Add NimScan

README.md

@@ -6,8 +6,11 @@ This too has several functions:
 
 ## To-Do
 
+* Add chisel x64
+* Integrate msfvenom
+* Add Webshells sync
+* Ability to add comments or description
 * Prettier code
-* Only update once per day, except if `-u` `--update`
 * Adding more services to listen to ?
 
 ## Pre-requisites
@@ -28,7 +31,16 @@ This too has several functions:
 }
 ```
 
-`python pendora-box.py`
+```
+user@wow$ python pendora-box.py -h
+usage: pendora-box.py [-h] [-u]
+
+Sync your files and starts a listener on HTTP, SMB or SMB2.
+
+options:
+  -h, --help    show this help message and exit
+  -u, --update  update your files (described in config.json)
+```
 
 ## Adding a file to track
 

config.json

@@ -18,29 +18,106 @@
             "MS11-046/MS11_46_k8.exe",
             "MS10-059/MS10-059.exe"
         ],
-        "diegocr/netcat": [
-            "nc.exe"
+        "flozz/p0wny-shell": [
+            "shell.php"
+        ],
+        "int0x33/nc.exe": [
+            "nc64.exe"
+        ],
+        "BloodHoundAD/BloodHound": [
+            "Collectors/SharpHound.exe"
+        ],
+        "PowerShellMafia/PowerSploit": [
+            "Recon/PowerView.ps1"
+        ],
+        "Flangvik/SharpCollection": [
+            "NetFramework_4.7_Any/Rubeus.exe"
+        ],
+        "calebstewart/CVE-2021-1675": [
+            "CVE-2021-1675.ps1"
+        ],
+        "besimorhino/powercat": [
+            "powercat.ps1"
+        ],
+        "r3motecontrol/Ghostpack-CompiledBinaries": [
+            "Seatbelt.exe"
         ]
     },
     "githubreleasesync": {
         "carlospolop/PEASS-ng": {
-            "local_version": "20220424",
+            "local_version": "20230419-b6aac9cb",
             "files": [
                 "linpeas.sh",
                 "winPEAS.bat",
-                "winPEASany.exe"
+                "winPEASany.exe",
+                "winPEASany_ofs.exe"
+            ]
+        },
+        "AlessandroZ/LaZagne": {
+            "local_version": "v2.4.5",
+            "files": [
+                "lazagne.exe"
+            ]
+        },
+        "DominicBreuker/pspy": {
+            "local_version": "v1.2.1",
+            "files": [
+                "pspy32",
+                "pspy64"
+            ]
+        },
+        "itm4n/PrintSpoofer": {
+            "local_version": "v1.0",
+            "files": [
+                "PrintSpoofer32.exe",
+                "PrintSpoofer64.exe"
+            ]
+        },
+        "PowerShell/Win32-OpenSSH": {
+            "local_version": "v9.2.2.0p1-Beta",
+            "files": [
+                "OpenSSH-Win32-{nobeta_version}.msi",
+                "OpenSSH-Win64-{nobeta_version}.msi"
+            ]
+        },
+        "elddy/NimScan": {
+            "local_version": "1.0.8",
+            "files": [
+                "NimScan.exe"
             ]
         },
         "jpillora/chisel": {
-            "local_version": "v1.7.7",
+            "local_version": "v1.8.1",
             "files": [
                 {
-                    "filename": "chisel_{short_version}_windows_amd64.gz",
-                    "binpath": "chisel.exe"
+                    "filename": "chisel_{short_version}_windows_386.gz",
+                    "inpath": "chisel.exe",
+                    "outpath": "chisel.exe"
+                },
+                {
+                    "filename": "chisel_{short_version}_linux_386.gz",
+                    "inpath": "chisel",
+                    "outpath": "chisel"
                 },
                 {
                     "filename": "chisel_{short_version}_linux_amd64.gz",
-                    "binpath": "chisel "
+                    "inpath": "chisel64",
+                    "outpath": "chisel64"
+                }
+            ]
+        },
+        "gentilkiwi/mimikatz": {
+            "local_version": "2.2.0-20220919",
+            "files": [
+                {
+                    "filename": "mimikatz_trunk.zip",
+                    "inpath": "Win32/mimikatz.exe",
+                    "outpath": "mimikatz32.exe"
+                },
+                {
+                    "filename": "mimikatz_trunk.zip",
+                    "inpath": "x64/mimikatz.exe",
+                    "outpath": "mimikatz64.exe"
                 }
             ]
         }
@@ -51,5 +128,17 @@
             "ncat.exe",
             "ncat"
         ]
+    },
+    "netcat": {
+        "local_version": "1.12",
+        "files": [
+            "nc.exe"
+        ]
+    },
+    "plink": {
+        "local_version": "0.78",
+        "files": [
+            "w32/plink.exe"
+        ]
     }
 }

pendora-box.py

@@ -1,15 +1,19 @@
+#!/usr/bin/env python3
+
+import argparse
 import json
 from pathlib import Path
 import hashlib
 import requests
-import base64
 import sys
-from os import geteuid
+from os import geteuid, chdir
