Skip to content

zer0yu/Awesome-CobaltStrike

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 

Repository files navigation

Awesome CobaltStrike Awesome CobaltStrike Awesome community

Contents

0x00 Introduction

  1. The first part is a collection of quality articles about CobaltStrike
  2. The third part is about the integration of the new features BOF resources
  3. This project is to solve the problem of not finding the right aggressor script or BOF when it is needed
  4. If there is quality content that is not covered in this repo, welcome to submit pr

0x01 Articles & Videos

1. Basic Knowledge

  1. Cobalt_Strike_wiki
  2. Cobalt Strike Book
  3. CobaltStrike4.0笔记
  4. CobaltStrike相关网络文章集合
  5. Cobalt Strike 外部 C2 之原理篇
  6. Cobalt Strike 桌面控制问题的解决(以及屏幕截图等后渗透工具)
  7. Cobalt Strike & MetaSploit 联动
  8. Cobalt-Strike-CheatSheet
  9. Cobalt Strike MITRE TTPs
  10. Red Team Operations with Cobalt Strike (2019)
  11. Cobalt Strike: Overview
  12. CobaltStrike插件开发
  13. Cobalt Strike 中文 Wiki

2. Crack and Customisation

  1. IntelliJ-IDEA修改cobaltstrike
  2. CobaltStrike二次开发环境准备
  3. Cobal Strike 自定义OneLiner
  4. 通过反射DLL注入来构建后渗透模块(第一课)
  5. Cobalt Strike Aggressor Script (第一课)
  6. Cobalt Strike Aggressor Script (第二课)
  7. Implementing Syscalls In The Cobaltstrike Artifact Kit
  8. Cobalt Strike 4.0 认证及修补过程
  9. 使用ReflectiveDLLInjection武装你的CobaltStrike
  10. Bypass cobaltstrike beacon config scan
  11. Tailoring Cobalt Strike on Target
  12. COFFLOADER: BUILDING YOUR OWN IN MEMORY LOADER OR HOW TO RUN BOFS
  13. Yet Another Cobalt Strike Stager: GUID Edition
  14. Cobalt Strike4.3 破解日记
  15. Cobalt Strike 进程创建与对应的 Syslog 日志分析
  16. Behind the Mask: Spoofing Call Stacks Dynamically with Timers

3. Useful Trick

  1. Cobalt Strike Spear Phish
  2. run CS in win -- teamserver.bat
  3. Remote NTLM relaying through CS -- related to CVE_2018_8581
  4. Cobalt Strike Convet VPN
  5. 渗透神器CS3.14搭建使用及流量分析
  6. CobaltStrike生成免杀shellcode
  7. CS-notes--一系列CS的使用技巧笔记
  8. 使用 Cobalt Strike 对 Linux 主机进行后渗透
  9. Cobalt Strike Listener with Proxy
  10. Cobalt Strike Convet VPN
  11. CS 4.0 SMB Beacon
  12. Cobalt Strike 浏览器跳板攻击
  13. Cobalt Strike 中 Bypass UAC
  14. 一起探索Cobalt Strike的ExternalC2框架
  15. 深入探索Cobalt Strike的ExternalC2框架
  16. Cobalt Strike的特殊功能(external_C2)探究
  17. A tale of .NET assemblies, cobalt strike size constraints, and reflection
  18. AppDomain.AssemblyResolve
  19. 从webshell建立代理上线不出网的内网机器
  20. 在Cobalt Strike BOF中进行直接系统调用
  21. Using Direct Syscalls in Cobalt Strike's Artifact Kit
  22. Cobalt Strike Staging and Extracting Configuration Information
  23. Create a proxy DLL with artifact kit
  24. Attackers are abusing MSBuild to evade defenses and implant Cobalt Strike beacons
  25. Lateral Movement with LiquidSnake
  26. CoffLoader from OtterHacker

4. CobaltStrike Hide

  1. CobaltStrike证书修改躲避流量审查
  2. CS 合法证书 + Powershell 上线
  3. Cobalt Strike 团队服务器隐匿
  4. 红队基础建设:隐藏你的C2 server
  5. Cobalt Strike HTTP C2 Redirectors with Apache mod_rewrite
  6. 深入研究cobalt strike malleable C2配置文件
  7. A Brave New World: Malleable C2
  8. How to Write Malleable C2 Profiles for Cobalt Strike
  9. Randomized Malleable C2 Profiles Made Easy
  10. 关于CobaltStrike的Stager被扫问题
  11. Beacon Stager listener 去特征
  12. 检测与隐藏Cobaltstrike服务器
  13. 记一次cs bypass卡巴斯基内存查杀
  14. cs bypass卡巴斯基内存查杀 2
  15. Cobalt Strike – Bypassing C2 Network Detections
  16. Cobalt Strike特征隐藏
  17. Cobalt Strike 反溯源之 CDN 篇
  18. Unleashing The Unseen: Harnessing The Power Of Cobalt Strike Profiles For EDR Evasion

5. CobaltStrike Analysis

  1. Volatility Plugin for Detecting Cobalt Strike Beacon. blog|Toolset
  2. 逆向分析Cobalt Strike安装后门
  3. 分析cobaltstrike c2 协议
  4. Small tool to decrypt a Cobalt Strike auth file
  5. Cobalt Strike 的 ExternalC2
  6. Detecting Cobalt Strike Default Modules via Named Pipe Analysis
  7. 浅析CobaltStrike Beacon Staging Server扫描
  8. Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability
  9. Analyzing Cobalt Strike for Fun and Profit
  10. Cobalt Strike Remote Threads detection
  11. The art and science of detecting Cobalt Strike
  12. A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers
  13. How to detect Cobalt Strike activities in memory forensics
  14. Detecting Cobalt Strike by Fingerprinting Imageload Events
  15. The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration
  16. CobaltStrike - beacon.dll : Your No Ordinary MZ Header
  17. GitHub-hosted malware calculates Cobalt Strike payload from Imgur pic
  18. Detecting Cobalt Strike beacons in NetFlow data
  19. Volatility Plugin for Detecting Cobalt Strike Beacon
  20. Easily Identify Malicious Servers on the Internet with JARM
  21. Cobalt Strike Beacon Analysis
  22. Hancitor infection with Pony, Evil Pony, Ursnif, and Cobalt Strike
  23. Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike
  24. Hiding in the Cloud: Cobalt Strike Beacon C2 using Amazon APIs
  25. Identifying Cobalt Strike team servers in the wild
  26. Multi-stage APT attack drops Cobalt Strike using Malleable C2 feature
  27. Operation Cobalt Kitty
  28. Detecting and Advancing In-Memory .NET Tradecraft
  29. Analysing Fileless Malware: Cobalt Strike Beacon
  30. IndigoDrop spreads via military-themed lures to deliver Cobalt Strike
  31. Cobalt Group Returns To Kazakhstan
  32. Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability
  33. Azure Sentinel Quick-Deploy with Cyb3rWard0g’s Sentinel To-Go – Let’s Catch Cobalt Strike!
  34. Cobalt Strike stagers used by FIN6
  35. Malleable C2 Profiles and You
  36. C2 Traffic patterns including Cobalt Strike
  37. Cobalt Strike DNS Direct Egress Not That Far Away
  38. Detecting Exposed Cobalt Strike DNS Redirectors
  39. Example of Cleartext Cobalt Strike Traffic
  40. Cobaltstrike-Beacons analyzed
  41. 通过DNS协议探测Cobalt Strike服务器
  42. Detecting Cobalt Strike with memory signatures
  43. CobaltStrike通信中host字段的获取
  44. 反击CobaltStrike(一) 以假乱真
  45. 某 C2 鸡肋漏洞分析:你的 CS 安全吗?
  46. Cobalt Strike Beacon Analysis from a Live C2

