ADSyncDump-BOF

ADSyncDump BOF The ADSyncDump BOF is a port of Dirkjan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File BOF for use with Cobalt Strike, Sliver and Havoc. !NOTE The tool has been tested on a Windows Server 2019 with Azure AD Connect version 2.2.1.0. The 32 bit version of the BO...

Cobaltstrike-RCE-CVE-2022-39197

Cobaltstrike RCE Vulnerability CVE-2022-39197 Reproduction Vulnerability Brief This vulnerability exists in the Cobalt Strike Beacon software and may allow an attacker to set a malformed username in the Beacon configuration, triggering XSS, which can lead to remote code execution on the Cobalt...

aggrokatz

aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...

ycsm

You Can't See Me YCSM This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular RATS Cobalt Strike, Empire, Metasploit. If HTTPS was selected, it will automatically setup letsencrypt certbot and obtain valid letsencrypt SSL...

Beaconator

Beaconator Beaconator is an aggressor script for Cobalt Strike used to generate either staged or stageless shellcode and packing the generated shellcode using your tool of choice. Currently, it supports the following tools: Staged Beacon Generator Alaris Stageless Beacon Generator PEzor ScareCrow...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process hProc =...

C2concealer

C2concealer C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike. Installation git clone https://github.com/RedSiege/C2concealer.git cd C2concealer python3 -m venv .venv source .venv/bin/activate pip3 install -e . Docker installation Refer to...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

pybeacon

PyBeacon PyBeacon is a collection of scripts for dealing with Cobalt Strike's encrypted traffic. It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings Scripts included There is a small library which includes encryption/decoding methods, however some example scripts...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

C3

C3 Build C3 MSVC/badge.svg?branch=master Build C3 Clang/badge.svg?branch=master C3 Custom Command and Control is a tool that allows Red Teams to rapidly develop and utilise esoteric command and control channels C2. It's a framework that extends other red team tooling, such as the commercial Cobal...

pyCobaltHound

Quick summary pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. pyCobaltHound strives to assists red team operators by: Automatically querying the BloodHound database to discover escalation paths opened ...

LDAPFragger

LDAPFragger LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes. For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes Dependencies a...

charlotte

charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

WindowSpy

WindowSpy 👀 WindowSpy is a Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth durin...

SourcePoint

SourcePoint SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written in Go. SourcePoint allows unique C2 profiles to be generated on the fly that helps reduce our Indicators of Compromise "IoCs" and allows the operator to spin up complex profiles with minimal effort. This...

CobaltBus

CobaltBus Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match t...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

taowu-cobalt_strike

Taowu A red team automation framework based on the Cobalt Strike platform. For communication and learning only, do not use for illegal purposes! The exploits used in the plugin are collected from the internet. Security issues are not guaranteed. Please conduct your own security review!...