Release v0.4.0: What's new ?
rportfwd command
The rportfwd allows you to port forward traffic between the beacon and the attacker server. Behind the scene it uses ligolo-ng listener.
Traffic targetting 127.0.0.1:4455 will be tunnelled to the attacker machine on 127.0.0.1:8001.
More details in the official orsted doc https://almounah.github.io/orsted-doc/globalcommands/95-rportfwd/
Stopping Session Range
It is now possible to stop session by specifying a range.
More details in the official orsted doc https://almounah.github.io/orsted-doc/globalcommands/4-session/#session-stop
Execute Assembly in the background
Sometimes you want to run an assembly in the background without waiting for the output, for example when escalating privileges with GodPotato
For that an option has been added in execute-assembly
[Session 73: haroun@DESKTOP-DU89UIV] » execute-assembly --help
Load and Execute Exe with donut
Usage:
execute-assembly [flags] file [args...]
Args:
file string Assembly to load
args string list Argument of the Assembly
Flags:
-b, --background If specified, run process in background without waiting for output. Usefull when migrating or using Potatoes.
-h, --help display help
-m, --method string Method to load Assembly (default: 1)
-p, --process string Sacrificial Process (default: C:\Windows\System32\notepad.exe)
execute-assembly is also now allowed it to look for exe in ./ to execute.
More details in the official orsted doc https://almounah.github.io/orsted-doc/windowscommands/94-execute-assembly/
Bug fixes
Some bug fixes, mainly:
- Fixing print bug when command is very big. Now it is limited to 100 character with '...'
- Updated AMSI Bypass