FilesColor.cna

#
# Color Coded Files Listing.
#
# A nice script that colorizes your `ls` output and keeps track of uploaded files 
# to let you highlight them. 
#
# Be wary of additional performance hit when listing big directories imposed by 
# their listing processing, coloring and sorting that this script does.
#
# Based on the original ProcessColor.cna idea by @r3dQu1nn.
#
# Author:
#   Mariusz Banach / mgeeky, '20
#   <mb [at] binary-offensive.com>
#   (https://github.com/mgeeky)
#

global('@UPLOADED_FILE_NAMES $TIMES_TO_DISPLAY_COLORS_SCHEME $MAX_OUTPUT_SIZE_TO_COLORIZE');

@UPLOADED_FILE_NAMES = @();
$TIMES_TO_DISPLAY_COLORS_SCHEME = 3;

# If files listing output is going to be longer than the below threshold, avoid processing
# that output to return results faster
$MAX_OUTPUT_SIZE_TO_COLORIZE = 65536;

sub interpretSize {
    local('$s $size');
    $s = 0L;
    $s = long($1);

    if($s == 0) { 
        $size = ""; 
    }
    else if($s < 1024L) { 
        $size .= long($s) . "B"; 
    }
    else if($s < long(1024L * 1024L)) { 
        $size = long(round($s / 1024.0, 1));
        $size .= "KB";
    }
    else if($s < long(1024L * 1024L * 1024L)) { 
        $size = long(round(($s / 1024.0) / 1024, 1)); 
        $size .= "MB";
    }
    else if($s < long(1024L * 1024L * 1024L * 1024L)) { 
        $size = long(round((($s / 1024.0) / 1024) / 1024, 1)); 
        $size .= "GB";
    }

    return $size;
}

set BEACON_OUTPUT_LS {
    local('$totalsize @subl $outls $temp $size $s $ext $dotpos $type $lastmod $name @lines @ls');
    this('$once');

    if(strlen($2) > $MAX_OUTPUT_SIZE_TO_COLORIZE) {
        return $2;
    }

    @lines = split("\n", ["$2" trim]);

    @configuration = @('config', 'conf', 'json', 'yml', 'xml', 'inf', 'properties', 'settings');
    @sensitive = @('ost', 'dmp', 'sqlite', 'sqlite3', 'kdbx', 'kdb', 'dit', 'kirbi', 'ccache', 'kirbis', 'git');
    @sensitive_files = @('ntds.dit', 'lsass.dmp', 'sam', 'system', 'security');
    @archives = @('rar', 'zip', '7z', 'tar', 'gz', 'bz2', 'iso');
    @exes = @('msi', 'sys', 'exe', 'dll', 'bat', 'sct');
    @docs = @('csv', 'odt', 'dotx', 'dotm', 'docm', 'xlam', 'xll', 'xlm', 'xlsm', 'xltx', 'msg', 'rtf', 'txt', 'pdf', 'docx', 'doc', 'xls', 'xlsx', 'ppt', 'pptx', 'pptm', 'odp', 'ppsm', 'ppa', 'ppam');
    @sources = @('cpp', 'md', 'h', 'hpp', 'c', 'pl', 'sql', 'php', 'py', 'java', 'rb', 
        'html', 'js', 'css', 'asp', 'aspx', 'cs', 'vbs', 'vbe', 'jse', 'ps1', 'sln', 'vcxproj', 'csproj', 'gitignore', 'gitmodules', 'gitattributes');


    if($once < $TIMES_TO_DISPLAY_COLORS_SCHEME) {
        $outls .= "\cC[*]\o Colors scheme:\n";
        $outls .= "\cC[*]\o ---------------------------\n";
        $outls .= "\cC[*]\o Directories: \c8 YELLOW \o\n";
        $outls .= "\cC[*]\o Cobalt Strike Uploaded Files: \cBBLUE\o\n";
        $outls .= "\cC[*]\o Sensitive files: \c4 RED \o\n";
        $outls .= "\cC[*]\o Configuration files: \c3 DARK GREEN \o\n";
        $outls .= "\cC[*]\o Archives: \c7 ORANGE \o\n";
        $outls .= "\cC[*]\o Source codes: \cC DARK BLUE \o\n";
        $outls .= "\cC[*]\o Executables: \cD MAGENTA \o\n";
        $outls .= "\cC[*]\o Documents: \c9 GREEN \o\n";
        $once += 1;
    }

    $outls .= "\c9[+]\o Location: \cC" . @lines[0] . "\o\n\n";
    $outls .= " Size       Type    Last Modified         Name\n";
    $outls .= " ----       ----    -------------------   ----\n";

