admin/maxDcb-C2Core
1
0
Fork 0
mirror of https://github.com/maxDcb/C2Core synced 2026-06-08 15:48:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Vault autcomplet

Browse Source
This commit is contained in:
maxdcb
2026-05-13 11:06:09 +02:00
parent 6ad0d2397a
commit cf30445406
9 changed files with 106 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/CimExec/cimExec.json
+13 -6
View File
@@ -3,12 +3,21 @@
"display_name": "cimExec",
"kind": "module",
"description": "Execute a command on a remote Windows host through CIM/WMI.",
"command_template": "cimExec -h {h:q} -c {c:q} [-n {n:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}]",
"command_template": "cimExec [--vault {vault:q}] -h {h:q} -c {c:q} [-n {n:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}]",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "-h",
"type": "flag",
@@ -35,12 +44,9 @@
},
{
"name": "-u",
"type": "credential",
"type": "flag",
"required": false,
"description": "DOMAIN\\user credentials, or TeamServer credential reference cred:<id>.",
"credential_filter": {
"type": "password"
}
"description": "DOMAIN\\user for explicit credential mode."
},
{
"name": "-p",
@@ -50,6 +56,7 @@
}
],
"examples": [
"cimExec --vault cred:credentialId -h server01 -c cmd.exe -a \"/c whoami\"",
"cimExec -h server01 -c cmd.exe -a \"/c whoami\"",
"cimExec -h server01 -n root/cimv2 -c powershell.exe -a \"-nop -c whoami\""
],
modules/DcomExec/dcomExec.json
+13 -6
View File
@@ -3,12 +3,21 @@
"display_name": "dcomExec",
"kind": "module",
"description": "Execute a command on a remote Windows host through DCOM.",
"command_template": "dcomExec -h {h:q} -c {c:q} [-a {a:q}] [-w {w:q}] [-k {k:q}] [-u {u:q}] [-p {p:q}] [-n {n:flag}]",
"command_template": "dcomExec [--vault {vault:q}] -h {h:q} -c {c:q} [-a {a:q}] [-w {w:q}] [-k {k:q}] [-u {u:q}] [-p {p:q}] [-n {n:flag}]",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "-h",
"type": "flag",
@@ -41,12 +50,9 @@
},
{
"name": "-u",
"type": "credential",
"type": "flag",
"required": false,
"description": "Username for explicit credentials, or TeamServer credential reference cred:<id>.",
"credential_filter": {
"type": "password"
}
"description": "Username for explicit credential mode."
},
{
"name": "-p",
@@ -62,6 +68,7 @@
}
],
"examples": [
"dcomExec --vault cred:credentialId -h fileserver -c cmd.exe -a \"/c whoami\"",
"dcomExec -h fileserver -c cmd.exe -a \"/c whoami\"",
"dcomExec -h fileserver -k HOST/fileserver.domain -u DOMAIN\\user -p Passw0rd -c cmd.exe -a \"/c whoami\""
],
modules/MakeToken/makeToken.json
+4 -4
View File
@@ -3,17 +3,17 @@
"display_name": "makeToken",
"kind": "module",
"description": "Create and impersonate a token from explicit credentials or a TeamServer vault credential reference.",
"command_template": "makeToken {credential:q?} {username:q?} {password:q?}",
"command_template": "makeToken [--vault {vault:q}] {username:q?} {password:q?}",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "credential",
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer credential reference, for example cred:<id>.",
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
"credential_filter": {
"type": "password"
}
@@ -32,7 +32,7 @@
}
],
"examples": [
"makeToken cred:credentialId",
"makeToken --vault cred:credentialId",
"makeToken DOMAIN\\Username Password123!"
