Awesome

Awesome CobaltStrike

0x00 Introduction
0x01 Articles & Videos
0x02 C2 Profiles
0x03 BOF
0x04 Aggressor Script
0x05 Related Tools
0x06 Related Resources

0x00 Introduction

The first part is a collection of quality articles about CobaltStrike
The third part is about the integration of the new features BOF resources
This project is to solve the problem of not finding the right aggressor script or BOF when it is needed
If there is quality content that is not covered in this repo, welcome to submit pr

0x01 Articles & Videos

1. Basic Knowledge

2. Crack and Customisation

3. Useful Trick

4. CobaltStrike Hide

5. CobaltStrike Analysis

6. CobaltStrike Video

0x02 C2 Profiles

Type	Name	Description
ALL	Malleable-C2-Profiles	Official Malleable C2 Profiles
ALL	Malleable-C2-Randomizer	This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage
ALL	malleable-c2	Cobalt Strike Malleable C2 Design and Reference Guide
ALL	Malleable-C2-Profiles	A collection of profiles used in Cobalt Strike and Empire's Malleable C2 Listener.
ALL	random_c2_profile	Random C2 Profile Generator
ALL	SourcePoint	SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.
ALL	C2concealer	C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.
ALL	MalleableC2-Profiles	A collection of Cobalt Strike Malleable C2 profiles. now have Windows Updates Profile
ALL	MalleableC2-Profiles	Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike
ALL	pyMalleableC2	A Python interpreter for Cobalt Strike Malleable C2 profiles that allows you to parse, modify, build them programmatically and validate syntax.
ALL	1135-CobaltStrike-ToolKit	Cobalt Strike的Malleable C2配置文件，被设计用来对抗流量分析
ALL	service_cobaltstrike	CobaltStrike profile
ALL	CobaltNotion	A spin-off research project. Cobalt Strike x Notion collab 2022.
ALL	Burp2Malleable	This is a quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles.
ALL	autoRebind	Automatically parse Malleable C2 profiled into CrossC2 rebinding library source code
ALL	goMalleable	Malleable C2 profiles parser and assembler written in golang
ALL	Malleable-CS-Profiles	A list of python tools to help create an OPSEC-safe Cobalt Strike profile.

