AggressorScripts - Aggressor scripts for use with Cobalt Strike 3.0+

项目说明

AggressorScripts

Aggressor scripts for use with Cobalt Strike 3.0+

apache-style-weblog-output.cna - outputs weblog hits to an Apache-like access log file named weblog.log in Cobalt Strike's working directory

beacon_to_empire.cna - a script that le Powershell Empire's RESTful API to migrate sessions from a Beacon session on Cobalt Strike

beaconid_note.cna - set Beacon note to its ID on load and initial checkin (primarily useful when coding Aggressor scripts)

beaconestablishednote.cna - set Beacon note to the time it was established on initial checkin

Beaconpire - send Beacons to Empire and pull Empire Agents into Cobalt Strike

CCDC - a collection of scripts designed for use at CCDC
* lulz.cna - includes some Blue Team annoyance functions: IE Popup (kiosk mode), Windows Alert (7+), Host Shutdown, Boo.exe (uploads/executes Boo), and Clippy popup (requires setup and Windows 7).
* misc.cna - includes functions to stomp the host file with a chosen text file or add an entry to the existing host file.
* sysinternals-killer.cna - Automatically kill common Blue Team processes, such as the Sysinternals tools, on launch

checkin_jobs_context.cna - adds context menu options to run "checkin" or "jobs" on Beacon session to help detect stale beacons in bulk

e.cna - script to send event log events to Slack. NOTE: Review code before deploying in production. Sensiti (usernames, hostnames, teamserver IPs) will be sent to Slack.

forcecheckin.cna - forces an SMB Beacon to checkin after a specified frequency

mass-dcsync.cna - DCSync a line-separated list of users from a DC

mimikatz-e.cna - runs mimikatz's "logonpasswords" alias every thirty minutes

mimikatz-timestamp-note-BETA.cna - POC script that adds a timestamp to the source column in new credentials. The script is considered BETA - it has not been field tested and has bugs.

OPSEC Profiles - limits the commands Cobalt Strike can execute while loaded. Used to reduce the chance of performing high-risk actions in mature target en.

powershell.cna - adds context items for some common Powerup and Powerview functions. For this to work, you must put the PowerUp.ps1 and powerview.ps1 files in the same directory as this script

ping_aliases.cna - creates an alias for quick ping (one ping packet w/ shell) and smbscan (to portscan smb w/o ping)

ps-window-alias.cna - creates an alias to open the process browser pane for the current Beacon

sil.cna - monitors Beacon output for machine hashes and stores them in the cred store. Also adds a dialog box for generating a Sil from a gathered machine hash

slack-notify-beacon.cna - sends a generic alert to a chosen Slack channel webhook when a new Beacon is established(requires curl on team server)

slack-notify-webhit.cna - sends a generic alert to a chosen Slack channel webhook when a specific URI or URIs are requested (requires curl on team server)

sleep-down-when-no-operators.cna - increases the sleep interval on all Beacons when there are no operators logged in

sleeptimer.cna - automatically sets sleep intervals based on time (i.e. from 10p to 6a, sleep for 60s). Resets to 60s sleeps when the sleep interval ends.

stale-beacon-notifier.cna - sends a generic alert to a chosen Slack channel webhook when a Beacon's last checkin exceeds a specified time (requires curl on team server).

timestamped_acti.cna - Outputs all event and activity logs with human-readable timestamp to acti.txt in your working directory (runs on script load)

Other Aggressor Repos

*
*
*
*
*
*
*

Submissions

Please feel free to submit a Pull Request with fixes or impro to any of the existing scripts; however, my intention is to only keep Aggressor scripts that I' in this repo.

If you have an idea for a script and would like to submit it somewhere, consider adding it to Lee Kagan's Aggressor Scripts Collection repo.

项目信息

开发语言：未知

Star 数：899

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Aggressor scripts for use with Cobalt Strike 3.0+展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。