],
"source": "manifest"
modules/PsExec/psExec.json
+14 -8
View File
@@ -3,28 +3,33 @@
"display_name": "psExec",
"kind": "module",
"description": "Copy and run a service executable on a remote Windows host. The service executable is resolved from Tools first, then UploadedArtifacts.",
"command_template": "psExec {auth_mode} {username:q?} {password:q?} {target:q} {service_artifact:q}",
"command_template": "psExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {target:q} {service_artifact:q}",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "auth_mode",
"type": "enum",
"required": true,
"required": false,
"description": "Authentication mode.",
"values": ["-u", "-k", "-n"]
},
{
"name": "username",
"type": "credential",
"type": "text",
"required": false,
"description": "DOMAIN\\Username for -u mode, or TeamServer credential reference cred:<id>.",
"completion_parents": ["-u"],
"credential_filter": {
"type": "password"
}
"description": "DOMAIN\\Username for explicit -u mode."
},
{
"name": "password",
@@ -66,6 +71,7 @@
}
],
"examples": [
"psExec --vault cred:credentialId fileserver service.exe",
"psExec -u DOMAIN\\Username Password123! fileserver service.exe",
"psExec -k fileserver service.exe",
"psExec -n fileserver service.exe"
modules/SpawnAs/spawnAs.json
+4 -4
View File
@@ -3,7 +3,7 @@
"display_name": "spawnAs",
"kind": "module",
"description": "Spawn a command under explicit Windows credentials or a TeamServer vault credential reference.",
"command_template": "spawnAs [-d {d:q}] [-l {l}] [-p {p:flag}] [--with-profile {with_profile:flag}] [--no-profile {no_profile:flag}] [-w {w:flag}] [--show-window {show_window:flag}] [--netonly {netonly:flag}] {credential:q?} {username:q?} {password:q?} -- {command:raw}",
"command_template": "spawnAs [-d {d:q}] [-l {l}] [-p {p:flag}] [--with-profile {with_profile:flag}] [--no-profile {no_profile:flag}] [-w {w:flag}] [--show-window {show_window:flag}] [--netonly {netonly:flag}] [--vault {vault:q}] {username:q?} {password:q?} -- {command:raw}",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
@@ -59,10 +59,10 @@
"description": "Use LOGON32_LOGON_NEW_CREDENTIALS."
},
{
"name": "credential",
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer credential reference, for example cred:<id>.",
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
"credential_filter": {
"type": "password"
}
@@ -88,7 +88,7 @@
}
],
"examples": [
"spawnAs cred:credentialId -- powershell.exe -nop -w hidden",
"spawnAs --vault cred:credentialId -- powershell.exe -nop -w hidden",
"spawnAs contoso\\alice P@ssw0rd -- powershell.exe -nop -w hidden",
"spawnAs -d . -l 9 bob Password123 -- cmd.exe /c whoami"
],
modules/SshExec/sshExec.json
+17 -13
View File
@@ -3,12 +3,21 @@
"display_name": "sshExec",
"kind": "module",
"description": "Execute a command on a remote SSH server using username/password authentication.",
"command_template": "sshExec -h {h:q} [-P {P}] -u {u:q} -p {p:q} -- {command:raw}",
"command_template": "sshExec [--vault {vault:q}] -h {h:q} [-P {P}] [-u {u:q}] [-p {p:q}] -- {command:raw}",
"target": "beacon",
"requires_session": true,
"platforms": ["windows", "linux"],
"archs": ["any"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to -u user --password password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "-h",
"type": "flag",
@@ -35,26 +44,20 @@
},
{
"name": "-u",
"type": "credential",
"required": true,
"description": "SSH username, or TeamServer credential reference cred:<id>.",
"credential_filter": {
"type": "password"
}
"type": "flag",
"required": false,
"description": "SSH username for explicit credential mode."
},
{
"name": "--user",
"type": "credential",
"type": "flag",
"required": false,
"description": "SSH username, or TeamServer credential reference cred:<id>.",
"credential_filter": {
"type": "password"
}
"description": "SSH username for explicit credential mode."
},
{
"name": "-p",
"type": "flag",
"required": true,
"required": false,
"description": "SSH password."
