Malleable C2 HTTP Listener

data/agent/agent.ps1

@@ -441,6 +441,8 @@ function Invoke-Empire {
         param($JobName)
         if($Script:Jobs.ContainsKey($JobName)) {
             $Script:Jobs[$JobName]['Buffer'].ReadAll()
+            $Script:Jobs[$JobName]['PSHost'].Streams.Error
+            $Script:Jobs[$JobName]['PSHost'].Streams.Error.Clear()
         }
     }
 
@@ -453,6 +455,8 @@ function Invoke-Empire {
             $Null = $Script:Jobs[$JobName]['PSHost'].Stop()
             # get results
             $Script:Jobs[$JobName]['Buffer'].ReadAll()
+            $Script:Jobs[$JobName]['PSHost'].Streams.Error
+            $Script:Jobs[$JobName]['PSHost'].Streams.Error.Clear()
             # unload the app domain runner
             $Null = [AppDomain]::Unload($Script:Jobs[$JobName]['AppDomain'])
             $Script:Jobs.Remove($JobName)

lib/common/malleable/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 johneiser
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

lib/common/malleable/README.md

@@ -0,0 +1,68 @@
+# MalleableC2Parser
+
+A [**Malleable Command and Control Profile**](https://www.cobaltstrike.com/help-malleable-c2) is a "simple program that specifies how to transform data and store it in a transaction", and is a key feature of [**Cobal Strike**](https://www.cobaltstrike.com/)'s Beacon payload.  This library is an attempt to abstract that functionality out so that other toolsets may use the same files to define their own communication profiles.
+
+## Usage
+
+```
+import malleable
+try:
+  p = malleable.Profile()
+  p.ingest("amazon.profile")
+  if p.validate():
+    request = p.get.construct_client("mydomain.sample", "mydata")
+    print request.url, request.headers, request.body
+except MalleableError as e:
+  print str(e)
+```
+
+## Architecture
+
+### Profile
+
+The `Profile` houses all the functionality of the Malleable C2 profile and is capable of ingesting and validating profiles.  A standard Malleable C2 profile contains a `Get Implementation`, a `Post Implementation`, and possibly a `Stager Implementation`, as well as several global variables like `sleeptime`, `jitter`, and `useragent`.
+
+### Implementation
+
+An `Implementation` is the specific instantiation of an HTTP client-server `Transaction`, and there are three defined: `Get`, `Post`, and `Stager`.  Each `Implementation` has its own storage paradigm and purpose within the communication profile.
+
+- Get: Fetch tasking from the C2
+  - Client: metadata (Session metadata)
+  - Server: output (Beacon's tasks)
+- Post: Return results to the C2
+  - Client: id (Session ID), output (Beacon's responses)
+  - Server: output (Empty)
+- Stager: Download a payload stage
+  - Client: metadata (Empty)
+  - Server: output (Encoded payload stage)
+
+### Transaction
+
+A `Transaction` defines the core components of an interaction between a web client request and a web server response.  As such, a `Transaction` houses a `Client` and `Server` object, each holding the appropriate components included in their part of the transaction.
+
+- Client: url, verb scheme, host, port, path, parameters, headers, body
+
+- Server: code, headers, body
+
+Each `Client` and `Server` object of a `Transaction` also includes the ability to *store* and *extract* encoded data within its structure, houseing the true value of a Malleable C2 profile.
+
+### Transformation
+
+This group of classes defines the model through which arbitrary data can undergo a sequence of reversable transformations.  A `Transform` houses the arbitrary functionality of a reversable transformation, and the following are defined:
+
+- Append
+- Base64
+- Base64Url
+- Mask
+- Netbios
+- Netbiosu
+- Prepend
+
+A `Terminator` houses the arbitrary functionality of a reversable storage mechanism, and the following are defined:
+
+- Print
+- Header
+- Parameter
+- UriAppend
+
+And finally, a `Container` houses a sequence of `Transforms` and their defined `Terminator`.  For example, a `Get Implementation` might include the `metadata Container`, which houses the `Base64Url Transform` and the `UriAppend Terminator`.  This means that the metadata to be sent in a GET request to the C2 server will first be Base64 encoded and url encoded, then stored at the end of the url.  The server will then retrieve the encoded data from the end of the url and proceed to url decode and base64 decode it.

lib/common/malleable/__init__.py

@@ -0,0 +1,5 @@
+from utility import MalleableError, MalleableUtil, MalleableObject
+from transformation import Transform, Terminator, Container
+from transaction import MalleableRequest, MalleableResponse, Transaction
+from implementation import Get, Post, Stager
+from profile import Profile