search

cobbr / ObfuscatedEmpire

ObfuscatedEmpire is a fork of Empire with Invoke-Obfuscation integrated directly into it's functionality.
https://cobbr.io/ObfuscatedEmpire.html
BSD 3-Clause "New" or "Revised" License
229 stars 32 forks source link

Mapi Listener does not like the "obfuscate" argument #14

Open sharpbazil opened 7 years ago

sharpbazil commented 7 years ago

(on Ubuntu 16.04) Always found the MAPI listener/stager to be finnicky, and it doesn't seem to like most things about being included with empire. This particular issue appears unique to ObfuscatedEmpire. The error is on generation of any powershell stager for the MAPI listener: [!] Exception: generate_launcher() got an unexpected keyword argument 'obfuscate' Might just be a quick fix to delete wherever that argument is sent to the MAPI stager generation code.

cjensenius commented 7 years ago

This issue exists in the http_foreign listener when using obfuscation in generate_launcher, I removed the extra argument and this resolved the issue.

cobbr commented 7 years ago

@sharpbazil Thanks for the report, sorry I haven't had a change to take a look. I'll take a look when I get a chance.

@cjensenius If you have a fix for this, could you submit a PR so I can understand how you fixed it?

cjensenius commented 7 years ago

@cobbr, no problem I will send a PR sometime tomorrow after testing, though in my haste earlier I neglected to notice that @sharpbazil has a simple function signature issue which is distinct from the issue I ran into. Would you prefer a PR for each issue separately?

OP issue (I think): The mapi listener is missing the obfuscate named argument but it is receiving it (line 154) def generate_launcher(self, encode=True, userAgent='default', proxy='default', proxyCreds='default', stagerRetries='0', language=None, safeChecks='', listenerName=None):

My change to the foreign listener was to line 232 of https://github.com/cobbr/ObfuscatedEmpire/blob/master/lib/listeners/http_foreign.py

stager = helpers.obfuscate(stager, self.mainMenu.installPath, obfuscationCommand=obfuscationCommand) to stager = helpers.obfuscate(stager, obfuscationCommand=obfuscationCommand)

cobbr commented 7 years ago

@cjensenius Yeah, if you have identified two distinct issues, then it would probably be helpful to have a PR for each of them. Either way works though.