From d519250becc809b6eec973f29ba662882de2d637 Mon Sep 17 00:00:00 2001 From: Bleon Proko Date: Wed, 24 Apr 2024 18:58:55 -0400 Subject: [PATCH] The rise of the new Nebula --- .dockerignore | 4 - .gitignore | 44 +- .idea/.gitignore | 6 +- .idea/{Nebula.iml => NewNebula.iml} | 29 +- .idea/inspectionProfiles/Project_Default.xml | 8 +- .idea/misc.xml | 12 +- .idea/modules.xml | 14 +- .idea/vcs.xml | 10 +- Dockerfile | 9 +- LICENSE | 2 + README.md | 169 +- ToDo.txt | 48 + client/Dockerfile | 17 + client/banner.py | 123 + client/client.py | 1856 + client/commands/aws_get_user_id.py | 14 + client/commands/get_iam_users.py | 20 + client/commands/get_misc_subdomains.py | 19 + client/core/RunAndPrintModule.py | 200 + {module => client/help}/__init__.py | 0 client/help/help.py | 127 + client/nebula | 3 + client/requirements.txt | 13 + .../AWS-ApplyAnsiblePlaybooks_Gituhub.txt | 0 .../AWS-ApplyAnsiblePlaybooks_S3.txt | 0 .../AWS-RunPowerShellScript.txt | 5 + .../AWS-RunRemoteScript.txt | 0 .../AWS-RunShellScript.txt | 0 .../AWS-RunPowerShellScript.txt | 0 .../AWS-RunShellScript.txt | 0 .../Dockerfile_download_particle_ubuntu | 0 {module/cleanup => client/tools}/__init__.py | 0 .../deploy_particle_container.yaml | 0 .../ansible/run_command_linux.yaml | 0 .../ansible/run_command_windows.yaml | 0 .../run_command_windows_powershell.yaml | 0 .../ansible/run_particle_linux.yaml | 0 .../ansible/run_particle_windows.yaml | 0 clientGUI/AddCredentials.py | 122 + clientGUI/FilterGraphListWidget.py | 26 + clientGUI/MainNebulaWindow.py | 1128 + clientGUI/MainNebulaWindow.py.bak | 706 + clientGUI/NebulaGUI.pyproject | 3 + clientGUI/NebulaGUI.pyproject.user | 219 + clientGUI/addCredentialWindow.ui | 592 + clientGUI/form.ui | 286 + {img => clientGUI}/logo.png | Bin clientGUI/mainwindow.ui | 1384 + clientGUI/nebula | 3 + clientGUI/requirements.txt | 10 + clientGUI/selectGraphFilterDialog.ui | 41 + clientGUI/widget.py | 86 + core/Agents/.idea/.gitignore | 8 + core/Agents/.idea/Agents.iml | 9 + core/Agents/.idea/modules.xml | 8 + core/Agents/.idea/vcs.xml | 6 + core/Agents/Particles.py | 34 + core/Agents/WebsocketGOAgent/agent.exe | Bin 0 -> 6199808 bytes core/Agents/WebsocketGOAgent/agent.go | 85 + core/Agents/WebsocketGOAgent/go.mod | 5 + core/Agents/WebsocketGOAgent/go.sum | 2 + core/Agents/go_build_Agents.exe | 1 + core/Agents/particle_app.py | 20 + core/Agents/particle_modules.py | 21 + .../Listeners/HTTP/core/models/Tasks.py | 0 core/Listeners/HTTP/database/db.py | 6 + core/Listeners/HTTP/database/models.py | 40 + core/Listeners/HTTP/http_listener.py | 43 + .../__pycache__/server.cpython-310.pyc | Bin 0 -> 1265 bytes core/Listeners/WebSocket/client.py | 16 + core/Listeners/WebSocket/server.py | 33 + core/Listeners/WebSocket/server_old.py | 21 + core/Listeners/WebSocket/server_socket_io.py | 68 + core/Listeners/WebSocket/threaded.py | 24 + {module/detectionbypass => core}/__init__.py | 0 core/__pycache__/__init__.cpython-310.pyc | Bin 0 -> 136 bytes core/auth/auth_azuread.py | 62 + core/auth/azure_wellknown_client_ids.py | 60 + core/banner/__pycache__/banner.cpython-38.pyc | Bin 8505 -> 0 bytes core/banner/__pycache__/banner.cpython-39.pyc | Bin 8425 -> 0 bytes core/banner/banner.py | 251 - core/colorpp/colorpp.py | 120 + .../commands/aws_get_user_id.py | 0 core/containers/Dockerfile_mongo | 104 + core/createSession/giveMeClient.py | 224 + core/database/db.py | 6 + core/database/models.py | 272 + core/database/models.py.bak | 232 + .../enum_user_privs.cpython-38.pyc | Bin 7798 -> 0 bytes .../enum_user_privs.cpython-39.pyc | Bin 6878 -> 0 bytes .../__pycache__/getuid.cpython-38.pyc | Bin 3792 -> 0 bytes .../__pycache__/getuid.cpython-39.pyc | Bin 4784 -> 0 bytes .../all_list_and_describe_calls.py | 4157 + core/enum_user_privs/enum_privesc.py | 143 +- .../enum_user_privs_on_services/s3.py | 74 + .../policy_reference_read.py | 182 + .../policy_reference_write.py | 304 + core/enum_user_privs/enum_user_privs.py | 68 +- core/enum_user_privs/getuid.py | 297 - core/enum_user_privs/getuid_aws.py | 303 + core/enum_user_privs/getuid_aws_ssmrole.py | 105 + core/enum_user_privs/getuid_azuread.py | 128 + core/help/__pycache__/help.cpython-38.pyc | Bin 5503 -> 0 bytes core/help/__pycache__/help.cpython-39.pyc | Bin 5523 -> 0 bytes core/help/help.py | 119 - core/img/logo.png | Bin 0 -> 126796 bytes core/misc/Regions.py | 20 + core/models/AWSCredentials.py | 90 + core/models/AWSIAM.py | 28 + core/models/AZURECredentials.py | 71 + core/models/ClientCommands.py | 49 + core/models/Cosmonaut.py | 78 + core/models/DigitalOceanCredentials.py | 71 + core/models/Domains.py | 30 + core/models/Listeners.py | 105 + core/models/Modules.py | 314 + core/models/Particles.py | 43 + {module/exploit => core/module}/__init__.py | 0 {module => core/module}/aws_template.py | 0 .../module/cleanup}/__init__.py | 0 .../cleanup/aws_iam_delete_access_key.py | 0 .../cleanup/aws_iam_delete_login_profile.py | 0 .../module}/cleanup/aws_s3_delete_bucket.py | 0 .../module/detection}/__init__.py | 0 .../module/detectionbypass}/__init__.py | 0 .../aws_detectionbypass_stop_logging.py | 0 .../aws_detectionbypass_update_trail.py | 0 {module/misc => core/module/enum}/__init__.py | 0 .../module/enum/__not_done_yet}/__init__.py | 0 .../aws_cloudtrail_list_trails.py | 0 .../enum/__not_done_yet}/aws_ec2_enum_all.py | 0 .../aws_ec2_enum_elastic_ips.py | 0 .../__not_done_yet}/aws_ec2_enum_images.py | 0 .../__not_done_yet}/aws_ec2_enum_instance.py | 0 .../aws_ec2_enum_launch_templates.py | 0 .../aws_ec2_enum_public_ipv4_ip_pools.py | 0 .../aws_ec2_enum_security_groups.py | 0 .../__not_done_yet}/aws_ec2_enum_snapshots.py | 0 .../__not_done_yet}/aws_ec2_enum_user_data.py | 0 .../aws_ec2_get_launch_template.py | 0 .../aws_ecr_describe_images.py | 0 .../enum/__not_done_yet}/aws_ecr_enum_all.py | 0 .../__not_done_yet}/aws_ecr_list_images.py | 0 .../enum/__not_done_yet}/aws_iam_enum_all.py | 15 +- .../__not_done_yet/aws_iam_enum_privesc.py | 258 + .../aws_iam_enum_role_permissions.py | 0 .../aws_iam_enum_users_just_in_case.py | 404 + .../aws_iam_get_access_key_last_used.py | 0 .../aws_iam_get_account_password_policy.py | 0 .../aws_iam_get_account_summary.py | 0 .../enum/__not_done_yet}/aws_iam_get_group.py | 0 .../aws_iam_get_instance_profile.py | 0 .../aws_iam_get_login_profile.py | 0 .../__not_done_yet}/aws_iam_get_policy.py | 0 .../enum/__not_done_yet}/aws_iam_get_role.py | 0 .../enum/__not_done_yet/aws_iam_get_user.py | 205 + .../aws_iam_get_user_details.py | 0 .../aws_iam_list_access_keys.py | 0 .../aws_iam_list_entities_for_policy.py | 0 .../aws_iam_list_group_policies.py | 0 .../__not_done_yet}/aws_iam_list_groups.py | 0 .../aws_iam_list_instance_profiles.py | 0 .../aws_iam_list_mfa_devices.py | 0 .../__not_done_yet}/aws_iam_list_roles.py | 0 .../aws_iam_list_user_policies.py | 0 .../aws_iam_list_virtual_mfa_devices.py | 0 .../__not_done_yet}/aws_lambda_enum_all.py | 0 .../aws_lambda_get_account_settings.py | 0 .../aws_lambda_get_function.py | 0 .../__not_done_yet}/aws_lambda_get_policy.py | 0 .../aws_lambda_list_function_alias.py | 0 .../aws_lambda_list_functions.py | 0 .../__not_done_yet}/aws_route53_get_dnssec.py | 0 .../aws_route53_get_hosted_zone.py | 0 .../aws_route53_list_hosted_zones.py | 0 ...s_route53_list_hosted_zones_by_dns_host.py | 0 .../aws_route53_list_hosted_zones_by_vpc.py | 0 .../enum/__not_done_yet}/aws_s3_enum_all.py | 0 .../aws_s3_get_bucket_logging.py | 0 .../aws_s3_get_bucket_policy.py | 0 .../aws_s3_get_bucket_policy_status.py | 0 .../__not_done_yet}/aws_s3_get_object_acl.py | 0 .../__not_done_yet}/aws_s3_list_buckets.py | 0 .../__not_done_yet}/aws_s3_list_objects.py | 0 .../__not_done_yet}/aws_ssm_get_document.py | 0 .../aws_ssm_list_associations.py | 0 .../__not_done_yet}/aws_ssm_list_commands.py | 0 .../__not_done_yet}/aws_ssm_list_documents.py | 0 .../aws_sts_get_access_key_info.py | 0 .../__not_done_yet}/aws_sts_get_user_id.py | 0 .../aws_support_describe_cases.py | 0 .../aws_enum_services_using_cost_explorer.py | 60 + core/module/enum/aws_iam_enum_groups.py | 212 + core/module/enum/aws_iam_enum_users.py | 506 + ...ws_misc_amazonec2roleforssm_permissions.py | 136 + .../enum/aws_misc_privilege_enumeration.py | 192 + .../module/enum/aws_s3_list_bucket_objects.py | 85 + core/module/enum/aws_s3_list_deleted_files.py | 85 + .../enum/digitalocean_space_enum_all.py | 255 + ...digitalocean_space_list_deleted_objects.py | 90 + .../module/enum/office365_enum_aad_objects.py | 148 + .../module/enum/office365_enum_admin_Users.py | 95 + .../enum/office365_enum_current_user.py | 194 + ...365_find_groups_with_dynamic_membership.py | 150 + .../enum/office365_get_group_members.py | 58 + core/module/enum/office365_get_user_list.py | 78 + .../office365_get_user_passsword_policy.py | 91 + core/module/enum/office365_list_groups.py | 52 + .../office365_list_mfa_status_for_users.py | 52 + core/module/enum/office365_list_users.py | 52 + core/module/exploit/__AMI_Images.py | 279232 +++++++++++++++ .../module/exploit}/__init__.py | 0 core/module/exploit/__wellKnownApps.json | 81 + .../aws_ec2_create_instance_with_user_data.py | 0 .../exploit/aws_ec2_modify_user_data.py | 0 .../aws_iam_create_user_login_profile.py | 2 +- .../exploit/aws_lambda_create_function.py | 136 +- .../exploit/aws_lambda_invoke_function.py | 0 .../module}/exploit/aws_s3_create_bucket.py | 0 .../module}/exploit/aws_s3_download_object.py | 6 + .../aws_s3_get_object_with_presigned_url.py | 124 + ..._upload_object_with_presigned_post_data.py | 124 + core/module/exploit/aws_ssm_send_command.py | 224 + .../exploit/aws_ssm_send_run_shell_command.py | 587 + .../module}/exploit/aws_ssm_start_session.py | 37 +- .../module}/exploit/aws_sts_assume_role.py | 0 .../aws_sts_assume_role_with_web_identity.py | 0 core/module/exploit/azure_ad_malicious.py | 216 + core/module/exploit/azure_adfs_spray.py | 275 + .../exploit/azuread_device_code_phish.py | 241 + .../exploit/azuread_device_code_phish_2.py | 215 + core/module/exploit/azuread_password_spray.py | 401 + .../digitalocean_space_download_object.py | 64 + .../exploit/office365_add_user_to_group.py | 72 + .../module/lateralmovement}/__init__.py | 0 .../module/listeners}/__init__.py | 0 .../module/listeners/__listeners}/__init__.py | 0 .../__listeners/aws_python_tcp_server.py | 0 .../aws_python_tcp_xor_encrypted_listener.py | 0 {ssh_keys => core/module/misc}/__init__.py | 0 .../misc/aws_phishing_email_campain.py | 0 .../misc/aws_s3_bucket_name_generator.py | 136 + .../misc/azure_service_basename_generator.py | 168 + .../misc/misc_email_username_generator.py | 136 + .../module/persistence}/__init__.py | 0 .../aws_iam_create_user_access_key.py | 67 + .../aws_iam_modify_user_access_key.py | 0 core/module/postexploitation/__init__.py | 0 .../aws_create_console_url.py | 182 + .../aws_lambda_download_function.py | 118 + core/module/privesc/__init__.py | 0 core/module/reconnaissance/__init__.py | 0 .../__ip_source/AWS_IP_Ranges.py | 15961 + .../__ip_source/Azure_IP_Ranges.py | 0 .../reconnaissance/__ip_source/DOIPRange.py | 6698 + .../__ip_source/DigitalOcean_IP_Ranges.csv | 0 .../__ip_source/GCP_IP_Ranges.py | 2 +- .../reconnaissance/__ip_source/IBM.txt | 0 .../__ip_source/O365_IP_Ranges.py | 444 +- .../reconnaissance/__ip_source/__init__.py | 0 .../reconnaissance/__ip_source/ip_ranges.py | 0 .../reconnaissance/__lists/dns_20000.txt | 19999 ++ .../reconnaissance/aws_account_id_fuzzer.py | 0 .../aws_iam_unauth_user_enum.py | 2 +- .../aws_s3_bucket_name_fuzzer.py | 233 + .../aws_s3_bucket_name_fuzzer_gui.py | 234 + .../reconnaissance/azure_check_azure_usage.py | 109 + .../azure_fuzz_aks_api_server.py | 194 + .../reconnaissance/azure_fuzz_storages.py | 167 + .../azure_service_dns_fuzzer.py | 301 + .../azuread_unauth_user_enum.py | 122 + .../digitalocean_space_bucket_name_fuzzer.py | 238 + .../reconnaissance/gcp_bucket_name_fuzzer.py | 186 + core/module/reconnaissance/misc_crtsh.py | 69 + .../module/reconnaissance/misc_dns_fuzzing.py | 69 + .../reconnaissance/misc_find_ip_category.py | 201 + .../misc_find_ip_category_copy.py | 214 + .../module}/reconnaissance/misc_gitdumper.py | 0 .../reconnaissance/misc_grayhatwarfare.py | 179 + core/module/stager/__init__.py | 0 core/module/stager/__revshell/__init__.py | 0 core/module/stager/__revshell/aws_go_tcp.exe | Bin 0 -> 6799360 bytes .../module/stager/__revshell/aws_linux_go_tcp | Bin 0 -> 7276905 bytes .../stager/__revshell/aws_linux_go_tcp.go | 346 + .../stager/__revshell/aws_python_tcp.py | 0 .../stager/__revshell/aws_windows_go_tcp.go | 723 +- .../stager/aws_python_tcp_xor_encrypted.py | 2 +- core/printcolor/coloring.py | 46 + .../__pycache__/run_aws_module.cpython-38.pyc | Bin 3150 -> 0 bytes .../__pycache__/run_aws_module.cpython-39.pyc | Bin 3144 -> 0 bytes .../run_azure_module.cpython-38.pyc | Bin 417 -> 0 bytes .../run_azure_module.cpython-39.pyc | Bin 535 -> 0 bytes .../__pycache__/run_gcp_module.cpython-38.pyc | Bin 328 -> 0 bytes .../__pycache__/run_gcp_module.cpython-39.pyc | Bin 360 -> 0 bytes core/run_module/azure_client_ids.py | 64 + core/run_module/run_aws_module.py | 146 +- core/run_module/run_azure_module.py | 6 +- core/run_module/run_azuread_module.py | 19 + core/run_module/run_digitalocean_module.py | 103 + core/run_module/run_gcp_module.py | 7 +- core/run_module/run_office365_module.py | 22 + .../set_azuread_credentials.py | 151 + .../set_azuread_credentials_2.py | 149 + dockercompose.yaml | 49 + install.bat | 28 + install.sh | 122 + less_binary/less.exe | Bin 327168 -> 0 bytes main.py | 2026 - module/__pycache__/__init__.cpython-38.pyc | Bin 114 -> 0 bytes module/__pycache__/__init__.cpython-39.pyc | Bin 146 -> 0 bytes module/enum/aws_ec2_enum_instances.py | 211 - module/enum/aws_iam_get_user.py | 97 - module/enum/aws_iam_list_users.py | 89 - module/exploit/aws_ssm_send_command.py | 336 - .../__pycache__/__init__.cpython-39.pyc | Bin 177 -> 0 bytes .../aws_python_tcp_server.cpython-39.pyc | Bin 6456 -> 0 bytes .../aws_phishing_email_campain.cpython-39.pyc | Bin 3080 -> 0 bytes .../__ip_source/AWS_IP_Ranges.py | 33499 -- .../__pycache__/AWS_IP_Ranges.cpython-39.pyc | Bin 215904 -> 0 bytes .../__pycache__/ip_ranges.cpython-39.pyc | Bin 215896 -> 0 bytes module/reconnaissance/aws_find_ip_category.py | 214 - .../aws_s3_bucket_name_fuzzer.py | 157 - module/reconnaissance/azure_check_azuread.py | 110 - .../azuread_unauth_user_enum.py | 121 - module/reconnaissance/misc_crtsh.py | 114 - module/stager/__revshell/aws_go_tcp.go | 215 - nebula | 3 - requirements.txt | 78 +- teamserver | 76 + teamserver.conf | 1 + teamserver.py | 411 + .../AWS-RunPowerShellScript.txt | 5 - uploads/__init__.py | 0 333 files changed, 348749 insertions(+), 38854 deletions(-) delete mode 100644 .dockerignore rename .idea/{Nebula.iml => NewNebula.iml} (70%) create mode 100644 ToDo.txt create mode 100644 client/Dockerfile create mode 100644 client/banner.py create mode 100644 client/client.py create mode 100644 client/commands/aws_get_user_id.py create mode 100644 client/commands/get_iam_users.py create mode 100644 client/commands/get_misc_subdomains.py create mode 100644 client/core/RunAndPrintModule.py rename {module => client/help}/__init__.py (100%) create mode 100644 client/help/help.py create mode 100644 client/nebula create mode 100644 client/requirements.txt rename {tools => client/tools}/__SSM_send_command_parameter_files/AWS-ApplyAnsiblePlaybooks_Gituhub.txt (100%) rename {tools => client/tools}/__SSM_send_command_parameter_files/AWS-ApplyAnsiblePlaybooks_S3.txt (100%) create mode 100644 client/tools/__SSM_send_command_parameter_files/AWS-RunPowerShellScript.txt rename {tools => client/tools}/__SSM_send_command_parameter_files/AWS-RunRemoteScript.txt (100%) rename {tools => client/tools}/__SSM_send_command_parameter_files/AWS-RunShellScript.txt (100%) rename {tools/__SSM_send_command_parameter_files => client/tools/__SSM_start_session_parameter_files}/AWS-RunPowerShellScript.txt (100%) rename {tools => client/tools}/__SSM_start_session_parameter_files/AWS-RunShellScript.txt (100%) rename {tools => client/tools}/__dockerfiles/Dockerfile_download_particle_ubuntu (100%) rename {module/cleanup => client/tools}/__init__.py (100%) rename {tools => client/tools}/__kubernetes_deployment_files/deploy_particle_container.yaml (100%) rename {tools => client/tools}/__playbooks/ansible/run_command_linux.yaml (100%) rename {tools => client/tools}/__playbooks/ansible/run_command_windows.yaml (100%) rename {tools => client/tools}/__playbooks/ansible/run_command_windows_powershell.yaml (100%) rename {tools => client/tools}/__playbooks/ansible/run_particle_linux.yaml (100%) rename {tools => client/tools}/__playbooks/ansible/run_particle_windows.yaml (100%) create mode 100644 clientGUI/AddCredentials.py create mode 100644 clientGUI/FilterGraphListWidget.py create mode 100644 clientGUI/MainNebulaWindow.py create mode 100644 clientGUI/MainNebulaWindow.py.bak create mode 100644 clientGUI/NebulaGUI.pyproject create mode 100644 clientGUI/NebulaGUI.pyproject.user create mode 100644 clientGUI/addCredentialWindow.ui create mode 100644 clientGUI/form.ui rename {img => clientGUI}/logo.png (100%) create mode 100644 clientGUI/mainwindow.ui create mode 100644 clientGUI/nebula create mode 100644 clientGUI/requirements.txt create mode 100644 clientGUI/selectGraphFilterDialog.ui create mode 100644 clientGUI/widget.py create mode 100644 core/Agents/.idea/.gitignore create mode 100644 core/Agents/.idea/Agents.iml create mode 100644 core/Agents/.idea/modules.xml create mode 100644 core/Agents/.idea/vcs.xml create mode 100644 core/Agents/Particles.py create mode 100644 core/Agents/WebsocketGOAgent/agent.exe create mode 100644 core/Agents/WebsocketGOAgent/agent.go create mode 100644 core/Agents/WebsocketGOAgent/go.mod create mode 100644 core/Agents/WebsocketGOAgent/go.sum create mode 100644 core/Agents/go_build_Agents.exe create mode 100644 core/Agents/particle_app.py create mode 100644 core/Agents/particle_modules.py rename module/detection/__init__.py => core/Listeners/HTTP/core/models/Tasks.py (100%) create mode 100644 core/Listeners/HTTP/database/db.py create mode 100644 core/Listeners/HTTP/database/models.py create mode 100644 core/Listeners/HTTP/http_listener.py create mode 100644 core/Listeners/WebSocket/__pycache__/server.cpython-310.pyc create mode 100644 core/Listeners/WebSocket/client.py create mode 100644 core/Listeners/WebSocket/server.py create mode 100644 core/Listeners/WebSocket/server_old.py create mode 100644 core/Listeners/WebSocket/server_socket_io.py create mode 100644 core/Listeners/WebSocket/threaded.py rename {module/detectionbypass => core}/__init__.py (100%) create mode 100644 core/__pycache__/__init__.cpython-310.pyc create mode 100644 core/auth/auth_azuread.py create mode 100644 core/auth/azure_wellknown_client_ids.py delete mode 100644 core/banner/__pycache__/banner.cpython-38.pyc delete mode 100644 core/banner/__pycache__/banner.cpython-39.pyc delete mode 100644 core/banner/banner.py create mode 100644 core/colorpp/colorpp.py rename module/enum/__init__.py => core/commands/aws_get_user_id.py (100%) create mode 100644 core/containers/Dockerfile_mongo create mode 