Cortana Tutorial - Armitage

A snapshot of the database is always available to your script. When Cortana polls the
database, it compares the new results to its understanding of the database. Cortana uses
the changes in the database to fire events that you may register listeners for.
Figure 3. Cotana's Data Management
The host_add and host_delete events fire when hosts are added or deleted. Look at the
&hosts_* functions to learn how to interact with and query hosts.
Cortana also fires events for services. The services_add_n fires when a service with port n
is first seen. The service_add event fires for any service and service_delete fires when a
service disappears from the database. Take a look at the &service_* functions to learn how
to interact with and query the known services.
Cortana fires the credential_add event when a credential is added to the database.
Metasploit automatically records working credentials as they're discovered. The
credential_delete event is fired when a credential is removed from the database. The
&credential_* functions let you query and manipulate the known credentials.
The session_open event fires when a new session opens up. A session is an active
connection between Metasploit and a compromised host. The session_close event fires
when a session closes. When a Meterpreter session is ready for interaction, Cortana fires a
session_sync event to indicate this. The &session_* functions provide tools to query or
close any existing sessions.
Cortana also fires a route_add event when a new pivot is setup. The route_delete event is
fired when a pivot is removed. The &route_* functions let you add, delete, and query
routes.
The loot_add event fires when a new loot is added to the database. Some Metasploit post
modules record their captured database as a loot entry. The main purpose of this event is
15