配置文件的webhook支持discord,所以尝试使用钉钉和企业微信。
WebHook { Discord { Url = "" AvatarUrl = "" User = "announcer" } }
服务端中判断如果配置了webhook会在自身添加agent之前就转发给discord了。
func (t *Teamserver) AgentAdd(Agent *agent.Agent) []*agent.Agent { if Agent != nil { if t.WebHooks != nil { t.WebHooks.NewAgent(Agent.ToMap()) } } ... }
可以看到在上线时,server的控制台上会有上线的信息。
借鉴一个老哥的做法:起个子程序来开服务端,同时监听并捕获这个信息:
process = subprocess.Popen(['./havoc', 'server', '--profile', './profiles/havoc.yaotl', '-v', '--debug'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True) capture = False // 获取到前四行即可 if "[DBUG] [agent.ParseDemonRegisterRequest:382]" in line: capture = True captured_text = "" line_count = 0 continue if capture: if line_count < 5: captured_text += line + '\n' line_count += 1 else: # send_messages('New connection!\n'+captured_text.strip()) capture = False
然后根据官方文档 发送text类型的消息,markdown可以但是在微信中不能正常显示。
上面是markdown下面是text文本,代码也上传了:gayhub
但这样并不是很好,而翻官方文档,里面有提供对客户端api的详细说明,主要涉及到havoc和havocui这两个。
对于ui可以直接在客户端的console中尝试他的效果:
像获取demons的数量可以用havoc.GetDemons()
文档中介绍了一些比较常用的api,在\client\src\Havoc\PythonApi
有更多的调用方向,比如下面的:
PyMemberDef PyDemonClass_members[] = { { "Listener", T_STRING, offsetof( PyDemonClass, Listener ), 0, "Listener name" }, { "DemonID", T_STRING, offsetof( PyDemonClass, DemonID ), 0, "Listener name" }, { "ExternalIP", T_STRING, offsetof( PyDemonClass, ExternalIP ), 0, "External IP" }, { "InternalIP", T_STRING, offsetof( PyDemonClass, InternalIP ), 0, "Internal IP" }, { "User", T_STRING, offsetof( PyDemonClass, User ), 0, "Username" }, { "Computer", T_STRING, offsetof( PyDemonClass, Computer ), 0, "Computer" }, { "Domain", T_STRING, offsetof( PyDemonClass, Domain ), 0, "Domain" }, { "OS", T_STRING, offsetof( PyDemonClass, OS ), 0, "Windows Version" }, { "OSBuild", T_STRING, offsetof( PyDemonClass, OSBuild ), 0, "Windows OS Build" }, { "OSArch", T_STRING, offsetof( PyDemonClass, OSArch ), 0, "Windows Architecture" }, { "ProcessName", T_STRING, offsetof( PyDemonClass, ProcessName ), 0, "Process Name" }, { "ProcessID", T_STRING, offsetof( PyDemonClass, ProcessID ), 0, "Process ID" }, { "ProcessArch", T_STRING, offsetof( PyDemonClass, ProcessArch ), 0, "Process Architecture" }, { "CONSOLE_INFO", T_INT, offsetof( PyDemonClass, CONSOLE_INFO ), 0, "Console message type info" }, { "CONSOLE_ERROR", T_INT, offsetof( PyDemonClass, CONSOLE_ERROR ), 0, "Console message type error" }, { "CONSOLE_TASK", T_INT, offsetof( PyDemonClass, CONSOLE_TASK ), 0, "Console message type task" }, { NULL }, }; PyMethodDef PyDemonClass_methods[] = { { "ConsoleWrite", ( PyCFunction ) DemonClass_ConsoleWrite, METH_VARARGS, "Prints messages to the demon sessions console" }, { "ProcessCreate", ( PyCFunction ) DemonClass_ProcessCreate, METH_VARARGS, "Creates a Process" }, { "InlineExecute", ( PyCFunction ) DemonClass_InlineExecute, METH_VARARGS, "Executes a coff file in the context of the demon sessions" }, { "InlineExecuteGetOutput", ( PyCFunction ) DemonClass_InlineExecuteGetOutput, METH_VARARGS, "Executes a coff file in the context of the demon sessions and get the output via a callback" }, { "DllSpawn", ( PyCFunction ) DemonClass_DllSpawn, METH_VARARGS, "Spawn and injects a reflective dll and get output from it" }, { "DllInject", ( PyCFunction ) DemonClass_DllInject, METH_VARARGS, "Injects a reflective dll into a specified process" }, { "DotnetInlineExecute", ( PyCFunction ) DemonClass_DotnetInlineExecute, METH_VARARGS, "Executes a dotnet assembly in the context of the demon sessions" }, { "Command", ( PyCFunction ) DemonClass_Command, METH_VARARGS, "Run a command" }, { "CommandGetOutput", ( PyCFunction ) DemonClass_CommandGetOutput, METH_VARARGS, "Run a command and retreive the output" }, { "ShellcodeSpawn", ( PyCFunction ) DemonClass_ShellcodeSpawn, METH_VARARGS, "Executes shellcode spawning a new process" }, { NULL }, };
代码的逻辑也很简单,就是通过havoc.Demon(demon_id)
获取到这个对象,抽出这里面的对象发送即可。代码可以去仓库看看。最终完成的效果如下:
最后也是正常能提示了,传送门:gayhub(一起交流)