CALDERA Plugin: Builder
The Builder plugin enables CALDERA to dynamically compile code segments into payloads that can be executed as abilities by implants.
Installation:
Install the required docker components with the following command:
sudo ./install.shDependencies/Requirements:
- Docker
- docker-py
Sample Ability
The following ability will compile the HelloWorld.exe executable, copy it to the machine running the agent, and execute it using either cmd or PowerShell.
---
- id: 096a4e60-e761-4c16-891a-3dc4eff02e74
name: C# Hello World
description: Dynamically compile HelloWorld.exe
tactic: execution
technique:
attack_id: T1059
name: Command-Line Interface
platforms:
windows:
psh,cmd:
build_target: HelloWorld.exe
language: csharp
code: |
using System;
namespace HelloWorld
{
class Program
{
static void Main(string[] args)
{
Console.WriteLine("Hello World!");
}
}
}DLL dependencies can be added by declaring a payloads list at the root of the ability.