Identify Empire C2 nodes

empire_identifier.py

#!/usr/bin/env python3
from urllib.request import build_opener, HTTPSHandler
from http.client import RemoteDisconnected
from hashlib import sha256
from sys import argv, exit
from binascii import hexlify
import ssl

class NoException(Exception):
    pass

steps = [
            {
                'url': 'https://{}/', 
                'response': 'a58fb107072d9523114a1b1f17fbf5e7a8b96da7783f24d84f83df34abc48576',
                'exception': NoException
            },
            {
                'url': 'https://{}/',
                'cookie': 'SESSIONID=id=id',
                'exception': RemoteDisconnected
            }
        ]

def main():
    if len(argv) != 2:
        print("Usage: %s <ip>" % argv[0])
        exit(1)

    context = ssl._create_unverified_context()
    
    for step in steps:
        opener = build_opener(HTTPSHandler(context=context))
        
        if 'cookie' in step:
            opener.addheaders.append(('Cookie', step['cookie']))

        try:
            resp = opener.open(step['url'].format(argv[1]))
        except step['exception']:
            print("[+] Exception correctly called")
        except Exception:
            print("[!] Unexpected exception found")
            print("[-] IP %s is not an Empire listener" % argv[1])
            exit(1)

        data = resp.read()

        if 'response' in step:
            shasum = sha256()
            shasum.update(data)
            if hexlify(shasum.digest()).decode('utf-8') == step['response']:
                print("[+] Response matches")
            else:
                print("[!] Response doesn't match")
                print("[-] IP %s is not an Empire listener" % argv[1])
                exit(1)
    print("[+] IP %s is an Empire listener" % argv[1])

if __name__=='__main__':
main()