Awesome
vscode-language-aggressor
This is a Visual Studio Code (VSC) extension that aims to provide:
- An implement of the Sleep and Cobalt Strike (CS) Aggressor grammar; and
- The definition of Cobalt Strike functions' prototype
Please note, that everything is based on the documentation provided by Raphael Mudge:
- Official sleep documentation: http://sleep.dashnine.org/manual/
- Official Cobalt Strike Aggressor documentation: https://www.cobaltstrike.com/aggressor-script/index.html
Features
This extensions offers a series of snippets for helping in building a Cobalt Strike Agressor scripts. The extension is based on the Cobalt Strike 4.0 aggresor script feature set. It also provide automatic closing of element tags for the filter fields.
Snippets
| Name | Description |
|---|---|
| heartbeat_1m | Fired every minute |
| h3 | Prints a sub-sub-title heading. |
| ssh_tasked | Fired when a task acknowledgement is posted to an SSH console. |
| openScriptConsole | Open the Aggressor Script console |
| listener_delete | Stop and remove a listener |
| sendmail_done | Fired when a phishing campaign completes |
| pref_set | Set a value in Cobalt Strike's preferences |
| event_newsite | Fired when a new site message is posted to the event log. |
| bsetenv | Ask Beacon to set an environment variable |
| listener_describe | Describe a listener. |
| sites | Returns a list of sites tied to Cobalt Strike's web server. |
| agServices | Pull information from the services model |
| beacon_command_describe | Describe a Beacon command |
| openWindowsExecutableStage | Open the dialog to generate a stageless Windows executable |
| elog | Publish a notification to the event log |
| EXECUTABLE_ARTIFACT_GENERATOR | Control the EXE and DLL generation for Cobalt Strike |
| beacon_remote_exec_method_describe | Describe a Beacon remote execute method |
| prompt_file_save | Show a file save dialog. |
| agTokens | Pull information from the phishing tokens model. |
| bdata | Get metadata for a Beacon session |
| POWERSHELL_COMPRESS | A hook used by the resource kit to compress a PowerShell script. The default uses gzip and returns a deflator script. |
| openBeaconBrowser | Open the beacon browser tab |
| bcd | Ask a Beacon to change it's current working directory |
| artifact_payload | Generates a stageless payload artifact (exe, dll) from a Cobalt Strike listener name |
| binject | Ask Beacon to inject a session into a specific process |
| beacon_exploit_register | Register a Beacon privilege escalation exploit with Cobalt Strike. This adds an option to the elevate command |
| PSEXEC_SERVICE | Set the service name used by jump psexec, psexec64, psexec_psh and psexec. |
| -isadmin | Check if a session has admin rights |
| bspawn | Ask Beacon to spawn a new session |
| openWindowsExecutableDialog | Open the dialog to generate a Windows executable |
| downloads | Returns a list of downloads in Cobalt Strike's data model |
| bookmark | Define a bookmark [PDF document only] |
| agApplications | Pull information from the applications model. |
| removeTab | Close the active tab |
| bspawnto | Change the default program Beacon spawns to inject capabilities into |
| bscreenshot | Ask Beacon to take a screenshot |
| keystrokes | Returns a list of keystrokes from Cobalt Strike's data model |
| openPayloadHelper | Open a payload chooser dialog. |
| p | Prints a paragraph of text. |
| beacon_initial_empty | Fired when a DNS Beacon calls home for the first time. At this point, no metadata has been exchanged. |
| openFileBrowser | Open the file browser for a Beacon |
| brm | Ask Beacon to remove a file or folder |
| berror | Publish an error message to the Beacon transcript |
| blogonpasswords | Ask Beacon to dump in-memory credentials with mimikatz |
| bdllspawn | Spawn a Reflective DLL as a Beacon post-exploitation job |
| listener_create_ext | Create a new listener |
| bpwd | Ask Beacon to print its current working directory |
| targets | Returns a list of host information in Cobalt Strike's data model. |
| web_hit | Fired when there's a new hit on Cobalt Strike's web server. |
| openCloneSiteDialog | Open the dialog for the website clone tool |