0x03 BOF

Type	Name	Description	Popularity
ALL	BOF_Collection	Various Cobalt Strike BOFs
ALL	cobaltstrike-bof-toolset	收集网络中在cobaltstrike中使用的bof工具集。
ALL	Situational Awareness BOF	Its larger goal is providing a code example and workflow for others to begin making more BOF files. Blog
ALL	bof_helper	Beacon Object File (BOF) Creation Helper
ALL	BOF-DLL-Inject	BOF DLL Inject is a custom Beacon Object File that uses manual map DLL injection in order to migrate a dll into a process all from memory.
ALL	cobaltstrike_bofs	BOF spawns a process of your choice under a specified parent, and injects a provided shellcode file via QueueUserAPC().
ALL	BOF-RegSave	Beacon Object File(BOF) for CobaltStrike that will acquire the necessary privileges and dump SAM - SYSTEM - SECURITY registry keys for offline parsing and hash extraction.
ALL	CobaltStrike BOF	DCOM Lateral Movement; WMI Lateral Movement - Win32_Process Create; WMI Lateral Movement - Event Subscription
ALL	BOFs	ETW Patching; API Function Utility; Syscalls Shellcode Injection
ALL	Remote Operations BOF	This repo serves as an addition to our previously released SA Repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format.
ALL	OperatorsKit	This repository contains a collection of tools that integrate with Cobalt Strike through Beacon Object Files (BOFs).
Dev	bof	This is a template project for building Cobalt Strike BOFs in Visual Studio.
Dev	Needle_Sift_BOF	Strstr with user-supplied needle and filename as a BOF.
Dev	Quser-BOF	Beacon Object Files Quser implementation using Windows API
Dev	BOF.NET	A .NET Runtime for Cobalt Strike's Beacon Object Files.
Dev	beacon-object-file	The format, described by Mudge here, asks that the operator construct an COFF file using a mingw-w64 compiler or the msvc compiler that holds an symbol name indicating its entrypoint, and underlying function calls.
Dev	InlineWhispers	Demonstrate the ability to easily use syscalls using inline assembly in BOFs.
Dev	WdToggle	A Proof of Concept Cobalt Strike Beacon Object File which uses direct system calls to enable WDigest credential caching and circumvent Credential Guard (if enabled).
Dev	Situational Awareness BOF	This Repo intends to serve two purposes. First it provides a nice set of basic situational awareness commands implemented in BOF. This allows you to perform some checks on a host before you begin executing commands that may be more invasive.
Dev	MiniDumpWriteDump	Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemory.
Dev	COFF Loader	This is a quick and dirty COFF loader (AKA Beacon Object Files). Currently can run un-modified BOF's so it can be used for testing without a CS agent running it. The only exception is that the injection related beacon compatibility functions are just empty.
Dev	Self_Deletion_BOF	BOF implementation of the research by @jonasLyk and the drafted PoC from @LloydLabs
Dev	PE Import Enumerator BOF	This is a BOF to enumerate DLL files to-be-loaded by a given PE file. Depending on the number of arguments, this will allow an operator to either view a listing of anticipated imported DLL files, or to view the imported functions for an anticipated DLL.
Dev	Visual-Studio-BOF-template	A Visual Studio template used to create Cobalt Strike BOFs
Dev	BOF-Builder	C# .Net 5.0 project to build BOF (Beacon Object Files) in mass based on them all being in a folder directory struct somewhere.
Dev	ELFLoader	This is a ELF object in memory loader/runner. The goal is to create a single elf loader that can be used to run follow on capabilities across all x86_64 and x86 nix operating systems.
Dev	Rust BOFs for Cobalt Strike	This took me like 4 days, but I got it working... rust core + alloc for Cobalt Strike BOFs. This is very much a PoC, but I'd love to see others playing around with it and contributing.
Dev	CoffeeLdr	CoffeeLdr is a loader for so called Beacon Object Files. This project can be used for testing Beacon Object files without using the Cobalt Strike framework or can be used to give custom implants a way to execute BOFs that where designed for Cobalt strike.
Dev	HalosGate Processlist Cobalt Strike BOF	Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes.
Dev	PPLFaultDumpBOF	Takes the original PPLFault and the original included DumpShellcode and combinds it all into a BOF targeting cobalt strike.
Dev	Winsocky	Winsocket implementation for Cobalt Strike. Used to communicate with the victim using winsockets instead of the traditional ways.
Dev	bof-vs	A Beacon Object File (BOF) template for Visual Studio.
Auxiliary	Defender Exclusions BOF	A BOF to determine Windows Defender exclusions.
Auxiliary	ScreenShot-BOF	ScreenShot bof for Cobalt Strike . All in memory and no spawn/inject.
Auxiliary	BofRoast	Beacon Object File repo for roasting Active Directory.
Auxiliary	EnumCLR.c	Cobalt Strike BOF to identify processes with the CLR loaded with a goal of identifying SpawnTo / injection candidates.
Auxiliary	PPEnum	Simple BOF to read the protection level of a process.
Auxiliary	secinject	Section Mapping Process Injection (secinject): Cobalt Strike BOF
Auxiliary	FindObjects-BOF	A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.
Auxiliary	Inject-assembly	Inject-assembly - Execute .NET in an Existing Process. This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly.
Auxiliary	WhereAmiI	WhereAmiI - Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.
Auxiliary	GetWebDAVStatus	Small project to determine if the Web Client service (WebDAV) is running on a remote system by checking for the presence of the DAV RPC SERVICE named pipe.
Auxiliary	ChromeKeyDump	BOF implementation of Chlonium tool to dump Chrome Masterkey and download Cookie/Login Data files
Auxiliary	Sleeper	BOF to call the SetThreadExecutionState function to prevent host from Sleeping
Auxiliary	LSASS	Beacon Object File to dump Lsass memory by obtaining a snapshot handle. Does MiniDumpWriteDump/NtReadVirtualMemory on SnapShot of LSASS instad of original LSASS itself hence evades some AV/EDR.
Auxiliary	getsystem	get system by duplicating winlogon's token.
Auxiliary	Silent Lsass Dump	Silent Lsass Dump
Auxiliary	unhook-bof	This is a Beacon Object File to refresh DLLs and remove their hooks.
Auxiliary	Beacon Health Check Aggressor Script	This aggressor script uses a beacon's note field to indicate the health status of a beacon.
Auxiliary	Registry BOF	A beacon object file for use with cobalt strike v4.1+. Supports querying, adding, and deleting keys/values of local and remote registries.
Auxiliary	InlineExecute-Assembly	InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module
Auxiliary	CredBandit	CredBandit is a proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel. The memory dump is done by using NTFS transactions which allows us to write the dump to memory and the MiniDumpWriteDump API has been replaced with an adaptation of ReactOS's implementation of MiniDumpWriteDump.
Auxiliary	Inject AMSI Bypass	Cobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection.
Auxiliary	Firewall_Enumerator_BOF	Cobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection.
Auxiliary	Detect-Hooks	Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR
Auxiliary	unhook-bof	Remove API hooks from a Beacon process.
Auxiliary	whereami	Cobalt Strike "Where Am I?" Beacon Object File
Auxiliary	HOLLOW	EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode
Auxiliary	BOFs	send_shellcode_via_pipe;cat;wts_enum_remote_processes
Auxiliary	SCShell	SCShell is a fileless lateral movement tool that relies on ChangeServiceConfigA to run commands.
Auxiliary	WinRMDLL	A while ago I produced CSharpWinRM which was alright, but I wanted to look at the WinRM C++ API properly.
Auxiliary	LSASS Dumping With Foreign Handles	LSASS Dumping With Foreign Handles