    @subl = sublist(@lines, 1);
    $totalsize = 0L;

    foreach $temp (@subl) {
        ($type, $s, $lastmod, $name) = split("\t", $temp);

        if ($name eq "." || $name eq "..") {
            continue;
        }

        if($type eq "D") { $type = "dir"; }
        else if($type eq "F") { $type = "fil"; }

        $s = long($s);
        $totalsize += $s;

        $size = interpretSize($s);
        $dotpos = lindexOf($name, '.');
        $ext = "";
        if(($dotpos) ) {
            $ext = lc(substr($name, $dotpos + 1));
        }
        
        if($type eq "dir") {
            # Directories in YELLOW
            push(@ls, %(type => $type, name => $name, entry => "\c8 $[10]size $[7]type\o $[21]lastmod\c8 $name \o"));
        } 
        else if($name in @UPLOADED_FILE_NAMES) {
            # Uploaded Files through Cobalt Strike (the ones we still keep track off) in Blue
            push(@ls, %(type => $type, name => $name, entry => "\cB $[10]size $[7]type\o $[21]lastmod\cB $name $+ \o"));
        }
        else if(($ext in @sensitive) || (lc($name) in @sensitive_files)) {
            # Sensitive files in Red
            push(@ls, %(type => $type, name => $name, entry => "\c4 $[10]size $[7]type\o $[21]lastmod\c4 $name \o"));
        }
        else if($ext in @exes) {
            # Executables in Magenta
            push(@ls, %(type => $type, name => $name, entry => "\cD $[10]size $[7]type\o $[21]lastmod\cD $name \o"));
        } 
        else if($ext in @interesting) {
            # Configuration files in Dark Green
            push(@ls, %(type => $type, name => $name, entry => "\c3 $[10]size $[7]type\o $[21]lastmod\c3 $name \o"));
        }
        else if($ext in @sources) {
            # Source codes in Dark Blue
            push(@ls, %(type => $type, name => $name, entry => "\cC $[10]size $[7]type\o $[21]lastmod\cC $name \o"));
        }
        else if($ext in @archives) {
            # Archives in Orange
            push(@ls, %(type => $type, name => $name, entry => "\c7 $[10]size $[7]type\o $[21]lastmod\c7 $name \o"));
        }
        else if($ext in @docs) {
            # Documents in Green
            push(@ls, %(type => $type, name => $name, entry => "\c9 $[10]size $[7]type\o $[21]lastmod\c9 $name \o"));
        } 
        else {
            push(@ls, %(type => $type, name => $name, entry => " $[10]size $[7]type $[21]lastmod $name \o"));
        }
    }

    sort({ return ($1['type'] cmp $2['type']); }, @ls);

    foreach $temp (@ls) {
        $outls .= $temp['entry'] . "\n";
    }

    $totalsize = interpretSize($totalsize);
    $outls .= "\nFiles and dirs count: " . size(@ls) . ", total size of files: $totalsize (output len: " . strlen($2) . ")\n";
    return $outls;
}

sub collectUploadedFiles {
    local('%entry %archives');
    %archives = data_query('archives');
    if(size(%archives) == 0) {
        return;
    }
    
    foreach %entry (%archives) {
        if (%entry['type'] ne "task") {
            continue;
        }

        if(indexOf(%entry['data'], "upload ") == 0) {
            if(%entry['data'] ismatch '^upload ("[^"]+"|[^\s]+) as ("[^"]+"|[^\s]+)$') {
                ($from, $to) = matched();
                push(@UPLOADED_FILE_NAMES, getFileName($to));
            }
        }
    }
}

on beacon_tasked {
    local('$from $to');

    if($2 ismatch 'Tasked beacon to upload ("[^"]+"|[^\s]+) as (.+)') {
        ($from, $to) = matched();
        push(@UPLOADED_FILE_NAMES, getFileName($to));
    }
}

on beacon_input {
    local('$from $to');
    
    if ($3 ismatch '^upload2? ("[^"]+"|[^\s]+) ?("[^"]+"|[^\s]+)?$') {
        ($from, $to) = matched();
        push(@UPLOADED_FILE_NAMES, getFileName($to));
    }

    # Remove file track as the file was requested to be deleted
    #else if ($3 ismatch '(?:shell|powershell|run) del (\w+)') {
    #    ($from) = matched();
    #    $from = getFileName($from);
    #    if($from in @UPLOADED_FILE_NAMES) {
    #        remove(@UPLOADED_FILE_NAMES, $from);
    #    }
    #}
}

collectUploadedFiles();