From cf304454067f67b2e26afa6f400a73048982c7b8 Mon Sep 17 00:00:00 2001 From: maxdcb <40819564+maxDcb@users.noreply.github.com> Date: Wed, 13 May 2026 11:06:09 +0200 Subject: [PATCH] Vault autcomplet --- modules/CimExec/cimExec.json | 19 ++++++++++----- modules/DcomExec/dcomExec.json | 19 ++++++++++----- modules/MakeToken/makeToken.json | 8 +++---- modules/PsExec/psExec.json | 22 ++++++++++------- modules/SpawnAs/spawnAs.json | 8 +++---- modules/SshExec/sshExec.json | 30 ++++++++++++++---------- modules/TaskScheduler/taskScheduler.json | 19 ++++++++++----- modules/WinRM/winRm.json | 22 ++++++++++------- modules/WmiExec/wmiExec.json | 22 ++++++++++------- 9 files changed, 106 insertions(+), 63 deletions(-) diff --git a/modules/CimExec/cimExec.json b/modules/CimExec/cimExec.json index 1c504e1..5c22f08 100644 --- a/modules/CimExec/cimExec.json +++ b/modules/CimExec/cimExec.json @@ -3,12 +3,21 @@ "display_name": "cimExec", "kind": "module", "description": "Execute a command on a remote Windows host through CIM/WMI.", - "command_template": "cimExec -h {h:q} -c {c:q} [-n {n:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}]", + "command_template": "cimExec [--vault {vault:q}] -h {h:q} -c {c:q} [-n {n:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}]", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "-h", "type": "flag", @@ -35,12 +44,9 @@ }, { "name": "-u", - "type": "credential", + "type": "flag", "required": false, - "description": "DOMAIN\\user credentials, or TeamServer credential reference cred:.", - "credential_filter": { - "type": "password" - } + "description": "DOMAIN\\user for explicit credential mode." }, { "name": "-p", @@ -50,6 +56,7 @@ } ], "examples": [ + "cimExec --vault cred:credentialId -h server01 -c cmd.exe -a \"/c whoami\"", "cimExec -h server01 -c cmd.exe -a \"/c whoami\"", "cimExec -h server01 -n root/cimv2 -c powershell.exe -a \"-nop -c whoami\"" ], diff --git a/modules/DcomExec/dcomExec.json b/modules/DcomExec/dcomExec.json index 87e5541..1b3dc5a 100644 --- a/modules/DcomExec/dcomExec.json +++ b/modules/DcomExec/dcomExec.json @@ -3,12 +3,21 @@ "display_name": "dcomExec", "kind": "module", "description": "Execute a command on a remote Windows host through DCOM.", - "command_template": "dcomExec -h {h:q} -c {c:q} [-a {a:q}] [-w {w:q}] [-k {k:q}] [-u {u:q}] [-p {p:q}] [-n {n:flag}]", + "command_template": "dcomExec [--vault {vault:q}] -h {h:q} -c {c:q} [-a {a:q}] [-w {w:q}] [-k {k:q}] [-u {u:q}] [-p {p:q}] [-n {n:flag}]", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "-h", "type": "flag", @@ -41,12 +50,9 @@ }, { "name": "-u", - "type": "credential", + "type": "flag", "required": false, - "description": "Username for explicit credentials, or TeamServer credential reference cred:.", - "credential_filter": { - "type": "password" - } + "description": "Username for explicit credential mode." }, { "name": "-p", @@ -62,6 +68,7 @@ } ], "examples": [ + "dcomExec --vault cred:credentialId -h fileserver -c cmd.exe -a \"/c whoami\"", "dcomExec -h fileserver -c cmd.exe -a \"/c whoami\"", "dcomExec -h fileserver -k HOST/fileserver.domain -u DOMAIN\\user -p Passw0rd -c cmd.exe -a \"/c whoami\"" ], diff --git a/modules/MakeToken/makeToken.json b/modules/MakeToken/makeToken.json index d405fa6..bee3246 100644 --- a/modules/MakeToken/makeToken.json +++ b/modules/MakeToken/makeToken.json @@ -3,17 +3,17 @@ "display_name": "makeToken", "kind": "module", "description": "Create and impersonate a token from explicit credentials or a TeamServer vault credential reference.", - "command_template": "makeToken {credential:q?} {username:q?} {password:q?}", + "command_template": "makeToken [--vault {vault:q}] {username:q?} {password:q?}", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ { - "name": "credential", + "name": "--vault", "type": "credential", "required": false, - "description": "TeamServer credential reference, for example cred:.", + "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.", "credential_filter": { "type": "password" } @@ -32,7 +32,7 @@ } ], "examples": [ - "makeToken cred:credentialId", + "makeToken --vault cred:credentialId", "makeToken DOMAIN\\Username Password123!" ], "source": "manifest" diff --git a/modules/PsExec/psExec.json b/modules/PsExec/psExec.json index e9278ef..d9f6f4a 100644 --- a/modules/PsExec/psExec.json +++ b/modules/PsExec/psExec.json @@ -3,28 +3,33 @@ "display_name": "psExec", "kind": "module", "description": "Copy and run a service executable on a remote Windows host. The service executable is resolved from Tools first, then UploadedArtifacts.", - "command_template": "psExec {auth_mode} {username:q?