| brunu | Ask Beacon to run a process under another process. |
| pivots | Returns a list of SOCKS pivots from Cobalt Strike's data model |
| openBeaconConsole | Open the console to interact with a Beacon |
| bkeylogger | Injects a keystroke logger into a process. |
| say | Post a public chat message to the event log. |
| bexecute | Ask Beacon to execute a command [without a shell]. This provides no output to the user |
| ssh_indicator | |
| openSOCKSSetup | open the SOCKS proxy server setup dialog |
| bpause | Ask Beacon to pause its execution. This is a one-off sleep. |
| beacon_initial | Fired when a Beacon calls home for the first time. |
| sendmail_post | Fired after a phish is sent to an email address. |
| bgetuid | Ask Beacon to print the User ID of the current token |
| p_formatted | Prints a paragraph of text with some format preservation. |
| menubar | Add a top-level item to the menubar |
| openMakeTokenDialog | open a dialog to help generate an access token |
| dialog_description | Adds a description to a &dialog |
| bspawnas | Ask Beacon to spawn a session as another user |
| iprange | Generate an array of IPv4 addresses based on a string description |
| HTMLAPP_EXE | Controls the content of the HTML Application User-driven (EXE Output) generated by Cobalt Strike |
| beacon_ids | Get the ID of all Beacons calling back to this Cobalt Strike team server |
| barch | Returns the architecture of your Beacon session (e.g., x86 or x64) |
| prompt_confirm | Show a dialog with Yes/No buttons. If the user presses yes, call the specified function. |
| bkerberos_ccache_use | Ask beacon to inject a UNIX kerberos ccache file into the user's kerberos tray |
| str_encode | Convert text to byte string with the specified character encoding. |
| bjump | Ask Beacon to spawn a session on a remote target |
| openCovertVPNSetup | open the Covert VPN setup dialog |
| agC2info | Pull information from the c2info model. |
| gunzip | Decompress a string (GZIP). |
| bhashdump | Ask Beacon to dump local account password hashes |
| POWERSHELL_DOWNLOAD_CRADLE | Change the form of the PowerShell download cradle used in Cobalt Strike's post-ex automation. This includes jump winrm,winrm64, [host] -> Access -> One Liner, and powershell-import. |
| sync_download | Sync a downloaded file (View -> Downloads) to a local path. |
| binfo | Get information from a Beacon session's metadata |
| drow_text | Adds a text field row to a &dialog |
| binjectsh | Inject shellcode into a process |
| dbutton_help | Adds a Help button to a &dialog. When this button is pressed, Cobalt Strike will open the user's browser to the specified URL |
| bppid | Set a parent process for Beacon's child processes |
| -isssh | Check if a session is an SSH session or not. |
| show_error | Shows an error message to the user in a dialog box. Use this function to relay error information. |
| action | Post a public action message to the event log. This is similar to the /me command. |
| beacon_remote_exploit_arch | Get the arch info for this Beacon lateral movement option |
| screenshots | Returns a list of screenshots from Cobalt Strike's data model |
| bmode | Change the data channel for a DNS Beacon |
| showVisualization | Switch Cobalt Strike visualization to a registered visualization. |
| bsocks_stop | Stop SOCKS proxy servers associated with the specified Beacon |
| openPowerShellWebDialog | Open the dialog to setup the PowerShell Web Delivery Attack |
| describe | Set a description for a report. |
| drow_file | Adds a file chooser row to a &dialog |
| localip | Get the IP address associated with the team server. |
| if elsif | if elsif statement |
| listeners | Return a list of listener names (with stagers only!) across all team servers this client is connected to |
| ssh_command_detail | Get the help information for an SSH command. |
| blog2 | Publishes an output message to the Beacon transcript. This function has an alternate format from &blog |
| bpowerpick | Spawn a process, inject Unmanaged PowerShell, and run the specified command |
| attack_name | Maps a MITRE ATT&CK tactic ID to its short name. |
| brportfwd_stop | Ask Beacon to stop a reverse port forward |
| artifact_sign | Sign an EXE or DLL file |