Auxiliary	PPLDump BOF	this is a fully-fledged BOF to dump an arbitrary protected process.(LSASS)
Auxiliary	PortBender	PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP).
Auxiliary	BOF2Shellcode	POC tool to convert a Cobalt Strike BOF into raw shellcode.
Auxiliary	DLL Hijack Search Order BOF	DLL Hijack Search Order Enumeration BOF
Auxiliary	InlineWhispers2	Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2
Auxiliary	NetUser	使用windows api添加用户，可用于net无法使用时
Auxiliary	BOF-Nim	用Nim语言写BoF
Auxiliary	Invoke-Bof	Load any Beacon Object File using Powershell!
Auxiliary	Cobalt-Clip	Cobalt-clip is clipboard addons for cobaltstrike to interact with clipboard. With this you can dump, edit and monitor the content of q clipboard.
Auxiliary	CoffLoader	Load and execute COFF files and Cobalt Strike BOFs in-memory
Auxiliary	COFFLoader2	Load and execute COFF files and Cobalt Strike BOFs in-memory
Auxiliary	Process Protection Level Enumerator BOF	A Syscall-only BOF file intended to grab process protection attributes, limited to a handful that Red Team operators and pentesters would commonly be interested in.
Auxiliary	Toggle_Token_Privileges_BOF	AAn (almost) syscall-only BOF file intended to either add or remove token privileges within the context of your current process.
Auxiliary	Cobalt Strike BOF - Inject ETW Bypass	Inject ETW Bypass into Remote Process via Syscalls (HellsGate	HalosGate)
Auxiliary	HandleKatz_BOF	PIC your Katz! Say hello to HandleKatz, our position independent Lsass dumper abusing cloned handles, direct system calls and a modified version of minidumpwritedump()
Auxiliary	tgtdelegation	tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick"
Auxiliary	nanodump	A Beacon Object File that creates a minidump of the LSASS process.
Auxiliary	xPipe Cobalt Strike BOF (x64)	Cobalt Strike Beacon Object File (BOF) to list active Pipes & return their Owner & Discretionary Access Control List (DACL) permissions.
Auxiliary	AddUser-Bof	Cobalt Strike BOF that Add an admin user
Auxiliary	ServiceMove-BOF	Lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking
Auxiliary	Detect-Hooks	Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR
Auxiliary	MemReader BoF	MemReader Beacon Object File will allow you to search and extract specific strings from a target process memory and return what is found to the beacon output.
Auxiliary	Readfile BoF	Not the prettiest code, short sweet and to the point and will allow you to read file contents to beacon output.
Auxiliary	ChromiumKeyDump	BOF implementation of Chlonium tool to dump Chrome/Edge Masterkey and download Cookie/Login Data files
Auxiliary	LdapSignCheck	Beacon Object File to scan a Domain Controller to see if LdapEnforceChannelBinding or LdapServerIntegrity has been modified to mitigate against relaying attacks.
Auxiliary	DelegationBOF	This tool uses LDAP to check a domain for known abusable Kerberos delegation settings. Currently, it supports RBCD, Constrained, Constrained w/Protocol Transition, and Unconstrained Delegation checks.
Auxiliary	RunOF	A tool to run object files, mainly beacon object files (BOF), in .Net.
Auxiliary	KillDefender_BOF	Beacon Object File implementation of pwn1sher's KillDefender.
Auxiliary	TokenStripBOF	TokenStrip is a Beacon Object File implementation of pwn1sher's KillDefender project utilizing syscalls via InlineWhispers.
Auxiliary	BOF - RDPHijack	Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
Auxiliary	Koh	Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
Auxiliary	RDPHijack	Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
Auxiliary	KDStab	BOF combination of KillDefender and Backstab.
Auxiliary	Token Vault BOF for Cobalt Strike	This Beacon Object File (BOF) creates in-memory storage for stolen/duplicated Windows access tokens.
Auxiliary	ASRenum	Identify ASR rules, actions, and exclusion locations.
Auxiliary	ThreadlessInject-BOF	BOF implementation of @EthicalChaos's ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.
Auxiliary	Inline-Execute-PE	Execute unmanaged Windows executables in CobaltStrike Beacons. This enables Operators to use many third party tools (Mimikatz, Dsquery, Sysinternals tools, etc) without needing to drop them to disk, reformat them to position independent code using a tool like Donut, or create a new process to run them.
Auxiliary	BOFs	Subscribes to WNF notifications for a number of seconds. && Backdoors SCManager SDDL.
Auxiliary	DomainPasswordSpray	Perform LDAP-based or Kerberos-based password spray using Windows API LogonUserSSPI. Skip disabled accounts, locked accounts and large BadPwdCount (if specified).
Auxiliary	BOF-CredUI	Credentials Collection via CredUIPromptForWindowsCredentials
Auxiliary	Cookie-Graber-BOF	C or BOF file to extract WebKit master key to decrypt user cookie. The C code can be used to compile an executable or a bof script for Cobalt Strike.
Auxiliary	ScreenshotBOF	An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
Auxiliary	ScreenshotBOFPlus	Take a screenshot without injection for Cobalt Strike. I only made minor optimizations to the existing code, and made it support the ability to get a complete screenshot when global scaling is initiated on Windows.
Auxiliary	Elevate-System-Trusted-BOF	This BOF can be used to elevate the current beacon to SYSTEM and obtain the TrustedInstaller group privilege. The impersonation is done through the SetThreadToken API.
Auxiliary	Hidden Desktop BOF	Hidden Desktop (often referred to as HVNC) is a tool that allows operators to interact with a remote desktop session without the user knowing.
Auxiliary	DropSpawn	DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection.
Auxiliary	Nanorobeus	COFF file (BOF) for managing Kerberos tickets.
Auxiliary	SelfDel	Delete file regardless of whether the handle is used via SetFileInformationByHandle
Auxiliary	GetWeChatBOF	用于获取微信信息的BOF测试文件, 仅支持3.9.6.33版本的偏移
Auxiliary	ShadowRDP	用This repository contains two applications. One is a beacon object file, which is used to retrieve the authentication string, also known as the invitation. The other is a graphical user interface program that can be run on the operator's system behind a SOCKS proxy to connect to the remote desktop session.
Auxiliary	SharpHound4Cobalt	The SharpHound data (test file, json, zip, cache file) will not be written on the disk but only sent to Cobalt Strike downloads through BOF.NET library.
Exploit	CVE-2020-0796-BOF	SMBGhost LPE
Exploit	ZeroLogon-BOF	ZeroLogon
Exploit	kernel-mii	Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551.
Exploit	PrivKit	PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
Exploit	CVE-2023-36874	About
Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE.
Persistence	SPAWN	Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
Persistence	PersistBOF	A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User).
BypassAV	ClipboardWindow-Inject	Beacon Object File (BOF) that injects beacon shellcode into remote process, avoiding the usage of common monitored APIs.
BypassAV	SigFlip	SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.
BypassAV	BokuLoader	Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.
BypassAV	AddDefenderExclusions	AddDefenderExclusions Beacon Object File Resources.
BypassAV	BOFMask	it demonstrates a technique to stealthily run BOFs without exposing Beacon to detection.
BypassUAC	Trusted Path UAC Bypass	Beacon object file implementation for trusted path UAC bypass. The target executable will be called without involving "cmd.exe" by using DCOM object.
BypassUAC	EventViewerUAC_BOF	This is a Beacon Object File implementation of the Event Viewer deserialization UAC bypass discovered by @orange_8361 and the POC put together by CsEnox.