100644 core/createSession/giveMeClient.py create mode 100644 core/database/db.py create mode 100644 core/database/models.py create mode 100644 core/database/models.py.bak delete mode 100644 core/enum_user_privs/__pycache__/enum_user_privs.cpython-38.pyc delete mode 100644 core/enum_user_privs/__pycache__/enum_user_privs.cpython-39.pyc delete mode 100644 core/enum_user_privs/__pycache__/getuid.cpython-38.pyc delete mode 100644 core/enum_user_privs/__pycache__/getuid.cpython-39.pyc create mode 100644 core/enum_user_privs/all_list_and_describe_calls.py create mode 100644 core/enum_user_privs/enum_privesc_files/enum_user_privs_on_services/s3.py create mode 100644 core/enum_user_privs/enum_privesc_files/policy_reference_read.py create mode 100644 core/enum_user_privs/enum_privesc_files/policy_reference_write.py delete mode 100644 core/enum_user_privs/getuid.py create mode 100644 core/enum_user_privs/getuid_aws.py create mode 100644 core/enum_user_privs/getuid_aws_ssmrole.py create mode 100644 core/enum_user_privs/getuid_azuread.py delete mode 100644 core/help/__pycache__/help.cpython-38.pyc delete mode 100644 core/help/__pycache__/help.cpython-39.pyc delete mode 100644 core/help/help.py create mode 100644 core/img/logo.png create mode 100644 core/misc/Regions.py create mode 100644 core/models/AWSCredentials.py create mode 100644 core/models/AWSIAM.py create mode 100644 core/models/AZURECredentials.py create mode 100644 core/models/ClientCommands.py create mode 100644 core/models/Cosmonaut.py create mode 100644 core/models/DigitalOceanCredentials.py create mode 100644 core/models/Domains.py create mode 100644 core/models/Listeners.py create mode 100644 core/models/Modules.py create mode 100644 core/models/Particles.py rename {module/exploit => core/module}/__init__.py (100%) rename {module => core/module}/aws_template.py (100%) rename {module/lateralmovement => core/module/cleanup}/__init__.py (100%) rename {module => core/module}/cleanup/aws_iam_delete_access_key.py (100%) rename {module => core/module}/cleanup/aws_iam_delete_login_profile.py (100%) rename {module => core/module}/cleanup/aws_s3_delete_bucket.py (100%) rename {module/listeners => core/module/detection}/__init__.py (100%) rename {module/listeners/__listeners => core/module/detectionbypass}/__init__.py (100%) rename {module => core/module}/detectionbypass/aws_detectionbypass_stop_logging.py (100%) rename {module => core/module}/detectionbypass/aws_detectionbypass_update_trail.py (100%) rename {module/misc => core/module/enum}/__init__.py (100%) rename {module/persistence => core/module/enum/__not_done_yet}/__init__.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_cloudtrail_list_trails.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_all.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_elastic_ips.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_images.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_instance.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_launch_templates.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_public_ipv4_ip_pools.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_security_groups.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_snapshots.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_enum_user_data.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ec2_get_launch_template.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ecr_describe_images.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ecr_enum_all.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ecr_list_images.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_enum_all.py (91%) create mode 100644 core/module/enum/__not_done_yet/aws_iam_enum_privesc.py rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_enum_role_permissions.py (100%) create mode 100644 core/module/enum/__not_done_yet/aws_iam_enum_users_just_in_case.py rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_access_key_last_used.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_account_password_policy.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_account_summary.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_group.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_instance_profile.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_login_profile.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_policy.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_role.py (100%) create mode 100644 core/module/enum/__not_done_yet/aws_iam_get_user.py rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_get_user_details.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_access_keys.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_entities_for_policy.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_group_policies.