PreludeOperator_QuickCheck

Simple Powershell Prelude Operator Quick Check

In this example, we will use boomtown.ngrok.io There are a couple ways to redirect HTTP.
You should replace this with either your ngrok instance or your redirector. The preferred method is a Gateway Redirector.

Cloudy with a chance of redirectors

Create a TTP

Create an Adversary - Add The TTP

Ensure Your Prelude Operator is Reachable over HTTP

Ngrok Example -

ngrok http --region=us --hostname=boomtown.ngrok.io 3391

Deploy a Cloud Gateway Redirector

{TODO}

Execute Checkin PowerShell

$PreludeHTTPDomain = "https://boomtown.ngrok.io"
$Executors = @()
$Executors += 'psh'
$Links = @()

$jsonBase = [pscustomobject]@{
    Name = "Boomer"
    Target = ""
    Hostname = "APTz"
    Location = ""
    Platform = "windows"
    Executors = $executors
    Range = "BoomTown"
	"Pwd" = ""
	"Sleep" = 10
	Executing= ""
    Links = $Links

}

$delivery = $jsonBase | ConvertTo-Json
# Checkin - Get Task

$response = Invoke-RestMethod -Uri $PreludeHTTPDomain -Method Post -Body $delivery -ContentType "application/json"
$ID = $response.links.ID

You should have a call back

Deploy The Adversary To Your BoomTown Range

Run The PowerShell Simple Stager

$PreludeHTTPDomain = "https://boomtown.ngrok.io"
$Executors = @()
$Executors += 'psh'
$Links = @()

$jsonBase = [pscustomobject]@{
    Name = "Boomer"
    Target = ""
    Hostname = "APTz"
    Location = ""
    Platform = "windows"
    Executors = $executors
    Range = "BoomTown"
	"Pwd" = ""
	"Sleep" = 10
	Executing= ""
    Links = $Links

}

$delivery = $jsonBase | ConvertTo-Json
# Checkin - Get Task

$response = Invoke-RestMethod -Uri $PreludeHTTPDomain -Method Post -Body $delivery -ContentType "application/json"
$ID = $response.links.ID


# Send Response
$Links += [pscustomobject]@{
    'ID'="$ID";
    'Executor'='psh';
	'Payload'=''
	'Request'= ""
    'Response'="Ready To Roll Out!";
    'Status'='0';
    'Pid'="$Pid"
}

$jsonBase = [pscustomobject]@{
    Name = "Boomer"
    Target = ""
    Hostname = "APTz"
    Location = ""
    Platform = "windows"
    Executors = $executors
    Range = "BoomTown"
	"Pwd" = ""
	"Sleep" = 10
	Executing= ""
    Links = $Links

}

$deliveryResponse = $jsonBase | ConvertTo-Json
$response_delivery = Invoke-RestMethod -Uri $PreludeHTTPDomain -Method Post -Body $deliveryResponse  -ContentType "application/json"

Check Status

Conclusion

The aim here is to help ensure you are up and running quick. Once you pass the check you are ready to start deploying more aggressive tests.

This is pretty rough, and can be better, but its a start ;-) Feedback Welcome. -Additional Idea:

Fiddler debugging

Simple DNS C2, etc..

WebShell

WSH Harnesses, JSScript, VBScript, VBA, HTA, SCT etc...

These are just some prototypes.