6. CobaltStrike Video

  1. Malleable Memory Indicators with Cobalt Strike's Beacon Payload
  2. STAR Webcast: Spooky RYUKy: The Return of UNC1878
  3. Excel 4.0 Macros Analysis - Cobalt Strike Shellcode Injection
  4. Profiling And Detecting All Things SSL With JA3

0x02 C2 Profiles

Type Name Description Popularity Language
ALL Malleable-C2-Profiles Official Malleable C2 Profiles
ALL Malleable-C2-Randomizer This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage
ALL malleable-c2 Cobalt Strike Malleable C2 Design and Reference Guide
ALL Malleable-C2-Profiles A collection of profiles used in Cobalt Strike and Empire's Malleable C2 Listener.
ALL random_c2_profile Random C2 Profile Generator
ALL SourcePoint SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.
ALL C2concealer C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.
ALL MalleableC2-Profiles A collection of Cobalt Strike Malleable C2 profiles. now have Windows Updates Profile
ALL MalleableC2-Profiles Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike
ALL pyMalleableC2 A Python interpreter for Cobalt Strike Malleable C2 profiles that allows you to parse, modify, build them programmatically and validate syntax.
ALL 1135-CobaltStrike-ToolKit Cobalt Strike的Malleable C2配置文件,被设计用来对抗流量分析
ALL service_cobaltstrike CobaltStrike profile
ALL CobaltNotion A spin-off research project. Cobalt Strike x Notion collab 2022.
ALL Burp2Malleable This is a quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles.
ALL autoRebind Automatically parse Malleable C2 profiled into CrossC2 rebinding library source code
ALL goMalleable Malleable C2 profiles parser and assembler written in golang
ALL Malleable-CS-Profiles A list of python tools to help create an OPSEC-safe Cobalt Strike profile.

