Skip to content

Instantly share code, notes, and snippets.

@thesubtlety
Created March 26, 2021 21:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save thesubtlety/594ff8387d7ee232415c4989ce20bb3b to your computer and use it in GitHub Desktop.
Save thesubtlety/594ff8387d7ee232415c4989ce20bb3b to your computer and use it in GitHub Desktop.
Stale beacon slacker, only messages once
# CNA script to alert on dead beacons. Doesn't repeat messages.
# author: noah @thesubtlety
# credit https://github.com/bluscreenofjeff/AggressorScripts/blob/master/stale-beacon-notifier.cna - bluescreenofjeff
$webhook_url = "https://hooks.slack.com/services/xxxxx";
$slack_channel = "#crackers";
%beacon_status = %();
# default stale value of 5 minutes (300000ms)
$stale_value = 300000;
on heartbeat_5m {
foreach $beacon (beacons()) {
$computer = $beacon['computer'];
$pid = $beacon['pid'];
$bid = $beacon['id'];
if (($beacon["last"] > $stale_value) && ($beacon["pbid"] eq '')) {
if (%beacon_status[$bid]["status"] eq "dead") {
break;
}
%beacon_status[$bid] = %(status => "dead");
$last_checkin = $beacon["last"] / 1000;
println("The beacon on " . $beacon['computer'] . " hasn't checked in for " . $last_checkin . " seconds.");
@curl_command = @('curl','-X','POST','--data-urlencode','payload={"username": "Continuous Op Bot", "icon_emoji": ":skeleton:", "channel": "' . $slack_channel . '", "text":"Beacon on ' . $beacon['computer'] . ' (' . $beacon['pid'] . ') now alive. "}',$webhook_url);
exec(@curl_command);
} else {
%beacon_status[$bid] = %(status => "alive");
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment