diff --git a/.gitmodules b/.gitmodules index 3d85c6840..9fce24f95 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,7 @@ +[submodule "data/profiles"] + path = data/profiles + url = https://github.com/BC-SECURITY/Malleable-C2-Profiles + [submodule "cli"] path = cli - url = https://github.com/BC-SECURITY/Empire-Cli + url = https://github.com/BC-SECURITY/Empire-Cli \ No newline at end of file diff --git a/README.md b/README.md index 3d0f94a4d..dfae2d7e5 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,7 @@ To install and run: ```sh git clone --recursive https://github.com/BC-SECURITY/Empire.git cd Empire -sudo ./install.sh +sudo ./setup/install.sh sudo poetry install sudo poetry run python empire ``` diff --git a/changelog b/changelog index e2a1fcddd..39f362cd7 100644 --- a/changelog +++ b/changelog @@ -3,6 +3,7 @@ - Version 3.7.0 Master Release - Revamped backend database from SQL to SQLAlchemy (@Cx01N, @Vinnybod) - Added new Empire CLI to packaging (@Vinnybod) + - Added malleable C2 profiles to empire directory: /data/profiles (@Cx01N) - Added --teamserver option to launcher (@Cx01N) - Added support for logging into Empire from multiple locations (@Vinnybod) - Added Invoke-WireTap (@Cx01N) diff --git a/data/profiles b/data/profiles new file mode 160000 index 000000000..7b97eb61d --- /dev/null +++ b/data/profiles @@ -0,0 +1 @@ +Subproject commit 7b97eb61dc014193c4abbc4853914d268aebe72c diff --git a/data/profiles/comfoo.txt b/data/profiles/comfoo.txt deleted file mode 100644 index 78eecbb89..000000000 --- a/data/profiles/comfoo.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Basic comfoo profile -# http://www.secureworks.com/cyber-threat-intelligence/threats/secrets-of-the-comfoo-masters/ -# https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/APT/comfoo.profile - -"/CWoNaJLBo/VTNeWw11212/|Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)|Accept:image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*|Accept-Language:en-en" \ No newline at end of file diff --git a/data/profiles/fiesta.txt b/data/profiles/fiesta.txt deleted file mode 100644 index beb10c57b..000000000 --- a/data/profiles/fiesta.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Fiesta Exploit Kit traffic profile -# http://malware-traffic-analysis.net/2014/04/05/index.html -# https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/crimeware/fiesta.profile - -"/rmvk30g/|Mozilla/4.0 (Windows 7 6.1) Java/1.7.0_11|Accept:text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2" \ No newline at end of file diff --git a/data/profiles/pitty_tiger.txt b/data/profiles/pitty_tiger.txt deleted file mode 100644 index 542cd7b2f..000000000 --- a/data/profiles/pitty_tiger.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Basic Pitty Tiger RAT profile -# http://bitbucket.cassidiancybersecurity.com/whitepapers/downloads/Pitty%20Tiger%20Final%20Report.pdf -# https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/APT/pitty_tiger.profile - -"/FC001/JOHN|Microsoft Internet Explorer" \ No newline at end of file diff --git a/data/profiles/zeus.txt b/data/profiles/zeus.txt deleted file mode 100644 index 4a69e2e90..000000000 --- a/data/profiles/zeus.txt +++ /dev/null @@ -1,5 +0,0 @@ -# Basic Zeus variant profile -# https://malwr.com/analysis/NjIwNTU2ODA2OTUxNDcwNmJiMTMzYzk4YzU4NWQyZDQ/ -# https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/crimeware/zeus.profile - -"/metro91/admin/1/ppptp.jpg,/metro91/admin/1/secure.php|Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)|Accept:*/*" \ No newline at end of file diff --git a/lib/common/empire.py b/lib/common/empire.py index ebc451a6e..eb3317695 100755 --- a/lib/common/empire.py +++ b/lib/common/empire.py @@ -959,7 +959,7 @@ def do_preobfuscate(self, line): # Preobfuscate a selected module_source file else: - module_source_fullpath = self.installPath + 'data/module_source/' + module + module_source_fullpath = self.installPath + '/data/module_source/' + module if not os.path.isfile(module_source_fullpath): print(helpers.color("[!] The module_source file:" + module_source_fullpath + " does not exist.")) return @@ -978,9 +978,9 @@ def do_preobfuscate(self, line): if obfuscate_all: files = [file for file in helpers.get_module_source_files()] else: - files = ['data/module_source/' + module] + files = ['/data/module_source/' + module] for file in files: - file = self.installPath + file + file = self.installPath + '/' + file if reobfuscate or not helpers.is_obfuscated(file): message = "[*] Obfuscating {}...".format(os.path.basename(file)) signal = json.dumps({ @@ -1216,7 +1216,7 @@ def complete_list(self, text, line, begidx, endidx): def complete_preobfuscate(self, text, line, begidx, endidx): "Tab-complete an interact command" - options = [(option[len('data/module_source/'):]) for option in helpers.get_module_source_files()] + options = [(option[len('/data/module_source/'):]) for option in helpers.get_module_source_files()] options.append('all') mline = line.partition(' ')[2] diff --git a/lib/common/helpers.py b/lib/common/helpers.py index ea3f5cb9e..ad40c097b 100644 --- a/lib/common/helpers.py +++ b/lib/common/helpers.py @@ -905,8 +905,8 @@ def obfuscate(installPath, psScript, obfuscationCommand): print(color("[!] PowerShell is not installed and is required to use obfuscation, please install it first.")) return "" # When obfuscating large scripts, command line length is too long. Need to save to temp file - toObfuscateFilename = installPath + "data/misc/ToObfuscate.ps1" - obfuscatedFilename = installPath + "data/misc/Obfuscated.ps1" + toObfuscateFilename = installPath + "/data/misc/ToObfuscate.ps1" + obfuscatedFilename = installPath + "/data/misc/Obfuscated.ps1" toObfuscateFile = open(toObfuscateFilename, 'w') toObfuscateFile.write(psScript) toObfuscateFile.close() diff --git a/lib/database/base.py b/lib/database/base.py index 059c56e81..650a51218 100644 --- a/lib/database/base.py +++ b/lib/database/base.py @@ -27,7 +27,7 @@ choice = input("\n [>] Would you like to reset your Empire instance? [y/N]: ") if choice.lower() == "y": Base.metadata.drop_all(engine) - subprocess.call("./reset.sh") + subprocess.call("./setup/reset.sh") else: pass diff --git a/install.sh b/setup/install.sh similarity index 100% rename from install.sh rename to setup/install.sh index a0a07b585..83c970938 100755 --- a/install.sh +++ b/setup/install.sh @@ -175,9 +175,9 @@ sudo pip3 install -r "$Pip_file" # Generate a cert ./cert.sh -cd .. - # Set up the database schema python3 ./setup_database.py +cd .. + echo -e '\n [*] Setup complete!\n' diff --git a/reset.sh b/setup/reset.sh similarity index 84% rename from reset.sh rename to setup/reset.sh index 015a23120..5c9ddea47 100755 --- a/reset.sh +++ b/setup/reset.sh @@ -7,6 +7,13 @@ fi IFS='/' read -a array <<< pwd +if [[ "$(pwd)" != *setup ]] +then + cd ./setup +fi + +cd .. + # remove the debug file if it exists if [ -e empire.debug ] then diff --git a/setup_database.py b/setup/setup_database.py similarity index 100% rename from setup_database.py rename to setup/setup_database.py