REW-sploit/rew-sploit.py at main · joel-correa/REW-sploit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
#!/usr/bin/env python
# coding=utf-8

import argparse
import random
import sys

import cmd2
from cmd2 import style, fg, bg
from colorama import Fore, Back, Style

version = '0.2'


class RewSploit(cmd2.Cmd):
    """ REW-sploit """

    # Setting this true makes it run a shell command if a cmd2/cmd command doesn't exist
    # default_to_shell = True
    REWSPLOIT_CATEGORY = 'REW-sploit Commands'

    def __init__(self):
        hist_file = '~/.rew-sploit_history'
        shortcuts = cmd2.DEFAULT_SHORTCUTS
        shortcuts.update({'&': 'speak'})
        super().__init__(multiline_commands=['orate'], shortcuts=shortcuts,
                         persistent_history_file=hist_file, persistent_history_length=100)

        self.intro = style('\n\n    __ __     ____  ____  __     __  __  ____ \n   / // /___ / ___)(  _ \(  )   /  \(  )(_  _)\n  ( (( ((___)\___ \ ) __// (_/\(  O ))(   )(\n   \_\\_\     (____/(__)  \____/ \__/(__) (__)\n\n                                 \n                                 Version: ' + version + '\n\n',
                           fg=fg.blue, bg=bg.black, bold=True)
        self.prompt = style('(REW-sploit)<< ', fg=fg.magenta)
        self.default_category = 'Utility Commands'

    #######################################
    # Module meterpreter_reverse_tcp
    #######################################
    met_rev_tcp_parser = argparse.ArgumentParser()
    met_rev_tcp_parser.add_argument('-f', '--file', type=ascii, help='PCAP file name',
                                    required=True)
    met_rev_tcp_parser.add_argument('-i', '--ip', type=ascii, help='Meterpreter C2 IP',
                                    required=True)
    met_rev_tcp_parser.add_argument('-p', '--port', type=int, help='Meterpreter C2 Port (default: 4444)',
                                    default=4444)

    @cmd2.with_category(REWSPLOIT_CATEGORY)
    @cmd2.with_argparser(met_rev_tcp_parser)
    def do_meterpreter_reverse_tcp(self, args):
        """
        Identify and try to decrypt the Meterpreter TCP session (AES encrypted)
        """

        plugin = __import__('modules.meterpreter_reverse_tcp')
        plugin.meterpreter_reverse_tcp.module_main(self=self, ip=args.ip,
                                                   port=args.port, file=args.file)

        return

    #######################################
    # Module meterpreter_reverse_http
    #######################################
    @cmd2.with_category(REWSPLOIT_CATEGORY)
    def do_meterpreter_reverse_http(self, args):
        """
        Identify and try to decrypt the Meterpreter HTTP session (AES encrypted)
        """

        self.poutput(Fore.RED + '[+] Not implemented yet' + Style.RESET_ALL)
        return

    #######################################
    # Module meterpreter_reverse_https
    #######################################
    @cmd2.with_category(REWSPLOIT_CATEGORY)
    def do_meterpreter_reverse_https(self, args):
        """
        Identify and try to decrypt the Meterpreter HTTPS session (AES encrypted)
        """

        self.poutput(Fore.RED + '[+] Not implemented yet' + Style.RESET_ALL)
        return

    #######################################
    # Module emulate_payload
    #######################################
    emulate_payload_parser = argparse.ArgumentParser()
    emulate_payload_parser.add_argument('-P', '--payload', type=ascii, help='Payload binary file',
                                        required=True)
    emulate_payload_parser.add_argument('-f', '--file', type=ascii, help='PCAP file name',
                                        default='')
    emulate_payload_parser.add_argument('-i', '--ip', type=ascii, help='Meterpreter C2 IP',
                                        default='0.0.0.0')
    emulate_payload_parser.add_argument('-p', '--port', type=int, help='Meterpreter C2 Port (default: 4444)',
                                        default=4444)
    emulate_payload_parser.add_argument('-a', '--arch', type=ascii, help='Architecture (x86 or x64)',
                                        default='x86')
    emulate_payload_parser.add_argument('-d', '--debug', action='count', help='Enable debug (more d, more infos)',
                                        default=0)
    emulate_payload_parser.add_argument('-F', '--fixups', action='store_true', help='Enable Unicorn Fixups',
                                        default=False)
    emulate_payload_parser.add_argument('-T', '--thread', action='store_true', help='Dump CreateThread API content from lpStartAddress',
                                        default=False)
    emulate_payload_parser.add_argument('-W', '--writefile', action='store_true', help='Dump WriteFile API content',
                                        default=False)
    emulate_payload_parser.add_argument('-E', '--exportname', type=ascii, help='DLL Export to emulate',
                                        default=None)

    @cmd2.with_category(REWSPLOIT_CATEGORY)
    @cmd2.with_argparser(emulate_payload_parser)
    def do_emulate_payload(self, args):
        """
        Emulate payload to decode encryption keys and decode the payload from PCAP
        """
        plugin = __import__('modules.emulate_payload')
        plugin.emulate_payload.module_main(self=self, ip=args.ip, port=args.port,
                                           payload=args.payload, file=args.file, arch=args.arch,
                                           debug=args.debug, fixups=args.fixups,
                                           thread=args.thread, writefile=args.writefile,
                                           exportname=args.exportname)
        return


if __name__ == '__main__':
    c = RewSploit()
    sys.exit(c.cmdloop())