The document outlines the functionalities and use cases of Cortana, an extension for automating tasks in Armitage and Metasploit, which is beneficial for penetration testing. It presents several scripts and modules, such as grabcreds.cna, safetynet.cna, and user_hunter.cna, that automate various tasks related to credential gathering, session management, and user enumeration. The document emphasizes how Cortana can enhance efficiency in pentesting by minimizing repetitive tasks through scripting and user interface customization.

1. Will
@harmj0y
Veris Group
Wielding a Cortana

2. $ whoami
• Security researcher and penetration tester for
Veris Group
• Co-founder of the Veil-Framework #avlol
o www.veil-framework.com
o Shmoocon ‘14: AV Evasion with the Veil Framework
o co-wrote Veil-Evasion, wrote Veil-Catapult and Veil-
PowerView
• https://github.com/HarmJ0y/
• http://harmj0y.net

3. tl;dr
• Cortana? wtf
• OK that’s cool, what can I do
• Cortana use cases:
o grabcreds.cna - auto hash dumping
o safetynet.cna - saving shells
o veil_evasion.cna - #avlol :)
o user_hunter.cna - find DAs
o beacon.cna - graphical beacons*

4. Cortana? wtf
• Raphael Mudge’s DARPA cyber fast track
project
• Allows for the scripting of Armitage and/or
Metasploit itself
o Some of this functionality is restricted to Cobalt
Strike - marked by a *
• Doesn’t seem to have publically caught on
o Which is dumb, since it’s incredibly useful

5. Cortana: Why Use It
• Allows for the easy customization of an
already existing, powerful tool
• Many standard pentest actions can be
automated and manipulated in useful ways
• Lets you minimize the time spent doing
repetitive tasks

6. Cortana Background
• Cortana is a set of extensions to the Sleep
language that allows for the control of
Armitage/Metasploit
• Sleep = Java-based scripting language
heavily inspired by Perl and written by
Raphael
o http://sleep.dashnine.org/documentation.html
o http://www.fastandeasyhacking.com/download/corta
na/cortana_tutorial.pdf

7. Sleep 101
• “Sleep is primarily a glue language and was
designed from the ground up to be
embedded in Java applications…[it] brings
the power of Perl to the Java platform.”
• Much of the backend of Armitage is actually
written in Sleep
https://today.java.net/pub/a/today/2005/07/14/sleep.html

8. Cortana 101
• Interaction with Metasploit is baked in
through utilization of MSF’s RPC interface
• You can send commands to a Meterpreter
session, interact with the backend database,
launch modules, etc.
• m_cmd($1, “sysinfo”);
• host_info($address);
• exploit("windows/smb/ms08_067_netapi", $addr);

9. Cortana 101
• Triggers can be set up to asynchronously
fire on various actions/events:
o new sessions
o meterpreter/shell commands
o new hosts/services/routes/etc.
• Lets you perform contextual actions and
automate a lot of post-exploitation

10. Cortana 101

11. Cortana 101
• The user interface for Armitage can be easily
modified:
o new program menus
o new meterpreter action menus
o changeable host icons
• Lots of examples at:
https://github.com/rsmudge/cortana-scripts
https://github.com/HarmJ0y/cortana

12. Cortana Use Cases

13. Use Case #1
• On each meterpreter session that comes in,
we always like to grab all credentials we can
from the box:
o hashdump
o run mimikatz
o see if a user we want is logged in
• ASPNET? Guest? SUPPORT_*? no thx

14. How Can Cortana Help?
• grabcreds.cna
o on session_sync { … }
o m_cmd($1, "wdigest");
o on meterpreter_wdigest { … }
• On each host that comes in:
o run hashdump and mimikatz
o filter out account names we don’t want
o dump creds to the database
o check users found against a designated list
o announce results on the team chat*

15. grabcreds.cna

16. Use Case #2
• Losing shells sucks
• Our standard procedure is to inject additional
sessions (or beacons*) for fallback in case
our main working session dies
o and not to just one C2 server
● This becomes tedious when you’re dealing
with A LOT of shells and various handlers

17. How Can Cortana Help?
• safetynet.cna
o on session_sync { … }
o launch("post", …)
• automatically runs a payload inject module
against each host
o injects a “safetynet” payload
• Problem:
o we want to inject two payloads, one from the existing
process context and one into explorer.exe

18. Sidenote: smart_payload_inject.rb
• Existing payload_inject.rb only allows for
injection against predefined process IDs
• smart_migrate.rb allows for “smart”
migration into explorer.exe
• Combine the two -> easy injection into a
specific process name, explorer.exe default

