mirror of
https://github.com/maxDcb/C2Core
synced 2026-06-08 15:48:01 +00:00
maxdcb
97 lines
2.7 KiB
JSON
97 lines
2.7 KiB
JSON
{
|
|
"name": "spawnAs",
|
|
"display_name": "spawnAs",
|
|
"kind": "module",
|
|
"description": "Spawn a command under explicit Windows credentials or a TeamServer vault credential reference.",
|
|
"command_template": "spawnAs [-d {d:q}] [-l {l}] [-p {p:flag}] [--with-profile {with_profile:flag}] [--no-profile {no_profile:flag}] [-w {w:flag}] [--show-window {show_window:flag}] [--netonly {netonly:flag}] [--vault {vault:q}] {username:q?} {password:q?} -- {command:raw}",
|
|
"target": "beacon",
|
|
"requires_session": true,
|
|
"platforms": ["windows"],
|
|
"archs": ["x86", "x64", "arm64"],
|
|
"args": [
|
|
{
|
|
"name": "-d",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Domain override."
|
|
},
|
|
{
|
|
"name": "-l",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Windows logon type.",
|
|
"values": ["2", "9"]
|
|
},
|
|
{
|
|
"name": "-p",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Load the user profile before launching the process."
|
|
},
|
|
{
|
|
"name": "--with-profile",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Load the user profile before launching the process."
|
|
},
|
|
{
|
|
"name": "--no-profile",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Do not load the user profile."
|
|
},
|
|
{
|
|
"name": "-w",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Show the process window."
|
|
},
|
|
{
|
|
"name": "--show-window",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Show the process window."
|
|
},
|
|
{
|
|
"name": "--netonly",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Use LOGON32_LOGON_NEW_CREDENTIALS."
|
|
},
|
|
{
|
|
"name": "--vault",
|
|
"type": "credential",
|
|
"required": false,
|
|
"description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
|
|
"credential_filter": {
|
|
"type": "password"
|
|
}
|
|
},
|
|
{
|
|
"name": "username",
|
|
"type": "text",
|
|
"required": true,
|
|
"description": "Username in Username, DOMAIN\\Username, or user@domain form."
|
|
},
|
|
{
|
|
"name": "password",
|
|
"type": "text",
|
|
"required": true,
|
|
"description": "Password for the supplied user."
|
|
},
|
|
{
|
|
"name": "command",
|
|
"type": "text",
|
|
"required": true,
|
|
"description": "Program and arguments to launch after --.",
|
|
"variadic": true
|
|
}
|
|
],
|
|
"examples": [
|
|
"spawnAs --vault cred:credentialId -- powershell.exe -nop -w hidden",
|
|
"spawnAs contoso\\alice P@ssw0rd -- powershell.exe -nop -w hidden",
|
|
"spawnAs -d . -l 9 bob Password123 -- cmd.exe /c whoami"
|
|
],
|
|
"source": "manifest"
|
|
}
|