0x04 Aggressor Script

Type	Name	Description
BypassAV	BypassAV	用于快速生成免杀的可执行文件
BypassAV	BypassAV	本质上利用的ps2exe.ps1脚本编译为exe，只是不想在命令行里操作，将其写为cna脚本，方便直接快速生成免杀的可执行文件且只有50KB，目前支持exe、ps1文件格式。
BypassAV	scrun	BypassAV ShellCode Loader (Cobaltstrike/Metasploit) Useage
BypassAV	ShellCode_Loader	Msf&CobaltStrike免杀ShellCode加载器
BypassAV	beacon-c2-go	beacon-c2-go (Cobaltstrike/Metasploit)
BypassAV	C--Shellcode	python ShellCode Loader (Cobaltstrike&Metasploit) Useage
BypassAV	Doge-Loader	Cobalt Strike Shellcode Loader by Golang
BypassAV	CS-Loader	CS免杀,包括python版和C版本的
BypassAV	CSSG	Cobalt Strike Shellcode Generator. Generates beacon stageless shellcode with exposed exit method, additional formatting, encryption, encoding, compression, multiline output, etc
BypassAV	Alaris	Alaris is a new and sneaky shellcode loader capable of bypassing most EDR systems as of today (02/28/2021). It uses several known TTP’s that help protect the malware and it’s execution flow.
BypassAV	CarbonMonoxide	EDR Evasion - Combination of SwampThing - TikiTorch
BypassAV	bypassAV-1	条件触发式远控 VT 6/70 免杀国内杀软及defender、卡巴斯基等主流杀软.
BypassAV	ScareCrow	ScareCrow is a payload creation framework for generating loaders for the use of side loading (not injection) into a legitimate Windows process (bypassing Application Whitelisting controls).
BypassAV	Dent	A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
BypassAV	PEzor	Open-Source PE Packer.
BypassAV	FuckThatPacker	A simple python packer to easily bypass Windows Defender
BypassAV	goShellCodeByPassVT	Go编译-race参数实现VT全免杀
BypassAV	HouQing	Advanced AV Evasion Tool For Red Team Ops
BypassAV	DesertFox	使用Golang实现免杀加载CobaltStrike和Metasploit的shellcode，目前免杀火绒、Avast、腾讯安全管家、360全家桶等主机安全软件。
BypassAV	DInjector	This repository is an accumulation of code snippets for various shellcode injection techniques using fantastic D/Invoke API
BypassAV	GoBypass	Golang免杀马生成工具（该工具仅针对Windows系统）
BypassAV	Bypass-script	使用 GoBypass 来进行免杀生成
BypassAV	CobaltWhispers	CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV.
BypassAV	AceLdr	Cobalt Strike UDRL for memory scanner evasion.
BypassAV	SharpTerminator	Terminate AV/EDR Processes using kernel driver
BypassUAC	UAC-SilentClean	This project implements a DLL planting technique to bypass UAC Always Notify and execute code in a high integrity process.
BypassUAC	csload.net	A cobaltStrike Shellcode loader, can bypass most of AV
Dev	cs-rdll-example	This is an example code pattern for using named pipes for IPC with ReflectiveDlls in Cobalt Strike.
Dev	Titan	Titan: A generic user defined reflective DLL for Cobalt Strike.
Dev	GECC	Go External C2 Client implementation for cobalt strike.
Dev	CobaltStrike beacon in rust	CobaltStrike beacon in rust.
Recon	red-team-scripts	perform some rudimentary Windows host enumeration with Beacon built-in commands
Recon	Registry-Recon	Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon.
Recon	aggressor-powerview	All functions listed in the PowerView about page are included in this with all arguments for each function. PowerView
Recon	PowerView3-Aggressor	PowerView Aggressor Script for CobaltStrike PowerView
Recon	AggressorScripts	Sharphound-Aggressor- A user menu for the SharpHound ingestor
Recon	ServerScan	内网横向信息收集的高并发网络扫描、服务探测工具。
Recon	TailorScan	端口扫描+探测网卡+ms17010探测
Recon	AggressiveProxy	LetMeOutSharp will try to enumerate all available proxy configurations and try to communicate with the Cobalt Strike server over HTTP(s) using the identified proxy configurations.
Recon	Spray-AD	A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.
Recon	Ladon	Ladon一款用于大型网络渗透的多线程插件化综合扫描神器，含端口扫描、服务识别、网络资产、密码爆破、高危漏洞检测以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描。
Recon	Ladon for Cobalt Strike	Ladon for Cobalt Strike(巨龙拉冬套件)
Recon	Recon-AD	Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
Exploit	XSS-Fishing2-CS	鱼儿在cs上线后自动收杆 / Automatically stop fishing in javascript after the fish is hooked
Exploit	XSS-Phishing	xss钓鱼，cna插件配合php后端收杆
Exploit	custom_payload_generator	CobaltStrike3.0+ --> creates various payloads for Cobalt Strike's Beacon. Current payload formats
Exploit	CrossC2	CrossC2 framework - Generator CobaltStrike's cross-platform beacon
Exploit	CrossC2 Kit	CrossC2Kit provides some interfaces for users to call to manipulate the CrossC2 Beacon session, thereby extending the functionality of Cobalt Strike.
Exploit	Cobaltstrike-MS17-010	ms17-010 exploit tool and scanner.
Exploit	AES-PowerShellCode	Standalone version of my AES Powershell payload for Cobalt Strike.
Exploit	SweetPotato_CS	CobaltStrike4.x --> SweetPotato
Exploit	ElevateKit	privilege escalation exploits
Exploit	CVE-2018-4878	CVE-2018-4878
Exploit	Aggressor-Scripts	The only current public is UACBypass, whose readme can be found inside its associated folder.
Exploit	CVE_2020_0796_CNA	基于ReflectiveDLLInjection实现的本地提权漏洞
Exploit	DDEAutoCS	setup our stage(d) Web Delivery attack
Exploit	geacon	Implement CobaltStrike's Beacon in Go (can be used in Linux)
Exploit	geacon_pro	geacon_pro is an Anti-Virus bypassing CobaltStrike Beacon written in Golang based on geacon project.
Exploit	geacon_plus	golang实现的CobaltStrike stageless http(s) beacon,在geacon项目基础上进行了较多扩展
Exploit	SpoolSystem	SpoolSystem is a CNA script for Cobalt Strike which uses the Print Spooler named pipe impersonation trick to gain SYSTEM privileges.
Exploit	CVE-2021-1675_RDL_LPE	PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR
Exploit	KRBTGS	KRBTGS is a post-exploitation option for Cobalt Strike to retrieve a working TGT for the current user that Beacon is running as, or impersonating. The attack does not require the user's password, and only assumes that the user you are running as is within a domain-joined environment. It attempts to guess the encryption type by choosing the strongest to least strong. The resulting .ccache can be converted into KIRBI format to be imported into other Beacons, or passed to other toolsets such as Impacket's example scripts to perform your post-exploitation endeavours.
Exploit	PrintSpoofer-ReflectiveDLL	PrintSpoofer的反射dll实现，结合Cobalt Strike使用
Persistence	persistence-aggressor-script	persistence-aggressor-script
Persistence	Peinject_dll	弃用winexec函数，使用shellexecute函数，程序流不在卡顿，达到真正的无感。
Persistence	TikiTorch	TikiTorch follows the same concept(CACTUSTORCH) but has multiple types of process injection available, which can be specified by the user at compile time.
Persistence	CACTUSTORCH	A JavaScript and VBScript shellcode launcher. This will spawn a 32 bit version of the binary specified and inject shellcode into it.
Persistence	UploadAndRunFrp	上传frpc并且运行frpc
Persistence	persistence-aggressor-script	Persistence Aggressor Script
Persistence	AggressiveGadgetToJScript	Automate the generation of payloads using the GadgetToJScript technique.
Persistence	FrpProPlugin	frp0.33修改版,过流量检测,免杀,支持加载远程配置文件可用于cs直接使用的插件
Persistence	Automatic-permission-maintenance	CobaltStrike 上线自动权限维持插件
Persistence	cobalt-strike-persistence	使用者通过cobalt strike生成Web Delivery类型的payload，然后加载此脚本可以到达自启动效果
Persistence	Cobalt_Strike_CNA	使用多种WinAPI进行权限维持的CobaltStrike脚本，包含API设置系统服务，设置计划任务，管理用户等。
Persistence	CustomKeyboardLayoutPersistence	Achieve execution using a custom keyboard layout, tested in Windows 11 Home version 21H2
Persistence	SharpEventPersist	Persistence by writing/reading shellcode from Event Log.
Auxiliary	SharpZippo	List/Read contents of Zip files (in memory and without extraction) using CobaltStrike's Execute-Assembly
Auxiliary	SharpExcelibur	Read Excel Spreadsheets (XLS/XLSX) using Cobalt Strike's Execute-Assembly
Auxiliary	SharpSword	Read the contents of DOCX files using Cobalt Strike's Execute-Assembly
Auxiliary	SharpCat	C# alternative to the linux "cat" command... Prints file contents to console. For use with Cobalt Strike's Execute-Assembly
Auxiliary	TabRenamer CNA	This will allow programmatic renaming of tabs as you see fit, with toggles of your history as you see fit.
Auxiliary	Liquid Snake	LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript
Auxiliary	TaskShell	TaskShell 计划任务相关自动化操作
Auxiliary	generate-rotating-beacon	1. Generate a beacon for a given listener; 2. Host the file at a specified location;3. Monitor the weblog for fetching of the specified location;
Auxiliary	ScareCrow-CobaltStrike	A Cobalt Strike script for ScareCrow payload generation. Works with all Loaders.
Auxiliary	AggressorScripts	CreateTicket; Seatbelt; SharpHound
Auxiliary	SharpeningCobaltStrike	In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server.