 import subprocess
 from io import BytesIO
 import zipfile
 import rpmfile
 import gzip
+from bs4 import BeautifulSoup
+import re
 
 
 def compute_file_hash(filepath):
@@ -24,8 +28,8 @@ def get_master_info(repo, filepath, credz):
     url = f"https://api.github.com/repos/{repo}/contents/{filepath}"
     r = requests.get(url, auth=credz)
     sha = r.json()['sha']
-    content = r.json()['content']
-    return sha, content
+    dlurl = r.json()['download_url']
+    return sha, dlurl
 
 
 def get_last_release_info(repo, credz):
@@ -64,12 +68,12 @@ def githubmastersync(reponame, filepaths, credz):
     for filepath in filepaths:
         localfile = Path('files').joinpath(Path(filepath).name)
         print(f"  * {localfile} ", end='')
-        lastsha, content = get_master_info(reponame, filepath, credz)
+        lastsha, dlurl = get_master_info(reponame, filepath, credz)
 
         if not localfile.exists():
-            content = base64.b64decode(content)
+            r = requests.get(dlurl)
             with open(localfile, 'wb') as f:
-                f.write(content)
+                f.write(r.content)
             print('-> Installed! ;)')
 
         else:
@@ -78,40 +82,50 @@ def githubmastersync(reponame, filepaths, credz):
             if sha == lastsha:
                 print('-> Up-to-date.')
             else:
-                content = base64.b64decode(content)
+                r = requests.get(dlurl)
                 with open(localfile, 'wb') as f:
-                    f.write(content)
+                    f.write(r.content)
                 print('-> Updated!')
 
 
 def githubreleasesync(reponame, repoinfo, credz):
     local_version = repoinfo['local_version']
     last_version = get_last_release_info(reponame, credz)
+
     short_version = last_version.replace('v', '')
+    nobeta_version = last_version.replace('p1-Beta', '')  # See https://github.com/PowerShell/Win32-OpenSSH/releases
 
     filenames = repoinfo['files']
 
     for filename in filenames:
         if isinstance(filename, dict):
-            binpath = filename['binpath']
+            inpath = filename['inpath']
+            outpath = filename['outpath']
             filename = filename['filename']
-            filename = filename.replace('{last_version}', last_version).replace('{short_version}', short_version)
-            localfile = Path('files').joinpath(Path(binpath).name)
-            if filename.endswith('.gz'):
-                is_gz = True
+            filename = filename.replace('{last_version}', last_version).replace('{short_version}', short_version).replace('{nobeta_version}', nobeta_version)
+            localfile = Path('files').joinpath(outpath)
             print(f"  * {localfile} ", end='')
 
         else:
-            filename = filename.replace('{last_version}', last_version).replace('{short_version}', short_version)
+            filename = filename.replace('{last_version}', last_version).replace('{short_version}', short_version).replace('{nobeta_version}', nobeta_version)
             localfile = Path('files').joinpath(Path(filename).name)
             print(f"  * {localfile} ", end='')
 
+        if filename.endswith('.gz'):
+            is_gz, is_zip = True, False
+        elif filename.endswith('.zip'):
+            is_gz, is_zip = False, True
+        else:
+            is_gz, is_zip = False, False
+
         urldl = f'https://github.com/{reponame}/releases/download/{last_version}/{filename}'
 
         if not localfile.exists():
             content = requests.get(urldl, auth=credz).content
             if is_gz:
-                extract_bin('gz', binpath, localfile, content)
+                extract_bin('gz', inpath, localfile, content)
+            elif is_zip:
+                extract_bin('zip', inpath, localfile, content)
             else:
                 with open(localfile, 'wb') as f:
                     f.write(content)
@@ -124,7 +138,9 @@ def githubreleasesync(reponame, repoinfo, credz):
             else:
                 content = requests.get(urldl, auth=credz).content
                 if is_gz:
-                    extract_bin('gz', binpath, localfile, content)
+                    extract_bin('gz', inpath, localfile, content)
+                elif is_zip:
+                    extract_bin('zip', inpath, localfile, content)
                 else:
                     with open(localfile, 'wb') as f:
                         f.write(content)
@@ -191,6 +207,103 @@ def ncatsync(conf):
         json.dump(data, jsonfile, indent=4)
 
 
+def netcatsync(conf):
+    # https://eternallybored.org/misc/netcat/ seems to be the most stable from all tested. (04/2022)
+    r = requests.get('https://eternallybored.org/misc/netcat/')
+    soup = BeautifulSoup(r.content, 'lxml')
+    versions = []
+    for link in soup.find_all('a', {'href': re.compile('netcat.+win.+')}):
