threatexpress/aggressor-scripts

Stars
137
Rank 264,618 (Top 6 %)
Language
JavaScript
Created about 6 years ago
Updated about 3 years ago

threatexpress/aggressor-scripts

threatexpress

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Cobalt Strike Aggressor Scripts

Cobalt Strike Aggressor Scripts

Collection of Cobalt Strike Aggressor Scripts

enumerate.cna

Cobalt Strike Aggressor script function and alias to perform some rudimentary Windows host enumeration with Beacon built-in API-only commands.

Additionally, adds a basic enumerate alias for Linux based systems in SSH sessions.

wmi_msbuild

Extends Beacon's jump command by adding a wmi_msbuild option that uses remote WMI to create a new msbuild process and execute an XML file generated via python with encrypted Beacon stageless shellcode. See wmi_msbuild.cna for OPSEC notes and usage.

Adapted by @andrewchiles for CS 4.0+ jump and removed PowerLessShell requirement Original Authors: Alyssa (ramen0x3f), MrT__F version for PowerLessShell

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

domainhunter

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

red-team-scripts

A collection of Red Team focused tools, scripts, and notes

random_c2_profile

Cobalt Strike random C2 Profile generator

cs2modrewrite

Convert Cobalt Strike profiles to modrewrite scripts

metatwin

The project is designed as a file resource cloner. Metadata, including digital signature, is extracted from one file and injected into another.

tinyshell

pasties

A collection of random bits of information common to many individual penetration tests, red teams, and other assessments

subshell

SubShell is a python command shell used to control and execute commands through HTTP requests to a webshell. SubShell acts as the interface to the remote webshells.

threatbox

ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of ansible playbooks. Why Ansible? Why not? This seemed a natural evolution.

invoke-pipeshell

SMB Named Pipe shell

portplow

PortPlow is a distributed port and system scanning & enumeration service. It enables the quick and automated enumeration of ports and services from multiple systems managed by a central console.

edc

Event Data Collector

mythic2modrewrite

Generate Apache mod_rewrite rules for Mythic C2 profiles

threat-mitigation

Threat Mitigation Strategies

procdot_sandbox

ProcDot Malware Sandbox

cobaltstrike_payload_generator

Quickly generate every payload type for each listener and optionally host via HTTP.

threatexpress

redteamguide

Home of https://redteam.guide

tools