| pref_get | Grabs a string value from Cobalt Strike's preferences |
| dialog | Create a dialog. Use &dialog_show to show it. |
| credentials | Returns a list of application credentials in Cobalt Strike's data model |
| bargue_add | This function adds an option to Beacon's list of commands to spoof arguments for. |
| bssh_key | Ask Beacon to spawn an SSH session |
| brunas | Ask Beacon to run a command as another user |
| beacon_elevator_describe | Describe a Beacon command elevator exploit |
| bremote_exec | Ask Beacon to run a command on a remote target |
| table | Prints a table |
| heartbeat_30s | Fired every thirty seconds |
| nobreak | Group report elements together without a line break. |
| event_private | Fired when a private message is posted to the event log. |
| host_info | Get information about a target |
| SIGNED_APPLET_MAINCLASS | Specify the MAIN class of the Java Signed Applet Attack. |
| openHTMLApplicationDialog | Open the HTML Application Dialog. |
| bsudo | Ask Beacon to run a command via sudo (SSH sessions only) |
| bargue_remove | This function removes an option to Beacon's list of commands to spoof arguments for. |
| bspawnu | Ask Beacon to spawn a session under another process. |
| stager_bind_pipe | Returns a bind_pipe stager for a specific Cobalt Strike listener. This stager is suitable for use in lateral movement actions that benefit from a small named pipe stager. Stage with &beacon_stage_pipe. |
| insert_component | Add a javax.swing.JComponent object to the menu tree |
| bpsexec_command | Ask Beacon to run a command on a remote host. This function creates a service on the remote host, starts it, and cleans it up |
| beacons | Fired when the team server sends over fresh information on all of our Beacons. This occurs about once each second. |
| bconnect | Ask Beacon (or SSH session) to connect to a Beacon peer over a TCP socket |
| brun | Ask Beacon to run a command |
| sendmail_pre | Fired before a phish is sent to an email address. |
| add_to_clipboard | Add text to the clipboard, notify the user |
| heartbeat_15m | Fired every fifteen minutes |
| -isactive | Check if a session is active or not. A session is considered active if (a) it has not acknowledged an exit message AND (b) it is not disconnected from a parent Beacon. |
| bdesktop | Start a VNC session |
| -is64 | Check if a session is on an x64 system or not (Beacon only). |
| SMART_APPLET_MAINCLASS | Specify the MAIN class of the Java Smart Applet Attack. |
| beacon_exploit_describe | Describe a Beacon exploit |
| openSiteManager | Open the site manager |
| event_quit | Fired when someone disconnects from the team server. |
| POWERSHELL_COMMAND | Change the form of the powershell comamnd run by Cobalt Strike's automation. This affects jump psexec_psh, powershell, and [host] -> Access -> One-liner. |
| beacon_command_register | Register help information for a Beacon command |
| str_xor | Walk a string and XOR it with the provided key. |
| beacon_remove | Remove a Beacon from the display |
| listener_info | Get information about a listener |
| format_size | Formats a number into a size (e.g., 1024 => 1kb) |
| bps | Task a Beacon to list processes |
| openServiceBrowser | Open service browser dialog |
| resetData | Reset Cobalt Strike's data model |
| prompt_text | Show a dialog that asks the user for text. |
| drow_checkbox | Adds a checkbox to a &dialog |
| insert_menu | Bring menus associated with a popup hook into the current menu tree. |
| btimestomp | Ask Beacon to change the file modified/accessed/created times to match another file |
| openConnectDialog | Open the connect dialog |
| openBypassUACDialog | Open the dialog for the Bypass UAC feature. |
| nextTab | Activate the tab that is to the right of the current tab |
| beacon_execute_job | Run a command and report its output to the user |
| stager_bind_tcp | Returns a bind_tcp stager for a specific Cobalt Strike listener. This stager is suitable for use in localhost-only actions that require a small stager. Stage with &beacon_stage_tcp. |
| beacon_exploits | Get a list of privilege escalation exploits registered with Cobalt Strike |
| str_chunk | Chunk a string into multiple parts |
