Havoc插件编写
配置文件的webhook支持discord，所以尝试使用钉钉和企业微信。
WebHook {
Discord {
Url = ""
AvatarUrl = ""
User = "announcer"
}
}服务端中判断如果配置了webhook会在自身添加agent之前就转发给discord了。
func (t *Teamserver) AgentAdd(Agent *agent.Agent) []*agent.Agent {
if Agent != nil {
if t.WebHooks != nil {
t.WebHooks.NewAgent(Agent.ToMap())
}
}
...
}可以看到在上线时，server的控制台上会有上线的信息。
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204822413-451631362.png
借鉴一个老哥的做法：起个子程序来开服务端，同时监听并捕获这个信息：
process = subprocess.Popen(['./havoc', 'server', '--profile', './profiles/havoc.yaotl', '-v', '--debug'],
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT,
text=True)
capture = False
// 获取到前四行即可
if " " in line:
capture = True
captured_text = ""
line_count = 0
continue
if capture:
if line_count < 5:
captured_text += line + '\n'
line_count += 1
else: #
send_messages('New connection!\n'+captured_text.strip())
capture = False然后根据官方文档 发送text类型的消息，markdown可以但是在微信中不能正常显示。
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204828187-1321460338.png
上面是markdown下面是text文本，代码也上传了：gayhub
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204828953-1287400511.png
但这样并不是很好，而翻官方文档，里面有提供对客户端api的详细说明，主要涉及到havoc和havocui这两个。
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204829753-1317717667.png
对于ui可以直接在客户端的console中尝试他的效果：
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204830354-952750075.png
像获取demons的数量可以用havoc.GetDemons()
文档中介绍了一些比较常用的api，在\client\src\Havoc\PythonApi有更多的调用方向，比如下面的：
PyMemberDef PyDemonClass_members[] = {
{ "Listener", T_STRING, offsetof( PyDemonClass, Listener ), 0, "Listener name" },
{ "DemonID", T_STRING, offsetof( PyDemonClass, DemonID ), 0, "Listener name" },
{ "ExternalIP", T_STRING, offsetof( PyDemonClass, ExternalIP ),0, "External IP" },
{ "InternalIP", T_STRING, offsetof( PyDemonClass, InternalIP ),0, "Internal IP" },
{ "User", T_STRING, offsetof( PyDemonClass, User ), 0, "Username" },
{ "Computer", T_STRING, offsetof( PyDemonClass, Computer ), 0, "Computer" },
{ "Domain", T_STRING, offsetof( PyDemonClass, Domain ), 0, "Domain" },
{ "OS", T_STRING, offsetof( PyDemonClass, OS ), 0, "Windows Version" },
{ "OSBuild", T_STRING, offsetof( PyDemonClass, OSBuild ), 0, "Windows OS Build" },
{ "OSArch", T_STRING, offsetof( PyDemonClass, OSArch ), 0, "Windows Architecture" },
{ "ProcessName", T_STRING, offsetof( PyDemonClass, ProcessName ), 0, "Process Name" },
{ "ProcessID", T_STRING, offsetof( PyDemonClass, ProcessID ), 0, "Process ID" },
{ "ProcessArch", T_STRING, offsetof( PyDemonClass, ProcessArch ), 0, "Process Architecture" },
{ "CONSOLE_INFO", T_INT, offsetof( PyDemonClass, CONSOLE_INFO ), 0, "Console message type info" },
{ "CONSOLE_ERROR",T_INT, offsetof( PyDemonClass, CONSOLE_ERROR ),0, "Console message type error" },
{ "CONSOLE_TASK", T_INT, offsetof( PyDemonClass, CONSOLE_TASK ), 0, "Console message type task" },
{ NULL },
};
PyMethodDef PyDemonClass_methods[] = {
{ "ConsoleWrite", ( PyCFunction ) DemonClass_ConsoleWrite, METH_VARARGS, "Prints messages to the demon sessions console" },
{ "ProcessCreate", ( PyCFunction ) DemonClass_ProcessCreate, METH_VARARGS, "Creates a Process" },
{ "InlineExecute", ( PyCFunction ) DemonClass_InlineExecute, METH_VARARGS, "Executes a coff file in the context of the demon sessions" },
{ "InlineExecuteGetOutput", ( PyCFunction ) DemonClass_InlineExecuteGetOutput, METH_VARARGS, "Executes a coff file in the context of the demon sessions and get the output via a callback" },
{ "DllSpawn", ( PyCFunction ) DemonClass_DllSpawn, METH_VARARGS, "Spawn and injects a reflective dll and get output from it" },
{ "DllInject", ( PyCFunction ) DemonClass_DllInject, METH_VARARGS, "Injects a reflective dll into a specified process" },
{ "DotnetInlineExecute", ( PyCFunction ) DemonClass_DotnetInlineExecute, METH_VARARGS, "Executes a dotnet assembly in the context of the demon sessions" },
{ "Command", ( PyCFunction ) DemonClass_Command, METH_VARARGS, "Run a command" },
{ "CommandGetOutput", ( PyCFunction ) DemonClass_CommandGetOutput, METH_VARARGS, "Run a command and retreive the output" },
{ "ShellcodeSpawn", ( PyCFunction ) DemonClass_ShellcodeSpawn, METH_VARARGS, "Executes shellcode spawning a new process" },
{ NULL },
};代码的逻辑也很简单，就是通过havoc.Demon(demon_id)获取到这个对象，抽出这里面的对象发送即可。代码可以去仓库看看。最终完成的效果如下：
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204835921-542610933.png
最后也是正常能提示了，传送门：gayhub（一起交流）
https://img2023.cnblogs.com/blog/3038812/202401/3038812-20240106204836660-2022950059.png
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！
页:
[1]