From 8a37354852e6c6250dd2324fff02a641aa22e383 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 18:55:53 -0500 Subject: [PATCH 1/8] Create README.md --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..a1eb9ff --- /dev/null +++ b/README.md @@ -0,0 +1,11 @@ +# CobaltStrike-ToolKit + +## CheckDA + +Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name. +While using .NET 3.5 to perform Domain Group enumeration. This allows for alerting on Pentest of a DA level beacon. + +''' +aggressor> load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna +[+] Load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna +''' From d448b6c14c7d5f1cdf7f723de36259c25322f34b Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 18:56:11 -0500 Subject: [PATCH 2/8] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a1eb9ff..dcab709 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name. While using .NET 3.5 to perform Domain Group enumeration. This allows for alerting on Pentest of a DA level beacon. -''' +``` aggressor> load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna [+] Load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna -''' +``` From 3334bfc621372c327890afa13128a31c3c5ad6e8 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 18:57:18 -0500 Subject: [PATCH 3/8] Update README.md --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index dcab709..974b30d 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,16 @@ Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name. While using .NET 3.5 to perform Domain Group enumeration. This allows for alerting on Pentest of a DA level beacon. +Load up the Script: ``` aggressor> load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna [+] Load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna ``` +When a intial beacon comes in you will see: +``` +[*] Tasked beacon to import: /root/Tools/CobaltStrike-ToolKit/Invoke-DACheck.ps1 +[*] Tasked beacon to run: Invoke-DACheck -Initial True +[+] host called home, sent: 2527 bytes +[+] received output: +Found-DA-User: admin +``` From d392283a208bd31aef9d7539590902ac1f4178b5 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 18:57:59 -0500 Subject: [PATCH 4/8] Update README.md --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 974b30d..a121921 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Load up the Script: aggressor> load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna [+] Load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna ``` -When a intial beacon comes in you will see: +When a intial beacon comes in you recive a pop up box and will see: ``` [*] Tasked beacon to import: /root/Tools/CobaltStrike-ToolKit/Invoke-DACheck.ps1 [*] Tasked beacon to run: Invoke-DACheck -Initial True @@ -18,3 +18,4 @@ When a intial beacon comes in you will see: [+] received output: Found-DA-User: admin ``` + From 7a13dd9ee9ccfd93fe64b0e318448cbb638d26b7 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 18:59:15 -0500 Subject: [PATCH 5/8] Update README.md --- README.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a121921..f35a48b 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name. While using .NET 3.5 to perform Domain Group enumeration. This allows for alerting on Pentest of a DA level beacon. - +### Usage Load up the Script: ``` aggressor> load /root/Tools/CobaltStrike-ToolKit/Initial-DACheck.cna @@ -18,4 +18,14 @@ When a intial beacon comes in you recive a pop up box and will see: [+] received output: Found-DA-User: admin ``` +### Indipendent Command: +``` +beacon> checkda +[*] Tasked beacon to import: /root/Tools/CobaltStrike-ToolKit/Invoke-DACheck.ps1 +[*] Tasked beacon to run: Invoke-DACheck +[+] host called home, sent: 2519 bytes +[+] received output: +[!] Currently DA Context +``` + From e869adc91b6b27aa34832682d15f594f71bb0813 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 18:59:45 -0500 Subject: [PATCH 6/8] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f35a48b..692ed5a 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ When a intial beacon comes in you recive a pop up box and will see: [+] received output: Found-DA-User: admin ``` -### Indipendent Command: +### Independent Command: ``` beacon> checkda [*] Tasked beacon to import: /root/Tools/CobaltStrike-ToolKit/Invoke-DACheck.ps1 From 3c9f20217324244c7de4d184b4fc106422ea728c Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 19:04:19 -0500 Subject: [PATCH 7/8] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 692ed5a..beaa841 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ ## CheckDA Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name. -While using .NET 3.5 to perform Domain Group enumeration. This allows for alerting on Pentest of a DA level beacon. +While using .NET 3.5 to perform Domain Group enumeration (powershell 2+ safe). This allows for alerting on Pentest of a DA level beacons. ### Usage Load up the Script: ``` From 6d81fc179732d2b63aa3252dd9cf8e7139ed46b5 Mon Sep 17 00:00:00 2001 From: Alexander Rymdeko-Harvey Date: Thu, 7 Jan 2016 19:08:52 -0500 Subject: [PATCH 8/8] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index beaa841..e1aaa6e 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # CobaltStrike-ToolKit -## CheckDA +## CheckDA - Command Currently uses a powershell based check, combined with a aggressor script to check for the intial agent user name. While using .NET 3.5 to perform Domain Group enumeration (powershell 2+ safe). This allows for alerting on Pentest of a DA level beacons.