Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit fa2e63b

Browse files
HKiritoHKirito
committedOct 11, 2021
Initial commit
0 parents  commit fa2e63b

File tree

4 files changed

+381
-0
lines changed

4 files changed

+381
-0
lines changed
 

‎dependency-reduced-pom.xml

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>GoogleAuth</groupId>
5+
<artifactId>CsRewrite</artifactId>
6+
<version>1.0-SNAPSHOT</version>
7+
<organization>
8+
<name>sanwu</name>
9+
</organization>
10+
<build>
11+
<finalName>cstool</finalName>
12+
<plugins>
13+
<plugin>
14+
<artifactId>maven-compiler-plugin</artifactId>
15+
<version>3.1</version>
16+
<configuration>
17+
<source>8</source>
18+
<target>8</target>
19+
</configuration>
20+
</plugin>
21+
<plugin>
22+
<artifactId>maven-shade-plugin</artifactId>
23+
<version>3.2.1</version>
24+
<executions>
25+
<execution>
26+
<phase>package</phase>
27+
<goals>
28+
<goal>shade</goal>
29+
</goals>
30+
<configuration>
31+
<transformers>
32+
<transformer>
33+
<manifestEntries>
34+
<Main-Class>sanwu.CsRewrite</Main-Class>
35+
<Premain-Class>sanwu.CsRewrite</Premain-Class>
36+
</manifestEntries>
37+
</transformer>
38+
</transformers>
39+
</configuration>
40+
</execution>
41+
</executions>
42+
</plugin>
43+
</plugins>
44+
</build>
45+
<properties>
46+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
47+
</properties>
48+
</project>

‎pom.xml

+112
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
<groupId>GoogleAuth</groupId>
7+
<artifactId>CsRewrite</artifactId>
8+
<version>1.0-SNAPSHOT</version>
9+
<packaging>jar</packaging>
10+
<organization>
11+
<name>sanwu</name>
12+
</organization>
13+
<properties>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
</properties>
16+
<build>
17+
<finalName>cstool</finalName>
18+
<plugins>
19+
<plugin>
20+
<groupId>org.apache.maven.plugins</groupId>
21+
<artifactId>maven-compiler-plugin</artifactId>
22+
<version>3.1</version>
23+
<configuration>
24+
<source>8</source>
25+
<target>8</target>
26+
</configuration>
27+
</plugin>
28+
29+
<!-- 打包可运行jar包 -->
30+
<!-- <plugin>-->
31+
<!-- <groupId>org.apache.maven.plugins</groupId>-->
32+
<!-- <artifactId>maven-assembly-plugin</artifactId>-->
33+
<!-- <configuration>-->
34+
<!-- <archive>-->
35+
<!-- <manifest>-->
36+
<!-- <mainClass>sanwu.CsRewrite</mainClass>-->
37+
<!-- </manifest>-->
38+
<!-- </archive>-->
39+
<!-- <finalName>cstool</finalName>-->
40+
<!-- <descriptorRefs>-->
41+
<!-- <descriptorRef>jar-with-dependencies</descriptorRef>-->
42+
<!-- </descriptorRefs>-->
43+
<!-- </configuration>-->
44+
<!-- <executions>-->
45+
<!-- <execution>-->
46+
<!-- <id>make-assembly</id>-->
47+
<!-- <phase>package</phase>-->
48+
<!-- <goals>-->
49+
<!-- <goal>single</goal>-->
50+
<!-- </goals>-->
51+
<!-- </execution>-->
52+
<!-- </executions>-->
53+
<!-- </plugin>-->
54+
55+
56+
<plugin>
57+
<groupId>org.apache.maven.plugins</groupId>
58+
<artifactId>maven-shade-plugin</artifactId>
59+
<version>3.2.1</version>
60+
<executions>
61+
<execution>
62+
<phase>package</phase>
63+
<goals>
64+
<goal>shade</goal>
65+
</goals>
66+
<configuration>
67+
<transformers>
68+
<transformer
69+
implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
70+
<manifestEntries>
71+
<Main-Class>sanwu.CsRewrite</Main-Class>
72+
<Premain-Class>sanwu.CsRewrite</Premain-Class>
73+
</manifestEntries>
74+
</transformer>
75+
</transformers>
76+
</configuration>
77+
</execution>
78+
</executions>
79+
</plugin>
80+
81+
82+
83+
</plugins>
84+
</build>
85+
<dependencies>
86+
<dependency>
87+
<groupId>commons-codec</groupId>
88+
<artifactId>commons-codec</artifactId>
89+
<version>1.11</version>
90+
</dependency>
91+
<dependency>
92+
<groupId>com.google.zxing</groupId>
93+
<artifactId>core</artifactId>
94+
<version>3.3.0</version>
95+
</dependency>
96+
<dependency>
97+
<groupId>org.javassist</groupId>
98+
<artifactId>javassist</artifactId>
99+
<version>3.25.0-GA</version>
100+
</dependency>
101+
<dependency>
102+
<groupId>de.taimos</groupId>
103+
<artifactId>totp</artifactId>
104+
<version>1.0</version>
105+
</dependency>
106+
<dependency>
107+
<groupId>com.google.zxing</groupId>
108+
<artifactId>javase</artifactId>
109+
<version>3.3.0</version>
110+
</dependency>
111+
</dependencies>
112+
</project>

