Kautilya is a toolkit which provides various payloads for a Human Interface Device which may help in breaking in a computer during penetration tests.

List of Payloads

Windows

Gather

• Gather Information
• Hashdump and Exfiltrate
• Keylog and Exfiltrate
• Sniffer
• WLAN keys dump
• Get Target Credentials
• Dump LSA Secrets
• Dump passwords in plain
• Copy SAM (VSS)
• Dump Process Memory

- Dump Windows Vault Credentials

Execute

• Download and Execute
• Connect to Hotspot and Execute code
• Code Execution using Powershell
• Code Execution using DNS TXT queries
• Download and Execute PowerShell Script
• Execute ShellCode

Backdoor

• Sethc and Utilman backdoor
• Time based payload execution
• HTTP backdoor
• DNS TXT Backdoor
• Wireless Rogue AP
• Tracking Target Connectivity

Escalate

• Remove Update
• Forceful Browsing

Manage

• Add an admin user
• Change the default DNS server
• Edit the hosts file
• Add a user and Enable RDP
• Add a user and Enable Telnet
• Add a user and Enable Powershell Remoting

Misc

• Browse and Accept Java Signed Applet
• Speak on Target

Linux

• Download and Execute
• Reverse Shells using built in tools
• Code Execution
• DNS TXT Code Execution
• Perl reverse shell (MSF)

OSX

• Download and Execute
• DNS TXT Code Execution
• Perl Reverse Shell (MSF)
• Ruby Reverse Shell (MSF)

Payloads Compatibility

• The Windows payloads and modules are written mostly in powershell (in combination with native commands) and are tested on Windows 7 and Windows 8.
• The Linux payloads are mostly shell scripts (those installed by default) in combination with commands. These are tested on Ubuntu 11.
• The OS X payloads are shell scripts (those installed by default) with usage of native commands. Tested on OS X Lion running on a VMWare

CHANGELOG:
0.5.0

• Added Execute Shellcode for Windows (under Execution menu).
• Added "Dump passwords in plain" for Windows (under Gather menu).
• Added "Copy SAM (VSS)" for Windows (under Gather menu).
• Added "Dump Process Memory" for Windows (under Gather menu).
• Added "Dump Windows Vault Credentials" for Windows (under Gather menu).
• Added "Add a user and Enable Powershell Remoting" for Windows (under Manage menu).
• Added support for Gems bundler.
• Added more banners of Kautilya.

• The Windows payloads and modules are written mostly in powershell (in combination with native commands) and are tested on Windows 7.
• The Linux payloads are mostly commands in combination with little Bash scripting. These are tested on Ubuntu 11.
• The OS X payloads are shell scripts (those installed by default) with usage of native commands. Tested on OS X Lion running on a VMWare.

Changelog v0.4.5

• Bug fixes and improvements in Time Based Exec. It now supports exfiltration and could be stopped remotely.
• Less lines of code for HTTP Backdoor and Download Execute PS.
• HTTP Backdoor, Download Execute PS, Hashdump and Exfiltrate and Dump LSA Secrets now execute the downloaded script in memory.
• Shortened parameters passed to powershell.exe when the scripts are called. Thus, saving the time in “typing” by HID.
• Added two new exfiltration options, POST requests and DNS TXT records.
• Username and password for exfiltration would be asked only if you select gmail or pastebin.
• Tinypaste as an option for exfiltration has been removed.
• Payloads have been made more modular which results in smaller size.
• Reboot Persistence has been added to HTTP Backdoor and DNS TXT Backdoor.
• Menu redesign.
• Bug fix in Dump LSA Secrets payload.
• Added ./extras/Decode.ps1. Use this to decode data exfiltrated by HTTP Backdoor and DNS TXT Backdoor.
• Added ./extras/Remove-Persistence.ps1. Use this to remove persistence by Keylogger, HTTP Backdoor and DNS TXT Backdoor.
• Kautilya could be run on Windows if win32console gem is installed.

• The Windows payloads and modules are written mostly in powershell (in combination with native commands) and are tested on Windows 7.
• The Linux payloads are mostly commands in combination with little Bash scripting. These are tested on Ubuntu 11.

Changelog v0.4.4

• Added “Download and Execute Powershell Script” windows payload.
• Added “Remove Update” windows payload.
• Added “LSA Secrets” windows payload.
• Updated “DNS TXT Backdoor”. It is much more easy to use know.
• Renamed Wait for Command to HTTP Backdoor
• HTTP Backdoor now keeps running till the stopstring is matched.
• An option has been added for no exfiltration of data. Choose 0 when Kautilya asks for exfil option.

Full Changelog: here

Download Kautilya v0.4.4