admin/killswitch-GUI-CobaltStrike-ToolKit
1
0
Fork 0
mirror of https://github.com/killswitch-GUI/CobaltStrike-ToolKit synced 2026-06-08 15:16:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of https://github.com/killswitch-GUI/CobaltStrike-ToolKit

Browse Source
This commit is contained in:
Alex Rymdeko-Harvey
2016-01-08 09:37:41 -05:00
parent 4577a93055 6d81fc1797
commit ffecf1db41
1 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+31
View File
@@ -0,0 +1,31 @@
# CobaltStrike-ToolKit
## CheckDA - Command
Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name.
While using .NET 3.5 to perform Domain Group enumeration (powershell 2+ safe). This allows for alerting on Pentest of a DA level beacons.
### Usage
Load up the Script:
```
aggressor> load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna
[+] Load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna
```
When a intial beacon comes in you recive a pop up box and will see:
```
[*] Tasked beacon to import: /root/Tools/CobaltStrike-ToolKit/Invoke-DACheck.ps1
[*] Tasked beacon to run: Invoke-DACheck -Initial True
[+] host called home, sent: 2527 bytes
[+] received output:
Found-DA-User: admin
```
### Independent Command:
```
beacon> checkda
[*] Tasked beacon to import: /root/Tools/CobaltStrike-ToolKit/Invoke-DACheck.ps1
[*] Tasked beacon to run: Invoke-DACheck
[+] host called home, sent: 2519 bytes
[+] received output:
[!] Currently DA Context
```