} {password:q?} {target:q} {service_artifact:q}", + "command_template": "psExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {target:q} {service_artifact:q}", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "auth_mode", "type": "enum", - "required": true, + "required": false, "description": "Authentication mode.", "values": ["-u", "-k", "-n"] }, { "name": "username", - "type": "credential", + "type": "text", "required": false, - "description": "DOMAIN\\Username for -u mode, or TeamServer credential reference cred:.", - "completion_parents": ["-u"], - "credential_filter": { - "type": "password" - } + "description": "DOMAIN\\Username for explicit -u mode." }, { "name": "password", @@ -66,6 +71,7 @@ } ], "examples": [ + "psExec --vault cred:credentialId fileserver service.exe", "psExec -u DOMAIN\\Username Password123! fileserver service.exe", "psExec -k fileserver service.exe", "psExec -n fileserver service.exe" diff --git a/modules/SpawnAs/spawnAs.json b/modules/SpawnAs/spawnAs.json index 73dd6da..59bcc8a 100644 --- a/modules/SpawnAs/spawnAs.json +++ b/modules/SpawnAs/spawnAs.json @@ -3,7 +3,7 @@ "display_name": "spawnAs", "kind": "module", "description": "Spawn a command under explicit Windows credentials or a TeamServer vault credential reference.", - "command_template": "spawnAs [-d {d:q}] [-l {l}] [-p {p:flag}] [--with-profile {with_profile:flag}] [--no-profile {no_profile:flag}] [-w {w:flag}] [--show-window {show_window:flag}] [--netonly {netonly:flag}] {credential:q?} {username:q?} {password:q?} -- {command:raw}", + "command_template": "spawnAs [-d {d:q}] [-l {l}] [-p {p:flag}] [--with-profile {with_profile:flag}] [--no-profile {no_profile:flag}] [-w {w:flag}] [--show-window {show_window:flag}] [--netonly {netonly:flag}] [--vault {vault:q}] {username:q?} {password:q?} -- {command:raw}", "target": "beacon", "requires_session": true, "platforms": ["windows"], @@ -59,10 +59,10 @@ "description": "Use LOGON32_LOGON_NEW_CREDENTIALS." }, { - "name": "credential", + "name": "--vault", "type": "credential", "required": false, - "description": "TeamServer credential reference, for example cred:.", + "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.", "credential_filter": { "type": "password" } @@ -88,7 +88,7 @@ } ], "examples": [ - "spawnAs cred:credentialId -- powershell.exe -nop -w hidden", + "spawnAs --vault cred:credentialId -- powershell.exe -nop -w hidden", "spawnAs contoso\\alice P@ssw0rd -- powershell.exe -nop -w hidden", "spawnAs -d . -l 9 bob Password123 -- cmd.exe /c whoami" ], diff --git a/modules/SshExec/sshExec.json b/modules/SshExec/sshExec.json index c9e595e..e98c7a3 100644 --- a/modules/SshExec/sshExec.json +++ b/modules/SshExec/sshExec.json @@ -3,12 +3,21 @@ "display_name": "sshExec", "kind": "module", "description": "Execute a command on a remote SSH server using username/password authentication.", - "command_template": "sshExec -h {h:q} [-P {P}] -u {u:q} -p {p:q} -- {command:raw}", + "command_template": "sshExec [--vault {vault:q}] -h {h:q} [-P {P}] [-u {u:q}] [-p {p:q}] -- {command:raw}", "target": "beacon", "requires_session": true, "platforms": ["windows", "linux"], "archs": ["any"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to -u user --password password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "-h", "type": "flag", @@ -35,26 +44,20 @@ }, { "name": "-u", - "type": "credential", - "required": true, - "description": "SSH username, or TeamServer credential reference cred:.", - "credential_filter": { - "type": "password" - } + "type": "flag", + "required": false, + "description": "SSH username for explicit credential mode." }, { "name": "--user", - "type": "credential", + "type": "flag", "required": false, - "description": "SSH username, or TeamServer credential reference cred:.", - "credential_filter": { - "type": "password" - } + "description": "SSH username for explicit credential mode." }, { "name": "-p", "type": "flag", - "required": true, + "required": false, "description": "SSH password." }, { @@ -84,6 +87,7 @@ } ], "examples": [ + "sshExec --vault cred:credentialId -h 10.0.0.5 -- id", "sshExec -h 10.0.0.5 -u admin -p Passw0rd! -c \"ipconfig /all\"", "sshExec -h server -P 22 -u admin -p Passw0rd! -- /bin/echo