| heartbeat_60m | Fired every sixty minutes |
| bpowershell_import_clear | Clear the imported PowerShell script from a Beacon session |
| beacon_elevator_register | Register a Beacon command elevator with Cobalt Strike. This adds an option to the runasadmin command |
| on | Register an event handler. This is an alternate to the on keyword |
| event_action | Fired when a user performs an action in the event log. This is similar to an action on IRC (the /me command) |
| openPreferencesDialog | Open the preferences dialog |
| bdcsync | Use mimikatz's dcsync command to pull a user's password hash from a domain controller |
| event_nouser | Fired when the current Cobalt Strike client tries to interact with a user who is not connected to the team server. |
| bkerberos_ticket_use | Ask beacon to inject a mimikatz kirbi file into the user's kerberos tray |
| beacon_indicator | Fired when an indicator of compromise notice is posted to a Beacon's console. |
| openKeystrokeBrowser | Open the keystroke browser tab |
| bmimikatz | Ask Beacon to run a mimikatz command |
| services | Returns a list of services in Cobalt Strike's data model. |
| belevate_command | Ask Beacon to run a command in a high-integrity context |
| bdllload | Call LoadLibrary() in a remote process with the specified DLL. |
| addVisualization | Register a visualization with Cobalt Strike |
| drow_mailserver | Adds a mail server field to a &dialog. |
| openAboutDialog | Open the "About Cobalt Strike" dialog |
| openJumpDialog | Open Cobalt Strike's lateral movement dialog |
| bdllinject | Inject a Reflective DLL into a process |
| bloginuser | Ask Beacon to create a token from the specified credentials. This is the make_token command |
| beacon_link | This function links to an SMB or TCP listener. If the specified listener is not an SMB or TCP listener, this function does nothing |
| openSpawnAsDialog | Open dialog to spawn a payload as another user |
| event_join | Fired when a user connects to the team server |
| range | Generate an array of numbers based on a string description of ranges. |
| beacon_host_script | Locally host a PowerShell script within Beacon and return a short script that will download and invoke this script. This function is a way to run large scripts when there are constraints on the length of your PowerShell one-liner |
| encode | Obfuscate a position-independent blob of code with an encoder |
| drow_krbtgt | Adds a krbtgt selection row to a &dialog |
| drow_beacon | Adds a beacon selection row to a &dialog |
| agSessions | Pull information from the sessions model |
| breg_queryv | Ask Beacon to query a value within a registry key |
| bupload_raw | Ask a Beacon to upload a file |
| pgraph | Generate the pivot graph GUI component |
| bcancel | Cancel a file download |
| call | Issue a call to the team server |
| bsteal_token | Ask Beacon to steal a token from a process |
| openSystemInformationDialog | Open the system information dialog. |
| blink | Ask Beacon to link to a host over a named pipe |
| drow_text_big | Adds a multi-line text field to a &dialog |
| beacon_output_ps | Fired when ps output is sent to a Beacon's console. |
| ssh_command_register | Register help information for an SSH console command. |
| attack_tactics | An array of MITRE ATT&CK tactics known to Cobalt Strike. |
| transform | Transform shellcode into another format. |
| tstamp | Format a time into a date/time value. This value does not include seconds. |
| bshspawn | Spawn shellcode (from a local file) into another process. This function benefits from Beacon's configuration to spawn post-exploitation jobs (e.g., spawnto, ppid, etc.) |
| drow_listener | Adds a listener selection row to a &dialog. This row only shows listeners with stagers (e.g., windows/beacon_https/reverse_https). |
| attack_mitigate | Maps a MITRE ATT&CK tactic ID to its mitigation strategy |
| attack_url | Maps a MITRE ATT&CK tactic ID to the URL where you can learn more. |
| bcp | Ask Beacon to copy a file or folder |
| ssh_command_describe | Describe an SSH command |
| heartbeat_20m | Fired every twenty minutes |
| data_query | Queries Cobalt Strike's data model |