Auxiliary	CS_Mail_Tip	Cobalt Strike主机上线邮件提醒插件
Auxiliary	Cobalt_Strike_Bot	CobaltStrike上线通知，飞书群聊机器人、server酱通知
Auxiliary	Cobaltstrike-atexec	利用任务计划进行横向，需要与135端口、445端口进行通信
Auxiliary	Sharp-HackBrowserData	C#的HackBrowserData工具，方便在cs中直接内存加载
Auxiliary	HackBrowserData	HackBrowserData的反射模块
Auxiliary	cobalt_sync	Standalone Cobalt Strike Operation Logging Aggressor script for Ghostwriter 2.0+
Auxiliary	samdump	Cobalt Strike samdump
Auxiliary	CallBackDump	能过卡巴、核晶、defender等杀软的dump lsass进程工具
Auxiliary	SharpeningCobaltStrike	In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server.
Auxiliary	SharpCompile	SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime.
Auxiliary	Quickrundown	Utilizing QRD will allow an operator to quickly characterize what processes are both known and unknown on a host through the use of colors and notes about the processes displayed.
Auxiliary	NetUser	This tool achieves "net user" in Window API. I made this to be used with Cobalt Strike's execute-assembly，所以可以内存加载添加用户
Auxiliary	FileSearch	C++枚举磁盘列表、遍历指定盘搜索特定类型文件包括反射DLL版本。
Auxiliary	Phant0m_cobaltstrike	This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.
Auxiliary	NoPowerShell	NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms.
Auxiliary	EventLogMaster	RDP EventLog Master
Auxiliary	ANGRYPUPPY	Bloodhound Attack Path Execution for Cobalt Strike
Auxiliary	CobaltStrike_Script_Wechat_Push	上线微信提醒的插件,通过微信Server酱提醒
Auxiliary	CS-Aggressor-Scripts	slack and webhooks reminder
Auxiliary	Aggressor-Scripts	surveying of powershell on targets (在对应的目标上检测powershell的相关信息)
Auxiliary	cs-magik	Implements an events channel and job queue using Redis for Cobalt Strike.
Auxiliary	GetClipboard	Cobalt Strike Reflective DLL Get clipboard content. The code basically comes from ReflectiveDLLInjection
Auxiliary	AggressorScripts	查看进程的时候讲av进程标注为红色
Auxiliary	Beaconator	Beaconator is an aggressor script for Cobalt Strike used to generate a raw stageless shellcode and packing the generated shellcode using PEzor.
Auxiliary	Raven	CobaltStrike External C2 for Websockets
Auxiliary	CobaltStrikeParser	Python parser for CobaltStrike Beacon's configuration
Auxiliary	fakelogonscreen	FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password.
Auxiliary	SyncDog	Make bloodhound sync with cobaltstrike.
Auxiliary	360SafeBrowsergetpass	一键辅助抓取360安全浏览器密码的CobaltStrike脚本，通过下载浏览器数据库、记录密钥来离线解密浏览器密码。
Auxiliary	SharpDecryptPwd	对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。
Auxiliary	List-GitHubAssembly	Fetch a list of avaialble artifacts from the configured GitHub repo.
Auxiliary	ExecuteAssembly	ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs via superfasthash hashing algorithm.
Auxiliary	aggrokatz	aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely.
Auxiliary	Zipper	This CobaltStrike tool allows Red teams to compress files and folders from local and UNC paths. This could be useful in situations where large files or folders need to be exfiltrated. After compressing a file or folder a random named zipfile is created within the user temp folder.
Auxiliary	CS-ServerChan	通过 CobaltStike 服务端 / 客户端挂载脚本，将上线主机信息通过 Server 酱通知到微信
Auxiliary	CS-PushPlus	使用免费且支持微信模板消息推送的 PushPlus 进行上线主机提醒
Auxiliary	HelpColor	Aggressor script that lists available Cobalt Strike beacon commands and colors them based on their type
Auxiliary	CobaltStrike Helpmsg CNA	This cna contains error messages for Win32 error codes, HRESULT defintions, and NTSTATUS definitions. This cna can be helpful for those operating out of linux/mac clients without access to the net.exe program, or as a quick way to looking hresult/ntstatus codes without having to do a google search.
Auxiliary	YouMayPasser	Stable PeSieve Bypass and Stable Moneta Bypass.
Auxiliary	Sync Downloads	This is meant as a fine-tuned control mechanism for syncing files from the Cobalt Strike Downloads entries in the data model
Auxiliary	Headless Strike	Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client.
Auxiliary	Headless Strike	内网渗透\红队工具\C#内存加载\cobaltstrike
Auxiliary	Cohab_Processes	A small Aggressor script to help Red Teams identify foreign processes on a host machine
Auxiliary	EnumStrike	Cobalt Strike Aggressor script to automate host and domain enumeration.
Synthesis	AM0N-Eye	AM0N-Eye is a compilation of a group of the most important scripts that were written specifically for Cobaltsetrike and the rest of the files such as de for modification in colors and images.
Synthesis	aggressor_snippets	A collection of random small Aggressor snippets that don't warrant their own repo
Synthesis	Erebus	CobaltStrike4.x --> Erebus CobaltStrike后渗透测试插件
Synthesis	CSplugins	CobaltStrike后渗透测试插件集合
Synthesis	Cobalt-Strike-Aggressor-Scripts	CobaltStrike后渗透测试插件集合 Usage
Synthesis	AggressorScripts	Aggressor scripts for use with Cobalt Strike 3.0+
Synthesis	RedTeamTools	RedTeamTools for use with Cobalt Strike
Synthesis	cobalt-arsenal	Aggressor Scripts for Cobalt Strike 4.0+
Synthesis	MoveKit	The aggressor script handles payload creation by reading the template files for a specific execution type. intro
Synthesis	StayKit	The aggressor script handles payload creation by reading the template files for a specific execution type. intro
Synthesis	AggressorScripts	AggressorScripts
Synthesis	AggressorScripts	Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
Synthesis	AggressorScripts	AggressorScripts
Synthesis	Aggressor-VYSEC	Contains a bunch of CobaltStrike Aggressor Scripts
Synthesis	AggressorAssessor	AggressorAssessor
Synthesis	AggressorAssessor	AggressorAssessor
Synthesis	aggressor-scripts	Collection of Cobalt Strike Aggressor Scripts
Synthesis	梼杌	基于cobalt strike平台的红队自动化框架
Synthesis	Aggressor-scripts	This is just a random collection of Aggressor Scripts I've written for Cobalt Strike 3.x. (其中有一个debug脚本比较好用)
Synthesis	Aggressor-Script	Collection of Aggressor Scripts for Cobalt Strike(主要包含了提权和权限维持脚本)
Synthesis	Aggressor-Script	Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on
Synthesis	aggressor_scripts_collection	Collection of various aggressor scripts for Cobalt Strike from awesome people. Will be sure to update this repo with credit to each person.
Synthesis	CobaltStrike-ToolKit	googlesearch.profile and script related to AD.
Synthesis	Arsenal	Cobalt Strike 3.13 Arsenal Kit
Synthesis	cobalt-arsenal	My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+
Synthesis	aggressor_scripts	A collection of useful scripts for Cobalt Strike.(powershell.cna;bot.cna;dcom_lateral_movement.cna;ElevateKit)
Synthesis	aggressor	creating tunnels with netsh; changed default to bit.ly redirect to mcdonalds;using powershell to kill parent process;
Synthesis	CobaltStrikeCNA	A collection of scripts - from various sources - see script for more info.
Synthesis	AggressorScripts	Highlights selected processes from the ps command in beacon;Loads various aliases into beacon;sets a few defaults for scripts to be used later..
Synthesis	AggressorAssessor	从C2生成到横向移动的全辅助脚本套件
Synthesis	AggressorCollection	Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors
Synthesis	Cobaltstrike-Aggressor-Scripts-Collection	The collection of tested cobaltstrike aggressor scripts.
Synthesis	aggressorScripts	CobaltStrike AggressorScripts for the lazy
Synthesis	Aggressor_Scripts	A compilation of Aggressor/Sleep scripts for operational purposes that I've made.
Synthesis	cobalt_strike_extension_kit	集成了SharpHound,SharpRDP,SharpWMI等在内的各种内网工具，使用AggressorScripts构建workflow
Synthesis	cobaltstrike	具备域管理员定位、域信息收集、权限维持、内网扫描、数据库hash dump、Everything内网搜索文件等功能的插件集合
Synthesis	365CobaltStrike	兼容CobaltStrike4.0的插件集合
Synthesis	Cobalt-Strike	内容有横向移动、密码抓取、权限提升、权限维持等,尽可能将内网渗透中常用到的东西整理一下,方便使用
Synthesis	CSPlugins	一个对Cobaltstrike第三方插件进行收集的项目，持续更新。
Synthesis	CobaltStrike-xor	third-party --> vnc_x86_dll and vnc_x64_dll
Synthesis	Z1-AggressorScripts	适用于Cobalt Strike 3.x & 4.x 的内网渗透插件集合
Synthesis	csplugin	导入PowerView脚本，和常见的功能使用
Synthesis	CSplugins	涉及工作目录、信息收集、凭据获取、权限维持、权限提升、用户相关、RDP相关、防火墙相关、域渗透、powershell相关、内网穿透、内网探测、远程文件下载、痕迹清除的综合型插件系统
Synthesis	LSTAR	本着简化 CS 右键和方便自己集成的目的，对 Reference 里的项目进行了缝合以及二次开 (抄) 发 (袭)并添加了虚拟机/AV 检测、主机相关密码抓取、 Cxk 限时免杀的 Mimikatz 和 Adduser 等功能
Synthesis	SharpUtils	A collection of C# utilities intended to be used with Cobalt Strike's execute-assembly.
Synthesis	SharpToolsAggressor	内网渗透中常用的c#程序整合成cs脚本，直接内存加载。持续更新~
Synthesis	C.Ex	CobaltStrike Plugin to start and utilize Cobalt Strike (locally or remotely) from within Sifter
Synthesis	OLa	一款CS后渗透模块插件，让大家使用一款插件就够了，本插件集大家之所长