},
{
@@ -84,6 +87,7 @@
}
],
"examples": [
"sshExec --vault cred:credentialId -h 10.0.0.5 -- id",
"sshExec -h 10.0.0.5 -u admin -p Passw0rd! -c \"ipconfig /all\"",
"sshExec -h server -P 22 -u admin -p Passw0rd! -- /bin/echo hello"
],
modules/TaskScheduler/taskScheduler.json
+13 -6
View File
@@ -3,12 +3,21 @@
"display_name": "taskScheduler",
"kind": "module",
"description": "Create and optionally run a scheduled task on a local or remote Windows host.",
"command_template": "taskScheduler -c {c:q} [-s {s:q}] [-t {t:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}] [--no-run {no_run:flag}] [--nocleanup {nocleanup:flag}]",
"command_template": "taskScheduler [--vault {vault:q}] -c {c:q} [-s {s:q}] [-t {t:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}] [--no-run {no_run:flag}] [--nocleanup {nocleanup:flag}]",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "-c",
"type": "flag",
@@ -35,12 +44,9 @@
},
{
"name": "-u",
"type": "credential",
"type": "flag",
"required": false,
"description": "DOMAIN\\user for task registration, or TeamServer credential reference cred:<id>.",
"credential_filter": {
"type": "password"
}
"description": "DOMAIN\\user for explicit task registration credentials."
},
{
"name": "-p",
@@ -62,6 +68,7 @@
}
],
"examples": [
"taskScheduler --vault cred:credentialId -s HOST -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"",
"taskScheduler -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"",
"taskScheduler -s HOST -t UpdateTask -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\" --nocleanup"
],
modules/WinRM/winRm.json
+14 -8
View File
@@ -3,28 +3,33 @@
"display_name": "winRm",
"kind": "module",
"description": "Execute a command remotely over WinRM.",
"command_template": "winRm {auth_mode} {username:q?} {password:q?} {target:q} {command:raw?}",
"command_template": "winRm [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {target:q} {command:raw?}",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "auth_mode",
"type": "enum",
"required": true,
"required": false,
"description": "Authentication mode.",
"values": ["-u", "-k", "-n"]
},
{
"name": "username",
"type": "credential",
"type": "text",
"required": false,
"description": "DOMAIN\\Username for -u mode, or TeamServer credential reference cred:<id>.",
"completion_parents": ["-u"],
"credential_filter": {
"type": "password"
}
"description": "DOMAIN\\Username for explicit -u mode."
},
{
"name": "password",
@@ -47,6 +52,7 @@
}
],
"examples": [
"winRm --vault cred:credentialId https://target:5986/wsman whoami.exe /all",
"winRm -u DOMAIN\\Username Password123! https://target:5986/wsman whoami.exe /all",
"winRm -k http://target.example.com:5985/wsman whoami.exe",
"winRm -n http://target:5985/wsman dir c:\\"
modules/WmiExec/wmiExec.json
+14 -8
View File
@@ -3,28 +3,33 @@
"display_name": "wmiExec",
"kind": "module",
"description": "Execute a command through WMI.",
"command_template": "wmiExec {auth_mode} {username:q?} {password:q?} {dc:q?} {target:q} {command:raw}",
"command_template": "wmiExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {dc:q?} {target:q} {command:raw}",
"target": "beacon",
"requires_session": true,
"platforms": ["windows"],
"archs": ["x86", "x64", "arm64"],
"args": [
{
"name": "--vault",
"type": "credential",
"required": false,
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
"credential_filter": {
"type": "password"
}
},
{
"name": "auth_mode",
"type": "enum",
"required": true,
"required": false,
"description": "Authentication mode.",
"values": ["-u", "-k", "-n"]
},
{
"name": "username",
"type": "credential",
"type": "text",
"required": false,
"description": "DOMAIN\\Username for -u mode, or TeamServer credential reference cred:<id>.",
"completion_parents": ["-u"],
"credential_filter": {
"type": "password"
}
"description": "DOMAIN\\Username for explicit -u mode."
},
{
"name": "password",
@@ -53,6 +58,7 @@
}
],
"examples": [
"wmiExec --vault cred:credentialId target whoami.exe",
"wmiExec -u DOMAIN\\Username Password123! target powershell.exe -nop -w hidden",
"wmiExec -k DOMAIN\\dc target whoami.exe /all",
"wmiExec -n localhost whoami.exe"