| applications | Returns a list of application information in Cobalt Strike's data model. These applications are results from the System Profiler |
| beacon_info | Get information from a Beacon session's metadata |
| binput | Report a command was run to the Beacon console and logs. Scripts that execute commands for the user (e.g., events, popup menus) should use this function to assure operator attribution of automated actions in Beacon's logs |
| mynick | Get the nickname associated with the current Cobalt Strike client |
| openJavaSignedAppletDialog | Open the Java Signed Applet dialog |
| beacon_commands | Get a list of Beacon commands |
| prompt_file_open | Show a file open dialog. |
| data_keys | List the query-able keys from Cobalt Strike's data model |
| dbutton_action | Adds an action button to a &dialog. When this button is pressed, the dialog closes and its callback is called. You may add multiple buttons to a dialog. Cobalt Strike will line these buttons up in a row and center them at the bottom of the dialog |
| bnet | Run a command from Beacon's net module |
| gzip | GZIP a string |
| ssh_input | Fired when an input message is posted to an SSH console. |
| alias | Creates an alias command in the Beacon console |
| bsleep | Ask Beacon to change its beaconing interval and jitter factor |
| bgetsystem | Ask Beacon to attempt to get the SYSTEM token. |
| keylogger_hit | Fired when there are new results reported to the web server via the cloned site keystroke logger. |
| beacon_remote_exec_methods | Get a list of remote execute methods registered with Cobalt Strike |
| beacon_error | Fired when an error is posted to a Beacon's console. |
| dialog_show | Shows a &dialog. |
| heartbeat_5m | Fired every five minutes |
| agTargets | Pull information from the targets model. |
| beacon_remote_exploits | Get a list of lateral movement options registered with Cobalt Strike |
| listener_restart | Restart a listener |
| heartbeat_15s | Fired every fifteen seconds |
| drow_combobox | Adds a combobox to a &dialog |
| beacon_stage_pipe | This function handles the staging process for a bind pipe stager. This is an optional stager for lateral movement. You can stage any x86 payload/listener through this stager. Use &stager_bind_pipe to generate this stager |
| bmv | Ask Beacon to move a file or folder |
| bnote | Assign a note to the specified Beacon |
| listeners_stageless | Return a list of listener names across all team servers this client is connected to. External C2 listeners are filtered (as they're not actionable via staging or exporting as a Reflective DLL). |
| openBrowserPivotSetup | open the browser pivot setup dialog |
| colorPanel | Generate a Java component to set accent colors within Cobalt Strike's data model |
| agCredentials | Pull information from the credentials model |
| openScriptManager | Open the tab for the script manager. |
| drow_interface | Adds a VPN interface selection row to a &dialog |
| if else | if else statement |
| openGoldenTicketDialog | open a dialog to help generate a golden ticket |
| ssh_error | Fired when an error is posted to an SSH console. |
| credential_add | Add a credential to the data model |
| drow_exploits | Adds a privilege escalation exploit selection row to a &dialog |
| openElevateDialog | Open the dialog to launch a privilege escalation exploit |
| SIGNED_APPLET_RESOURCE | Specify a Java Applet file to use for the Java Signed Applet Attack. |
| hosts | Returns a list of IP addresses from Cobalt Strike's target model |
| listeners_local | Return a list of listener names. This function limits itself to the current team server only. External C2 listener names are omitted |
| br | Print a line-break. |
| beacon_data | Get metadata for a Beacon session |
| bblockdlls | Launch child processes with binary signature policy that blocks non-Microsoft DLLs from loading in the process space |
| bcovertvpn | Ask Beacon to deploy a Covert VPN client |
| beacon_stage_tcp | This function handles the staging process for a bind TCP stager. This is the preferred stager for localhost-only staging. You can stage any payload/listener through this stager. Use &stager_bind_tcp to generate this stager |