0x03 BOF

Type Name Description Popularity Language
ALL BOF_Collection Various Cobalt Strike BOFs
ALL cobaltstrike-bof-toolset 收集网络中在cobaltstrike中使用的bof工具集。
ALL Situational Awareness BOF Its larger goal is providing a code example and workflow for others to begin making more BOF files. Blog
ALL bof_helper Beacon Object File (BOF) Creation Helper
ALL BOF-DLL-Inject BOF DLL Inject is a custom Beacon Object File that uses manual map DLL injection in order to migrate a dll into a process all from memory.
ALL cobaltstrike_bofs BOF spawns a process of your choice under a specified parent, and injects a provided shellcode file via QueueUserAPC().
ALL BOF-RegSave Beacon Object File(BOF) for CobaltStrike that will acquire the necessary privileges and dump SAM - SYSTEM - SECURITY registry keys for offline parsing and hash extraction.
ALL CobaltStrike BOF DCOM Lateral Movement; WMI Lateral Movement - Win32_Process Create; WMI Lateral Movement - Event Subscription
ALL BOFs ETW Patching; API Function Utility; Syscalls Shellcode Injection
ALL Remote Operations BOF This repo serves as an addition to our previously released SA Repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format.
ALL OperatorsKit This repository contains a collection of tools that integrate with Cobalt Strike through Beacon Object Files (BOFs).
Dev bof This is a template project for building Cobalt Strike BOFs in Visual Studio.
Dev Needle_Sift_BOF Strstr with user-supplied needle and filename as a BOF.
Dev Quser-BOF Beacon Object Files Quser implementation using Windows API
Dev BOF.NET A .NET Runtime for Cobalt Strike's Beacon Object Files.
Dev beacon-object-file The format, described by Mudge here, asks that the operator construct an COFF file using a mingw-w64 compiler or the msvc compiler that holds an symbol name indicating its entrypoint, and underlying function calls.
Dev InlineWhispers Demonstrate the ability to easily use syscalls using inline assembly in BOFs.
Dev WdToggle A Proof of Concept Cobalt Strike Beacon Object File which uses direct system calls to enable WDigest credential caching and circumvent Credential Guard (if enabled).
Dev Situational Awareness BOF This Repo intends to serve two purposes. First it provides a nice set of basic situational awareness commands implemented in BOF. This allows you to perform some checks on a host before you begin executing commands that may be more invasive.
Dev MiniDumpWriteDump Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemory.
Dev COFF Loader This is a quick and dirty COFF loader (AKA Beacon Object Files). Currently can run un-modified BOF's so it can be used for testing without a CS agent running it. The only exception is that the injection related beacon compatibility functions are just empty.
Dev Self_Deletion_BOF BOF implementation of the research by @jonasLyk and the drafted PoC from @LloydLabs
Dev PE Import Enumerator BOF This is a BOF to enumerate DLL files to-be-loaded by a given PE file. Depending on the number of arguments, this will allow an operator to either view a listing of anticipated imported DLL files, or to view the imported functions for an anticipated DLL.
Dev Visual-Studio-BOF-template A Visual Studio template used to create Cobalt Strike BOFs
Dev BOF-Builder C# .Net 5.0 project to build BOF (Beacon Object Files) in mass based on them all being in a folder directory struct somewhere.
Dev ELFLoader This is a ELF object in memory loader/runner. The goal is to create a single elf loader that can be used to run follow on capabilities across all x86_64 and x86 nix operating systems.
Dev Rust BOFs for Cobalt Strike This took me like 4 days, but I got it working... rust core + alloc for Cobalt Strike BOFs. This is very much a PoC, but I'd love to see others playing around with it and contributing.
Dev CoffeeLdr CoffeeLdr is a loader for so called Beacon Object Files. This project can be used for testing Beacon Object files without using the Cobalt Strike framework or can be used to give custom implants a way to execute BOFs that where designed for Cobalt strike.
Dev HalosGate Processlist Cobalt Strike BOF Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes.
Dev PPLFaultDumpBOF Takes the original PPLFault and the original included DumpShellcode and combinds it all into a BOF targeting cobalt strike.
Dev Winsocky Winsocket implementation for Cobalt Strike. Used to communicate with the victim using winsockets instead of the traditional ways.
Dev bof-vs A Beacon Object File (BOF) template for Visual Studio.
Auxiliary Defender Exclusions BOF A BOF to determine Windows Defender exclusions.
Auxiliary ScreenShot-BOF ScreenShot bof for Cobalt Strike . All in memory and no spawn/inject.
Auxiliary BofRoast Beacon Object File repo for roasting Active Directory.
Auxiliary EnumCLR.c Cobalt Strike BOF to identify processes with the CLR loaded with a goal of identifying SpawnTo / injection candidates.
Auxiliary PPEnum Simple BOF to read the protection level of a process.
Auxiliary secinject Section Mapping Process Injection (secinject): Cobalt Strike BOF
Auxiliary FindObjects-BOF A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.
Auxiliary Inject-assembly Inject-assembly - Execute .NET in an Existing Process. This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly.
Auxiliary WhereAmiI WhereAmiI - Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.
Auxiliary GetWebDAVStatus Small project to determine if the Web Client service (WebDAV) is running on a remote system by checking for the presence of the DAV RPC SERVICE named pipe.
Auxiliary ChromeKeyDump BOF implementation of Chlonium tool to dump Chrome Masterkey and download Cookie/Login Data files
Auxiliary Sleeper BOF to call the SetThreadExecutionState function to prevent host from Sleeping
Auxiliary LSASS Beacon Object File to dump Lsass memory by obtaining a snapshot handle. Does MiniDumpWriteDump/NtReadVirtualMemory on SnapShot of LSASS instad of original LSASS itself hence evades some AV/EDR.
Auxiliary getsystem get system by duplicating winlogon's token.
Auxiliary Silent Lsass Dump Silent Lsass Dump
Auxiliary unhook-bof This is a Beacon Object File to refresh DLLs and remove their hooks.
Auxiliary Beacon Health Check Aggressor Script This aggressor script uses a beacon's note field to indicate the health status of a beacon.
Auxiliary Registry BOF A beacon object file for use with cobalt strike v4.1+. Supports querying, adding, and deleting keys/values of local and remote registries.
Auxiliary InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module
Auxiliary CredBandit CredBandit is a proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel. The memory dump is done by using NTFS transactions which allows us to write the dump to memory and the MiniDumpWriteDump API has been replaced with an adaptation of ReactOS's implementation of MiniDumpWriteDump.
Auxiliary Inject AMSI Bypass Cobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection.
Auxiliary Firewall_Enumerator_BOF Cobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection.
Auxiliary Detect-Hooks Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR
Auxiliary unhook-bof Remove API hooks from a Beacon process.
Auxiliary whereami Cobalt Strike "Where Am I?" Beacon Object File
Auxiliary HOLLOW EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode
Auxiliary BOFs send_shellcode_via_pipe;cat;wts_enum_remote_processes
Auxiliary SCShell SCShell is a fileless lateral movement tool that relies on ChangeServiceConfigA to run commands.
Auxiliary WinRMDLL A while ago I produced CSharpWinRM which was alright, but I wanted to look at the WinRM C++ API properly.
Auxiliary LSASS Dumping With Foreign Handles LSASS Dumping With Foreign Handles
