numbreaker

Overview

A Cobalt Strike Aggressor Script to assist an operators in conversions of common numerical, alphanumerical, or similar data types into human readable data. Supports converting from:

• SAMAccount type values that are typically found listed for accounts in Active Directory.
• User Account Control values that are associated to an accounts in Active Directory.
• Common Microsoft timestamps. ie Active Directory (e.g. accountExpires, LastLogon, LastLogonTimestamp, and LastPwdSet) or Windows Filetime/Systemtime values.
• CIDR IP Range start and end calculation
• JSON Web Token (JWT) decode/display.

Usage

1. Install the Aggressor Script into your Cobalt Strike Client.
2. In a beacon window type numbreaker
3. Enter in a value in the new pop-up window
4. Select the type of conversion that is desired by clicking on the appropriate radial dial buttons.

Alternatively, once can install as a right-click pop-up in your Cobalt Strike default.cna. Reference the manual for more info.

Screenshots

SAM Account Type

MSAD/LDAP/NT Datetime

User Account Control

CIDR Range Calc

JWT Decoder