hello" ], diff --git a/modules/TaskScheduler/taskScheduler.json b/modules/TaskScheduler/taskScheduler.json index 0d7c39c..1504162 100644 --- a/modules/TaskScheduler/taskScheduler.json +++ b/modules/TaskScheduler/taskScheduler.json @@ -3,12 +3,21 @@ "display_name": "taskScheduler", "kind": "module", "description": "Create and optionally run a scheduled task on a local or remote Windows host.", - "command_template": "taskScheduler -c {c:q} [-s {s:q}] [-t {t:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}] [--no-run {no_run:flag}] [--nocleanup {nocleanup:flag}]", + "command_template": "taskScheduler [--vault {vault:q}] -c {c:q} [-s {s:q}] [-t {t:q}] [-a {a:q}] [-u {u:q}] [-p {p:q}] [--no-run {no_run:flag}] [--nocleanup {nocleanup:flag}]", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to -u DOMAIN\\user -p password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "-c", "type": "flag", @@ -35,12 +44,9 @@ }, { "name": "-u", - "type": "credential", + "type": "flag", "required": false, - "description": "DOMAIN\\user for task registration, or TeamServer credential reference cred:.", - "credential_filter": { - "type": "password" - } + "description": "DOMAIN\\user for explicit task registration credentials." }, { "name": "-p", @@ -62,6 +68,7 @@ } ], "examples": [ + "taskScheduler --vault cred:credentialId -s HOST -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"", "taskScheduler -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\"", "taskScheduler -s HOST -t UpdateTask -c C:\\Windows\\System32\\cmd.exe -a \"/c whoami\" --nocleanup" ], diff --git a/modules/WinRM/winRm.json b/modules/WinRM/winRm.json index e410419..5efba67 100644 --- a/modules/WinRM/winRm.json +++ b/modules/WinRM/winRm.json @@ -3,28 +3,33 @@ "display_name": "winRm", "kind": "module", "description": "Execute a command remotely over WinRM.", - "command_template": "winRm {auth_mode} {username:q?} {password:q?} {target:q} {command:raw?}", + "command_template": "winRm [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {target:q} {command:raw?}", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "auth_mode", "type": "enum", - "required": true, + "required": false, "description": "Authentication mode.", "values": ["-u", "-k", "-n"] }, { "name": "username", - "type": "credential", + "type": "text", "required": false, - "description": "DOMAIN\\Username for -u mode, or TeamServer credential reference cred:.", - "completion_parents": ["-u"], - "credential_filter": { - "type": "password" - } + "description": "DOMAIN\\Username for explicit -u mode." }, { "name": "password", @@ -47,6 +52,7 @@ } ], "examples": [ + "winRm --vault cred:credentialId https://target:5986/wsman whoami.exe /all", "winRm -u DOMAIN\\Username Password123! https://target:5986/wsman whoami.exe /all", "winRm -k http://target.example.com:5985/wsman whoami.exe", "winRm -n http://target:5985/wsman dir c:\\" diff --git a/modules/WmiExec/wmiExec.json b/modules/WmiExec/wmiExec.json index 5d9c4da..bd0e918 100644 --- a/modules/WmiExec/wmiExec.json +++ b/modules/WmiExec/wmiExec.json @@ -3,28 +3,33 @@ "display_name": "wmiExec", "kind": "module", "description": "Execute a command through WMI.", - "command_template": "wmiExec {auth_mode} {username:q?} {password:q?} {dc:q?} {target:q} {command:raw}", + "command_template": "wmiExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {dc:q?} {target:q} {command:raw}", "target": "beacon", "requires_session": true, "platforms": ["windows"], "archs": ["x86", "x64", "arm64"], "args": [ + { + "name": "--vault", + "type": "credential", + "required": false, + "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.", + "credential_filter": { + "type": "password" + } + }, { "name": "auth_mode", "type": "enum", - "required": true, + "required": false, "description": "Authentication mode.", "values": ["-u", "-k", "-n"] }, { "name": "username", - "type": "credential", + "type": "text", "required": false, - "description": "DOMAIN\\Username for -u mode, or TeamServer credential reference cred:.", - "completion_parents": ["-u"], - "credential_filter": { - "type": "password" - } + "description": "DOMAIN\\Username for explicit -u mode." }, { "name": "password", @@ -53,6 +58,7 @@ } ], "examples": [ + "wmiExec --vault cred:credentialId target whoami.exe", "wmiExec -u DOMAIN\\Username Password123! target powershell.exe -nop -w hidden", "wmiExec -k DOMAIN\\dc target whoami.exe /all", "wmiExec -n localhost whoami.exe"