‎src/main/java/sanwu/CsRewrite.java

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
package sanwu;
2+
3+
import com.google.zxing.WriterException;
4+
import javassist.*;
5+
6+
import java.io.ByteArrayInputStream;
7+
import java.io.IOException;
8+
import java.lang.instrument.Instrumentation;
9+
import java.util.Scanner;
10+
11+
class CsRewrite {
12+
13+
/**
14+
*
15+
* @param agentArgs TOTPSecretKey
16+
* @return
17+
* @throws Exception
18+
*/
19+
public static void premain(String agentArgs, Instrumentation inst) throws Exception{
20+
//Have class resources and TOTP secret
21+
ClassPool classPool = ClassPool.getDefault();
22+
Loader loader = new Loader(classPool);
23+
24+
25+
//插入类路径，进行获取所需修改的类路径
26+
String className = "server.ManageUser";
27+
28+
//Find ClassFile to byte[] and give it to classfileBuffer
29+
CtClass cl = classPool.getCtClass(className);
30+
byte[] classfileBuffer = cl.toBytecode();
31+
32+
//defrost server.ManageUser class
33+
cl.stopPruning(true);
34+
cl.defrost();
35+
byte[] classfileBuffer2 = addCsTransformer(className,classfileBuffer,agentArgs);
36+
37+
cl = classPool.makeClass(new ByteArrayInputStream(classfileBuffer2));
38+
cl.toClass();
39+
}
40+
41+
public static byte[] addCsTransformer(String className,byte[] classfileBuffer,String totpSecretKey) throws Exception{
42+
ClassPool classPool = ClassPool.getDefault();
43+
try {
44+
if (className == null) {
45+
return classfileBuffer;
46+
} else if (className.equals("server.ManageUser")) { // 只修改 ManageUser 类
47+
CtClass cls = classPool.makeClass(new ByteArrayInputStream(classfileBuffer));
48+
CtMethod ctmethod = cls.getDeclaredMethod("process",
49+
new CtClass[]{classPool.get("common.Request")});
50+
String func = "{"
51+
+ "if (!$0.authenticated && \"aggressor.authenticate\".equals($1.getCall()) && $1.size() == 3) {"
52+
+ " java.lang.String mnickname = $1.arg(0)+\"\";"
53+
+ " java.lang.String mpassword = $1.arg(1)+\"\";"
54+
+ " java.lang.String mver = $1.arg(2)+\"\";"
55+
+ " if(mnickname.length() < 6){ $0.client.writeObject($1.reply(\"Dynamic Code Error.\"));return; };" // 用户名如果低于 6 位就直接 return
56+
57+
+ " java.lang.String lastcode = sanwu.GoogleAuthenticationTool.getTOTPCode(\""+totpSecretKey+"\");"// 生成 TOTP 6位数字
58+
+ " if(!mnickname.substring(mnickname.length()-6, mnickname.length()).equals(lastcode)) {" // 比对动态口令，如果口令没对上，就 return
59+
+ " $0.client.writeObject($1.reply(\"Dynamic Code Error.\"));return;"
60+
+ " }"
61+
+ "}"
62+
+ "}";
63+
ctmethod.insertBefore(func); // 把上面的代码插入到 process 函数最前面，如果口令正确，就继续走 cs 常规的流程
64+
byte[] result = cls.toBytecode();
65+
//if not detach ,will frost class
66+
cls.detach();
67+
return result;
68+
69+
}
70+
} catch (Exception ex) {
71+
ex.printStackTrace();
72+
System.out.printf("[CSTOTPAgent] PreMain transform Error: %s\n", ex);
73+
}
74+
return new byte[]{};
75+
}
76+
77+
public static void Generator(){
78+
//默认用户名为Steve，title为teamwork;
79+
String title = "teamwork";
80+
String name = "Steve";
81+
82+
System.out.println("生成 CobaltStrike TOTP 密钥");
83+
String secret = GoogleAuthenticationTool.generateSecretKey();
84+
System.out.println("SecretKey: "+secret);
85+
86+
//Get User input
87+
Scanner scanner = new Scanner(System.in);
88+
System.out.println("Please input your name and title(,): ");
89+
String line = scanner.nextLine();
90+
String[] split = line.split(",");
91+
if (split[0]==" "){
92+
name = split[0];
93+
title = split[1];
94+
}
95+
String QRString = GoogleAuthenticationTool.spawnScanQRString(name,secret,title);
96+
String codestring = null;
97+
try {
98+
codestring = GoogleAuthenticationTool.createQRCode(QRString,"",400,400);
99+
} catch (WriterException e) {
100+
e.printStackTrace();
101+
} catch (IOException e) {
102+
e.printStackTrace();
103+
}
104+
System.out.println(codestring);
105+
System.out.println("\nPlease in CS args(file teamserver) plus -javaagent:$yourJarFilePath="+secret);
106+
String totpSecretKey = GoogleAuthenticationTool.getTOTPCode(secret);
107+
}
108+
109+
public static void main(String[] args) throws Exception {
110+
CsRewrite.Generator();
111+
}
112+
}
113+
114+

