Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Updated API to include reporting #168

Merged
merged 4 commits into from
Apr 14, 2020
Merged

Updated API to include reporting #168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e1e5c82
Merge pull request #129 from BC-SECURITY/dev
Cx01N Mar 13, 2020
af30a1f
Merge pull request #140 from BC-SECURITY/dev
Cx01N Mar 23, 2020
4a14649
Merge pull request #148 from BC-SECURITY/dev
Cx01N Apr 6, 2020
962a522
Updated API reporting for Starkiller integration
Cx01N Apr 10, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions empire
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1178,12 +1178,38 @@ def start_restful_api(empireMenu, suppress=False, username=None, password=None,
"""
Returns JSON describing the reporting events from the backend database.
"""
reportingRaw = execute_db_query(conn, 'SELECT ID, name, event_type, message, time_stamp, taskID FROM reporting')
reportingRaw = execute_db_query(conn, '''
SELECT
reporting.time_stamp,
event_type,
u.username,
substr(reporting.name, pos+1) as agent_name,
a.hostname,
taskID,
t.data as "Task",
r.data as "Results"
FROM
(
SELECT
time_stamp,
event_type,
name,
instr(name, '/') as pos,
taskID
FROM reporting
WHERE name LIKE 'agent%'
AND reporting.event_type == 'task' OR reporting.event_type == 'checkin') reporting
LEFT OUTER JOIN taskings t on (reporting.taskID = t.id) AND (agent_name = t.agent)
LEFT OUTER JOIN results r on (reporting.taskID = r.id) AND (agent_name = r.agent)
JOIN agents a on agent_name = a.session_id
LEFT OUTER JOIN users u on t.user_id = u.id
ORDER BY reporting.time_stamp DESC
''')
reportingEvents = []

for reportingEvent in reportingRaw:
[ID, name, event_type, message, time_stamp, taskID] = reportingEvent
reportingEvents.append({"ID":ID, "agentname":name, "event_type":event_type, "message":json.loads(message), "timestamp":time_stamp, "taskID":taskID})
[time_stamp, event_type, user_name, agent_name, host_name, taskID, task, results] = reportingEvent
reportingEvents.append({"timestamp":time_stamp, "event_type":event_type, "username":user_name, "agent_name":agent_name, "host_name":host_name, "taskID":taskID, "task":task, "results":results})

return jsonify({'reporting' : reportingEvents})

Expand Down
12 changes: 7 additions & 5 deletions lib/common/empire.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -968,8 +968,9 @@ def do_report(self, line):
# Empire Log
cur.execute("""
SELECT
time_stamp,
reporting.time_stamp,
event_type,
u.username,
substr(reporting.name, pos+1) as agent_name,
a.hostname,
taskID,
Expand All @@ -986,9 +987,10 @@ def do_report(self, line):
FROM reporting
WHERE name LIKE 'agent%'
AND reporting.event_type == 'task' OR reporting.event_type == 'checkin') reporting
LEFT OUTER JOIN taskings t on (reporting.taskID = t.id) AND (agent_name = t.agent)
LEFT OUTER JOIN results r on (reporting.taskID = r.id) AND (agent_name = r.agent)
JOIN agents a on agent_name = a.session_id
LEFT OUTER JOIN taskings t on (reporting.taskID = t.id) AND (agent_name = t.agent)
LEFT OUTER JOIN results r on (reporting.taskID = r.id) AND (agent_name = r.agent)
JOIN agents a on agent_name = a.session_id
LEFT OUTER JOIN users u on t.user_id = u.id
""")
rows = cur.fetchall()
print(helpers.color("[*] Writing data/master.log"))
Expand All @@ -1000,7 +1002,7 @@ def do_report(self, line):
for n in range(len(row)):
if isinstance(row[n], bytes):
row[n] = row[n].decode('UTF-8')
f.write('\n' + row[0] + ' - ' + row[3] + ' (' + row[2] + ')> ' + str(row[5]) + '\n' + str(row[6]) + '\n')
f.write('\n' + row[0] + ' - ' + row[3] + ' (' + row[2] + ')> ' + str(row[5]) + '\n' + str(row[6]) + '\n' + str(row[7]) + '\n')
f.close()
cur.close()
finally:
Expand Down