harleyqu1nn / aggressorscripts

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

Aggressor Scripts

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

• All_In_One.cna v1 - Removed and outdated

  • All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script integration.
  • Version 2 is currently in development!

• ArtifactPayloadGenerator.cna

  • Generates every type of Stageless/Staged Payload based off a HTTP/HTTPS Listener

  • Creates /opt/cobaltstrike/Staged_Payloads, /opt/cobaltstrike/Stageless_Payloads

• AVQuery.cna

  • Queries the Registry with powershell for all AV Installed on the target

  • Quick and easy way to get the AV you are dealing with as an attacker

  

• CertUtilWebDelivery.cna

  • Stageless Web Delivery using CertUtil.exe

  • Powerpick is used to spawn certutil.exe to download the stageless payload on target and execute with rundll32.exe

  

• EDR.cna

  • Detects EDR solutions running on local/remote hosts

• RedTeamRepo.cna

  • A common collection of OS commands, and Red Team Tips for when you have no Google or RTFM on hand.

  • Script will be updated on occasion, feedback and more inputs are welcomed!

  

• ProcessColor.cna

  • Color coded process listing without the file requirement.

  • Thanks to @oldb00t for the original version: https://github.com/oldb00t/AggressorScripts/tree/master/Ps-highlight

  

aggressorscripts's Issues

Armitage

Hi
Are this scripts work in Armitage?

ServiceEXEPersist.cna sc CREATE command Errors out on older windows distributions

First, thanks for these scripts. Anyone who puts their good works up front like this is a real hero, and there are many out there. As payback, I have been testing some of these scripts over various OS's. Here is one I found to be an issue with a suggested fix:

File: ServiceEXEPersist.cna
lines 16-19.
the "sc" commands need to be modified to use "sc.exe". During testing of multiple OS's, especially older windows like Windows 7/8/2008, the binpath= argument will error out when inserting persistence. By moving the command call to sc.exe, the entire command will properly process the new sc create command - now I am not sure why, but it just does...

ArtifactPayloadGenerator.cna script bug

My English is bad

$listener_name = lc($name);
if ($listener_name hasmatch "http" || $listener_name hasmatch "https")

If the listener name does not contain HTTP or HTTPS, it will fail.
Can use the listener_info function
This will get the type of listener

$listener_name = listener_info($name);
if ($listener_name hasmatch "http" || $listener_name hasmatch "https") {
......
}
else{
.......
}

Need for video tutorial

hi man , first thanks for this great scripts, but i need a small tutorial using all these scripts please , thanks in advance.

Case sensitive process matches for ProcessColor.cna ?

Is the string comparison case sensitive ? I have seen a number of hosts where 'cb.exe' processes were not properly highlighted in red. I think that also happened for Tanium processes a couple times.