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_groups.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_instance_profiles.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_mfa_devices.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_roles.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_user_policies.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_iam_list_virtual_mfa_devices.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_lambda_enum_all.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_lambda_get_account_settings.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_lambda_get_function.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_lambda_get_policy.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_lambda_list_function_alias.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_lambda_list_functions.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_route53_get_dnssec.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_route53_get_hosted_zone.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_route53_list_hosted_zones.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_route53_list_hosted_zones_by_dns_host.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_route53_list_hosted_zones_by_vpc.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_enum_all.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_get_bucket_logging.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_get_bucket_policy.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_get_bucket_policy_status.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_get_object_acl.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_list_buckets.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_s3_list_objects.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ssm_get_document.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ssm_list_associations.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ssm_list_commands.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_ssm_list_documents.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_sts_get_access_key_info.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_sts_get_user_id.py (100%) rename {module/enum => core/module/enum/__not_done_yet}/aws_support_describe_cases.py (100%) create mode 100644 core/module/enum/aws_enum_services_using_cost_explorer.py create mode 100644 core/module/enum/aws_iam_enum_groups.py create mode 100644 core/module/enum/aws_iam_enum_users.py create mode 100644 core/module/enum/aws_misc_amazonec2roleforssm_permissions.py create mode 100644 core/module/enum/aws_misc_privilege_enumeration.py create mode 100644 core/module/enum/aws_s3_list_bucket_objects.py create mode 100644 core/module/enum/aws_s3_list_deleted_files.py create mode 100644 core/module/enum/digitalocean_space_enum_all.py create mode 100644 core/module/enum/digitalocean_space_list_deleted_objects.py create mode 100644 core/module/enum/office365_enum_aad_objects.py create mode 100644 core/module/enum/office365_enum_admin_Users.py create mode 100644 core/module/enum/office365_enum_current_user.py create mode 100644 core/module/enum/office365_find_groups_with_dynamic_membership.py create mode 100644 core/module/enum/office365_get_group_members.py create mode 100644 core/module/enum/office365_get_user_list.py create mode 100644 core/module/enum/office365_get_user_passsword_policy.py create mode 100644 core/module/enum/office365_list_groups.py create mode 100644 core/module/enum/office365_list_mfa_status_for_users.py create mode 100644 core/module/enum/office365_list_users.py create mode 100644 core/module/exploit/__AMI_Images.py rename {module/postexploitation => core/module/exploit}/__init__.py (100%) create mode 100644 core/module/exploit/__wellKnownApps.json rename {module => core/module}/exploit/aws_ec2_create_instance_with_user_data.py (100%) rename {module => core/module}/exploit/aws_ec2_modify_user_data.py (100%) rename {module => core/module}/exploit/aws_iam_create_user_login_profile.py (99%) rename {module => core/module}/exploit/aws_lambda_create_function.py (62%) rename {module => core/module}/exploit/aws_lambda_invoke_function.py (100%) rename {module => core/module}/exploit/aws_s3_create_bucket.py (100%) rename {module => core/module}/exploit/aws_s3_download_object.py (97%) create mode 100644 core/module/exploit/aws_s3_get_object_with_presigned_url.py create mode 100644 core/module/exploit/aws_s3_upload_object_with_presigned_post_data.py create mode 100644 core/module/exploit/aws_ssm_send_command.py create mode 100644 core/module/exploit/aws_ssm_send_run_shell_command.py rename {module => core/module}/exploit/aws_ssm_start_session.py (85%) rename {module => core/module}/exploit/aws_sts_assume_role.py (100%) rename {module => core/module}/exploit/aws_sts_assume_role_with_web_identity.py (100%) create mode 100644 core/module/exploit/azure_ad_malicious.py create mode 100644 core/module/exploit/azure_adfs_spray.py create mode 100644 core/module/exploit/azuread_device_code_phish.py create mode 100644 core/module/exploit/azuread_device_code_phish_2.py create mode 100644 core/module/exploit/azuread_password_spray.py create mode 100644 core/module/exploit/digitalocean_space_download_object.py create mode 100644 core/module/exploit/office365_add_user_to_group.py rename {module/privesc => core/module/lateralmovement}/__init__.py (100%) rename {module/reconnaissance => core/module/listeners}/__init__.py (100%) rename {module/stager => core/module/listeners/__listeners}/__init__.py (100%) rename {module => core/module}/listeners/__listeners/aws_python_tcp_server.py (100%) rename {module => core/module}/listeners/aws_python_tcp_xor_encrypted_listener.py (100%) rename {ssh_keys => core/module/misc}/__init__.py (100%) rename {module => core/module}/misc/aws_phishing_email_campain.py (100%) create mode 100644 core/module/misc/aws_s3_bucket_name_generator.py create mode 100644 core/module/misc/azure_service_basename_generator.py create mode 100644 core/module/misc/misc_email_username_generator.py rename {tools => core/module/persistence}/__init__.py (100%) create mode 100644 core/module/persistence/aws_iam_create_user_access_key.py rename module/persistence/aws_iam_create_user_access_key.py => core/module/persistence/aws_iam_modify_user_access_key.py (100%) create mode 100644 core/module/postexploitation/__init__.py create mode 100644 core/module/postexploitation/aws_create_console_url.py create mode 100644 core/module/postexploitation/aws_lambda_download_function.py create mode 100644 core/module/privesc/__init__.py create mode 100644 core/module/reconnaissance/__init__.py create mode 100644 core/module/reconnaissance/__ip_source/AWS_IP_Ranges.py rename {module => core/module}/reconnaissance/__ip_source/Azure_IP_Ranges.py (100%) create mode 100644 core/module/reconnaissance/__ip_source/DOIPRange.py rename {module => core/module}/reconnaissance/__ip_source/DigitalOcean_IP_Ranges.csv (100%) rename {module => core/module}/reconnaissance/__ip_source/GCP_IP_Ranges.py (99%) rename {module => core/module}/reconnaissance/__ip_source/IBM.txt (100%) rename module/reconnaissance/__ip_source/O365_IP_Ranges.json => core/module/reconnaissance/__ip_source/O365_IP_Ranges.py (85%) create mode 100644 core/module/reconnaissance/__ip_source/__init__.py rename {module => core/module}/reconnaissance/__ip_source/ip_ranges.py (100%) create mode 100644 core/module/reconnaissance/__lists/dns_20000.txt rename {module => core/module}/reconnaissance/aws_account_id_fuzzer.py (100%) rename {module => core/module}/reconnaissance/aws_iam_unauth_user_enum.py (95%) create mode 100644 core/module/reconnaissance/aws_s3_bucket_name_fuzzer.py create mode 100644 core/module/reconnaissance/aws_s3_bucket_name_fuzzer_gui.py create mode 100644 core/module/reconnaissance/azure_check_azure_usage.py create mode 100644 core/module/reconnaissance/azure_fuzz_aks_api_server.py create mode 100644 core/module/reconnaissance/azure_fuzz_storages.py create mode 100644 core/module/reconnaissance/azure_service_dns_fuzzer.py create mode 100644 core/module/reconnaissance/azuread_unauth_user_enum.py create mode 100644 core/module/reconnaissance/digitalocean_space_bucket_name_fuzzer.py create mode 100644 core/module/reconnaissance/gcp_bucket_name_fuzzer.py create mode 100644 core/module/reconnaissance/misc_crtsh.py create mode 100644 core/module/reconnaissance/misc_dns_fuzzing.py create mode 100644 core/module/reconnaissance/misc_find_ip_category.py create mode 100644 core/module/reconnaissance/misc_find_ip_category_copy.py rename {module => core/module}/reconnaissance/misc_gitdumper.py (100%) create mode 100644 core/module/reconnaissance/misc_grayhatwarfare.py create mode 100644 core/module/stager/__init__.py create mode 100644 core/module/stager/__revshell/__init__.py create mode 100644 core/module/stager/__revshell/aws_go_tcp.exe create mode 100644 core/module/stager/__revshell/aws_linux_go_tcp create mode 100644 core/module/stager/__revshell/aws_linux_go_tcp.go rename {module => core/module}/stager/__revshell/aws_python_tcp.py (100%) rename {module => core/module}/stager/__revshell/aws_windows_go_tcp.go (93%) rename {module => core/module}/stager/aws_python_tcp_xor_encrypted.py (94%) create mode 100644 core/printcolor/coloring.py delete mode 100644 core/run_module/__pycache__/run_aws_module.cpython-38.pyc delete mode 100644 core/run_module/__pycache__/run_aws_module.cpython-39.pyc delete mode 100644 core/run_module/__pycache__/run_azure_module.cpython-38.pyc delete mode 100644 