Skip to content

Changelog

Grimmie edited this page Nov 16, 2022 · 7 revisions

v0.1 - Initial Release

Initial Release

Tradecraft Modules

  • RegList - lists registry contents
  • Timestomp - modifies file and directory timestamps

Persist Methods

  • OverrideTasks - deploys MSBuild Override task based persistence based on a payload specified
  • GenericRegAdd - adds an arbitrary registry key
  • RunKeys - deploys a registry run key

Payload Modules

  • PopCalc - PoC payload to test persistence, pops calc (C#)
  • HelloWorld - runs a hello world script (C#)

v0.2 - Kalaedescope

Persist Modules

  • PSProfiles - backdoors a PowerShell profile

PersistOps Methods

  • registerEventFilter (WMIOps) - registers WMI event filter
  • registerActiveScriptEventConsumer (WMIOps) - registers WMI ActiveScriptEventConsumer
  • registerCommandLineEventConsumer (WMIOps) - registers WMI CommandLineEventConsumer
  • registerIntervalTimerInstruction (WMIOps) - registers WMI IntervalTimerInstruction
  • registerFilterToConsumerBinding (WMIOps) - registers WMI FilterToConsumerBinding
  • shellExec (ShellOps) - executes a shell command and returns output
  • ModifyKey (RegOps) - modify an existing registry key

Tradecraft Modules

  • WMIQuery - Runs arbitrary WMI query, allows for property filtering
  • Creds
    • Check - tests domain credentials
    • List - lists locally stored credentials
  • FileRead - reads file without having to download
  • ProcList - lists running processes
  • SchList - lists scheduled tasks
  • SvcList - lists services
  • NetList - ipconfig
  • Compile - compiles C# payloads to exe

QoL

  • Payloads moved to /Modules/Payloads
  • Payload modules now have requiresAdmin variable, allows for easy identifying modules requiring admin permissions to be set
  • added -lm flag for easier navigation