mirror of
https://github.com/Und3rf10w/Aggressor-scripts
synced 2026-06-08 12:46:53 +00:00
Und3rf10w
293 lines
8.4 KiB
Plaintext
293 lines
8.4 KiB
Plaintext
# This kit is limited to actions that I use for development and debugging, and thus is not loaded with the rest of them.
|
|
# @Und3rf10w
|
|
|
|
command beaconinfo {
|
|
foreach $beacon (beacons()) {
|
|
println("Beacon ID: " . $beacon['id'] . " is " . $beacon['computer']);
|
|
}
|
|
}
|
|
|
|
# This basically shows the powershell commandlets loaded for every beacon
|
|
command loaded_powershell{
|
|
foreach $beacon (beacons()) {
|
|
if (data_query('cmdlets')[$beacon['id']] ne $null) {
|
|
println("\c7ID: \cF" . $beacon['id'] . ",\c3 Hostname: \cF" . $beacon['computer'] . ",\c4 Cmdlets Enabled: \cF" . data_query('cmdlets')[$beacon['id']]);
|
|
}
|
|
}
|
|
}
|
|
|
|
# This shows what responses generated by the c2 server would look like
|
|
command c2_sample_server{
|
|
println(data_query('metadata')['c2sample.server']);
|
|
}
|
|
|
|
# This shows what requests generated by the clients look like
|
|
command c2_sample_client{
|
|
println(data_query('metadata')['c2sample.client']);
|
|
}
|
|
|
|
# This shows a list of everyone that's connected to the teamserver:
|
|
command who{
|
|
println("\c7Currently logged on users on this teamserver are:");
|
|
foreach $user (data_query('users')){
|
|
println("\c3 * \cF $user");
|
|
}
|
|
}
|
|
|
|
# This command shows a hostname of every sessions that happened, active or inactive. Basically just to provide a list of pwned hosts.
|
|
command pwn3d_hosts {
|
|
foreach $session (data_query('sessions')) {
|
|
$computer = $session['computer'];
|
|
println($computer);
|
|
}
|
|
}
|
|
|
|
# Shows the queryable Keys within cobalt strike's data model
|
|
command show_data_keys{
|
|
foreach $key (data_keys()){
|
|
println("\n\c4=== $key ===");
|
|
}
|
|
}
|
|
|
|
# Queries the specified key within cobalt strike's data model
|
|
# USAGE: query_data_key <key_name>
|
|
command query_data_key {
|
|
$key_name = $1;
|
|
println("\n\c4=== Data for \c8\U$key_name\U \c4data key ===\n");
|
|
println(data_query($key_name));
|
|
}
|
|
|
|
# Syncs all of the downloads on the teamserver to a specified path. Recursively recreates the file structure as it was on the system the file was downloaded from
|
|
# This is not very safe to use.
|
|
# TODO: Figure out how to get the content of a file stored on the teamserver
|
|
# USAGE: sync_all_downloads [/path/on/client/machine/to/save/downloads/to] <IP address of host to download files for>
|
|
command sync_all_downloads {
|
|
$file_path = $1; # TODO: sanity check, $1 MUST be provided.
|
|
if (!-exists $file_path){
|
|
mkdir($filepath);
|
|
}
|
|
if (!-isDir $file_path){
|
|
println("\c4 $file_path is not a directory");
|
|
exit("Specified direcotry is not a directory");
|
|
}
|
|
if (!-canwrite $file_path){
|
|
println("\c4 We can not write to $filepath (check permissions?)");
|
|
exit("Can not write to specified directory");
|
|
}
|
|
# foreach $file (downloads()){
|
|
# if ($2){
|
|
# if ( ! $file['host'] eq $2 ){
|
|
# continue
|
|
# }
|
|
# }
|
|
# println("Processing download for " . size(downloads()) . " files...");
|
|
# $newpath = $file['path'];
|
|
# $newpath = strrep($newpath, "\\", "/");
|
|
# if ($newpath eq ""){ $newpath = "/"; } # Sanity check in the event that the new path is blank
|
|
# $newpath = $file_path + "/" + $file['host'] + "/" + $newpath;
|
|
# if (!-exists $newpath){
|
|
# mkdir($newpath);
|
|
# }
|
|
# $fullfile = $newpath + $file['name'];
|
|
# TODO: Figure out how to get the content of a file sitting on the teamserver
|
|
# if (checkError($error)) {
|
|
# println("Error recieved while trying to write " . $fullfile . ": $error");
|
|
# }
|
|
# if (-canwrite $fullfile){
|
|
# $handle = openf(">>$fullfile");
|
|
# println($handle, $fileontheCSServer); #See TODO
|
|
# closef($handle);
|
|
# } else {
|
|
# println("Error while trying to write to $fullfile");
|
|
# }
|
|
# }
|
|
# command sync_all_downloads {
|
|
# $file_path = $1; # TODO: sanity check, $1 MUST be provided.
|
|
# if (!-exists $file_path){
|
|
# mkdir($filepath);
|
|
# }
|
|
# if (!-isDir $file_path){
|
|
# println("\c4 $file_path is not a directory");
|
|
# exit("Specified direcotry is not a directory");
|
|
# }
|
|
# if (!-canwrite $file_path){
|
|
# println("\c4 We can not write to $filepath (check permissions?)");
|
|
# exit("Can not write to specified directory");
|
|
# }
|
|
# foreach $file (downloads()){
|
|
# if ($2){
|
|
# if (!$file['host'] eq $2){
|
|
# continue
|
|
# }
|
|
# }
|
|
# println("Processing download for " . size(downloads()) . " files...");
|
|
# $newpath = $file['path'];
|
|
# $newpath = strrep($newpath, "\\", "/");
|
|
# if ($newpath eq ""){ $newpath = "/"; } # Sanity check in the event that the new path is blank
|
|
# $newpath = $file_path + "/" + $file['host'] + "/" + $newpath;
|
|
# if (!-exists $newpath){
|
|
# mkdir($newpath);
|
|
# }
|
|
# # $fullfile = $newpath + $file['name'];
|
|
# # TODO: Figure out how to get the content of a file sitting on the teamserver
|
|
# # if (checkError($error)) {
|
|
# # println("Error recieved while trying to write " . $fullfile . ": $error");
|
|
# # }
|
|
# # if (-canwrite $fullfile){
|
|
# # $handle = openf(">>$fullfile");
|
|
# # println($handle, $fileontheCSServer); #See TODO
|
|
# # closef($handle);
|
|
# # } else {
|
|
# # println("Error while trying to write to $fullfile");
|
|
# # }
|
|
# }
|
|
}
|
|
|
|
# Generates and display a process tree for the selected beacon.
|
|
# Use this to determine your current beacon's exposure to HIDS.
|
|
# I've ran into situations where HIDS/AV will attempt to kill as many parents of a malicous process as possible
|
|
|
|
sub pstreeBpsArray {
|
|
@ps_arry = split('\n', $2);
|
|
$b_pid = beacon_info($1, "pid");
|
|
treeBuilder(@ps_arry, $b_pid, 0);
|
|
pstreeCreate(@tree, size(@tree));
|
|
blog($1, $treeoutput);
|
|
}
|
|
|
|
sub treeBuilder{
|
|
$b_pid = $2;
|
|
@ps_arry = $1;
|
|
$x = $3;
|
|
foreach $entry (@ps_arry){
|
|
($name, $ppid, $pid) = split("\\s+", $entry);
|
|
if ($pid eq $b_pid){
|
|
@tree[$x][0] = $name;
|
|
@tree[$x][1] = $pid;
|
|
@tree[$x][2] = $ppid;
|
|
treeBuilder(@ps_arry, $ppid, $x++);
|
|
}
|
|
}
|
|
}
|
|
|
|
sub pstreeCreate {
|
|
$y = 0;
|
|
$first_time_bool = true;
|
|
@full_tree = $1;
|
|
println(@full_tree);
|
|
$x = $2;
|
|
$x--;
|
|
while ($x >= 0){
|
|
$spacer = ("\t" x $y);
|
|
if (@full_tree[$x][0] ne $null){
|
|
if ($first_time_bool ne true){
|
|
$treeoutput = $treeoutput . "\n" . $spacer . "↳ ";
|
|
}
|
|
}
|
|
$first_time_bool = false;
|
|
$treeoutput = $treeoutput . "(" . @full_tree[$x][1] . ") " . @full_tree[$x][0];
|
|
$x--;
|
|
$y++;
|
|
}
|
|
return $treeoutput;
|
|
}
|
|
|
|
# This alias checks whether CS thinks the beacon is an admin based on the '-isadmin' function
|
|
alias iscsadmin{
|
|
if (-isadmin $1){
|
|
blog($1, "Beacon is admin");
|
|
} else{
|
|
blog($1, "Beacon is not admin");
|
|
}
|
|
}
|
|
|
|
# This alias shows the process tree for the beacon
|
|
alias bproctree{
|
|
blog($1, "Generate this beacon's process tree...")