core/run_module/__pycache__/run_azure_module.cpython-39.pyc delete mode 100644 core/run_module/__pycache__/run_gcp_module.cpython-38.pyc delete mode 100644 core/run_module/__pycache__/run_gcp_module.cpython-39.pyc create mode 100644 core/run_module/azure_client_ids.py create mode 100644 core/run_module/run_azuread_module.py create mode 100644 core/run_module/run_digitalocean_module.py create mode 100644 core/run_module/run_office365_module.py create mode 100644 core/set_credentials/set_azuread_credentials.py create mode 100644 core/set_credentials/set_azuread_credentials_2.py create mode 100644 dockercompose.yaml create mode 100644 install.bat create mode 100644 install.sh delete mode 100644 less_binary/less.exe delete mode 100644 main.py delete mode 100644 module/__pycache__/__init__.cpython-38.pyc delete mode 100644 module/__pycache__/__init__.cpython-39.pyc delete mode 100644 module/enum/aws_ec2_enum_instances.py delete mode 100644 module/enum/aws_iam_get_user.py delete mode 100644 module/enum/aws_iam_list_users.py delete mode 100644 module/exploit/aws_ssm_send_command.py delete mode 100644 module/listeners/__listeners/__pycache__/__init__.cpython-39.pyc delete mode 100644 module/listeners/__listeners/__pycache__/aws_python_tcp_server.cpython-39.pyc delete mode 100644 module/misc/__pycache__/aws_phishing_email_campain.cpython-39.pyc delete mode 100644 module/reconnaissance/__ip_source/AWS_IP_Ranges.py delete mode 100644 module/reconnaissance/__ip_source/__pycache__/AWS_IP_Ranges.cpython-39.pyc delete mode 100644 module/reconnaissance/__ip_source/__pycache__/ip_ranges.cpython-39.pyc delete mode 100644 module/reconnaissance/aws_find_ip_category.py delete mode 100644 module/reconnaissance/aws_s3_bucket_name_fuzzer.py delete mode 100644 module/reconnaissance/azure_check_azuread.py delete mode 100644 module/reconnaissance/azuread_unauth_user_enum.py delete mode 100644 module/reconnaissance/misc_crtsh.py delete mode 100644 module/stager/__revshell/aws_go_tcp.go delete mode 100644 nebula create mode 100644 teamserver create mode 100644 teamserver.conf create mode 100644 teamserver.py delete mode 100644 tools/__SSM_start_session_parameter_files/AWS-RunPowerShellScript.txt create mode 100644 uploads/__init__.py diff --git a/.dockerignore b/.dockerignore deleted file mode 100644 index 8ecf7c0..0000000 --- a/.dockerignore +++ /dev/null @@ -1,4 +0,0 @@ -.git -.DS_Store -LICENSE -README.md \ No newline at end of file diff --git a/.gitignore b/.gitignore index 484c7a0..4629caa 100644 --- a/.gitignore +++ b/.gitignore @@ -4,16 +4,34 @@ /.nebula-history-file /100_percent_done /__pycache__/ -/module/cleanup/__pycache__/ -/module/detection/__pycache__/ -/module/detectionbypass/__pycache__/ -/module/enum/__pycache__/ -/module/exploit/__pycache__/ -/module/lateralmovement/__pycache__/ -/module/listeners/__pycache__/ -/module/persistence/__pycache__/ -/module/postexploitation/__pycache__/ -/module/privesc/__pycache__/ -/module/reconnaissance/__pycache__/ -/module/stager/__pycache__/ -/workspaces \ No newline at end of file +/core/module/cleanup/__pycache__/ +/core/module/detection/__pycache__/ +/core/module/detectionbypass/__pycache__/ +/core/module/enum/__pycache__/ +/core/module/exploit/__pycache__/ +/core/module/lateralmovement/__pycache__/ +/core/module/listeners/__pycache__/ +/core/module/persistence/__pycache__/ +/core/module/postexploitation/__pycache__/ +/core/module/privesc/__pycache__/ +/core/module/reconnaissance/__pycache__/ +/core/module/reconnaissance/__ip_source/__pycache__/ +/core/module/stager/__pycache__/ +/core/module/misc/__pycache__/ +/core/models/__pycache__/ +/core/run_module/__pycache__/ +/core/auth/__pycache__/ +/core/createSession/__pycache__/ +/core/enum_user_privs/__pycache__/ +/core/database/__pycache__/ +/core/module/listeners/__listeners/__pycache__/ +/core/module/reconnaissance/__ip_source/__pycache__/ +/workspaces +/client/venv/ +/clientGUI/venv/ +/client/__pycache__/ +/client/commands/__pycache__/ +/client/core/__pycache__/ +/client/help/__pycache__/ +/client/help/__pycache__/ +/client/.nebula-history-file diff --git a/.idea/.gitignore b/.idea/.gitignore index 26d3352..eaf91e2 100644 --- a/.idea/.gitignore +++ b/.idea/.gitignore @@ -1,3 +1,3 @@ -# Default ignored files -/shelf/ -/workspace.xml +# Default ignored files +/shelf/ +/workspace.xml diff --git a/.idea/Nebula.iml b/.idea/NewNebula.iml similarity index 70% rename from .idea/Nebula.iml rename to .idea/NewNebula.iml index 8e5446a..1d2a0a0 100644 --- a/.idea/Nebula.iml +++ b/.idea/NewNebula.iml @@ -1,14 +1,17 @@ - - - - - - - - - - - + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml index bf221fd..3dce9c6 100644 --- a/.idea/inspectionProfiles/Project_Default.xml +++ b/.idea/inspectionProfiles/Project_Default.xml @@ -1,12 +1,10 @@