ADSyncDump-BOF

ADSyncDump BOF The ADSyncDump BOF is a port of Dirkjan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File BOF for use with Cobalt Strike, Sliver and Havoc. !NOTE The tool has been tested on a Windows Server 2019 with Azure AD Connect version 2.2.1.0. The 32 bit version of the BO...

Modules

Modules Modules used by the Havoc Framework. Powerpick Powerpick implementation for the Havoc Framework. InvokeAssembly InvokeAssembly implementation for the Havoc Framework. Template This is the base template for the modules. You can use this to write your own modules for the Havoc Framework...

cobaltstrike-headless

Headless Strike Aggressorscript that turns the headless aggressor client into a mostly functional cobalt strike client. Usage connect to your teamserver via the builtin headless aggressor utility ./agscript root@kitploit: ./agscript host port user password load the .cna file root@kitploit:...

RDPHijack-BOF

BOF - RDPHijack Cobalt Strike Beacon Object File BOF that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access token / kerberos ticket e.g., golden ticket of the session owner, you will be able to hijack the session remotely without dropping any beacon/too...

AzureC2Relay

AzureC2Relay AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will b...

CobaltStrikeDos

Una vulnerabilidad de denegación de servicio DoS CVE-2021-36798 fue encontrada en Cobalt Strike. La vulnerabilidad se corrigió en la versión 4.4. Se puede encontrar más información aquí Uso root@kitploit: python3 CobaltStrikeDos.py https://1.1.1.1 root@kitploit: $ python3 CobaltStrikeDos.py...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

Cobaltstrike-RCE-CVE-2022-39197

Reproducción de la vulnerabilidad RCE CVE-2022-39197 en Cobaltstrike Resumen de la vulnerabilidad Esta vulnerabilidad existe en el software Beacon de Cobalt Strike y puede permitir a un atacante establecer un nombre de usuario mal formado en la configuración de Beacon, desencadenando XSS y...

CobaltStrike-BOF

CobaltStrike BOF Collection of beacon BOF. 1 DCOM Lateral Movement A quick PoC that uses DCOM ShellWindows via beacon object files for lateral movement.You can either specify credentials or use the current user. To use the current user, just leave the domain, username, and password empty. A short...

geacon

Geacon Usando Go para implementar Beacon de CobaltStrike Este proyecto es solo para aprendizaje de análisis de protocolos e ingeniería inversa. Si se han violado los derechos de alguien, por favor contácteme para eliminar el proyecto, y por último, NO LO USE ILEGALMENTE Cómo jugar 1. Configura el...

geacon

Geacon Using Go to implement CobaltStrike's Beacon This project is for learning protocol analysis and reverse engineering only, if someone's rights have been violated, please contact me to remove the project, and the last DO NOT USE IT ILLEGALLY How to play 1. Setup the teamserver and start a htt...

injectAmsiBypass

Cobalt Strike BOF - Inyectar omisión de AMSI Archivo de Objeto Beacon BOF de Cobalt Strike que omite AMSI en un proceso remoto mediante inyección de código. Ejecutando el BOF inject-amsiBypass desde CobaltStrike ¿Qué hace esto? 1. Usa el argumento PID proporcionado para obtener un identificador...

CSSG

CSSG Cobalt Strike Shellcode Generator Ryan Stephenson RCStep Adds Shellcode - Shellcode Generator to the Cobalt Strike top menu bar CSSG is aggressor, .NET, and python scripts used to more easily generate and format beacon shellcode Generates beacon stageless shellcode with exposed exit method,...

ProcessStomping

ProcessStomping A variation of ProcessOverwriting to execute shellcode on an executable's section What is it For a more detailed explanation you can read my blog post Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on a...

CVE-2022-39197-POC

CVE-2022-39197-POC 中文版本READMECN.md Introducción a la vulnerabilidad Según el Registro de actualizaciones de la última versión 4.7.1 lanzada oficialmente por CobaltStrike el 20 de septiembre, la versión del servidor del equipo Fuimos contactados por un investigador independiente llamado...

CVE-2024-26229-BOF

CVE-2024-26229 Beacon Object Files Beacon Object File BOF implementations from NVISO of CVE-2024-26229 for Cobalt Strike and BruteRatel. Compile with: root@kitploit: gcc -c CVE-2024-26229-bof.c -o CVE-2024-26229-bof.o This vulnerability was patched on April 9th, 2024. See...

kube-beacon

Proyecto Kube-Beacon ¡Escanea tu runtime de Kubernetes!! Kube-Beacon es un escáner de auditoría de código abierto que realiza comprobaciones de auditoría en un clúster de Kubernetes desplegado y genera un informe de seguridad...

WindowSpy

WindowSpy 👀 WindowSpy is a Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth durin...

BOF_Collection

BOFCollection Various Cobalt Strike BOFs Requirements beacon.h For compilation instructions and BOF overview help-bof ActiveDirectory GetDomainInfo.c Returns information on the current domain and domain controller. inline-execute GetDomainInfo.o Collection GetClipboard.c Prints any text on the...