Auxiliary PPLDump BOF this is a fully-fledged BOF to dump an arbitrary protected process.(LSASS)
Auxiliary PortBender PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP).
Auxiliary BOF2Shellcode POC tool to convert a Cobalt Strike BOF into raw shellcode.
Auxiliary DLL Hijack Search Order BOF DLL Hijack Search Order Enumeration BOF
Auxiliary InlineWhispers2 Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2
Auxiliary NetUser 使用windows api添加用户,可用于net无法使用时
Auxiliary BOF-Nim 用Nim语言写BoF
Auxiliary Invoke-Bof Load any Beacon Object File using Powershell!
Auxiliary Cobalt-Clip Cobalt-clip is clipboard addons for cobaltstrike to interact with clipboard. With this you can dump, edit and monitor the content of q clipboard.
Auxiliary CoffLoader Load and execute COFF files and Cobalt Strike BOFs in-memory
Auxiliary COFFLoader2 Load and execute COFF files and Cobalt Strike BOFs in-memory
Auxiliary Process Protection Level Enumerator BOF A Syscall-only BOF file intended to grab process protection attributes, limited to a handful that Red Team operators and pentesters would commonly be interested in.
Auxiliary Toggle_Token_Privileges_BOF AAn (almost) syscall-only BOF file intended to either add or remove token privileges within the context of your current process.
Auxiliary Cobalt Strike BOF - Inject ETW Bypass Inject ETW Bypass into Remote Process via Syscalls (HellsGate HalosGate)
Auxiliary HandleKatz_BOF PIC your Katz! Say hello to HandleKatz, our position independent Lsass dumper abusing cloned handles, direct system calls and a modified version of minidumpwritedump()
Auxiliary tgtdelegation tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick"
Auxiliary nanodump A Beacon Object File that creates a minidump of the LSASS process.
Auxiliary xPipe Cobalt Strike BOF (x64) Cobalt Strike Beacon Object File (BOF) to list active Pipes & return their Owner & Discretionary Access Control List (DACL) permissions.
Auxiliary AddUser-Bof Cobalt Strike BOF that Add an admin user
Auxiliary ServiceMove-BOF Lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking
Auxiliary Detect-Hooks Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR
Auxiliary MemReader BoF MemReader Beacon Object File will allow you to search and extract specific strings from a target process memory and return what is found to the beacon output.
Auxiliary Readfile BoF Not the prettiest code, short sweet and to the point and will allow you to read file contents to beacon output.
Auxiliary ChromiumKeyDump BOF implementation of Chlonium tool to dump Chrome/Edge Masterkey and download Cookie/Login Data files
Auxiliary LdapSignCheck Beacon Object File to scan a Domain Controller to see if LdapEnforceChannelBinding or LdapServerIntegrity has been modified to mitigate against relaying attacks.
Auxiliary DelegationBOF This tool uses LDAP to check a domain for known abusable Kerberos delegation settings. Currently, it supports RBCD, Constrained, Constrained w/Protocol Transition, and Unconstrained Delegation checks.
Auxiliary RunOF A tool to run object files, mainly beacon object files (BOF), in .Net.
Auxiliary KillDefender_BOF Beacon Object File implementation of pwn1sher's KillDefender.
Auxiliary TokenStripBOF TokenStrip is a Beacon Object File implementation of pwn1sher's KillDefender project utilizing syscalls via InlineWhispers.
Auxiliary BOF - RDPHijack Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
Auxiliary Koh Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
Auxiliary RDPHijack Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
Auxiliary KDStab BOF combination of KillDefender and Backstab.
Auxiliary Token Vault BOF for Cobalt Strike This Beacon Object File (BOF) creates in-memory storage for stolen/duplicated Windows access tokens.
Auxiliary ASRenum Identify ASR rules, actions, and exclusion locations.
Auxiliary ThreadlessInject-BOF BOF implementation of @EthicalChaos's ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.
Auxiliary Inline-Execute-PE Execute unmanaged Windows executables in CobaltStrike Beacons. This enables Operators to use many third party tools (Mimikatz, Dsquery, Sysinternals tools, etc) without needing to drop them to disk, reformat them to position independent code using a tool like Donut, or create a new process to run them.
Auxiliary BOFs Subscribes to WNF notifications for a number of seconds. && Backdoors SCManager SDDL.
Auxiliary DomainPasswordSpray Perform LDAP-based or Kerberos-based password spray using Windows API LogonUserSSPI. Skip disabled accounts, locked accounts and large BadPwdCount (if specified).
Auxiliary BOF-CredUI Credentials Collection via CredUIPromptForWindowsCredentials
Auxiliary Cookie-Graber-BOF C or BOF file to extract WebKit master key to decrypt user cookie. The C code can be used to compile an executable or a bof script for Cobalt Strike.
Auxiliary ScreenshotBOF An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
Auxiliary ScreenshotBOFPlus Take a screenshot without injection for Cobalt Strike. I only made minor optimizations to the existing code, and made it support the ability to get a complete screenshot when global scaling is initiated on Windows.
Auxiliary Elevate-System-Trusted-BOF This BOF can be used to elevate the current beacon to SYSTEM and obtain the TrustedInstaller group privilege. The impersonation is done through the SetThreadToken API.
Auxiliary Hidden Desktop BOF Hidden Desktop (often referred to as HVNC) is a tool that allows operators to interact with a remote desktop session without the user knowing.
Auxiliary DropSpawn DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection.
Auxiliary Nanorobeus COFF file (BOF) for managing Kerberos tickets.
Auxiliary SelfDel Delete file regardless of whether the handle is used via SetFileInformationByHandle
Auxiliary GetWeChatBOF 用于获取微信信息的BOF测试文件, 仅支持3.9.6.33版本的偏移
Auxiliary ShadowRDP 用This repository contains two applications. One is a beacon object file, which is used to retrieve the authentication string, also known as the invitation. The other is a graphical user interface program that can be run on the operator's system behind a SOCKS proxy to connect to the remote desktop session.
Auxiliary SharpHound4Cobalt The SharpHound data (test file, json, zip, cache file) will not be written on the disk but only sent to Cobalt Strike downloads through BOF.NET library.
Exploit CVE-2020-0796-BOF SMBGhost LPE
Exploit ZeroLogon-BOF ZeroLogon
Exploit kernel-mii Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551.
Exploit PrivKit PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
Exploit CVE-2023-36874 About
Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE.
Persistence SPAWN Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
Persistence PersistBOF A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User).
BypassAV ClipboardWindow-Inject Beacon Object File (BOF) that injects beacon shellcode into remote process, avoiding the usage of common monitored APIs.
BypassAV SigFlip SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.
BypassAV BokuLoader Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.
BypassAV AddDefenderExclusions AddDefenderExclusions Beacon Object File Resources.
BypassAV BOFMask it demonstrates a technique to stealthily run BOFs without exposing Beacon to detection.
BypassUAC Trusted Path UAC Bypass Beacon object file implementation for trusted path UAC bypass. The target executable will be called without involving "cmd.exe" by using DCOM object.
BypassUAC EventViewerUAC_BOF This is a Beacon Object File implementation of the Event Viewer deserialization UAC bypass discovered by @orange_8361 and the POC put together by CsEnox.

