PrivKit

PrivKit A collection of Beacon Object Files BOFs for Windows Local Privilege Escalation Checks. Description PrivKit is an open-source tool that empowers red teamers and penetration testers to quickly identify common Windows local privilege escalation vectors using Cobalt Strike Beacon Object File...

Crystal-Kit

Crystal Kit This repo is a technical and social experiment to explore whether replacing Cobalt Strike's evasion primitives Sleepmask/BeaconGate with a Crystal Palace PICO is feasible or even desirable for advanced evasion scenarios. Usage 1. Disable the sleepmask and stage obfuscations in Malleab...

Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

COM-Hunter

COM-Hunter COM Hijacking VOODOO Description COM-Hunter is a COM Hijacking persistence tool. Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike. The following list explains the available modes: Search Mode : Searches for CLSIDs based on LocalServer32,...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

MalleableC2Profiles

MalleableC2Profiles Malleable C2 profiles for Cobalt Strike version 3.6+ bingsearchgetonly.profile - Bing web search profile, uses GET requests only cnnvideogetonly.profile - MSNBC live video straming profile, uses GET requests only googledrivegetonly.profile - Google Drive document viewer...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

ADSyncDump-BOF

ADSyncDump BOF The ADSyncDump BOF is a port of Dirkjan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File BOF for use with Cobalt Strike, Sliver and Havoc. !NOTE The tool has been tested on a Windows Server 2019 with Azure AD Connect version 2.2.1.0. The 32 bit version of the BO...

REW-sploit

REW-sploit Need help in analyzing Windows shellcode or attack coming from Metasploit Framework or Cobalt Strike or may be also other malicious or obfuscated code? Do you need to automate tasks with simple scripting? Do you want help to decrypt MSF generated traffic by extracting keys from payload...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

aggrokatz

aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...

C2concealer

C2concealer C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike. Installation git clone https://github.com/RedSiege/C2concealer.git cd C2concealer python3 -m venv .venv source .venv/bin/activate pip3 install -e . Docker installation Refer to...

cs2modrewrite

Automatically Generate Rulesets for Apache modrewrite or Nginx for Intelligent HTTP C2 Redirection This project converts a Cobalt Strike profile to a functional modrewrite .htaccess or Nginx config file to support HTTP reverse proxy redirection to a Cobalt Strike teamserver. The use of reverse...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

Ps-Tools

Ps-Tools, an advanced process monitoring toolkit for offensive operations. Having a good technical understanding of the systems we land on during an engagement is a key condition for deciding what is going to be the next step within an operation. Collecting and analysing data of running processes...

SourcePoint

SourcePoint SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written in Go. SourcePoint allows unique C2 profiles to be generated on the fly that helps reduce our Indicators of Compromise "IoCs" and allows the operator to spin up complex profiles with minimal effort. This...

pyCobaltHound

Quick summary pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. pyCobaltHound strives to assists red team operators by: Automatically querying the BloodHound database to discover escalation paths opened ...

ScheduleRunner

ScheduleRunner - A C tool with more flexibility to customize scheduled task for both persistence and lateral movement in red team operation Scheduled task is one of the most popular attack technique in the past decade and now it is still commonly used by hackers/red teamers for persistence and...

Beaconator

Beaconator Beaconator is an aggressor script for Cobalt Strike used to generate either staged or stageless shellcode and packing the generated shellcode using your tool of choice. Currently, it supports the following tools: Staged Beacon Generator Alaris Stageless Beacon Generator PEzor ScareCrow...

proxychains-ng

ProxyChains-NG ver 4.17 README ProxyChains is a UNIX program, that hooks network-related libc functions in DYNAMICALLY LINKED programs via a preloaded DLL dlsym, LDPRELOAD and redirects the connections through SOCKS4a/5 or HTTP proxies. It supports TCP only no UDP/ICMP etc. The way it works is...