‎src/main/java/sanwu/GoogleAuthenticationTool.java

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
package sanwu;
2+
import com.google.zxing.BarcodeFormat;
3+
import com.google.zxing.MultiFormatWriter;
4+
import com.google.zxing.WriterException;
5+
import com.google.zxing.client.j2se.MatrixToImageWriter;
6+
import com.google.zxing.common.BitMatrix;
7+
import de.taimos.totp.TOTP;
8+
import org.apache.commons.codec.binary.Base32;
9+
import org.apache.commons.codec.binary.Hex;
10+
11+
12+
import javax.imageio.ImageIO;
13+
import java.awt.image.BufferedImage;
14+
import java.io.*;
15+
import java.net.URLEncoder;
16+
import java.security.SecureRandom;
17+
import java.util.Base64;
18+
19+
20+
public class GoogleAuthenticationTool {
21+
22+
public static String generateSecretKey() {
23+
SecureRandom random = new SecureRandom();
24+
byte[] bytes = new byte[20];
25+
random.nextBytes(bytes);
26+
Base32 base32 = new Base32();
27+
return base32.encodeToString(bytes);
28+
}
29+
30+
/**
31+
* 根据32位随机码获得正确的6位数字
32+
*
33+
* @param secretKey
34+
* @return
35+
*/
36+
public static String getTOTPCode(String secretKey) {
37+
Base32 base32 = new Base32();
38+
byte[] bytes = base32.decode(secretKey);
39+
String hexKey = Hex.encodeHexString(bytes);
40+
return TOTP.getOTP(hexKey);
41+
}
42+
43+
44+
/**
45+
* 生成绑定二维码（字符串）
46+
*
47+
* @param account 账户信息（展示在Google Authenticator App中的）
48+
* @param secretKey 密钥
49+
* @param title 标题 （展示在Google Authenticator App中的）
50+
* @return
51+
*/
52+
public static String spawnScanQRString(String account, String secretKey, String title) {
53+
try {
54+
return "otpauth://totp/"
55+
+ URLEncoder.encode(title + ":" + account, "UTF-8").replace("+", "%20")
56+
+ "?secret=" + URLEncoder.encode(secretKey, "UTF-8").replace("+", "%20")
57+
+ "&issuer=" + URLEncoder.encode(title, "UTF-8").replace("+", "%20");
58+
} catch (UnsupportedEncodingException e) {
59+
throw new IllegalStateException(e);
60+
}
61+
}
62+
63+
/**
64+
* 生成二维码（文件）【返回图片的base64，若指定输出路径则同步输出到文件中】
65+
*
66+
* @param barCodeData 二维码字符串信息
67+
* @param outPath 输出地址
68+
* @param height
69+
* @param width
70+
* @throws WriterException
71+
* @throws IOException
72+
*/
73+
public static String createQRCode(String barCodeData, String outPath, int height, int width)
74+
throws WriterException, IOException {
75+
BitMatrix matrix = new MultiFormatWriter().encode(barCodeData, BarcodeFormat.QR_CODE,
76+
width, height);
77+
BufferedImage bufferedImage = MatrixToImageWriter.toBufferedImage(matrix);
78+
79+
ByteArrayOutputStream bof = new ByteArrayOutputStream();
80+
ImageIO.write(bufferedImage, "png", bof);
81+
String base64 = imageToBase64(bof.toByteArray());
82+
if(outPath!=null&&!outPath.equals("")) {
83+
try (FileOutputStream out = new FileOutputStream(outPath)) {
84+
MatrixToImageWriter.writeToStream(matrix, "png", out);
85+
}
86+
}
87+
return base64;
88+
}
89+
90+
/**
91+
* 将图片文件转换成base64字符串，参数为该图片的路径
92+
*
93+
* @param dataBytes
94+
* @return java.lang.String
95+
*/
96+
private static String imageToBase64(byte[] dataBytes) {
97+
// 对字节数组Base64编码
98+
String encoded = Base64.getEncoder().encodeToString(dataBytes);
99+
//Base32 base32 = new Base32();
100+
//String encoded = base32.encodeToString(dataBytes);
101+
if (dataBytes != null) {
102+
return "data:image/jpeg;base64," + encoded;// 返回Base64编码过的字节数组字符串
103+
}
104+
return null;
105+
}
106+
107+
}

0 commit comments

Comments
 (0)
Please sign in to comment.