List of Payloads

Windows

Gather

• Gather Information
• Hashdump and Exfiltrate
• Keylog and Exfiltrate
• Sniffer
• WLAN keys dump
• Get Target Credentials
• Dump LSA Secrets
• Dump passwords in plain
• Copy SAM (VSS)
• Dump Process Memory

- Dump Windows Vault Credentials

Execute

• Download and Execute
• Connect to Hotspot and Execute code
• Code Execution using Powershell
• Code Execution using DNS TXT queries
• Download and Execute PowerShell Script
• Execute ShellCode

Backdoor

• Sethc and Utilman backdoor
• Time based payload execution
• HTTP backdoor
• DNS TXT Backdoor
• Wireless Rogue AP
• Tracking Target Connectivity

Escalate

• Remove Update
• Forceful Browsing

Manage

• Add an admin user
• Change the default DNS server
• Edit the hosts file
• Add a user and Enable RDP
• Add a user and Enable Telnet
• Add a user and Enable Powershell Remoting

Misc

• Browse and Accept Java Signed Applet
• Speak on Target

Linux

• Download and Execute
• Reverse Shells using built in tools
• Code Execution
• DNS TXT Code Execution
• Perl reverse shell (MSF)

OSX

• Download and Execute
• DNS TXT Code Execution
• Perl Reverse Shell (MSF)
• Ruby Reverse Shell (MSF)

Payloads Compatibility

• The Windows payloads and modules are written mostly in powershell (in combination with native commands) and are tested on Windows 7 and Windows 8.
• The Linux payloads are mostly shell scripts (those installed by default) in combination with commands. These are tested on Ubuntu 11.
• The OS X payloads are shell scripts (those installed by default) with usage of native commands. Tested on OS X Lion running on a VMWare

• Added Execute Shellcode for Windows (under Execution menu).
• Added "Dump passwords in plain" for Windows (under Gather menu).
• Added "Copy SAM (VSS)" for Windows (under Gather menu).
• Added "Dump Process Memory" for Windows (under Gather menu).
• Added "Dump Windows Vault Credentials" for Windows (under Gather menu).
• Added "Add a user and Enable Powershell Remoting" for Windows (under Manage menu).
• Added support for Gems bundler.
• Added more banners of Kautilya.

• The Windows payloads and modules are written mostly in powershell (in combination with native commands) and are tested on Windows 7.
• The Linux payloads are mostly commands in combination with little Bash scripting. These are tested on Ubuntu 11.
• The OS X payloads are shell scripts (those installed by default) with usage of native commands. Tested on OS X Lion running on a VMWare.

Changelog v0.4.5

• Bug fixes and improvements in Time Based Exec. It now supports exfiltration and could be stopped remotely.
• Less lines of code for HTTP Backdoor and Download Execute PS.
• HTTP Backdoor, Download Execute PS, Hashdump and Exfiltrate and Dump LSA Secrets now execute the downloaded script in memory.
• Shortened parameters passed to powershell.exe when the scripts are called. Thus, saving the time in “typing” by HID.
• Added two new exfiltration options, POST requests and DNS TXT records.
• Username and password for exfiltration would be asked only if you select gmail or pastebin.
• Tinypaste as an option for exfiltration has been removed.
• Payloads have been made more modular which results in smaller size.
• Reboot Persistence has been added to HTTP Backdoor and DNS TXT Backdoor.
• Menu redesign.
• Bug fix in Dump LSA Secrets payload.
• Added ./extras/Decode.ps1. Use this to decode data exfiltrated by HTTP Backdoor and DNS TXT Backdoor.
• Added ./extras/Remove-Persistence.ps1. Use this to remove persistence by Keylogger, HTTP Backdoor and DNS TXT Backdoor.
• Kautilya could be run on Windows if win32console gem is installed.

• payload.py - The payload file
• setup.py - Required file for Py2Exe
• runme.bat - Batch script for compiling the payload into a Windows executable