infosecn1nja
/
AggressorScripts
mirror of https://github.com/infosecn1nja/AggressorScripts.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
115 Commits
3 Branches
0 Tags
211 KiB
C# 71%
Python 19%
PowerShell 10%
 
 
 
Go to file
Harley Lebeau 18d6bdb021
Added Newer Symantec processes 		2017-11-07 12:13:51 -07:00
Logging Added Newer Symantec processes 2017-11-07 12:13:51 -07:00
Persistence Added Sample WQL Queries and Payload example 2017-08-13 13:40:09 -04:00
AVQuery.cna Update AVQuery.cna 2017-07-16 15:47:56 -04:00
All_In_One.cna Update All_In_One.cna 2017-05-20 04:08:18 -04:00
ArtifactPayloadGenerator.cna Automatic Artifact Payload Generator 2017-07-06 12:30:46 -04:00
CertUtilWebDelivery.cna Updated script to use PowerPick thanks @424f424f! 2017-09-01 23:05:08 -04:00
ProcessMonitor.cna Add files via upload 2017-10-12 14:58:27 -06:00
ProcessMonitor.ps1 Add files via upload 2017-10-12 14:58:27 -06:00
README.md Update README.md 2017-09-04 05:36:43 -04:00
RedTeamRepo.cna Update RedTeamRepo.cna 2017-09-04 05:40:51 -04:00

README.md

Aggressor Scripts

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

  • All_In_One.cna v1

    • All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script integration.
    • Thanks to @rsmudge, @enigma0x3, @harmj0y, PowerShell Mafia folks, Nathan Wray, @Und3rFl0w, @oldb00t, bluescreenofjeff for all the help and code snippets.
    • Script must reside in /opt/cobaltstrike/ directory. (Location can be changed inside the script)

All_In_One.cna Dependencies:

Parent Folder/Files: 
    /opt/cobaltstrike/All_In_One.cna
    /opt/cobaltstrike/av_hips_executables.txt 
    /opt/cobaltstrike/logs.py
Sub Folders: 
    /opt/cobaltstrike/scripts/
    /opt/cobaltstrike/Payloads/
    /opt/cobaltstrike/modules/
Elevate Kit (Licensed Users Only)

  • ArtifactPayloadGenerator.cna

    • Generates every type of Stageless/Staged Payload based off a HTTP/HTTPS Listener

    • Creates /opt/cobaltstrike/Staged_Payloads, /opt/cobaltstrike/Stageless_Payloads

  • AVQuery.cna

    • Queries the Registry with powershell for all AV Installed on the target

    • Quick and easy way to get the AV you are dealing with as an attacker

    av

  • CertUtilWebDelivery.cna

    • Stageless Web Delivery using CertUtil.exe

    • Powerpick is used to spawn certutil.exe to download the stageless payload on target and execute with rundll32.exe

    certutil2

  • RedTeamRepo.cna

    • A common collection of OS commands, and Red Team Tips for when you have no Google or RTFM on hand.

    • Script will be updated on occasion, feedback and more inputs are welcomed!

    redrepo