Repository files navigation

Aggressor script for easier team collaboration with Cobalt Strike.

ℹ️ This project contains CNA files for Cobalt Strike, parsers for automated editing of the CNA files, and guides to set up webhooks on the Slack application.

These CNA files will notify you via the Slack application when:

• A new client connects to the team server.
• A CS client disconnects from the team server.
• A new incoming beacon.
• A new web hit occurs.
• A CS client posts something in the event log.
• New site hosts.
• New credentials come in from keylogging.
• A new screenshot is taken from Cobalt Strike.

ℹ️ The scripts are compatible with both the Windows and Linux operating systems.

The following table illustrates the CNA files included in this project:

The official author of this project is@sec_groundzero.

Special thanks to my friend@nickvourd for his contributions.

This aggressor script was inspired by@bluescreenofjeff's projects.

• CS-Aggressor-Scripts
  • Description
  • Acknowledgement
  • Table of Contents
  • Webhooks
    • Setup Slack and Webhooks
  • Parsers
    • Linux Parser for Slack
    • Windows Parser for Slack
  • References

ℹ️ To set up a Slack server and webhook, you can follow these guides provided on theSlack website.

In this project, there are two parsers that automate the editing of CNA file according to your personal preferences.

ℹ️ However, you can manually edit the CNA files without using the parsers.

In the following table, the parsers of this project are presented:

TheLinux parser for Slack uses three mandatory arguments:

• hostname
• channel
• webhook

To run the linux parser, you should use the following usage:

./slack-cna-parser_linux.sh --channel "#XXXX" --hostname "XXXX" --webhook "https://hooks.slack.com/services/XXXX"

Example:

TheWindows parser for Slack uses three mandatory arguments:

• hostname
• channel
• webhook

To run the windows parser, you should use the following usage:

.\slack-cna-parser_windows.ps1  -hostname "XXXX" -channel "#XXXX" -webhook "https://hooks.slack.com/services/XXXX"

Example:

• Aggressor Script Guide by Forta
• Slack Official Site
• Sleep Language 2.1 Tutorial
• Cobalt Strike Official Site
• AggressorScripts GitHub by bluscreenofjeff