloggedon"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-wmiregcachedrdpconnection"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("get-wmiregmounteddrive"): check_module_loaded("powerview.ps1", randomuri, user)
elif command.startswith("invoke-wmievent"): check_module_loaded("Invoke-WMIEvent.ps1", randomuri, user)
elif command.startswith("remove-wmievent"): check_module_loaded("Invoke-WMIEvent.ps1", randomuri, user)
elif command.startswith("invoke-wmi"): check_module_loaded("Invoke-WMIExec.ps1", randomuri, user)
elif command.startswith("get-lapspasswords"): check_module_loaded("Get-LAPSPasswords.ps1", randomuri, user)
elif command.startswith("new-jscriptshell"): check_module_loaded("New-JScriptShell.ps1", randomuri, user)
def run_autoloads_sharp(command, randomuri, user):
command = command.lower().strip()
if command.startswith("run-exe seatbelt"): check_module_loaded("Seatbelt.exe", randomuri, user)
elif command.startswith("run-exe sharpup"): check_module_loaded("SharpUp.exe", randomuri, user)
elif command.startswith("run-exe safetydump"): check_module_loaded("SafetyDump.exe", randomuri, user)
elif command.startswith("run-exe rubeus"): check_module_loaded("Rubeus.exe", randomuri, user)
elif command.startswith("run-exe sharpview"): check_module_loaded("SharpView.exe", randomuri, user)
elif command.startswith("run-exe watson"): check_module_loaded("Watson.exe", randomuri, user)
elif command.startswith("run-exe sharphound"): check_module_loaded("SharpHound.exe", randomuri, user)
elif command.startswith("run-exe internalmonologue"): check_module_loaded("InternalMonologue.exe", randomuri, user)
elif command.startswith("run-exe sharpsocks"): check_module_loaded("SharpSocks.exe", randomuri, user)
elif command.startswith("sharpsocks"): check_module_loaded("SharpSocks.exe", randomuri, user)
elif command.startswith("safetykatz"): check_module_loaded("SafetyKatz.exe", randomuri, user)