ScreenshotBOF

ScreenshotBOF An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory. Features JPEG compression In memory download as screenshot or as file Supports capturing of minimized windows Grayscale, JPEG quality and...

COM-Hunter

COM-Hunter COM Hijacking VOODOO Description COM-Hunter is a COM Hijacking persistence tool. Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike. The following list explains the available modes: Search Mode : Searches for CLSIDs based on LocalServer32,...

Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

SourcePoint

SourcePoint SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written in Go. SourcePoint allows unique C2 profiles to be generated on the fly that helps reduce our Indicators of Compromise "IoCs" and allows the operator to spin up complex profiles with minimal effort. This...

hideNsneak

Welcome to hideNsneak. This application assists in managing attack infrastructure for penetration testers by providing an interface to rapidly deploy, manage, and take down various cloud services. These include VMs, domain fronting, Cobalt Strike servers, API gateways, and firewalls. Black Hat...

taowu-cobalt_strike

Taowu A red team automation framework based on the Cobalt Strike platform. For communication and learning only, do not use for illegal purposes! The exploits used in the plugin are collected from the internet. Security issues are not guaranteed. Please conduct your own security review!...

eden

Eden Eden loader is a PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate currently a PIC version of the Sleepmask-VS Draugr callgate BOF. The goal of Eden loader is to: Demonstrate the power of using Crystal Palace ...

CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

OpenMalleableC2

OpenMalleableC2 Open Source Implementation of Cobalt Strike's Malleable C2 OpenMalleableC2 is a framework-agnostic library that implements Cobalt Strike's Malleable C2 profile format for HTTP transformations. It enables security researchers and red teams to easily implement malleable C2...

ColdWer

A cold war on your endpoint. 🥶 ColdWer ColdWer leverages WerFaultSecure.exe PPL bypass to freeze EDR/AV processes and dump LSASS memory on modern Windows systems. C O L D W E R └─┴─┴── WerFaultSecure └─┴──────── LSASS Dump └─┴──────────── Cold Freeze Freeze your EDR/AV. Extract what you need. Sta...

Cobaltstrike_BOFLoader

CobaltstrikeBOFLoader This is an open source port/reimplementation of the Cobalt Strike BOF Loader as is. For the most part, everything is done as in the original Beacon + Teamserver in Cobalt Strike. This includes shortcomings that are resolved in other open source COFF loaders such as the...

CaddySmith

CaddySmith CaddySmith is a small Python script that reads a Cobalt Strike or Sliver C2 profile and forges a Caddy web server config out of it. The generated Caddyfile turns a regular Linux box into a redirector: legitimate beacon traffic gets reverse-proxied to your team server, and anything else...

BOF_RunPe

BOFRunPE BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe is used - all output is captured via IAT hooking and redirected to the...

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives straight from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and reads the bytes directly from disk. Targets: C:\Windows\System32\config\SAM...

REW-sploit

REW-sploit Need help in analyzing Windows shellcode or attack coming from Metasploit Framework or Cobalt Strike or may be also other malicious or obfuscated code? Do you need to automate tasks with simple scripting? Do you want help to decrypt MSF generated traffic by extracting keys from payload...

BOF_ExecuteAssembly

BOF Execute-Assembly Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques. Overview Core Architecture ┌──────────────────────────────────────────────────────────────────────────────┐ │ Cobalt Strike Beacon │ │ Parent Process │...

pyMalleableC2

pyMalleableC2 A Python interpreter for Cobalt Strike Malleable C2 profiles that allows you to parse, modify, build them programmatically and validate syntax. Supports all of the Cobalt Strike Malleable C2 Profile grammar starting from Cobalt Strike version 4.3. It's not backwards compatible with...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

Cohab_Processes

CohabProcesses This Aggressor script is intended to help internal Red Teams identify suspicious or foreign processes "Cohabitation" running in their environments. Red Teams may assemble a list of "known" processes either independently or in collaboration with Blue force and feed it to the aggress...

BypassUAC

README This program is based on whitelist bypassuac. Using CS's AV-bypassing payload, you can directly get a session with UAC privileges. Usage: bypassuac.exe The demo effect is as follows whoami /priv as follows hashdump captures passwords as follows Bypass-AV Effect Windows Defender test passed...