0x05 Related Tools

Type	Name	Description
AntiCobaltStrike	cobaltstrike_brute	Cobalt Strike Team Server Password Brute Forcer
AntiCobaltStrike	Dissecting Cobalt Strike using Python	dissect.cobaltstrike is a Python library for dissecting and parsing Cobalt Strike related data such as beacon payloads and Malleable C2 Profiles.
AntiCobaltStrike	CobaltSpam	Cobalt Strike Team Server Password Brute Forcer
AntiCobaltStrike	CobaltStrikeDos	CVE-2021-36798 Exp: Cobalt Strike < 4.4 Dos
AntiCobaltStrike	CS_mock	模拟cobalt strike beacon上线包
AntiCobaltStrike	CS_fakesubmit	一个可以伪装上线Cobaltstrike的脚本
AntiCobaltStrike	CobaltStrikeScan	Scan files or process memory for Cobalt Strike beacons and parse their configuration.
AntiCobaltStrike	grab_beacon_config	Simple PoC script to scan and acquire CobaltStrike Beacon configurations.
AntiCobaltStrike	C2-JARM	通过ssl实现所产生的JARM hash来识别不同的c2，例如CobaltStrike
AntiCobaltStrike	JARM	JARM fingerprints scanner
AntiCobaltStrike	DetectCobaltStomp	A quick(and perhaps dirty!) PoC tool to detect Module Stomping as implemented by Cobalt Strike with moderate to high confidence
AntiCobaltStrike	cobaltstrike	Code and yara rules to detect and analyze Cobalt Strike
AntiCobaltStrike	CS_Decrypt	解密可以帮助你理解cs beacon通信原理，但注意密钥是在本地teamserver中
AntiCobaltStrike	CS Scripts	parse_beacon_keys.py 对 .cobaltstrike.beacon_keys 文件的解析工具
AntiCobaltStrike	PyBeacon	A collection of scripts for dealing with Cobalt Strike beacons in Python Resources
AntiCobaltStrike	cobaltstrikescan	Detecting CobaltStrike for Volatility
AntiCobaltStrike	CobaltStrikeForensic	Toolset for research malware and Cobalt Strike beacons
AntiCobaltStrike	DuckMemoryScan	A simple tool to find backdoors including but not limited to iis hijacking, fileless Trojan, bypass AV shellcode.
AntiCobaltStrike	CobaltSplunk Splunk Application	CobaltSplunk is a Splunk Application that knows how to 1) ingest Cobalt Strike related logs and parse them properly, 2) display useful operational dashboards, 3) display relevant reports.
AntiCobaltStrike	BeaconHunter	Behavior based monitoring and hunting tool built in C# tool leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.
AntiCobaltStrike	CobaltStrikeDetected	40行代码检测到大部分CobaltStrike的shellcode
AntiCobaltStrike	BeaconEye	Hunts out CobaltStrike beacons and logs operator command output
AntiCobaltStrike	Beacon_re	cobalt strike beacon代码还原
AntiCobaltStrike	Beacon.dll	cobalt strike beacon实现
AntiCobaltStrike	SharpBeacon	cobalt strike beacon csharp实现
AntiCobaltStrike	EvilEye	EvilEye is a BeaconEye implement in Golang.
AntiCobaltStrike	Hunt-Sleeping-Beacons	The idea of this project is to identify beacons which are unpacked at runtime or running in the context of another process (=InMemory malware)..
AntiCobaltStrike	CSRouge	恶意的CS服务器,只能urldns
AntiCobaltStrike	Cobalt Strike Discovery	Finds Cobalt Strike fingerprint on targets via traffic telemetry
Anti-AntiCobaltStrike	bypass-beacon-config-scan	Bypass cobaltstrike beacon config scan for 4.1
Anti-AntiCobaltStrike	bypass-beacon-config-scan	CSAgent 与 GoogleAuth 的缝合体，cobalt strike4.4版本的破解+otp动态口令的agent
BypassAV	Cooolis-ms	Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection的代码执行工具，它的定位在于能够在静态查杀上规避一些我们将要执行且含有特征的代码，帮助红队人员更方便快捷的从Web容器环境切换到C2环境进一步进行工作。
BypassAV	UrbanBishopLocal	A port of FuzzySecurity's UrbanBishop project for inline shellcode execution.
BypassAV	ShellcodeLoader	Windows通用免杀shellcode加载器
BypassAV	ZheTian	免杀shellcode加载框架
BypassAV	EXOCET	AV-evading, undetectable, payload delivery tool
BypassAV	SecondaryDevCobaltStrike	CobaltStrike after second development, can bypass Kaspersky, Norton, McAfee, etc.
BypassAV	Bypass_Go	参考CS的Bypass插件+分离免杀思想改造
BypassAV	CrossNet-Beta	In the red team operation, the phishing executable file is generated by using the white utilization, to bypass AV and automatically judging the network environment. can bypass 360 and huorong
BypassAV	EVA	FUD shellcode Injector
BypassAV	BypassAV	用golang来打包生成后门，具备一定的免杀能力
BypassAV	NimShellCodeLoader	Nim编写Windows平台shellcode免杀加载器
BypassAV	beacon_hook_bypass_memscan	cs bypass卡巴斯基内存查杀: https://xz.aliyun.com/t/9399
BypassAV	ZheTian	ZheTian Powerful remote load and execute ShellCode tool
BypassAV	bypassAV	破产版免杀，大致思路是将shellcode异或，之后在主程序中解码。关键是清除一些符号信息
BypassAV	JsLoader	免杀shellcode并绕过杀毒添加自启动
BypassAV	ShellcodeLoader	将shellcode用rsa加密并动态编译exe，自带几种反沙箱技术。
BypassAV	Alt-Beacon-Payload	Beacon payload using AV bypass method from https://github.com/fullmetalcache/CsharpMMNiceness and shellcode generated from https://github.com/RCStep/CSSG.(可以给他补充一个cna一键配置脚本)
BypassAV	SigFlip	SigFlip是一款用于修补有签名的PE文件（exe、dll、sys等）的工具，它不会影响或破坏现有的签名，换句话说，你可以通过嵌入数据（即shellcode）来改变PE文件的校验和/哈希值，而不会破坏文件签名、完整性检查或PE文件功能。
BypassAV	SigFlip	SigFlip是一款用于修补有签名的PE文件（exe、dll、sys等）的工具，它不会影响或破坏现有的签名，换句话说，你可以通过嵌入数据（即shellcode）来改变PE文件的校验和/哈希值，而不会破坏文件签名、完整性检查或PE文件功能。这是他的golang实现
BypassAV	Shellcode Fluctuation PoC	一个内存规避技术的PoC，循环地加密和解密shellcode的内容，然后使它在RW（或NoAccess）和RX内存保护之间波动。当我们的shellcode驻留在RW或NoAccess内存页时，像Moneta或pe-sieve这样的扫描器将无法追踪它并转储它以进行进一步分析。
BypassAV	cool	Golang-Gin 框架写的免杀平台，内置分离、捆绑等多种BypassAV方式。
BypassAV	ThreadStackSpoofer	Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and
BypassAV	SleepyCrypt	A shellcode function to encrypt a running process image in memory when sleeping.
BypassAV	GobypassAV	免杀shellcode加载器，使用go实现，免杀bypass火绒、360、核晶、def等主流杀软.
BypassAV	AtomLdr	A DLL loader with evasive features.
Analysis	Beacon	Open Source Cobalt Strike Beacon. Unreleased, in research stages
Analysis	Linco2	模拟Cobalt Strike的Beacon与C2通信过程，实现了基于HTTP协议的Linux C2，客户端可以通过curl就能下发Beacon任务。
Analysis	beacon-object-files	This repository contains miscellaneous examples of Cobalt Strike Beacon object file extensions.
Auxiliary	C2ReverseProxy	When you encounter a non-networked environment during penetration, you can use this tool to establish a reverse proxy channel so that the beacons generated by CobaltStrike can bounce back to the CobaltStrike server.
Auxiliary	Cobalt strike custom 404 page	You can find the CS service through 404 pages.
Auxiliary	StageStrike	A custom Cobalt Strike stager written in C.. is how the project started.