|
|
$b_pid = beacon_info($1, "pid");
|
|
@ps_arry = wait(bps($1, &pstreeBpsArray));
|
|
}
|
|
|
|
popup beacon_bottom {
|
|
menu "DebugKit" {
|
|
item "Notify at next check-in"{
|
|
local('$bid');
|
|
foreach $bid ($1){
|
|
openOrActivate($bid);
|
|
binput($bid, "checkin");
|
|
bcheckin($bid);
|
|
on beacon_checkin{
|
|
elog("Beacon: " . $1 . " checked in at $3 as requested");
|
|
}
|
|
}
|
|
}
|
|
item "Display Beacon ID" {
|
|
local('$bid');
|
|
foreach $bid ($1) {
|
|
openOrActivate($bid);
|
|
blog($bid, "This beacon's ID is: " . binfo($bid, "id"));
|
|
}
|
|
}
|
|
item "HTTP Egress" {
|
|
local('$bid');
|
|
foreach $bid ($1){
|
|
prompt_text("URL to assess?", "http://google.com", {
|
|
$httpDebugURL = $1;
|
|
return $httpDebugURL;
|
|
});
|
|
sleep(1);
|
|
binput($1, "powershell (New-Object System.Net.WebClient).DownloadString(\"$httpDebugURL\")");
|
|
bpowershell($1, "(New-Object System.Net.WebClient).DownloadString(\"$httpDebugURL\")");
|
|
}
|
|
}
|
|
item "Show beacon's process tree"{
|
|
local('$bid');
|
|
foreach $bid ($1) {
|
|
blog($1, "Generate this beacon's process tree...")
|
|
$b_pid = beacon_info($1, "pid");
|
|
@ps_arry = wait(bps($1, &pstreeBpsArray));
|
|
}
|
|
}
|
|
menu "Loaded PowerShell"{
|
|
item "Are PowerShell scripts loaded?"{
|
|
local('$bid')
|
|
foreach $bid ($1){
|
|
if (data_query('cmdlets')[$bid] ne $null) {
|
|
openOrActivate($bid);
|
|
blog($bid, "\c7PowerShell Import Checker Status\cF:\c3 YES, ACTIVE POWERSHELL IMPORT\cF");
|
|
}
|
|
else {
|
|
openOrActivate($bid);
|
|
blog($bid, "\c7PowerShell Import Checker Status\cF:\c4 NO ACTIVE POWERSHELL IMPORTS\cF");
|
|
}
|
|
}
|
|
}
|
|
item "Show loaded PowerShell functions"{
|
|
local('$bid')
|
|
foreach $bid ($1){
|
|
if (data_query('cmdlets')[$bid] ne $null) {
|
|
openOrActivate($bid);
|
|
blog($bid, "\c7Current active PowerShell modules for this Beacon are: \cF" . data_query('cmdlets')[$bid]);
|
|
}
|
|
else {
|
|
openOrActivate($bid);
|
|
berror($bid, "\c4ERROR! No active powershell modules");
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
popup ssh {
|
|
menu "DebugKit"{
|
|
item "Display Session ID"{
|
|
local('$bid');
|
|
foreach $bid ($1) {
|
|
openOrActivate($bid);
|
|
blog($bid, "This session's ID is: " . binfo($bid, "id"));
|
|
}
|
|
}
|
|
}
|
|
}
|