cobalt-strike Goto Github PK

aggressor_script_examples

This repository contains tips, tricks, and examples of aggressor script functions. The intent is to share bite size examples that can be used in other scripts.

beacon_health_check

This aggressor script uses a beacon's note field to indicate the health status of a beacon.

bof-vs

A Beacon Object File (BOF) template for Visual Studio

bof_template

A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs are a way to rapidly extend the Beacon agent with new post-exploitation features.

callback_examples

This contains a number of examples demonstrating how to use callback functions in supported aggressor script functions

callstackmasker

A PoC implementation for dynamically masking call stacks with timers.

community_kit

Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and scripts have been written and published, but they can be challenging to locate. Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike. The Cobalt Strike team acts as the curator and provides this kit to showcase this fantastic work.

cortana-scripts

A collection of Cortana scripts that you may use with Armitage and Cobalt Strike 2.x. Cortana Scripts are not compatible with Cobalt Strike 3.x. Cobalt Strike 3.x uses a variant of Cortana called Aggressor Script.

cve-2020-0796-bof

elevatekit

The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.

malleable-c2-profiles

Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.

obfuscator-llvm

proxydllexample

code for the Proxy DLL example blog post

sleep

Automatically exported from code.google.com/p/sleep

sleep_python_bridge

This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the standard GUI client. NOTE: This project is very much in BETA. The goal is to provide a playground for testing and is in no way an officially support feature. Perhaps this could be something added in the future to the core product.

teamserver-prop

TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the “HotCobalt” vulnerability. This repository contains an example file that contains the default settings.

unhook-bof

Remove API hooks from a Beacon process.

vncdll

Stand-alone VNC server compiled as a Reflective DLL

zerologon-bof