In an earlier module, you have learned how you can make use of
different download cradles to actually download PowerShell
scripts and execute them in memory.
I wanted to spend a few moments showing you an awesome
tool called Invoke‑CradleCrafter.
This is available on GitHub, and you can download
it from the link on your screen.
Within Kali Linux, you can import this module into
PowerShell using the Import‑Module command.
Once you have the module imported, all you need to do is issue the
Invoke‑CradleCrafter, and this will go ahead and start the framework.
Now essentially, this CradleCrafter framework can be used to
generate download cradles. And the two options that you have is
to generate Memory‑only remote download cradles or Disk‑based
remote download cradles.
Now before you get started with actually using these options, there are a
couple of things that you need to configure on this framework.
A quick way to view this would be to look at the
tutorial. As I issue the command tutorial,
I can see that under point number 1,
I need to define the URL, the path, and the command that I would like to use.
So let's define this.
My URL will be my Kali Linux Python server that I'm
hosting locally. And for the path, I'm going to make use of the PowerView module.
Now PowerView has got a number of commands, but let's use a simple command
for the sake of this demonstration. and that command that I'm going to use
is the Get‑NetDomain. Right, so now that I've got my URL path and command
defined, let's look at these options.
So I'm going to focus predominantly on the memory options.
To view the options,
you need to issue the command memory, and then you've got a list
of the different cradle options that exist.
Now you may notice that some of these cradle options look familiar, and
that is because we've used it in an earlier module.
So I'm going to go ahead and try the OpenRead method, and that is part
of the Net.WebClient class. In order to generate the cradle, all I need
to do is type out the option that I would like to use, and once I hit
Enter, I then get the cradle.
Now I can further add some additional options onto this cradle.
So, looking at the list of options that we have,
I can rearrange the syntax structure,
make use of the new object cmdlet, leverage the OpenRead method, and so forth.
So I'm going to go ahead and rearrange the syntax structure, and I'm going to
leverage random variables. And I have a new result, so let's go ahead and test
this out. Switching back to my target machine, I'll paste in my new download
cradle, and I get the results back.
Now if I wanted to start over and generate a new cradle,
I can issue the reset command, and this will go and remove all of
the cradle options that I've created. From here,
I can navigate back to the main menu, and I have a list of the initial options.
So here you can see that this is a really handy
framework to keep in your toolkit.
It can allow you to quickly generate different types of cradles that you can use
to download your PowerShell scripts on your target machine.