Pinned Repositories
aggressor_script_examples
This repository contains tips, tricks, and examples of aggressor script functions. The intent is to share bite size examples that can be used in other scripts.
beacon_health_check
This aggressor script uses a beacon's note field to indicate the health status of a beacon.
bof-vs
A Beacon Object File (BOF) template for Visual Studio
bof_template
A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs are a way to rapidly extend the Beacon agent with new post-exploitation features.
CallStackMasker
A PoC implementation for dynamically masking call stacks with timers.
community_kit
Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and scripts have been written and published, but they can be challenging to locate. Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike. The Cobalt Strike team acts as the curator and provides this kit to showcase this fantastic work.
ElevateKit
The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.
Malleable-C2-Profiles
Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.
sleep_python_bridge
This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the standard GUI client. NOTE: This project is very much in BETA. The goal is to provide a playground for testing and is in no way an officially support feature. Perhaps this could be something added in the future to the core product.
teamserver-prop
TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the “HotCobalt” vulnerability. This repository contains an example file that contains the default settings.
Cobalt Strike's Repositories
Cobalt-Strike/community_kit
Cobalt Strike is a post-exploitation framework designed to be extended and customized by the user community. Several excellent tools and scripts have been written and published, but they can be challenging to locate. Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike. The Cobalt Strike team acts as the curator and provides this kit to showcase this fantastic work.
Cobalt-Strike/CallStackMasker
A PoC implementation for dynamically masking call stacks with timers.
Cobalt-Strike/Malleable-C2-Profiles
Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.
Cobalt-Strike/sleep_python_bridge
This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the standard GUI client. NOTE: This project is very much in BETA. The goal is to provide a playground for testing and is in no way an officially support feature. Perhaps this could be something added in the future to the core product.
Cobalt-Strike/beacon_health_check
This aggressor script uses a beacon's note field to indicate the health status of a beacon.
Cobalt-Strike/bof_template
A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs are a way to rapidly extend the Beacon agent with new post-exploitation features.
Cobalt-Strike/bof-vs
A Beacon Object File (BOF) template for Visual Studio
Cobalt-Strike/ElevateKit
The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.
Cobalt-Strike/teamserver-prop
TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the “HotCobalt” vulnerability. This repository contains an example file that contains the default settings.
Cobalt-Strike/ProxyDLLExample
code for the Proxy DLL example blog post
Cobalt-Strike/unhook-bof
Remove API hooks from a Beacon process.
Cobalt-Strike/obfuscator-llvm
Cobalt-Strike/callback_examples
This contains a number of examples demonstrating how to use callback functions in supported aggressor script functions
Cobalt-Strike/ZeroLogon-BOF
Cobalt-Strike/aggressor_script_examples
This repository contains tips, tricks, and examples of aggressor script functions. The intent is to share bite size examples that can be used in other scripts.
Cobalt-Strike/CVE-2020-0796-BOF
Cobalt-Strike/cortana-scripts
A collection of Cortana scripts that you may use with Armitage and Cobalt Strike 2.x. Cortana Scripts are not compatible with Cobalt Strike 3.x. Cobalt Strike 3.x uses a variant of Cortana called Aggressor Script.
Cobalt-Strike/vncdll
Stand-alone VNC server compiled as a Reflective DLL
Cobalt-Strike/sleep
Automatically exported from code.google.com/p/sleep