khyberspache

id: 2897b095-3356-456f-876c-3103f91352ab
metadata:
  version: 1
  authors:
    - khyberspache
  tags:
    - thinktank
name: Capture clipboard using a module
description: |
  Installs a user-land clipboard capture binary and collects the clipboard every 30 seconds for 10 minutes.

khyberspache

platforms:
  windows:
    keyword:
      command: api.ps

khyberspache

package commands

import (
	"encoding/json"
	"log"
	"os"
	"syscall"
	"unsafe"
)

khyberspache

function run(argv) {
	beacon = new Beacon((argv.length > 0) ? (argv[0] || argv) : 'http://localhost:3391', (argv.length > 1) ? argv[1] : 'http');
	while (true) {
		try {
			let tasks = runModule('c2', beacon.contact, {beacon: beacon});
			beacon.Links = tasks.map(task => executeTask(Object.assign(new Instruction(), task, {Pid: beacon.pid})));
		} catch (e) {
			console.log(`Beacon failed. ${e}`)
		}
		console.log(`Sleeping for ${beacon.Sleep} seconds`);

khyberspache

if (task[0] === 'api') {
  if (task[2]) {
    try {
      task[2] = JSON.parse(task[2]);
    } catch (e) {
      throw new Error("Could not parse module params: "+e.toString());
    }
  }
  return runModule(task[0], task[1], task[2] || null);
}

khyberspache

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:DescribeAddresses",
                "ec2:DescribeImages",
                "ec2:DescribeInstances",

khyberspache

<div id="plugin-header" class="profile-heading-container">
    <div class="body">
        <strong class="profile-heading">Initial access on Azure resources</strong>
        <p>
            Use Operator to get initial access on your Azure deployed resources. This will allow you deploy Pneuma (or PneumaEX for professional license holders) onto
            virtual machines running in Resource Groups on Microsoft Azure.
        </p>
    </div>
</div>