0x04 Aggressor Script

Type Name Description Popularity Language
BypassAV BypassAV 用于快速生成免杀的可执行文件
BypassAV BypassAV 本质上利用的ps2exe.ps1脚本编译为exe,只是不想在命令行里操作,将其写为cna脚本,方便直接快速生成免杀的可执行文件且只有50KB,目前支持exe、ps1文件格式。
BypassAV scrun BypassAV ShellCode Loader (Cobaltstrike/Metasploit) Useage
BypassAV ShellCode_Loader Msf&CobaltStrike免杀ShellCode加载器
BypassAV beacon-c2-go beacon-c2-go (Cobaltstrike/Metasploit)
BypassAV C--Shellcode python ShellCode Loader (Cobaltstrike&Metasploit) Useage
BypassAV Doge-Loader Cobalt Strike Shellcode Loader by Golang
BypassAV CS-Loader CS免杀,包括python版和C版本的
BypassAV CSSG Cobalt Strike Shellcode Generator. Generates beacon stageless shellcode with exposed exit method, additional formatting, encryption, encoding, compression, multiline output, etc
BypassAV Alaris Alaris is a new and sneaky shellcode loader capable of bypassing most EDR systems as of today (02/28/2021). It uses several known TTP’s that help protect the malware and it’s execution flow.
BypassAV CarbonMonoxide EDR Evasion - Combination of SwampThing - TikiTorch
BypassAV bypassAV-1 条件触发式远控 VT 6/70 免杀国内杀软及defender、卡巴斯基等主流杀软.
BypassAV ScareCrow ScareCrow is a payload creation framework for generating loaders for the use of side loading (not injection) into a legitimate Windows process (bypassing Application Whitelisting controls).
BypassAV Dent A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
BypassAV PEzor Open-Source PE Packer.
BypassAV FuckThatPacker A simple python packer to easily bypass Windows Defender
BypassAV goShellCodeByPassVT Go编译-race参数实现VT全免杀
BypassAV HouQing Advanced AV Evasion Tool For Red Team Ops
BypassAV DesertFox 使用Golang实现免杀加载CobaltStrike和Metasploit的shellcode,目前免杀火绒、Avast、腾讯安全管家、360全家桶等主机安全软件。
BypassAV DInjector This repository is an accumulation of code snippets for various shellcode injection techniques using fantastic D/Invoke API
BypassAV GoBypass Golang免杀马生成工具(该工具仅针对Windows系统)
BypassAV Bypass-script 使用 GoBypass 来进行免杀生成
BypassAV CobaltWhispers CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV.
BypassAV AceLdr Cobalt Strike UDRL for memory scanner evasion.
BypassAV SharpTerminator Terminate AV/EDR Processes using kernel driver
BypassUAC UAC-SilentClean This project implements a DLL planting technique to bypass UAC Always Notify and execute code in a high integrity process.
BypassUAC csload.net A cobaltStrike Shellcode loader, can bypass most of AV
Dev cs-rdll-example This is an example code pattern for using named pipes for IPC with ReflectiveDlls in Cobalt Strike.
Dev Titan Titan: A generic user defined reflective DLL for Cobalt Strike.
Dev GECC Go External C2 Client implementation for cobalt strike.
Dev CobaltStrike beacon in rust CobaltStrike beacon in rust.
Recon red-team-scripts perform some rudimentary Windows host enumeration with Beacon built-in commands
Recon Registry-Recon Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon.
Recon aggressor-powerview All functions listed in the PowerView about page are included in this with all arguments for each function. PowerView
Recon PowerView3-Aggressor PowerView Aggressor Script for CobaltStrike PowerView
Recon AggressorScripts Sharphound-Aggressor- A user menu for the SharpHound ingestor
Recon ServerScan 内网横向信息收集的高并发网络扫描、服务探测工具。
Recon TailorScan 端口扫描+探测网卡+ms17010探测
Recon AggressiveProxy LetMeOutSharp will try to enumerate all available proxy configurations and try to communicate with the Cobalt Strike server over HTTP(s) using the identified proxy configurations.
Recon Spray-AD A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.
Recon Ladon Ladon一款用于大型网络渗透的多线程插件化综合扫描神器,含端口扫描、服务识别、网络资产、密码爆破、高危漏洞检测以及一键GetShell,支持批量A段/B段/C段以及跨网段扫描,支持URL、主机、域名列表扫描。
Recon Ladon for Cobalt Strike Ladon for Cobalt Strike(巨龙拉冬套件)
Recon Recon-AD Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
Exploit XSS-Fishing2-CS 鱼儿在cs上线后自动收杆 / Automatically stop fishing in javascript after the fish is hooked
Exploit XSS-Phishing xss钓鱼,cna插件配合php后端收杆
Exploit custom_payload_generator CobaltStrike3.0+ --> creates various payloads for Cobalt Strike's Beacon. Current payload formats
Exploit CrossC2 CrossC2 framework - Generator CobaltStrike's cross-platform beacon
Exploit CrossC2 Kit CrossC2Kit provides some interfaces for users to call to manipulate the CrossC2 Beacon session, thereby extending the functionality of Cobalt Strike.
Exploit Cobaltstrike-MS17-010 ms17-010 exploit tool and scanner.
Exploit AES-PowerShellCode Standalone version of my AES Powershell payload for Cobalt Strike.
Exploit SweetPotato_CS CobaltStrike4.x --> SweetPotato
Exploit ElevateKit privilege escalation exploits
Exploit CVE-2018-4878 CVE-2018-4878
Exploit Aggressor-Scripts The only current public is UACBypass, whose readme can be found inside its associated folder.
Exploit CVE_2020_0796_CNA 基于ReflectiveDLLInjection实现的本地提权漏洞
Exploit DDEAutoCS setup our stage(d) Web Delivery attack
Exploit geacon Implement CobaltStrike's Beacon in Go (can be used in Linux)
Exploit geacon_pro geacon_pro is an Anti-Virus bypassing CobaltStrike Beacon written in Golang based on geacon project.
Exploit geacon_plus golang实现的CobaltStrike stageless http(s) beacon,在geacon项目基础上进行了较多扩展
Exploit SpoolSystem SpoolSystem is a CNA script for Cobalt Strike which uses the Print Spooler named pipe impersonation trick to gain SYSTEM privileges.
Exploit CVE-2021-1675_RDL_LPE PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR
Exploit KRBTGS KRBTGS is a post-exploitation option for Cobalt Strike to retrieve a working TGT for the current user that Beacon is running as, or impersonating. The attack does not require the user's password, and only assumes that the user you are running as is within a domain-joined environment. It attempts to guess the encryption type by choosing the strongest to least strong. The resulting .ccache can be converted into KIRBI format to be imported into other Beacons, or passed to other toolsets such as Impacket's example scripts to perform your post-exploitation endeavours.
Exploit PrintSpoofer-ReflectiveDLL PrintSpoofer的反射dll实现,结合Cobalt Strike使用
Persistence persistence-aggressor-script persistence-aggressor-script
Persistence Peinject_dll 弃用winexec函数,使用shellexecute函数,程序流不在卡顿,达到真正的无感。
Persistence TikiTorch TikiTorch follows the same concept(CACTUSTORCH) but has multiple types of process injection available, which can be specified by the user at compile time.
Persistence CACTUSTORCH A JavaScript and VBScript shellcode launcher. This will spawn a 32 bit version of the binary specified and inject shellcode into it.
Persistence UploadAndRunFrp 上传frpc并且运行frpc
Persistence persistence-aggressor-script Persistence Aggressor Script
Persistence AggressiveGadgetToJScript Automate the generation of payloads using the GadgetToJScript technique.
Persistence FrpProPlugin frp0.33修改版,过流量检测,免杀,支持加载远程配置文件可用于cs直接使用的插件
Persistence Automatic-permission-maintenance CobaltStrike 上线自动权限维持插件
Persistence cobalt-strike-persistence 使用者通过cobalt strike生成Web Delivery类型的payload,然后加载此脚本可以到达自启动效果
Persistence Cobalt_Strike_CNA 使用多种WinAPI进行权限维持的CobaltStrike脚本,包含API设置系统服务,设置计划任务,管理用户等。
Persistence CustomKeyboardLayoutPersistence Achieve execution using a custom keyboard layout, tested in Windows 11 Home version 21H2
Persistence SharpEventPersist Persistence by writing/reading shellcode from Event Log.
Auxiliary SharpZippo List/Read contents of Zip files (in memory and without extraction) using CobaltStrike's Execute-Assembly
Auxiliary SharpExcelibur Read Excel Spreadsheets (XLS/XLSX) using Cobalt Strike's Execute-Assembly
Auxiliary SharpSword Read the contents of DOCX files using Cobalt Strike's Execute-Assembly
Auxiliary SharpCat C# alternative to the linux "cat" command... Prints file contents to console. For use with Cobalt Strike's Execute-Assembly
Auxiliary TabRenamer CNA This will allow programmatic renaming of tabs as you see fit, with toggles of your history as you see fit.
Auxiliary Liquid Snake LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript
Auxiliary TaskShell TaskShell 计划任务相关自动化操作
Auxiliary generate-rotating-beacon 1. Generate a beacon for a given listener; 2. Host the file at a specified location;3. Monitor the weblog for fetching of the specified location;
Auxiliary ScareCrow-CobaltStrike A Cobalt Strike script for ScareCrow payload generation. Works with all Loaders.
Auxiliary AggressorScripts CreateTicket; Seatbelt; SharpHound
Auxiliary SharpeningCobaltStrike In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server.
