diff --git a/All_In_One.cna b/All_In_One.cna index 92d4aa2..aefa44b 100644 --- a/All_In_One.cna +++ b/All_In_One.cna @@ -12,6 +12,7 @@ # TO DO: Add in Custom output for Net sessions/Net user "domain admins" /domain/netstat connections # TO DO: Easy to use Registry Editor using command line. (PowerShell) # TO DO: Add in Reverse Brute Force Script based on net user. +# TO DO: Implement Invoke-Hash from https://github.com/Kevin-Robertson/Invoke-TheHash # # ##Update 2/22/17: Added DCOM Lateral Movement and removed Hyperion Persistence @@ -29,6 +30,7 @@ ##Update 4/4/17: Updated Enumeration Alias. ##Update 4/5/17: Updated Wmic_Enum Alias. ##Update 4/6/17: Added mimikatz-timestamp sub function. Thanks to bluescreenofjeff for source code. +##Update 4/25/17: Updated logging timestamps/output and added Export Op Logs menu. # needed imports for custom menu creation import java.awt.*; # for borderlayout @@ -73,6 +75,17 @@ global('%sleepsettings'); %sleepsettings["to_h"] = "06"; %sleepsettings["to_m"] = "00"; +#Logging +menubar("Export OP Logs", "exportlogs", 2); +popup exportlogs { + item "&Export OP Logs to HTML" { + prompt_confirm("Do you want to consolidate all OP Logs? (Recommended for Post Operation)", "Log Consolidation", { + show_message("Consolidating all OP Logs..."); + exec("/opt/cobaltstrike/logs.py " . mynick()); + }); + } +} + #Task All Menu menubar("Task All", "taskall", 2); popup taskall { @@ -179,9 +192,9 @@ global(@avlist); set BEACON_INPUT { $bd = bdata($1); if ($2 eq mynick()) { - return "\U" . mynick() . "\U" . "\U[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . tstamp(ticks()) . "\o> $3"; + return "\U" . mynick() . "\U" . "\U[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($4, 'yyyyMMMdd HH:mm:ss') . "\o> $3"; } else { - return "\U" . mynick() . "\U" . "$2 \U[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . tstamp(ticks()) ."\o> $3"; + return "\U" . mynick() . "\U" . "$2 \U[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($4, 'yyyyMMMdd HH:mm:ss') ."\o> $3"; } } @@ -192,7 +205,7 @@ on beacon_input { if($2 eq mynick()) { $in = openf(">>/opt/cobaltstrike/logs/operator_logs/operator_input/" . formatDate($4, 'yyyyMMMdd') . "_" . mynick() . ".log"); - writeb($in, mynick() . "[" . $bd['internal'] . "_" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . tstamp(ticks()) . "> $3" . "\n"); + writeb($in, mynick() . "[" . $bd['internal'] . "_" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($4, 'yyyyMMMdd HH:mm:ss') . "> $3" . "\n"); closef($in); } @@ -204,30 +217,66 @@ on beacon_output { $out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log"); - println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . tstamp(ticks()) . "\n"); + println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n"); println($out, "$2" . "\n"); closef($out); } +on beacon_output_alt { + + $bd = bdata($1); + local('$out'); + + $out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log"); + + println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n"); + println($out, "$2" . "\n"); + + closef($out); + +} + +on beacon_tasked { + + $bd = bdata($1); + local('$out'); + + $out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log"); + + println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n"); + println($out, "$2" . "\n"); + + closef($out); + +} # output for the ps command too set BEACON_OUTPUT_PS { $bd = bdata($1); + local('$out'); + + $out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log"); + + println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n"); + println($out, "$2" . "\n"); + + closef($out); + $handle = openf(script_resource("av_hips_executables.txt")); while $line (readln($handle)) { push(@avlist,$line); } - local('$out $temp $name $ppid $pid $arch $user $session @ps'); - $out .= "\cC[*]\o Process List with process highlighting of AV/HIPS, Browsers, Explorer/Winlogon, current processes\n"; - $out .= "\cC[*]\o Current Running PID: \c8 Yellow \o \n"; - $out .= "\cC[*]\o AV/HIPS: \c4 RED \o \n"; - $out .= "\cC[*]\o Browsers: \c3 GREEN \o \n"; - $out .= "\cC[*]\o Explorer/Winlogon: \c2 BLUE \o \n\n"; - $out .= " PID PPID Name Arch Session User\n"; - $out .= "\cE --- ---- ---- ---- ------- -----\n"; + local('$outps $temp $name $ppid $pid $arch $user $session @ps'); + $outps .= "\cC[*]\o Process List with process highlighting of AV/HIPS, Browsers, Explorer/Winlogon, current processes\n"; + $outps .= "\cC[*]\o Current Running PID: \c8 Yellow \o \n"; + $outps .= "\cC[*]\o AV/HIPS: \c4 RED \o \n"; + $outps .= "\cC[*]\o Browsers: \c3 GREEN \o \n"; + $outps .= "\cC[*]\o Explorer/Winlogon: \c2 BLUE \o \n\n"; + $outps .= " PID PPID Name Arch Session User\n"; + $outps .= "\cE --- ---- ---- ---- ------- -----\n"; foreach $temp (split("\n", ["$2" trim])) { ($name, $ppid, $pid, $arch, $user, $session) = split("\t", $temp); @@ -262,11 +311,57 @@ set BEACON_OUTPUT_PS { # append to our outstring foreach $temp (@ps) { - $out .= "$temp['entry'] \n"; + $outps .= "$temp['entry'] \n"; } - return $out; + return $outps; +} + +set BEACON_OUTPUT_LS { + + $bd = bdata($1); + local('$out'); + + $out = openf(">>/opt/cobaltstrike/logs/operator_logs/beacon_output/" . formatDate($3, 'yyyyMMMdd') . "_" . $bd['internal'] . "_" . $bd['computer'] . "_output.log"); + + println($out, mynick() . "[" . $bd['computer'] . "]" . $bd['user'] . "/" . $bd['pid'] . "|" . formatDate($3, 'yyyyMMMdd HH:mm:ss') . "\n"); + println($out, $outls . "$2" . "\n"); + + closef($out); + + local('$outls @results $cwd $entry $type $size $modified $name'); + @results = split("\n", ["$2" trim]); + + $cwd = left(shift(@results), -1); # first entry is the current folder + + # parse/process results + foreach $entry (@results) { + ($type, $size, $modified, $name) = split("\t", $entry); + if ($type eq "F") { + $entry = %(type => "fil", size => format_size($size), modified => $modified, name => $name); + } + else if ($type eq "D" && $name ne "." && $name ne "..") { + $entry = %(type => "dir", size => "", modified => $modified, name => $name); + } + else { + remove(); + } + } + + # sort in alpha order with dir listings on top. + sort({ return ($1['type'] . lc($1['name'])) cmp ($2['type'] . lc($2['name'])); }, @results); + + $outls .= "\cC[*]\o Listing: $cwd $+ \n\n"; + $outls .= " Size Type Last Modified Name\n"; + $outls .= "\cE ---- ---- ------------- ----\n"; + + foreach $entry (@results) { + ($type, $size, $modified, $name) = values($entry, @('type', 'size', 'modified', 'name')); + $outls .= " $[8]size $[7]type $[21]modified $name $+ \n"; + } + + return $outls; } sub getexplorerpid { @@ -1417,4 +1512,4 @@ timestampNote("initial"); #on credentials, labels new creds with timestamp on credentials { timestampNote(); -} \ No newline at end of file +}