Update atexec.py

Signed-off-by: Kahvi-0xFF <46513413+Kahvi-0@users.noreply.github.com>

Author: Kahvi-0

nxc/protocols/smb/atexec.py

@@ -82,8 +82,6 @@ def get_end_boundary(self):
         return end_boundary.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3]
 
     def gen_xml(self, command):
-        global cmdstdout
-        global cmd_path
         #Random setting order to help with detection
         settings = [
             "       <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>",
@@ -107,20 +105,23 @@ def gen_xml(self, command):
         random.shuffle(settings2)
         randomized_settings2 = "\n".join(settings2)
 
-        IdleSettings = [
+        idleSettings = [
             "         <StopOnIdleEnd>true</StopOnIdleEnd>",
             "         <RestartOnIdle>false</RestartOnIdle>"
         ]
-        random.shuffle(IdleSettings)
-        randomized_IdleSettings = "\n".join(IdleSettings)
+        random.shuffle(idleSettings)
+        randomized_idleSettings = "\n".join(idleSettings)
         random_digit = random.randint(2, 6)
 
         match = re.match(r'^(.+?\\[^\\ ]+)\s+(.*)', command)
         if match:
             cmd_path = match.group(1)
             cmd_args = match.group(2)
         else:
-            print("Could not split the command properly.")
+            self.logger.display(f"Full Path not detected, defaulting to CMD")
+            self.__retOutput = True
+            cmd_path = f"C:\Windows\System32\cmd.exe"
+            cmd_args = f"/c {command}"
 
         xml = f"""<?xml version="1.0" encoding="UTF-16"?>
         <Task version="1.{random_digit}" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
@@ -138,35 +139,29 @@ def gen_xml(self, command):
         <Settings>
            {randomized_settings}
            <IdleSettings>
-           {randomized_IdleSettings}
+           {randomized_idleSettings}
            </IdleSettings>
            {randomized_settings2}
         </Settings>
         <Actions Context="LocalSystem">
            <Exec>
            <Command>{cmd_path}</Command>
         """
+
         if self.__retOutput:
             file_location = "\\Windows\\Temp\\" if self.output_file_location is None else self.output_file_location
             if self.output_filename is None:
                 self.__output_filename = os.path.join(file_location, gen_random_string(8))
             else:
                 self.__output_filename = os.path.join(file_location, self.output_filename)
-            
-            if "cmd" in cmd_path.lower() or "powershell" in cmd_path.lower():
-                cmd_output = f"&gt; {self.__output_filename} 2&gt;&amp;1"
-                cmdstdout = 1
-                argument_xml = f"      <Arguments>{cmd_args} {cmd_output}</Arguments>"
-            else:
-                cmd_output = ""
-                cmdstdout = 0
-                argument_xml = f"      <Arguments>{cmd_args} {cmd_output}</Arguments>"
+
+            cmd_output = f"&gt; {self.__output_filename} 2&gt;&amp;1"
+            argument_xml = f"      <Arguments>{cmd_args} {cmd_output}</Arguments>"
 
 
         elif self.__retOutput is False:
             argument_xml = f"      <Arguments>{cmd_args}</Arguments>"
 
-        
         self.logger.debug("Generated argument XML: " + argument_xml)
         xml += argument_xml
 
@@ -186,9 +181,8 @@ def execute_handler(self, command):
 
         dce.set_credentials(*self.__rpctransport.get_credentials())
         dce.connect()
-
         xml = self.gen_xml(command)
-
+        
         self.logger.debug(f"Task XML: {xml}")
         self.logger.info(f"Creating task \\{self.task_name}")
         try:
@@ -216,51 +210,48 @@ def execute_handler(self, command):
 
         self.logger.info(f"Deleting task \\{self.task_name}")
         tsch.hSchRpcDelete(dce, f"\\{self.task_name}")
-
+        
         if self.__retOutput:
             smbConnection = self.__rpctransport.get_smb_connection()
 
             tries = 1
             # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing
             sleep(0.4)
-            if cmdstdout == 1:
-               while True:
-                   try:
-                       self.logger.info(f"Attempting to read {self.__share}\\{self.__output_filename}")
-                       smbConnection.getFile(self.__share, self.__output_filename, self.output_callback)
-                       break
-                   except Exception as e:
-                       if tries >= self.__tries:
-                           self.logger.fail("ATEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method")
-                           break
-                       if "STATUS_BAD_NETWORK_NAME" in str(e):
+            while True:
+                try:
+                    self.logger.info(f"Attempting to read {self.__share}\\{self.__output_filename}")
+                    smbConnection.getFile(self.__share, self.__output_filename, self.output_callback)
+                    break
+                except Exception as e:
+                    if tries >= self.__tries:
+                        self.logger.fail("ATEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method")
+                        break
+                    if "STATUS_BAD_NETWORK_NAME" in str(e):
                            self.logger.fail(f"ATEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)")
                            break
-                       elif "STATUS_VIRUS_INFECTED" in str(e):
-                           self.logger.fail("Command did not run because a virus was detected")
-                           break
-                       # When executing PowerShell and the command is still running, we get a sharing violation
-                       # We can use that information to wait longer than if the file is not found (probably av or something)
-                       if "STATUS_SHARING_VIOLATION" in str(e):
-                           self.logger.info(f"File {self.__share}\\{self.__output_filename} is still in use with {self.__tries - tries} tries left, retrying...")
-                           tries += 1
-                           sleep(1)
-                       elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
-                           self.logger.info(f"File {self.__share}\\{self.__output_filename} not found with {self.__tries - tries} tries left, deducting 10 tries and retrying...")
-                           tries += 10
-                           sleep(1)
-                       else:
-                           self.logger.debug(f"Exception when trying to read output file: {e!s}. {self.__tries - tries} tries left, retrying...")
-                           tries += 1
-                           sleep(1)
-  
-   
-               try:
-                   self.logger.debug(f"Deleting file {self.__share}\\{self.__output_filename}")
-                   smbConnection.deleteFile(self.__share, self.__output_filename)
-               except Exception:
-                   pass
-
-            else:
-              self.logger.display("No output file was saved to be retrived") 
+                    elif "STATUS_VIRUS_INFECTED" in str(e):
+                        self.logger.fail("Command did not run because a virus was detected")
+                        break
+                    # When executing PowerShell and the command is still running, we get a sharing violation
+                    # We can use that information to wait longer than if the file is not found (probably av or something)
+                    if "STATUS_SHARING_VIOLATION" in str(e):
+                        self.logger.info(f"File {self.__share}\\{self.__output_filename} is still in use with {self.__tries - tries} tries left, retrying...")
+                        tries += 1
+                        sleep(1)
+                    elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
+                        self.logger.info(f"File {self.__share}\\{self.__output_filename} not found with {self.__tries - tries} tries left, deducting 10 tries and retrying...")
+                        tries += 10
+                        sleep(1)
+                    else:
+                        self.logger.debug(f"Exception when trying to read output file: {e!s}. {self.__tries - tries} tries left, retrying...")
+                        tries += 1
+                        sleep(1)
+ 
+            try:
+                self.logger.debug(f"Deleting file {self.__share}\\{self.__output_filename}")
+                smbConnection.deleteFile(self.__share, self.__output_filename)
+            except Exception:
+                pass
+        else:
+          self.logger.display("No output file was saved to be retrived") 
         dce.disconnect()