Auxiliary CS_Mail_Tip Cobalt Strike主机上线邮件提醒插件
Auxiliary Cobalt_Strike_Bot CobaltStrike上线通知,飞书群聊机器人、server酱通知
Auxiliary Cobaltstrike-atexec 利用任务计划进行横向,需要与135端口、445端口进行通信
Auxiliary Sharp-HackBrowserData C#的HackBrowserData工具,方便在cs中直接内存加载
Auxiliary HackBrowserData HackBrowserData的反射模块
Auxiliary cobalt_sync Standalone Cobalt Strike Operation Logging Aggressor script for Ghostwriter 2.0+
Auxiliary samdump Cobalt Strike samdump
Auxiliary CallBackDump 能过卡巴、核晶、defender等杀软的dump lsass进程工具
Auxiliary SharpeningCobaltStrike In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server.
Auxiliary SharpCompile SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime.
Auxiliary Quickrundown Utilizing QRD will allow an operator to quickly characterize what processes are both known and unknown on a host through the use of colors and notes about the processes displayed.
Auxiliary NetUser This tool achieves "net user" in Window API. I made this to be used with Cobalt Strike's execute-assembly,所以可以内存加载添加用户
Auxiliary FileSearch C++枚举磁盘列表、遍历指定盘搜索特定类型文件包括反射DLL版本。
Auxiliary Phant0m_cobaltstrike This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.
Auxiliary NoPowerShell NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms.
Auxiliary EventLogMaster RDP EventLog Master
Auxiliary ANGRYPUPPY Bloodhound Attack Path Execution for Cobalt Strike
Auxiliary CobaltStrike_Script_Wechat_Push 上线微信提醒的插件,通过微信Server酱提醒
Auxiliary CS-Aggressor-Scripts slack and webhooks reminder
Auxiliary Aggressor-Scripts surveying of powershell on targets (在对应的目标上检测powershell的相关信息)
Auxiliary cs-magik Implements an events channel and job queue using Redis for Cobalt Strike.
Auxiliary GetClipboard Cobalt Strike Reflective DLL Get clipboard content. The code basically comes from ReflectiveDLLInjection
Auxiliary AggressorScripts 查看进程的时候讲av进程标注为红色
Auxiliary Beaconator Beaconator is an aggressor script for Cobalt Strike used to generate a raw stageless shellcode and packing the generated shellcode using PEzor.
Auxiliary Raven CobaltStrike External C2 for Websockets
Auxiliary CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration
Auxiliary fakelogonscreen FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password.
Auxiliary SyncDog Make bloodhound sync with cobaltstrike.
Auxiliary 360SafeBrowsergetpass 一键辅助抓取360安全浏览器密码的CobaltStrike脚本,通过下载浏览器数据库、记录密钥来离线解密浏览器密码。
Auxiliary SharpDecryptPwd 对密码已保存在 Windwos 系统上的部分程序进行解析,包括:Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品(Xshell,Xftp)。
Auxiliary List-GitHubAssembly Fetch a list of avaialble artifacts from the configured GitHub repo.
Auxiliary ExecuteAssembly ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs via superfasthash hashing algorithm.
Auxiliary aggrokatz aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely.
Auxiliary Zipper This CobaltStrike tool allows Red teams to compress files and folders from local and UNC paths. This could be useful in situations where large files or folders need to be exfiltrated. After compressing a file or folder a random named zipfile is created within the user temp folder.
Auxiliary CS-ServerChan 通过 CobaltStike 服务端 / 客户端 挂载脚本,将上线主机信息通过 Server 酱通知到微信
Auxiliary CS-PushPlus 使用免费且支持微信模板消息推送的 PushPlus 进行上线主机提醒
Auxiliary HelpColor Aggressor script that lists available Cobalt Strike beacon commands and colors them based on their type
Auxiliary CobaltStrike Helpmsg CNA This cna contains error messages for Win32 error codes, HRESULT defintions, and NTSTATUS definitions. This cna can be helpful for those operating out of linux/mac clients without access to the net.exe program, or as a quick way to looking hresult/ntstatus codes without having to do a google search.
Auxiliary YouMayPasser Stable PeSieve Bypass and Stable Moneta Bypass.
Auxiliary Sync Downloads This is meant as a fine-tuned control mechanism for syncing files from the Cobalt Strike Downloads entries in the data model
Auxiliary Headless Strike Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client.
Auxiliary Headless Strike 内网渗透\红队工具\C#内存加载\cobaltstrike
Auxiliary Cohab_Processes A small Aggressor script to help Red Teams identify foreign processes on a host machine
Auxiliary EnumStrike Cobalt Strike Aggressor script to automate host and domain enumeration.
Synthesis AM0N-Eye AM0N-Eye is a compilation of a group of the most important scripts that were written specifically for Cobaltsetrike and the rest of the files such as de for modification in colors and images.
Synthesis aggressor_snippets A collection of random small Aggressor snippets that don't warrant their own repo
Synthesis Erebus CobaltStrike4.x --> Erebus CobaltStrike后渗透测试插件
Synthesis CSplugins CobaltStrike后渗透测试插件集合
Synthesis Cobalt-Strike-Aggressor-Scripts CobaltStrike后渗透测试插件集合 Usage
Synthesis AggressorScripts Aggressor scripts for use with Cobalt Strike 3.0+
Synthesis RedTeamTools RedTeamTools for use with Cobalt Strike
Synthesis cobalt-arsenal Aggressor Scripts for Cobalt Strike 4.0+
Synthesis MoveKit The aggressor script handles payload creation by reading the template files for a specific execution type. intro
Synthesis StayKit The aggressor script handles payload creation by reading the template files for a specific execution type. intro
Synthesis AggressorScripts AggressorScripts
Synthesis AggressorScripts Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
Synthesis AggressorScripts AggressorScripts
Synthesis Aggressor-VYSEC Contains a bunch of CobaltStrike Aggressor Scripts
Synthesis AggressorAssessor AggressorAssessor
Synthesis AggressorAssessor AggressorAssessor
Synthesis aggressor-scripts Collection of Cobalt Strike Aggressor Scripts
Synthesis 梼杌 基于cobalt strike平台的红队自动化框架
Synthesis Aggressor-scripts This is just a random collection of Aggressor Scripts I've written for Cobalt Strike 3.x. (其中有一个debug脚本比较好用)
Synthesis Aggressor-Script Collection of Aggressor Scripts for Cobalt Strike(主要包含了提权和权限维持脚本)
Synthesis Aggressor-Script Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on
Synthesis aggressor_scripts_collection Collection of various aggressor scripts for Cobalt Strike from awesome people. Will be sure to update this repo with credit to each person.
Synthesis CobaltStrike-ToolKit googlesearch.profile and script related to AD.
Synthesis Arsenal Cobalt Strike 3.13 Arsenal Kit
Synthesis cobalt-arsenal My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+
Synthesis aggressor_scripts A collection of useful scripts for Cobalt Strike.(powershell.cna;bot.cna;dcom_lateral_movement.cna;ElevateKit)
Synthesis aggressor creating tunnels with netsh; changed default to bit.ly redirect to mcdonalds;using powershell to kill parent process;
Synthesis CobaltStrikeCNA A collection of scripts - from various sources - see script for more info.
Synthesis AggressorScripts Highlights selected processes from the ps command in beacon;Loads various aliases into beacon;sets a few defaults for scripts to be used later..
Synthesis AggressorAssessor 从C2生成到横向移动的全辅助脚本套件
Synthesis AggressorCollection Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors
Synthesis Cobaltstrike-Aggressor-Scripts-Collection The collection of tested cobaltstrike aggressor scripts.
Synthesis aggressorScripts CobaltStrike AggressorScripts for the lazy
Synthesis Aggressor_Scripts A compilation of Aggressor/Sleep scripts for operational purposes that I've made.
Synthesis cobalt_strike_extension_kit 集成了SharpHound,SharpRDP,SharpWMI等在内的各种内网工具,使用AggressorScripts构建workflow
Synthesis cobaltstrike 具备域管理员定位、域信息收集、权限维持、内网扫描、数据库hash dump、Everything内网搜索文件等功能的插件集合
Synthesis 365CobaltStrike 兼容CobaltStrike4.0的插件集合
Synthesis Cobalt-Strike 内容有横向移动、密码抓取、权限提升、权限维持等,尽可能将内网渗透中常用到的东西整理一下,方便使用
Synthesis CSPlugins 一个对Cobaltstrike第三方插件进行收集的项目,持续更新。
Synthesis CobaltStrike-xor third-party --> vnc_x86_dll and vnc_x64_dll
Synthesis Z1-AggressorScripts 适用于Cobalt Strike 3.x & 4.x 的内网渗透插件集合
Synthesis csplugin 导入PowerView脚本,和常见的功能使用
Synthesis CSplugins 涉及工作目录、信息收集、凭据获取、权限维持、权限提升、用户相关、RDP相关、防火墙相关、域渗透、powershell相关、内网穿透、内网探测、远程文件下载、痕迹清除的综合型插件系统
Synthesis LSTAR 本着简化 CS 右键和方便自己集成的目的,对 Reference 里的项目进行了缝合以及二次开 (抄) 发 (袭)并添加了虚拟机/AV 检测、主机相关密码抓取、 Cxk 限时免杀的 Mimikatz 和 Adduser 等功能
Synthesis SharpUtils A collection of C# utilities intended to be used with Cobalt Strike's execute-assembly.
Synthesis SharpToolsAggressor 内网渗透中常用的c#程序整合成cs脚本,直接内存加载。持续更新~
Synthesis C.Ex CobaltStrike Plugin to start and utilize Cobalt Strike (locally or remotely) from within Sifter
Synthesis OLa 一款CS后渗透模块插件,让大家使用一款插件就够了,本插件集大家之所长