| drow_site | Adds a site/URL field to a &dialog. |
| openSystemProfilerDialog | Open the dialog to setup the system profiler. |
| ssh_output | Fired when output is posted to an SSH console. |
| bpsinject | Inject Unmanaged PowerShell into a specific process and run the specified cmdlet |
| fireEvent | Fire an event |
| profiler_hit | Fired when there are new results reported to the System Profiler. |
| bbrowserpivot_stop | Stop a Browser Pivot |
| event_beacon_initial | Fired when an initial beacon message is posted to the event log. |
| openCredentialManager | Open the credential manager tab |
| ssh_commands | Get a list of SSH commands. |
| pref_set_list | Stores a list value into Cobalt Strike's preferences. |
| stager | Returns the stager for a specific Cobalt Strike listener |
| attack_describe | Maps a MITRE ATT&CK tactic ID to its longer description. |
| beacon_output | Fired when output is posted to a Beacon's console. |
| bgetprivs | Attempts to enable the specified privilege in your Beacon session |
| beacon_host_imported_script | Locally host a previously imported PowerShell script within Beacon and return a short script that will download and invoke this script |
| vpn_tap_delete | Destroy a Covert VPN interface |
| heartbeat_5s | Fired every five seconds |
| openListenerManager | Open the listener manager |
| bpassthehash | Ask Beacon to create a token that passes the specified hash. This is the pth command in Beacon. It uses mimikatz |
| event_public | Fired when a public message is posted to the event log. |
| PYTHON_COMPRESS | Compress a Python script generated by Cobalt Strike. |
| fireAlias | Runs a user-defined alias |
| beacon_output_ls | Fired when ls output is sent to a Beacon's console. |
| beacon_checkin | Fired when a Beacon checkin acknowledgement is posted to a Beacon's console |
| output | Print elements against a grey backdrop. Line-breaks are preserved. |
| beacon_remote_exploit_describe | Describe a Beacon lateral movement option |
| licenseKey | Get the license key for this instance of Cobalt Strike |
| bbrowserpivot | Start a Browser Pivot |
| tbrowser | Generate the target browser GUI component. |
| openPivotListenerSetup | open the pivot listener setup dialog |
| prompt_directory_open | Show a directory open dialog. |
| h1 | Prints a title heading. |
| breg_query | Ask Beacon to query a key within the registry |
| bmkdir | Ask Beacon to make a directory |
| str_decode | Convert a string of bytes to text with the specified encoding. |
| previousTab | Activate the tab that is to the left of the current tab. |
| bpowershell | Ask Beacon to run a PowerShell cmdlet |
| kvtable | Prints a table with key/value pairs. |
| -isbeacon | Check if a session is a Beacon or not. |
| beacon_output_alt | Fired when (alternate) output is posted to a Beacon's console. What makes for alternate output? It's just different presentation from normal output. |
| bdrives | Ask Beacon to list the drives on the compromised system |
| bportscan | Ask Beacon to run its port scanner |
| bls | Task a Beacon to list files |
| openApplicationManager | Open the application manager (system profiler results) tab |
| brev2self | Ask Beacon to drop its current token. This calls the RevertToSelf() Win32 API |
| list_unordered | Prints an unordered list |
| bjobkill | Ask Beacon to kill a running post-exploitation job |
| heartbeat_10m | Fired every ten minutes |
| belevate | Ask Beacon to spawn an elevated session with a registered technique |
| tokenToEmail | Covert a phishing token to an email address. |
| getAggressorClient | Returns the aggressor.AggressorClient Java object. This can reach anything internal within the current Cobalt Strike client context |
| layout | Prints a table with no borders and no column headers. |
| separator | Insert a separator into the current menu tree. |
| host_update | Add or update a host in the targets model |
| script_resource | Returns the full path to a resource that is stored relative to this script file. |
| bdownload | Ask a Beacon to download a file |
| openOfficeMacro | Open the office macro export dialog |
| bupload | Ask a Beacon to upload a file |
| openSpearPhishDialog | Open the dialog for the spear phishing tool. |
