improsec/SharpEventPersist

problem

Closed this issue · 2 comments

m0s30 commented

can u show me a example for the file shellcode.bin?
Is it generated by cs which is raw format?

m0s30 commented

is that mean,i don't need to convert the bin to hex by myself? And the program will convert the raw bin to hex automatically?
I hope to get your answer.thanks

Hi PANDA-MS.
You can get the shellcode from Cobalt Strike by selecting "Attacks -> Packages -> Windows Executable (S)" and choose "Raw" output. Remember to select "Use x64 payload". You can also use stageless raw x64 shellcode from Cobalt Strike.
You don't need to convert it to anything. Just save the shellcode from Cobalt Strike as "whatever.bin" and run the tool with "-file C:\path\to\whatever.bin".