timwhitez/Cobalt-Strike-Aggressor-Scripts
FreeCobalt Strike Aggressor 插件包
FreeFree tier
About timwhitez/Cobalt-Strike-Aggressor-Scripts
A comprehensive collection of Cobalt Strike Aggressor Scripts (CNA) that enhances the Cobalt Strike framework with various post-exploitation, privilege escalation, credential theft, persistence, and information gathering modules. Includes scripts for local privilege escalation exploits, MS17-010, RDP theft, Chrome password retrieval, Navicat decryption, WinSCP plaintext extraction, VM detection, log clearing, firewall manipulation, and more. Originally maintained by timwhitez, it provides a modular approach with a Main.cna loader. Note: the project has not been updated since April 2020, and some open-source samples may be detected by antivirus software.
Key Features
Privilege escalation exploits (Elevate module)
Information gathering (Info-Collect, Chrome passwords)
Credential theft (Navicat decrypt, WinSCP plaintext, mimikatz for Win2012+)
Persistence mechanisms (registry, service, mshta auto-start)
RDP module (rdpthief, query RDP port, enable RDP)
Process color coding based on criteria (e.g., highlight antivirus)
MS17-010 exploitation with payloads
VM detection via PowerShell
Event log clearing
Firewall management (close firewall or allow specific executable)
Pros & Cons
Pros
- Comprehensive collection of useful aggressor scripts in one package
- Open source and free to use
- Modular design with easy loading via Main.cna
- Includes both well-known and niche post-exploitation techniques
- Active development history with frequent updates (until 2020)
- Supports multiple languages: C and PowerShell
Cons
- Project has not been updated since April 2020, may lack recent techniques
- Open-source samples may be detected by modern antivirus software (as stated by author)
- Documentation primarily in Chinese, which may be a barrier for non-Chinese speakers
- Requires Cobalt Strike (commercial C2 framework) to use the scripts
- Some scripts may need modification for specific environments
Best For
Red team operations and penetration testingPost-exploitation privilege escalationCredential harvesting from various applicationsEstablishing persistence on compromised hostsRDP session theft and RDP service manipulationAutomating information gathering during engagementsBypassing defenses with VM detection and log clearing
FAQ
How do I load these scripts into Cobalt Strike?
Load the Main.cna file via Cobalt Strike's Script Manager. The repository includes a wiki with detailed usage instructions.
Are these scripts still effective against modern antivirus?
The author notes that open-source samples may no longer bypass antivirus detection. Users may need to modify the scripts to evade current defenses.
What are the main modules included?
Key modules include Elevate (privilege escalation), Info-Collect (information gathering), Persistence, RDPthief, MS17-010, and utilities for firewall, log clearing, and more.