| powershell_compress | Compresses a PowerShell script and wraps it in a script to decompress and execute it. |
| beacon_output_jobs | Fired when jobs output is sent to a Beacon's console. |
| openScreenshotBrowser | Open the screenshot browser tab |
| openJavaSmartAppletDialog | Open the Java Smart Applet dialog |
| openOrActivate | If a Beacon console exists, make it active. If a Beacon console does not exist, open it. |
| dispatch_event | Call a function in Java Swing's Event Dispatch Thread. Java's Swing Library is not thread safe. All changes to the user interface should happen from the Event Dispatch Thread |
| ts | Prints a time/date stamp in italics. |
| users | Returns a list of users connected to this team server. |
| h4 | Prints a sub-sub-sub-title heading. |
| disconnect | Fired when this Cobalt Strike becomes disconnected from the team server. |
| vpn_interface_info | Get information about a VPN interface. |
| beacon_remote_exec_method_register | Register a Beacon remote execute method with Cobalt Strike. This adds an option for use with the remote-exec command |
| dstamp | Format a time into a date/time value. This value includes seconds. |
| beacon_command_detail | Get the help information for a Beacon command |
| base64_decode | Unwrap a base64-encoded string |
| bcheckin | Ask a Beacon to checkin. This is basically a no-op for Beacon |
| site_host | Host content on Cobalt Strike's web server |
| btask | Report a task acknowledgement for a Beacon. This task acknowledgement will also contribute to the narrative in Cobalt Strike's Activity Report and Sessions Report |
| pref_get_list | Grabs a list value from Cobalt Strike's preferences. |
| host_delete | Delete a host from the targets model |
| closeClient | Close the current Cobalt Strike team server connection |
| HTMLAPP_POWERSHELL | Controls the content of the HTML Application User-driven (PowerShell Output) generated by Cobalt Strike |
| sendmail_start | Fired when a new phishing campaign kicks off. |
| event_notify | Fired when a message from the team server is posted to the event log. |
| bipconfig | Task a Beacon to list network interfaces |
| bunlink | Ask Beacon to delink a Beacon its connected to over a TCP socket or named pipe |
| RESOURCE_GENERATOR_VBS | Controls the content of the HTML Application User-driven (EXE Output) generated by Cobalt Strike. |
| heartbeat_1s | Fired every second |
| openOneLinerDialog | Open the dialog to generate a PowerShell one-liner for this specific Beacon session |
| openScriptedWebDialog | Open the dialog to setup a Scripted Web Delivery Attack |
| archives | Returns a massive list of archived information about your activity from Cobalt Strike's data model. This information is leaned on heavily to reconstruct your activity timeline in Cobalt Strike's reports. |
| openHostFileDialog | Open the host file dialog |
| url_open | Open a URL in the default browser. |
| bexit | Ask a Beacon to exit |
| bkerberos_ticket_purge | Ask beacon to purge tickets from the user's kerberos tray |
| bexecute_assembly | Spawns a local .NET executable assembly as a Beacon post-exploitation job |
| ssh_checkin | Fired when an SSH client checkin acknowledgement is posted to an SSH console. |
| bshell | Ask Beacon to run a command with cmd.exe |
| SMART_APPLET_RESOURCE | Specify a Java Applet file to use for the Java Smart Applet Attack |
| ssh_initial | Fired when an SSH session is seen for the first time. |
| h2 | Prints a sub-title heading. |
| bpsexec | Ask Beacon to spawn a payload on a remote host. This function generates an Artifact Kit executable, copies it to the target, and creates a service to run it. Clean up is included too |
| RESOURCE_GENERATOR | Control the format of the VBS template used in Cobalt Strike. |
| show_message | Shows a message to the user in a dialog box. Use this function to relay information. |
| artifact_general | Generates a payload artifact from arbitrary shellcode |
| beacon_elevators | Get a list of command elevator exploits registered with Cobalt Strike |
| bkill | Ask Beacon to kill a process |
| openPortScannerLocal | Open the port scanner dialog with options to target a Beacon's local network |