+        version = link['href'].split('-')[-1].split('.zip')[0]
+        versions.append(version)
+
+    last_version = max(versions)
+    local_version = conf['local_version']
+
+    for filename in conf['files']:
+        # nc64.exe is also available in the archive feel free to add it.
+        localfile = Path('files').joinpath(Path(filename).name)
+        print(f"  * {localfile} ", end='')
+
+        archtype = 'zip'
+        binpath = filename
+        destpath = f'files/{filename}'
+        urldl = f'https://eternallybored.org/misc/netcat/netcat-win32-{last_version}.zip'
+
+        if not localfile.exists():
+            content = requests.get(urldl).content
+            extract_bin(archtype, binpath, destpath, content)
+
+            print('-> Installed! ;)')
+        else:
+            if local_version == last_version:
+                print('-> Up-to-date.')
+
+            else:
+                content = requests.get(urldl).content
+                extract_bin(archtype, binpath, destpath, content)
+
+                with open("config.json", "r") as jsonfile:
+                    data = json.load(jsonfile)
+
+                data['netcat']['local_version'] = last_version
+
+                with open("config.json", "w") as jsonfile:
+                    json.dump(data, jsonfile, indent=4)
+                print('-> Updated!')
+
+    with open("config.json", "r") as jsonfile:
+        data = json.load(jsonfile)
+
+    data['netcat']['local_version'] = last_version
+
+    with open("config.json", "w") as jsonfile:
+        json.dump(data, jsonfile, indent=4)
+
+
+def plinksync(conf):
+    r = requests.get('https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html')
+    last_version = r.text.split('PuTTY.\nCurrently this is ')[1].split(', ')[0]
+    local_version = conf['local_version']
+
+    for filename in conf['files']:
+        localfile = Path('files').joinpath(Path(filename).name)
+        print(f"  * {localfile} ", end='')
+
+        urldl = 'https://the.earth.li/~sgtatham/putty/latest/w32/plink.exe'
+
+        if not localfile.exists():
+            content = requests.get(urldl).content
+            with open(localfile, 'wb') as f:
+                f.write(content)
+
+            print('-> Installed! ;)')
+        else:
+            if local_version == last_version:
+                print('-> Up-to-date.')
+
+            else:
+                content = requests.get(urldl).content
+                with open(localfile, 'wb') as f:
+                    f.write(content)
+
+                with open("config.json", "r") as jsonfile:
+                    data = json.load(jsonfile)
+
+                data['plink']['local_version'] = last_version
+
+                with open("config.json", "w") as jsonfile:
+                    json.dump(data, jsonfile, indent=4)
+                print('-> Updated!')
+
+    with open("config.json", "r") as jsonfile:
+        data = json.load(jsonfile)
+
+    data['plink']['local_version'] = last_version
+
+    with open("config.json", "w") as jsonfile:
+        json.dump(data, jsonfile, indent=4)
+
+
 def update(config):
     print("Updating...")
     with open("credz.json", "r") as jsonfile:
@@ -203,7 +316,9 @@ def update(config):
     for reponame, repoinfo in config['githubreleasesync'].items():
         githubreleasesync(reponame, repoinfo, credz)
 
-    ncatsync(config['ncat'])
+    # ncatsync(config['ncat'])
+    netcatsync(config['netcat'])
+    plinksync(config['plink'])
     make_executable()
 
 
@@ -366,21 +481,34 @@ def menu_choice(menu_options):
         elif option == 3:
             listen_smb(files_dir, 2)
         elif option == 0:
-            sys.exit('Quitting')
+            print('Quitting')
+            sys.exit()
         else:
             print('Invalid option. Please enter a valid number.')
 
 
 if __name__ == '__main__':
+
+    chdir(Path(__file__).resolve().parent)  # Change current dir to source location
+
+    parser = argparse.ArgumentParser(description='Sync your files and starts a listener on HTTP, SMB or SMB2.')
+    parser.add_argument('-u', '--update', action='store_true', help='update your files (described in config.json)')
+    args = parser.parse_args()
+
     with open("config.json", "r") as jsonfile:
         config = json.load(jsonfile)
 
+    if args.update:
         update(config)
     tmp = Path('files/tmp')
     is_empty = not any(tmp.iterdir())
     if not is_empty:
         if yes_or_no("The folder 'files/tmp' is not empty. Would you like to remove the content ?", default="no"):
-            rmtree(tmp)
+            for p in tmp.iterdir():
+                if p.is_dir():
+                    rmtree(p)
+                else:
+                    p.unlink()
 
     print('Choose a service to start a listener:')
     menu_options = {