Auxiliary	CS_SSLGen	sslgen will install a letsencrypt certificate and create a Cobalt Strike keystore from it.
Auxiliary	CobaltPatch	Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be Appended In Stage / Post-Ex Blocks. Made for C Programmers
Auxiliary	pycobalt	Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be Appended In Stage / Post-Ex Blocks. Made for C Programmers.
Auxiliary	redshell	An interactive command prompt that executes commands through proxychains and automatically logs them on a Cobalt Strike team server.
Auxiliary	CobaltStrikeToGhostWriter	Log converter from CS logs to a CSV in Ghostwriter's operation log format.
Auxiliary	Ansible-Cobalt-Strike	An Ansible role to install cobalt-strike on debian based architectures, let's be honest it's for kali.
Auxiliary	cobaltstrike_runtimeconfig	A POC showing how to modify Cobalt Strike beacon at runtime
Auxiliary	pystinger	Pystinger implements SOCK4 proxy and port mapping through webshell. It can be directly used by cobalt strike for session online.
Auxiliary	ansible-role-cobalt-strike	An Ansible role for installing Cobalt Strike.
Auxiliary	CrossNet	In the red team operation, the phishing executable file is generated by using the white utilization, avoiding killing and automatically judging the network environment.
Auxiliary	CrossC2-C2Profile	CrossC2通信协议API实现，可兼容使用C2Profile
Auxiliary	BypassAddUser	Bypass AV to add users
Auxiliary	Docker-CobaltStrike	The tool covers almost all the technical links needed in the apt attack chain. Use cloud functions to avoid traceability Using docker container is fast and convenient Use the python script I wrote to avoid privacy disclosure and malicious attacks
Auxiliary	TeamServer.prop	TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the “HotCobalt” vulnerability. This repository contains an example file that contains the default settings.
Auxiliary	Cobalt_Strike_Ansible	Cobalt Strike Ansible Deployment Guide (自动化部署与管理)
Auxiliary	Ansible Role: Cobalt Strike	Ansible Role: Cobalt Strike (自动化部署与管理)
Auxiliary	csOnvps	cobaltstrike4.4 自动化执行teamserver，快速临时开启Teamserver脚本。
Auxiliary	Cobalt Strike Sleep Python Bridge	This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the standard GUI client.
Auxiliary	c2_reporter	Ingests logs/dbs from cobalt and empire and outputs an excel report with activity, sessions, and credentials
Auxiliary	Cobalt Strike Beacon Dataset	Open Dataset of Cobalt Strike Beacon metadata (2018-2022)
Auxiliary	Dumpert	Dumpert, an LSASS memory dumper using direct system calls and API unhooking
Auxiliary	DuplicateDump	Dumping LSASS with a duplicated handle from custom LSA plugin
Auxiliary	BOFHound	Generate BloodHound compatible JSON from logs written by ldapsearch BOF and pyldapsearch
Auxiliary	PersistAssist	PersistAssist is a fully modular persistence framework written in C#. All persistence techniques contain a cleanup method which will server to remove the persistence aside from the persistence code.
Auxiliary	ElusiveMice	Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind
Phishing	GoFileBinder	A builder 🔨 for binding evil program 😈 and normal document 🐣
Synthesis	geacon	Using Go to implement CobaltStrike's Beacon
Synthesis	geacon	geacon:简单适配了一个profile配置文件,可直接拿来修改使用,用于cs上线linux.
Synthesis	redi	Automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt)
Synthesis	cs2modrewrite	Automatically Generate Rulesets for Apache mod_rewrite or Nginx for Intelligent HTTP C2 Redirection
Synthesis	cs2webconfig	Automatically Generate Rulesets for IIS for Intelligent HTTP/S C2 Redirection
Synthesis	RedGuard	RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
Synthesis	WebGuard	WebGuard是根据风起师傅的RedGuard和mgeeky师傅的RedWarden结合出来的http请求过滤器go包，亦在帮助采用go编写C2 http监听器做流量过滤和规则匹配
Synthesis	RedWarden	Flexible CobaltStrike Malleable Redirector
Synthesis	RedCaddy	C2 redirector base on caddy
Synthesis	Oratu	一个用于隐藏C2的、开箱即用的反向代理服务器。旨在省去繁琐的配置Nginx服务的过程。
Synthesis	Oss-stinger	利用oss实现http转发/cobalt strike上线
Synthesis	Apache Mod_Rewrite Terrafrom Automation	Bash scripts that take variables from the user and then call terraform scripts to automate standing up apache2 with mod_rewrite in front of C2 servers. Right now, this repo supports standing up redirectors in Linode or Digital Ocean, and I have different scripts for standing up http redirectors versus https redirectors. Since the mod_rewrite redirector setup scripts use a user agent value and optionally a bearer token, these redirectors are not C2 dependent and can work for any C2 that uses http or https.
Synthesis	Red-EC2	Deploy RedTeam Specific EC2 via ansible.
Synthesis	Rapid Attack Infrastructure	Red Team Infrastructure... Quick... Fast... Simplified.
Synthesis	RedCommander	Creates two Cobalt Strike C2 servers (DNS and HTTPS), with redirectors, and RedELK in Amazon AWS. Minimal setup required! Companion Blog here
Synthesis	CobaltPatch	Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be Appended In Stage / Post-Ex Blocks. Made for C Programmers
Synthesis	CPLResourceRunner	Run shellcode(Cobalt Strike) from resource
Synthesis	csdroid	cobaltstrike手机客户端 / cobaltstrike android
Dev	vscode-language-aggressor	This is a Visual Studio Code (VSC) extension that aims to provide: An implement of the Sleep and Cobalt Strike (CS) Aggressor grammar; and The definition of Cobalt Strike functions' prototype
Dev	PayloadAutomation	Payload Automation is a collection of Python classes for automating payload development, testing, opsec checking, and deployment with Cobalt Strike.
Dev	CrackSleeve	cs4.0 cs 4.1 beacon加解密
Dev	beacon	Former attempt at creating a independent Cobalt Strike Beacon
Dev	ExternalC2.NET	.NET Standard 2.0 libraries which implement Cobalt Strike's External C2 specfication (revision 0.1).
Dev	GPUSleep	GPUSleep moves the beacon image to GPU memory before the beacon sleeps, and move it back to main memory after sleeping.
Dev	CallStackMasker	A PoC implementation for dynamically masking call stacks with timers.
Crack	CSAgent	CobaltStrike 4.x通用白嫖及汉化加载器，采用javaagent+javassist的方式动态修改jar包，可直接加载原版cobaltstrike.jar，理论上支持到目前为止的所有4.x版本