19. safetynet.cna - interface

20. Adding From Existing Listeners*

21. Custom Safetynet Payloads

22. Installing Safetynets

23. Use Case #3
• Armitage/Cobalt Strike are great, but
sometimes we want specific gui
modifications
• Say we want to have a Cobalt Strike
workspace containing only hosts with active
beacons*
*http://www.advancedpentest.com/help-beacon

24. How Can Cortana Help?
• We can grab the active beacon list
o @beacons = call('beacon.list');
• We can setup ‘heartbeat’ callbacks to
periodically perform actions
o on heartbeat_5s {…}
• We can modify our gui in useful ways
o filter host_image { …change a host’s gui image …}
o bind Ctrl+B { open_beacon_browser(); }

25. Graphical Beacons

26. Use Case #4
• psexec in Metasploit is great, but the
standard exe templates = no good
• Veil-Evasion does a great job at generating
AV-evading executables :)
• But generating each time, reconfiguring
paths, etc. is a pain

27. How Can Cortana Help?
• veil_evasion.cna
o filter user_launch { … }
o exec(SYSTEM COMMAND);
• Invokes Veil-Evasion to generate a binary,
intercepts psexec calls in Armitage, and
substitutes this in for a custom EXE
• No more caught payloads :)

28. Sidenote: swing >_<
• Exposed Cortana functions are great, but
didn’t quite cover exactly what we wanted
• Luckily, Cortana scripts can integrate various
java/swing GUI manipulations
• And guess what? Armitage has examples.
And it’s BSD-licensed

29. Armitage Backend

30. Armitage Backend

31. veil_evasion.cna - Main Menu

32. veil_evasion.cna - Main Interface

33. Use case #5
• What’s the usual goal for a smash-and-grab
pentest?
• Find out who the domain admins are
• Find where they’re logged into
• Find a set of credentials that gives us
SYSTEM on their box
• psexec, pop a box, mimikatz, profit

34. Situational Awareness 101
• Manual process on the domain side:
• net user /domain
• net group /domain
• net view
• net view <hostname>
• net sessions <hostname>

35. Netview.exe
• Rub Fuller (@mubix) released a tool at
Derbycon 2012 called Netview, which
“enumerates systems using WinAPI calls”
• Can find hosts, shares, and logged on users
across a network
• Two API calls really interest us:
o NetServerEnum – enumerate (from the DC) domain
systems of a certain type
o NetWkstaUserEnum – get users logged onto a
system

36. Metasploit
• Most of this type of functionality already
exists in Metasploit (of course):
• smb_enumusers_domain
o uses NetWkstaUserEnum (through railgun) to get
users logged into a particular machine
• local_admin_search_enum
o checks a range of IPs to see if the current user has
admin access, and grabs the logged in users with
NetWkstaUserEnum as well

37. Metasploit
•
• enum_domain_group_users
o runs “net groups GROUP /domain” against a host
and parses the results
• computer_browser_discovery
o queries the default domain controller for all hosts of
a particular type using NetServerEnum

38. user_hunter.rb
• New Metasploit module, drawing from
existing functionality
• Takes a username, userlist, or domain group
to query against the local DC
• Takes a host list, or runs “net view” to try to
enumerate all machines on a domain

39. user_hunter.rb
• Runs NetWkstaUserEnum against each
target host to determine the users logged
into the machine
• Compares this against the target user list,
throwing a specific user.hunter note into the
database when it finds a match
• point -> click -> be told where DA’s are

40. How Can Cortana Help?
• We can interact fully with the msf database
o @notes = call("db.notes")["notes"];
• We can setup ‘heartbeat’ callbacks to
periodically perform actions
o on heartbeat_5s {…}
• We can modify our gui in useful ways
o filter host_image { …change a host’s gui image …}

41. Cortana – user_hunter.cna
• Cortana script that periodically polls the MSF
database for our user.hunter notes
• Modifies the host icons of any systems with
found users
o i.e. any systems where a DA is logged into!
• Also adds an option to launch the
user_hunter.rb module from any
meterpreter session

42. Demo

43. Recap
• Cortana is awesome, contribute!
o https://github.com/rsmudge/cortana-scripts
o https://github.com/HarmJ0y/cortana
• Many standard assessment actions can be
automated and manipulated in useful ways
• The less time you spend doing repetitive
actions = the more you can spend pwning
the client

44. Questions?
Will
@harmj0y
will@harmj0y.net
harmj0y on Freenode - #veil and #armitage
Get the cortana pack-
https://github.com/HarmJ0y/cortana