LSTAR - Aggressor

A plugin from initial access to domain takeover, enabling intranet traversal

With the goal of simplifying CS right-click operations and facilitating integration, referencing a large number of post-exploitation plugins

Restructured and enriched host credential acquisition, multi-level intranet penetration, hidden scheduled tasks, bypass-enabled Mimikatz, clone and add user functions, etc.

Features:

• Cooperate with CobaltStrike's TCP, SMB, Proxy and other methods for internet-restricted hosts to penetrate complex network environments
• Provide multiple bypass execution methods for RDP related, AddUser, LsassDump and other functions to handle unusual environments
• Integrate multiple shadow user and hidden scheduled task functions running with WinAPI or Assembly memory loading for bypass

Main modules include:

Each module adds a green separator line before execution, making it easy to locate echoed information and improve collaboration efficiency

CobaltStrike host online WeChat notification plugin:

• If you want to use the free WeChat template message push, please visit: https://github.com/lintstar/CS-PushPlus
• If you have an enterprise WeChat push channel subscribed via ServerChan, please visit: https://github.com/lintstar/CS-ServerChan

Disclaimer

This project is only for security research and legitimate enterprise security construction. All consequences and responsibilities are borne by the user.

Update 2022.1.15

• Added bypass-enabled clone user, add user, and scheduled task functions
• Retrieve the latest version of Sunflower identification code and verification code
• Integrated Ladon 9.1.1 multi-protocol alive detection and other functions
• Categorized functions, simplified plugin secondary menus

InfoCollect

Common commands are categorized by scenario

SharpGetInfo

Integrated the latest public version 9.1.1 of Ladon

AntiVirusCheck

Antivirus information displayed locally on Beacon status bar

Implementation principle: https://blog.csdn.net/weixin_42282189/article/details/121090055

IntrScan

Added Ladon multi-protocol alive detection (SMB, WMI, SNMP, HTTP, DNS, MAC, MSSQL)

To a certain extent, can detect intranet assets behind firewalls: Using MAC to bypass firewall and detect alive hosts

Alive IP detection

AuthPromote

BadPotato (BeichenDream)

Fixed the bug that only whoami could be executed; now you can run with System privileges via parameters

Badpotato (Ladon)

Added Ladon's Badpotato

SweetPatato (Ladon)

Note: Tests show that the above two privilege escalation behaviors are intercepted and killed by digital antivirus software

AuthMaintain

SharpSchTask

【Use with caution】Utilizing Windows API, tooled to create hidden scheduled tasks while bypassing security software blocks for persistent control.

Project address: https://github.com/0x727/SchTask_0x727

SharpShadowUser

【Use with caution】Bypass remote memory loading, clone hidden shadow user

Project address: https://github.com/An0nySec/ShadowUser

EasyPersistent

Fixed PE file path issue; can now use API method to delete and add users properly

PassCapture

Functions categorized by scenario

SunFlower

Retrieve the latest version of Sunflower identification code and verification code

The latest Sunflower's base_encry_pwd parameter has been moved from config.ini to the registry

RemoteLogin

Simplified secondary menu

BypassCXK

SharpAddUser

Bypass AV: Use the DirectoryService namespace to add users to the Administrators and Remote Desktop groups

Project address: https://github.com/An0nySec/UserAdd

CloneX

Security detection tool for adding and cloning users from the command line

Project address: https://github.com/0x727/CloneX_0x727

Update 2021.10.18

• Reintegrated and optimized the overall functional modules
• Added BOF implementation for ZeroLogon vulnerability in Lateral Movement module
• Added some functions that run via Assembly without dropping files

InfoCollect

SharpGetInfo (One-click host information collection)

Use Ladon to collect host basic information, network information, user information, process information, whether in domain, etc.

SharpListRDP (RDP record query)

Collect RDP inbound and outbound connection records for easy identification of operation and maintenance hosts and lateral movement