0x06 Related Resources

Type	Name	Description
DATA	SilasCutler JARM Scan CobaltStrike Beacon Config.json	SilasCutler JARM Scan CobaltStrike Beacon Config
DATA	Cobalt Strike hashes	This page shows some basic information the Yara rule CobaltStrike including corresponding malware samples.
DATA	List of Cobalt Strike servers	List of Cobalt Strike servers
DATA	CobaltStrike samples pass=infected	CobaltStrike samples
DATA	List of spawns from exposed Cobalt Strike C2	List of spawns from exposed Cobalt Strike C2
DATA	C2IntelFeeds	Automatically created C2 Feeds based of Censys
YARA	apt_cobaltstrike	Cobalt Strike Yara
YARA	apt_cobaltstrike_evasive	Cobalt Strike Yara
YARA	rules	Cobalt Strike Yara
Rules	suricata-rules	Suricata IDS rules used to detect the red team penetration/malicious behavior, support testing CobaltStrike/MSF/Empire/DNS tunnels/Weevely scorpion/mining/rebound/kitchen/ice shell/ICMP tunnel, etc

Awesome

Awesome CobaltStrike

Contents

0x00 Introduction

0x01 Articles & Videos

1. Basic Knowledge

2. Crack and Customisation

3. Useful Trick

4. CobaltStrike Hide

5. CobaltStrike Analysis

6. CobaltStrike Video

0x02 C2 Profiles

0x03 BOF

0x04 Aggressor Script

0x05 Related Tools

0x06 Related Resources