CVE-2021-1675_RDL_LPE

CVE-2021-1675RDLLPE CS reflective loading plugin for PrintNightMare LPE privilege escalation vulnerability. Out-of-the-box, memory loading, obfuscated driver name loading to bypass Defender/EDR. Disclaimer: This project is only for learning and communication, please use it cautiously within a...

CobaltBus

CobaltBus Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match t...

ColdWer

A cold war on your endpoint. 🥶 ColdWer ColdWer leverages WerFaultSecure.exe PPL bypass to freeze EDR/AV processes and dump LSASS memory on modern Windows systems. C O L D W E R └─┴─┴── WerFaultSecure └─┴──────── LSASS Dump └─┴──────────── Cold Freeze Freeze your EDR/AV. Extract what you need. Sta...

CVE-2019-2729

CVE-2019-2729 Exploit code for CVE-2019-2729 Oracle Weblogic running on Windows. Can create a callback to a CobaltStrike listener or a Metasploit handler with payload windows/meterpreter/reversetcp Also have a non-beacon exploit that just executes commands on the underlying host. exploit.py. This...

CSPlugins

CSPlugins Collect useful Cobaltstrike third-party plugins, continuously updated...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

cs2modrewrite

Automatically Generate Rulesets for Apache modrewrite or Nginx for Intelligent HTTP C2 Redirection This project converts a Cobalt Strike profile to a functional modrewrite .htaccess or Nginx config file to support HTTP reverse proxy redirection to a Cobalt Strike teamserver. The use of reverse...

ADSearch

ADSearch A tool written for cobalt-strike's execute-assembly command that allows for more efficent querying of AD. Key Features List all Domain Admins Custom LDAP Search Connect to LDAPS Servers Output JSON data from AD instances Retrieve custom attributes from a generic query i.e. All computers...

unhook-bof

This is a Beacon Object File to refresh DLLs and remove their hooks. The code is from Cylance's Universal Unhooking research: https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software To use: Load unhook.cna into Cobalt Strike via Cobalt Strike - Script Manager Run...

PPEnum

PPEnum Simple BOF to read the protection level of a process...

sysmon-config

sysmon-config | A Sysmon configuration file This is a forked and modified version of @SwiftOnSecurity's sysmon config. It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the...

CVE-2002-0347

CVE-2002-0347 Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. dot dot in an HTTP request. Packetstorm publication at https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html...

pyMalleableC2

pyMalleableC2 A Python interpreter for Cobalt Strike Malleable C2 profiles that allows you to parse, modify, build them programmatically and validate syntax. Supports all of the Cobalt Strike Malleable C2 Profile grammar starting from Cobalt Strike version 4.3. It's not backwards compatible with...

BOF_RunPe

BOFRunPE BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe is used - all output is captured via IAT hooking and redirected to the...

Ladon

Ladon Large-scale Intranet Penetration Scanner Cobalt Strike Plugin Memory Loading Program Introduction Ladon is a large-scale intranet penetration scanner, domain penetration, and lateral movement tool, featuring PowerShell modules, Cobalt Strike plugins, memory loading, and fileless scanning. I...

C2concealer

C2concealer C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike. Installation git clone https://github.com/RedSiege/C2concealer.git cd C2concealer python3 -m venv .venv source .venv/bin/activate pip3 install -e . Docker installation Refer to...

PrintSpoofer-ReflectiveDLL

PrintSpoofer Details PrintSpoofer is a tool that performs local privilege escalation by exploiting a vulnerability in the Windows Print Spooler service CVE-2019-1040 / CVE-2019-1019. This project implements the PrintSpoofer exploit in Reflective DLL format, making it suitable for use with...

ScreenshotBOF

ScreenshotBOF An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory. Features JPEG compression In memory download as screenshot or as file Supports capturing of minimized windows Grayscale, JPEG quality and...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process hProc =...