| addTab | Create a tab to display a GUI object |
| attack_detect | Maps a MITRE ATT&CK tactic ID to its detection strategy |
| brportfwd | Ask Beacon to setup a reverse port forward |
| base64_encode | Base64 encode a string |
| heartbeat_30m | Fired every thirty minutes |
| beacon_tasked | Fired when a task acknowledgement is posted to a Beacon's console. |
| try catch | Try Catch statement |
| openDownloadBrowser | Open the download browser tab |
| openProcessBrowser | Open a process browser for one or more Beacons |
| if | if statement |
| openEventLog | Open the event log |
| bbrowser | Generate the beacon browser GUI component. Shows only Beacons. |
| heartbeat_10s | Fired every ten seconds |
| transform_vbs | Transform shellcode into a VBS expression that results in a string |
| beacon_mode | Fired when a mode change acknowledgement is posted to a Beacon's console. |
| openSOCKSBrowser | Open the tab to list SOCKS proxy servers |
| openPayloadGeneratorDialog | Open the Payload Generator dialog. |
| bclear | This is the "oops" command. It clears the queued tasks for the specified beacon |
| APPLET_SHELLCODE_FORMAT | Format shellcode before it's placed on the HTML page generated to serve the Signed or Smart Applet Attacks. |
| blog | Post a message to WordPress.com (just kidding). Publishes an output message to the Beacon transcript |
| bjobs | Ask Beacon to list running post-exploitation jobs |
| landscape | Changes the orientation of this document to landscape. |
| artifact_stager | Generates a stager artifact (exe, dll) from a Cobalt Strike listener |
| bargue_list | List the commands + fake arguments Beacon will spoof arguments for |
| openWebLog | Open the web log tab. |
| openInterfaceManager | Open the tab to manage Covert VPN interfaces |
| privmsg | Post a private message to a user in the event log |
| bpowershell_import | Import a PowerShell script into a Beacon |
| bshinject | Inject shellcode (from a local file) into a specific process |
| listener_pivot_create | Create a new pivot listener |
| ssh_output_alt | Fired when (alternate) output is posted to an SSH console. What makes for alternate output? It's just different presentation from normal output. |
| alias_clear | Removes an alias command (and restores default functionality if it existed) |
| vpn_tap_create | Create a Covert VPN interface on the team server system. |
| drow_listener_stage | Adds a listener selection row to a &dialog. This row shows all Beacon and Foreign listener payloads. |
| bssh | Ask Beacon to spawn an SSH session |
| powershell_command | Returns a one-liner to run a PowerShell expression (e.g., powershell.exe -nop -w hidden -encodedcommand MgAgACsAIAAyAA==) |
| highlight | Insert an accent (color highlight) into Cobalt Strike's data model |
| bsocks | Start a SOCKS proxy server associated with a beacon |
| beacon_input | Fired when an input message is posted to a Beacon's console. |
| vpn_interfaces | Return a list of VPN interface names |
| site_kill | Remove a site from Cobalt Strike's web server |
| beacon_remote_exploit_register | Register a Beacon lateral movement option with Cobalt Strike. This function extends the jump command |
| ready | Fired when this Cobalt Strike client is connected to the team server and ready to act. |
| popup_clear | Remove all popup menus associated with the current menu. This is a way to override Cobalt Strike's default popup menu definitions |
| payload | Exports a raw payload for a specific Cobalt Strike listener |
| sbrowser | Generate the session browser GUI component. Shows Beacon AND SSH sessions. |
| brunasadmin | Ask Beacon to run a command in a high-integrity context (bypasses UAC). |
| openTargetBrowser | Open the targets browser |
| openPortScanner | Open the port scanner dialog |
Release Notes
1.0.0
Initial release.
Questions, issues, feature requests, and contributions
- If you come across a problem with the extension, please file an issue
- Contributions are always welcome!
- Any and all feedback is appreciated and welcome!
- If someone has already filed an issue that encompasses your feedback, please leave a 👍/👎 reaction on the issue
- Otherwise please file a new issue