0x05 Related Tools

Type Name Description Popularity Language
AntiCobaltStrike cobaltstrike_brute Cobalt Strike Team Server Password Brute Forcer
AntiCobaltStrike Dissecting Cobalt Strike using Python dissect.cobaltstrike is a Python library for dissecting and parsing Cobalt Strike related data such as beacon payloads and Malleable C2 Profiles.
AntiCobaltStrike CobaltSpam Cobalt Strike Team Server Password Brute Forcer
AntiCobaltStrike CobaltStrikeDos CVE-2021-36798 Exp: Cobalt Strike < 4.4 Dos
AntiCobaltStrike CS_mock 模拟cobalt strike beacon上线包
AntiCobaltStrike CS_fakesubmit 一个可以伪装上线Cobaltstrike的脚本
AntiCobaltStrike CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration.
AntiCobaltStrike grab_beacon_config Simple PoC script to scan and acquire CobaltStrike Beacon configurations.
AntiCobaltStrike C2-JARM 通过ssl实现所产生的JARM hash来识别不同的c2,例如CobaltStrike
AntiCobaltStrike JARM JARM fingerprints scanner
AntiCobaltStrike DetectCobaltStomp A quick(and perhaps dirty!) PoC tool to detect Module Stomping as implemented by Cobalt Strike with moderate to high confidence
AntiCobaltStrike cobaltstrike Code and yara rules to detect and analyze Cobalt Strike
AntiCobaltStrike CS_Decrypt 解密可以帮助你理解cs beacon通信原理,但注意密钥是在本地teamserver中
AntiCobaltStrike CS Scripts parse_beacon_keys.py 对 .cobaltstrike.beacon_keys 文件的解析工具
AntiCobaltStrike PyBeacon A collection of scripts for dealing with Cobalt Strike beacons in Python Resources
AntiCobaltStrike cobaltstrikescan Detecting CobaltStrike for Volatility
AntiCobaltStrike CobaltStrikeForensic Toolset for research malware and Cobalt Strike beacons
AntiCobaltStrike DuckMemoryScan A simple tool to find backdoors including but not limited to iis hijacking, fileless Trojan, bypass AV shellcode.
AntiCobaltStrike CobaltSplunk Splunk Application CobaltSplunk is a Splunk Application that knows how to 1) ingest Cobalt Strike related logs and parse them properly, 2) display useful operational dashboards, 3) display relevant reports.
AntiCobaltStrike BeaconHunter Behavior based monitoring and hunting tool built in C# tool leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.
AntiCobaltStrike CobaltStrikeDetected 40行代码检测到大部分CobaltStrike的shellcode
AntiCobaltStrike BeaconEye Hunts out CobaltStrike beacons and logs operator command output
AntiCobaltStrike Beacon_re cobalt strike beacon代码还原
AntiCobaltStrike Beacon.dll cobalt strike beacon实现
AntiCobaltStrike SharpBeacon cobalt strike beacon csharp实现
AntiCobaltStrike EvilEye EvilEye is a BeaconEye implement in Golang.
AntiCobaltStrike Hunt-Sleeping-Beacons The idea of this project is to identify beacons which are unpacked at runtime or running in the context of another process (=InMemory malware)..
AntiCobaltStrike CSRouge 恶意的CS服务器,只能urldns
AntiCobaltStrike Cobalt Strike Discovery Finds Cobalt Strike fingerprint on targets via traffic telemetry
Anti-AntiCobaltStrike bypass-beacon-config-scan Bypass cobaltstrike beacon config scan for 4.1
Anti-AntiCobaltStrike bypass-beacon-config-scan CSAgent 与 GoogleAuth 的缝合体,cobalt strike4.4版本的破解+otp动态口令的agent
BypassAV Cooolis-ms Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection的代码执行工具,它的定位在于能够在静态查杀上规避一些我们将要执行且含有特征的代码,帮助红队人员更方便快捷的从Web容器环境切换到C2环境进一步进行工作。
BypassAV UrbanBishopLocal A port of FuzzySecurity's UrbanBishop project for inline shellcode execution.
BypassAV ShellcodeLoader Windows通用免杀shellcode加载器
BypassAV ZheTian 免杀shellcode加载框架
BypassAV EXOCET AV-evading, undetectable, payload delivery tool
BypassAV SecondaryDevCobaltStrike CobaltStrike after second development, can bypass Kaspersky, Norton, McAfee, etc.
BypassAV Bypass_Go 参考CS的Bypass插件+分离免杀思想改造
BypassAV CrossNet-Beta In the red team operation, the phishing executable file is generated by using the white utilization, to bypass AV and automatically judging the network environment. can bypass 360 and huorong
BypassAV EVA FUD shellcode Injector
BypassAV BypassAV 用golang来打包生成后门,具备一定的免杀能力
BypassAV NimShellCodeLoader Nim编写Windows平台shellcode免杀加载器
BypassAV beacon_hook_bypass_memscan cs bypass卡巴斯基内存查杀: https://xz.aliyun.com/t/9399
BypassAV ZheTian ZheTian Powerful remote load and execute ShellCode tool
BypassAV bypassAV 破产版免杀,大致思路是将shellcode异或,之后在主程序中解码。 关键是清除一些符号信息
BypassAV JsLoader 免杀shellcode并绕过杀毒添加自启动
BypassAV ShellcodeLoader 将shellcode用rsa加密并动态编译exe,自带几种反沙箱技术。
BypassAV Alt-Beacon-Payload Beacon payload using AV bypass method from https://github.com/fullmetalcache/CsharpMMNiceness and shellcode generated from https://github.com/RCStep/CSSG.(可以给他补充一个cna一键配置脚本)
BypassAV SigFlip SigFlip是一款用于修补有签名的PE文件(exe、dll、sys等)的工具,它不会影响或破坏现有的签名,换句话说,你可以通过嵌入数据(即shellcode)来改变PE文件的校验和/哈希值,而不会破坏文件签名、完整性检查或PE文件功能。
BypassAV SigFlip SigFlip是一款用于修补有签名的PE文件(exe、dll、sys等)的工具,它不会影响或破坏现有的签名,换句话说,你可以通过嵌入数据(即shellcode)来改变PE文件的校验和/哈希值,而不会破坏文件签名、完整性检查或PE文件功能。这是他的golang实现
BypassAV Shellcode Fluctuation PoC 一个内存规避技术的PoC,循环地加密和解密shellcode的内容,然后使它在RW(或NoAccess)和RX内存保护之间波动。当我们的shellcode驻留在RW或NoAccess内存页时,像Moneta或pe-sieve这样的扫描器将无法追踪它并转储它以进行进一步分析。
BypassAV cool Golang-Gin 框架写的免杀平台,内置分离、捆绑等多种BypassAV方式。
BypassAV ThreadStackSpoofer Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and
BypassAV SleepyCrypt A shellcode function to encrypt a running process image in memory when sleeping.
BypassAV GobypassAV 免杀shellcode加载器,使用go实现,免杀bypass火绒、360、核晶、def等主流杀软.
BypassAV AtomLdr A DLL loader with evasive features.
Analysis Beacon Open Source Cobalt Strike Beacon. Unreleased, in research stages
Analysis Linco2 模拟Cobalt Strike的Beacon与C2通信过程,实现了基于HTTP协议的Linux C2,客户端可以通过curl就能下发Beacon任务。
Analysis beacon-object-files This repository contains miscellaneous examples of Cobalt Strike Beacon object file extensions.
Auxiliary C2ReverseProxy When you encounter a non-networked environment during penetration, you can use this tool to establish a reverse proxy channel so that the beacons generated by CobaltStrike can bounce back to the CobaltStrike server.
Auxiliary Cobalt strike custom 404 page You can find the CS service through 404 pages.
Auxiliary StageStrike A custom Cobalt Strike stager written in C.. is how the project started.
Auxiliary CS_SSLGen sslgen will install a letsencrypt certificate and create a Cobalt Strike keystore from it.
Auxiliary CobaltPatch Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be Appended In Stage / Post-Ex Blocks. Made for C Programmers
Auxiliary pycobalt Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be Appended In Stage / Post-Ex Blocks. Made for C Programmers.
Auxiliary redshell An interactive command prompt that executes commands through proxychains and automatically logs them on a Cobalt Strike team server.
