A Cobalt Strike Aggressor Script to assist an operators in conversions of common numerical types into human understandable types. Supports converting from:
- User Account Control values that are associated to an accounts in Active Directory.
- Common Microsoft timestamps. ie Active Directory (e.g. accountExpires, LastLogon, LastLogonTimestamp, and LastPwdSet) or Windows Filetime/Systemtime values.
- Install the Aggressor Script into your Cobalt Strike Client.
- In a beacon window type
numbreaker - Enter in a numerical value in the new pop-up window
- Select the type of conversion that is desired by clicking on the appropriate radial dial buttons.
Alterntively, once can install as a right-click pop-up in your Cobalt Strike default.cna. Reference the manual for more info.
The radial option for berval is currently NOT IMPLEMENTED. It's a placeholder until one day I drum up one more numerical option that can be converted clientside for operators.
MSAD/LDAP/NT Datetime
User Account Control