CaddySmith

CaddySmith CaddySmith is a small Python script that reads a Cobalt Strike or Sliver C2 profile and forges a Caddy web server config out of it. The generated Caddyfile turns a regular Linux box into a redirector: legitimate beacon traffic gets reverse-proxied to your team server, and anything else...

OpenMalleableC2

OpenMalleableC2 Open Source Implementation of Cobalt Strike's Malleable C2 OpenMalleableC2 is a framework-agnostic library that implements Cobalt Strike's Malleable C2 profile format for HTTP transformations. It enables security researchers and red teams to easily implement malleable C2...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

trustme

trustme BOF to impersonate TrustedInstaller via DISM API trigger and thread impersonation. What this does Elevates a Cobalt Strike Beacon from an admin context to NT AUTHORITY\SYSTEM with the NT SERVICE\TrustedInstaller SID in the token groups. This gives you the ability to modify files, registry...

CobaltBus

CobaltBus Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match t...

CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

Astral_Projection

Astral Projection - UDRL Astral Projection is a Cobalt Strike UDRL User-Defined Reflective Loader, that performs advanced module stomping. The UDRL loads a module using LoadLibraryExW, then manipulates its internals by setting VEH to intercept strategic calls that allow it to steal the section...

eden

Eden Eden loader is a PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate currently a PIC version of the Sleepmask-VS Draugr callgate BOF. The goal of Eden loader is to: Demonstrate the power of using Crystal Palace ...

CSSG

CSSG Cobalt Strike Shellcode Generator Ryan Stephenson RCStep Adds Shellcode - Shellcode Generator to the Cobalt Strike top menu bar CSSG is aggressor, .NET, and python scripts used to more easily generate and format beacon shellcode Generates beacon stageless shellcode with exposed exit method,...

charlotte

charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...

spawn

SPAWN - Cobalt Strike BOF Cobalt Strike BOF जो एक बलि प्रक्रिया sacrificial process को जन्म देता है, उसमें शेलकोड इंजेक्ट करता है, और पेलोड निष्पादित करता है। EDR/UserLand हुक्स से बचने के लिए Arbitrary Code Guard ACG, BlockDll, और PPID स्पूफिंग के साथ बलि प्रक्रिया को जन्म देकर बनाया गया है। ACG...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process root@kitploit: hProc =...

Malleable-C2-Randomizer

Malleable-C2-Randomizer يقوم هذا السكربت بإضفاء العشوائية على ملفات Malleable C2 الخاصة بـ Cobalt Strike من خلال استخدام لغة وسيطة، على أمل تقليل فرص رصد ضوابط الكشف القائمة على التوقيعات. باختصار، يوزّع السكربت القالب المقدَّم، ويستبدل المتغيرات بقيمة عشوائية من قائمة كلمات مقدَّمة أو مدمجة،...

CSPOC

Cobalt Strike XSS stocké RCE CVE-2022-39197 Paramètres d'exécution : -u: Adresse d'écoute http de Cobaltstrike, ex: http://127.0.0.1:8500 -p: Payload, ex: ne doit pas être trop long Démo : Commande de build : go build -ldflags "-s -w" Groupe QQ : Cliquez pour rejoindre : 528118163 Rejoindre le...

BOF_RunPe

BOFRunPE BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe is used - all output is captured via IAT hooking and redirected to the...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

Cohab_Processes

CohabProcesses This Aggressor script is intended to help internal Red Teams identify suspicious or foreign processes "Cohabitation" running in their environments. Red Teams may assemble a list of "known" processes either independently or in collaboration with Blue force and feed it to the aggress...

GraphStrike

GraphStrike Release blog: GraphStrike: Using Microsoft Graph API to Make Beacon Traffic Disappear Developer blog: GraphStrike: Anatomy of Offensive Tool Development Introduction GraphStrike is a suite of tools that enables Cobalt Strike's HTTPS Beacon to use Microsoft Graph API for C2...

malleable-c2

कोबाल्ट स्ट्राइक मैलेबल C2 डिज़ाइन और संदर्भ गाइड यह परियोजना कोबाल्ट स्ट्राइक मैलेबल C2 प्रोफाइल डिज़ाइन करते समय संदर्भ के रूप में काम करने के लिए है। उपयोग से पहले हमेशा ./c2lint /path/to/my.profile के साथ अपने प्रोफाइल को सत्यापित करें! मैलेबल C2 प्रोफाइल मार्गदर्शन निम्नलिखित मैलेबल C2 की सम...

pyCobaltHound

Quick summary pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. pyCobaltHound strives to assists red team operators by: Automatically querying the BloodHound database to discover escalation paths opened ...