Cortana Tutorial - Armitage

3. Post Exploitation
Interacting with Compromised Hosts
Cortana scripts may interact with compromised hosts. Compromised hosts are shared
resources between other Cortana scripts and red team members. Cortana hides this where
possible. Script should never assume they have exclusive control over a compromised host.
Sessions come in two flavors: shell and meterpreter sessions. Sessions are identified by a
unique session id. Throughout an engagement, no two sessions will share the same id.
Cortana functions and events that interact with or respond to sessions, identify each
session with this id.
Scripts may use the predicates -ismeterpreter id and -isshell id to quickly distinguish
between a shell session and a meterpreter session. A special predicate -
iswinmeterpreter id identifies Windows meterpreter sessions.
Interacting with a Shell Session
A shell session is a simple connection to a shell process on a compromised host. Cortana
scripts may send commands to a shell and receive their output.
To send a command, use the &s_cmd function. This function will queue the requested
command, execute it, and fire a shell event when the command completes. Cortana will
also attempt to fire a shell_command event when it can figure out the first token of your
command.
on shell_whoami {
println("[ $+ $1 $+ ] I am: $3");
}
on session_open {
if (!-isshell $1) {
return;
}
}
s_cmd($1, "whoami");
Armitage and Cortana do not allow multiple actors to use a shell session at the same time.
This would create chaos. One person might change the current working directory while
someone else is trying to compile a privilege escalation exploit. It doesn't work.
To share a shell session, Cortana and Armitage support the concept of a shell lock. Only one
team member may own a shell session at any time. If that team member or bot disconnects,
their lock is automatically released.
The &s_cmd function will queue commands and periodically check if the lock for a shell
session is available. Once the lock is available, the queued commands will execute. After the
commands are complete, Cortana will release its lock.
17