Changelog

v0.1 - Initial Release

Initial Release

Tradecraft Modules

• RegList - lists registry contents
• Timestomp - modifies file and directory timestamps

Persist Methods

• OverrideTasks - deploys MSBuild Override task based persistence based on a payload specified
• GenericRegAdd - adds an arbitrary registry key
• RunKeys - deploys a registry run key

Payload Modules

• PopCalc - PoC payload to test persistence, pops calc (C#)
• HelloWorld - runs a hello world script (C#)

v0.2 - Kalaedescope

Persist Modules

• PSProfiles - backdoors a PowerShell profile

PersistOps Methods

• registerEventFilter (WMIOps) - registers WMI event filter
• registerActiveScriptEventConsumer (WMIOps) - registers WMI ActiveScriptEventConsumer
• registerCommandLineEventConsumer (WMIOps) - registers WMI CommandLineEventConsumer
• registerIntervalTimerInstruction (WMIOps) - registers WMI IntervalTimerInstruction
• registerFilterToConsumerBinding (WMIOps) - registers WMI FilterToConsumerBinding
• shellExec (ShellOps) - executes a shell command and returns output
• ModifyKey (RegOps) - modify an existing registry key

Tradecraft Modules

• WMIQuery - Runs arbitrary WMI query, allows for property filtering
• Creds
  • Check - tests domain credentials
  • List - lists locally stored credentials
• FileRead - reads file without having to download
• ProcList - lists running processes
• SchList - lists scheduled tasks
• SvcList - lists services
• NetList - ipconfig
• Compile - compiles C# payloads to exe

QoL

• Payloads moved to /Modules/Payloads
• Payload modules now have requiresAdmin variable, allows for easy identifying modules requiring admin permissions to be set
• added -lm flag for easier navigation