LSTAR - CobaltStrike 综合后渗透插件
A plugin from initial access to domain takeover, enabling intranet traversal
With the goal of simplifying CS right-click operations and facilitating integration, referencing a large number of post-exploitation plugins
Restructured and enriched host credential acquisition, multi-level intranet penetration, hidden scheduled tasks, bypass-enabled Mimikatz, clone and add user functions, etc.
Features:
Main modules include:
Each module adds a green separator line before execution, making it easy to locate echoed information and improve collaboration efficiency
CobaltStrike host online WeChat notification plugin:
- If you want to use the free WeChat template message push, please visit: https://github.com/lintstar/CS-PushPlus
- If you have an enterprise WeChat push channel subscribed via ServerChan, please visit: https://github.com/lintstar/CS-ServerChan
This project is only for security research and legitimate enterprise security construction. All consequences and responsibilities are borne by the user.
Common commands are categorized by scenario
Integrated the latest public version 9.1.1 of Ladon
Antivirus information displayed locally on Beacon status bar
Implementation principle: https://blog.csdn.net/weixin_42282189/article/details/121090055
Added Ladon multi-protocol alive detection (SMB, WMI, SNMP, HTTP, DNS, MAC, MSSQL)
To a certain extent, can detect intranet assets behind firewalls: Using MAC to bypass firewall and detect alive hosts
Alive IP detection
Fixed the bug that only whoami could be executed; now you can run with System privileges via parameters
Added Ladon's Badpotato
Note: Tests show that the above two privilege escalation behaviors are intercepted and killed by digital antivirus software
【Use with caution】Utilizing Windows API, tooled to create hidden scheduled tasks while bypassing security software blocks for persistent control.
Project address: https://github.com/0x727/SchTask_0x727
【Use with caution】Bypass remote memory loading, clone hidden shadow user
Project address: https://github.com/An0nySec/ShadowUser
Fixed PE file path issue; can now use API method to delete and add users properly
Functions categorized by scenario
Retrieve the latest version of Sunflower identification code and verification code
The latest Sunflower's base_encry_pwd parameter has been moved from config.ini to the registry
Simplified secondary menu
Bypass AV: Use the DirectoryService namespace to add users to the Administrators and Remote Desktop groups
Project address: https://github.com/An0nySec/UserAdd
Security detection tool for adding and cloning users from the command line
Project address: https://github.com/0x727/CloneX_0x727
Use Ladon to collect host basic information, network information, user information, process information, whether in domain, etc.
Collect RDP inbound and outbound connection records for easy identification of operation and maintenance hosts and lateral movement
Added Cube to replace the old version of brute force; also supports intranet info collection and MSSQL command execution. See the run instructions for details.
Added Allin for flexible scanning. Example: remotely obtain NIC IP:
If you don't want to drop an EXE, you can use Assembly mode for quick OXID detection
Run after uploading agent
Admin side receives the connection and can build a Socks5 tunnel
Delete agent
Modified the execution method of LsassDump; when deleting LsassDump, the dumped C:\Windows\Temp\1.dmp is also deleted
Added support for LsassDump (WinAPI) function, remotely read the dumped C:\Windows\Temp\1.tmp from the target machine (.net 4.5)
Added methods to enable, disable, and query RDP related information using PowerShell
PS scripts are sourced from the RDP module of the Black Devil plugin in References
Added BOF implementation for ZeroLogon vulnerability
Reference: https://github.com/rsmudge/ZeroLogon-BOF
Added upload of corresponding EXE file based on target machine architecture
Added parameter hints output for targeted execution of individual modules
Added Crack intranet brute force tool
Added upload of corresponding EXE file based on target machine architecture
Fixed a BUG in version V1.2 where LaZagne was killed and its dropped file deleted before it finished running due to network issues. Changed to manual execution mode.
Added LsassDump using Windows API for memory dumping, supports both x86 and x64 machines
After successful dump, the generated 1.dmp is saved in C:\Windows\Temp\ directory
Directly read it locally:
Added RDP related functions:
Use Windows API to enable RDP service
Added CheckVM to detect if the target is a virtual machine
The previous script had a certain probability of failure:
Updated with a new antivirus detection method
Fixed BUG in the previous privilege escalation module
EasyPersistent: https://github.com/yanghaoi/CobaltStrike_CNA
Added a Cobalt Strike CNA script for Windows system privilege persistence
Uses reflective DLL module via API to visually operate on common privilege persistence methods like system services and scheduled tasks. Very useful. (Author's words)
A useful tool for retrieving host passwords in real-world tests (uploaded and runs, then automatically deletes the exe file)
Optimized phishing password stealing for Windows 10 and Windows 7
Since the fake page effect is not great, it is only recommended for desperate situations:
Added Netview and Powerview functions
Process query via Wmic
Contains various intranet scanning tools
Custom command execution
fscan defaults to upload to C:\\Windows\\Temp\\
Console output
Delete fscan and result text
Useful intranet penetration tools, all without dropping config files, reducing traceability risk
Added Silver Ticket and Golden Ticket based on Taowu
Includes lateral movement tools like sharpwmi based on port 135
Stitched from Jiushi's trace cleaning, to be improved
cxk's time-limited bypass version of adduser and mimikatz
Just for fun when hacking websites
