Cortana Scripts

The pt_autodoc.cna Cortana script monitors for the addition and deletion of hosts and services. It records these changes in a MySQL database, which can subsequently be imported into graph visualization software like Gephi.

Key behaviors:

• Addition: When a host or service is detected, the script checks the graph database. If it doesn't exist, it creates the node and any necessary parent nodes (e.g., subnets) and establishes the appropriate edges. If the node exists, it updates the node's end time.
• Deletion: When a host or service is removed, the script does not delete the node from the graph. Instead, it sets the end time of the associated node to the current time.
• Data Persistence Note: Nodes store a single start and end time. If a service is added and removed multiple times, the database only retains the initial 'seen' time and the most recent end time.

Beef_Strike provides the following automation and integration capabilities:

• Metasploit Integration: Auto-loads the BeEF plugin and auto-imports new zombies into the Metasploit database.
• Attack Automation: Performs MiTM via Ettercap to inject BeEF hooks across a LAN and executes MiTB (Man-in-the-Browser) attacks for persistence.
• Command Execution: Automatically runs BeEF commands against victims based on their browser type.
• Targeted Exploitation: Allows pentesters to specify particular exploits against specific browser profiles.
• Intelligence & Reporting: Geolocates zombies on Google Maps and generates PDF reports of BeEF zombies.

Raven is configured by replacing a placeholder string of 1024 'A' characters with a comma-separated list of attacker-controlled URLs, terminated by a NULL byte.

Constraints:

• The total length of the URL list must not exceed 1024 characters.
• Raven uses a round-robin approach to attempt connections to the provided URLs.
• URLs can include custom port numbers.
• Raven phones home every five minutes.

Safetynet allows for automated payload injection with the following configuration capabilities:

• Payload Selection: Specify safetynets from existing handlers on the teamserver or define custom handlers.
• Auto-Injection: By default, safetynets are set to auto-inject into new sessions. This behavior can be toggled off.
• Process Targeting: Safetynets can optionally be injected into explorer.exe.
• Persistence: All Safetynet configurations are stored in the database and will persist across teamserver restarts.

To use the user_hunter.cna Cortana script, you must first install the underlying user_hunter.rb Metasploit module into your teamserver's Metasploit installation. Place the module in the following directory:

./metasploit-framework/modules/post/windows/gather/

mkdir -p ./metasploit-framework/modules/post/windows/gather/
cp user_hunter.rb ./metasploit-framework/modules/post/windows/gather/

Cortana scripts are designed for use within the [Armitage] and [Cobalt Strike] environments. To use the scripts provided in this repository:

1. Download the repository contents as a ZIP or TGZ file from the [Downloads] link.
2. Extract the files.
3. Load the specific scripts you wish to use into your Armitage or Cobalt Strike instance.

Once the environment is prepared, follow these steps to begin exploitation:

1. Load the Script: Load the beef_strike.cna Cortana script into Armitage. A new sub-menu will appear under the Attack menu.
2. Connect: Connect to your BeEF server instance via the new menu.
3. Recruit Zombies:
   • XSS Method: Use XSS exploitation or the web cloner/mass mailer.
   • MiTM Method: If using Ettercap, choose the interface to poison.
   • Configuration: You must modify the infect.filter file in the project folder to point to your BeEF server address and port (the default is localhost:3000).
4. Exploitation: Once a zombie is recruited, the script automatically profiles the victim's browser. You can then use client-side exploits and send them to zombies via the BeEF invisible iframe module.

To compile Raven, ensure you have mingw installed on your system, then run the build command.

build
# or on Linux with MinGW:
./build.sh

If you want to contribute new scripts, follow these requirements:

• Structure: Each script must reside in its own folder containing a .cna file and any necessary resources. An optional readme file can also be included within the folder.
• Workflow: Fork the repository, make your modifications, and submit a pull request.
• Alternative: If you prefer not to use Git, you can email your script contribution to contact at fastandeasyhacking dot com.

The script allows for advanced payload configuration within the Armitage/Cobalt Strike UI:

• Payload Substitution: You can optionally configure payloads to be substituted into PSEXEC calls on the fly.
• Listener Integration: You can select existing Cobalt Strike listeners, and the script will automatically populate the appropriate options.
• Persistence: Payload options are saved automatically and persist across restarts of Armitage or Cobalt Strike.