A Cobalt Strike Aggressor Script to assist an operators in conversions of common numerical, alphanumerical, or similar data types into human readable data. Supports converting from:
- SAMAccount type values that are typically found listed for accounts in Active Directory.
- User Account Control values that are associated to an accounts in Active Directory.
- Common Microsoft timestamps. ie Active Directory (e.g. accountExpires, LastLogon, LastLogonTimestamp, and LastPwdSet) or Windows Filetime/Systemtime values.
- CIDR IP Range start and end calculation
- JSON Web Token (JWT) decode/display.
- Install the Aggressor Script into your Cobalt Strike Client.
- In a beacon window type
numbreaker - Enter in a value in the new pop-up window
- Select the type of conversion that is desired by clicking on the appropriate radial dial buttons.
Alternatively, once can install as a right-click pop-up in your Cobalt Strike default.cna. Reference the manual for more info.
SAM Account Type
MSAD/LDAP/NT Datetime
User Account Control
CIDR Range Calc
JWT Decoder