Auxiliary CobaltStrikeToGhostWriter Log converter from CS logs to a CSV in Ghostwriter's operation log format.
Auxiliary Ansible-Cobalt-Strike An Ansible role to install cobalt-strike on debian based architectures, let's be honest it's for kali.
Auxiliary cobaltstrike_runtimeconfig A POC showing how to modify Cobalt Strike beacon at runtime
Auxiliary pystinger Pystinger implements SOCK4 proxy and port mapping through webshell. It can be directly used by cobalt strike for session online.
Auxiliary ansible-role-cobalt-strike An Ansible role for installing Cobalt Strike.
Auxiliary CrossNet In the red team operation, the phishing executable file is generated by using the white utilization, avoiding killing and automatically judging the network environment.
Auxiliary CrossC2-C2Profile CrossC2通信协议API实现,可兼容使用C2Profile
Auxiliary BypassAddUser Bypass AV to add users
Auxiliary Docker-CobaltStrike The tool covers almost all the technical links needed in the apt attack chain. Use cloud functions to avoid traceability Using docker container is fast and convenient Use the python script I wrote to avoid privacy disclosure and malicious attacks
Auxiliary TeamServer.prop TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the “HotCobalt” vulnerability. This repository contains an example file that contains the default settings.
Auxiliary Cobalt_Strike_Ansible Cobalt Strike Ansible Deployment Guide (自动化部署与管理)
Auxiliary Ansible Role: Cobalt Strike Ansible Role: Cobalt Strike (自动化部署与管理)
Auxiliary csOnvps cobaltstrike4.4 自动化执行teamserver,快速临时开启Teamserver脚本。
Auxiliary Cobalt Strike Sleep Python Bridge This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the standard GUI client.
Auxiliary c2_reporter Ingests logs/dbs from cobalt and empire and outputs an excel report with activity, sessions, and credentials
Auxiliary Cobalt Strike Beacon Dataset Open Dataset of Cobalt Strike Beacon metadata (2018-2022)
Auxiliary Dumpert Dumpert, an LSASS memory dumper using direct system calls and API unhooking
Auxiliary DuplicateDump Dumping LSASS with a duplicated handle from custom LSA plugin
Auxiliary BOFHound Generate BloodHound compatible JSON from logs written by ldapsearch BOF and pyldapsearch
Auxiliary PersistAssist PersistAssist is a fully modular persistence framework written in C#. All persistence techniques contain a cleanup method which will server to remove the persistence aside from the persistence code.
Auxiliary ElusiveMice Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind
Phishing GoFileBinder A builder 🔨 for binding evil program 😈 and normal document 🐣
Synthesis geacon Using Go to implement CobaltStrike's Beacon
Synthesis geacon geacon:简单适配了一个profile配置文件,可直接拿来修改使用,用于cs上线linux.
Synthesis redi Automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt)
Synthesis cs2modrewrite Automatically Generate Rulesets for Apache mod_rewrite or Nginx for Intelligent HTTP C2 Redirection
Synthesis cs2webconfig Automatically Generate Rulesets for IIS for Intelligent HTTP/S C2 Redirection
Synthesis RedGuard RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
Synthesis WebGuard WebGuard是根据风起师傅的RedGuard和mgeeky师傅的RedWarden结合出来的http请求过滤器go包,亦在帮助采用go编写C2 http监听器做流量过滤和规则匹配
Synthesis RedWarden Flexible CobaltStrike Malleable Redirector
Synthesis RedCaddy C2 redirector base on caddy
Synthesis Oratu 一个用于隐藏C2的、开箱即用的反向代理服务器。旨在省去繁琐的配置Nginx服务的过程。
Synthesis Oss-stinger 利用oss实现http转发/cobalt strike上线
Synthesis Apache Mod_Rewrite Terrafrom Automation Bash scripts that take variables from the user and then call terraform scripts to automate standing up apache2 with mod_rewrite in front of C2 servers. Right now, this repo supports standing up redirectors in Linode or Digital Ocean, and I have different scripts for standing up http redirectors versus https redirectors. Since the mod_rewrite redirector setup scripts use a user agent value and optionally a bearer token, these redirectors are not C2 dependent and can work for any C2 that uses http or https.
Synthesis Red-EC2 Deploy RedTeam Specific EC2 via ansible.
Synthesis Rapid Attack Infrastructure Red Team Infrastructure... Quick... Fast... Simplified.
Synthesis RedCommander Creates two Cobalt Strike C2 servers (DNS and HTTPS), with redirectors, and RedELK in Amazon AWS. Minimal setup required! Companion Blog here
Synthesis CobaltPatch Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be Appended In Stage / Post-Ex Blocks. Made for C Programmers
Synthesis CPLResourceRunner Run shellcode(Cobalt Strike) from resource
Synthesis csdroid cobaltstrike手机客户端 / cobaltstrike android
Dev vscode-language-aggressor This is a Visual Studio Code (VSC) extension that aims to provide: An implement of the Sleep and Cobalt Strike (CS) Aggressor grammar; and The definition of Cobalt Strike functions' prototype
Dev PayloadAutomation Payload Automation is a collection of Python classes for automating payload development, testing, opsec checking, and deployment with Cobalt Strike.
Dev CrackSleeve cs4.0 cs 4.1 beacon加解密
Dev beacon Former attempt at creating a independent Cobalt Strike Beacon
Dev ExternalC2.NET .NET Standard 2.0 libraries which implement Cobalt Strike's External C2 specfication (revision 0.1).
Dev GPUSleep GPUSleep moves the beacon image to GPU memory before the beacon sleeps, and move it back to main memory after sleeping.
Dev CallStackMasker A PoC implementation for dynamically masking call stacks with timers.
Crack CSAgent CobaltStrike 4.x通用白嫖及汉化加载器,采用javaagent+javassist的方式动态修改jar包,可直接加载原版cobaltstrike.jar,理论上支持到目前为止的所有4.x版本

0x06 Related Resources

Type Name Description Popularity
DATA SilasCutler JARM Scan CobaltStrike Beacon Config.json SilasCutler JARM Scan CobaltStrike Beacon Config
DATA Cobalt Strike hashes This page shows some basic information the Yara rule CobaltStrike including corresponding malware samples.
DATA List of Cobalt Strike servers List of Cobalt Strike servers
DATA CobaltStrike samples pass=infected CobaltStrike samples
DATA List of spawns from exposed Cobalt Strike C2 List of spawns from exposed Cobalt Strike C2
DATA C2IntelFeeds Automatically created C2 Feeds based of Censys
YARA apt_cobaltstrike Cobalt Strike Yara
YARA apt_cobaltstrike_evasive Cobalt Strike Yara
YARA rules Cobalt Strike Yara
Rules suricata-rules Suricata IDS rules used to detect the red team penetration/malicious behavior, support testing CobaltStrike/MSF/Empire/DNS tunnels/Weevely scorpion/mining/rebound/kitchen/ice shell/ICMP tunnel, etc