EventViewerUAC_BOF

EventViewerUACBOF This is a Beacon Object File implementation of the Event Viewer deserialization UAC bypass discovered by @orange8361 and the POC put together by CsEnox. Tested on x64 Win10/Win11 OPSEC WARNINGS! This UAC bypass performs the following actions which should be considered in referen...

CVE-2022-39197-POC

CVE-2022-39197-POC 中文版本READMECN.md Vulnerability Intro According to the Update Log of the latest version 4.7.1 officially released by CobaltStrike on 20 September, teamserver version We were contacted by an independent researcher named "Beichendream" to inform us of an XSS vulnerability they foun...

BeaconEye

BeaconEye Introduction BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon, BeaconEye will monitor each process for C2 activity. How it works BeaconEye will scan live processes or MiniDump files for suspected CobaltStrike beacons. In li...

DropSpawn_BOF

DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

esp32_esp8266_attacks

ESP32/ESP8266 Wi-Fi Attacks This repository is part of a research outcome from theASSET Research Group. This repository demonstrates 3 Wi-Fi attacks against the popular ESP32/8266 IoT devices: Zero PMK Installation CVE-2019-12587 - Hijacking ESP32/ESP8266 clients connected to enterprise networks;...

Koh

Koh Koh is a C and Beacon Object File BOF toolset that allows for the capture of user credential material via purposeful token/logon session leakage. Some code was inspired by Elad Shamir's Internal-Monologue project no license, as well as KB180548. For why this is possible and Koh's approeach, s...

WindowSpy

WindowSpy 👀 WindowSpy is a Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth durin...

AzureC2Relay

AzureC2Relay AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will b...

GhostTunnel

GhostTunnel GhostTunnel is a covert backdoor transmission method that can be used in an isolated environment. It can attack the target through the HID device only to release the payload agent, then the HID device can be removed after the payload is released. GhostTunnel use 802.11 Probe Request...

CVE-2024-26229-BOF

CVE-2024-26229 Beacon Object Files Beacon Object File BOF implementations from NVISO of CVE-2024-26229 for Cobalt Strike and BruteRatel. Compile with: root@kitploit: gcc -c CVE-2024-26229-bof.c -o CVE-2024-26229-bof.o This vulnerability was patched on April 9th, 2024. See...

kube-beacon

Kube-Beacon Project Scan your kubernetes runtime !! Kube-Beacon is an open source audit scanner who perform audit check on a deployed kubernetes cluster and output a security report. The audit tests are the full implementation of CIS Kubernetes Benchmark specification...

hoaxshell

hoaxshell ⚡ इस परियोजना का नवीनतम संस्करण HoaxShell standalone listener है, जो नए पेलोड टेम्पलेट के साथ आता है। आप इसे सीधे https://revshells.com से भी उपयोग कर सकते हैं सुनिश्चित करें कि लिसनर के रूप में hoaxshell चुनें। ⚠️ 2022-10-18 से, hoaxshell AMSI द्वारा पहचाना जाता है malware-encyclopedia।...

redi

redi HTTP RATs CobaltStrike Beacon, meterpreter, आदि और CobaltStrike DNS Beacon के साथ संगत स्वचालित रीडायरेक्टर सेटअप। यह स्क्रिप्ट या तो nginx रिवर्स प्रॉक्सी, या dnsmasq का उपयोग करके DNS प्रॉक्सी/फ़ॉरवर्डर सेट कर सकती है। यदि HTTPS चुना गया है, तो यह स्वचालित रूप से letsencrypt certbot सेट...

cs_yara

csyara Check Cobalt Strike Yara Rules 参考链接 https://github.com/CCob/BeaconEye BeaconEye Bug Fix: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1 rule from https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs beaconEye.yar root@kitploit: rule...

pybeacon

PyBeacon PyBeacon Cobalt Strike के एन्क्रिप्टेड ट्रैफ़िक से निपटने के लिए स्क्रिप्ट का एक संग्रह है। यह बीकन मेटाडेटा को एन्क्रिप्ट/डिक्रिप्ट कर सकता है, साथ ही सममित रूप से एन्क्रिप्टेड कार्यों को पार्स कर सकता है। शामिल स्क्रिप्ट एक छोटी लाइब्रेरी है जिसमें एन्क्रिप्शन/डिकोडिंग विधियाँ शामिल है...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process root@kitploit: hProc =...

CS-MemoryEvasion

MemoryEvasion A Cobalt Strike memory evasion loader for redteamers,Support x86/x64 stager/stagerless payload with profiletested on windows7/10,winserver 2012 How Evasion? Hook Sleep,CreateProcessA,CreateHeap,GetProcessHeap functions before the shellcode is loaded into memory. Create a new heap fo...

geacon

Geacon استخدام Go لتنفيذ Beacon من CobaltStrike هذا المشروع مخصص لتعلم تحليل البروتوكولات والهندسة العكسية فقط، إذا تم انتهاك حقوق شخص ما، يرجى الاتصال بي لإزالة المشروع، وأخيراً لا تستخدمه بشكل غير قانوني كيفية التشغيل 1. قم بإعداد teamserver وابدأ مستمع http، سيولد teamserver الملف...

Modules

الوحدات الوحدات المستخدمة في إطار عمل Havoc. Powerpick تطبيق Powerpick لإطار عمل Havoc. InvokeAssembly تطبيق InvokeAssembly لإطار عمل Havoc. Template هذا هو القالب الأساسي للوحدات. يمكنك استخدامه لكتابة وحداتك الخاصة لإطار عمل Havoc. SituationalAwareness مجموعة من ملفات كائنات المنارة Beacon Obje...