Cobalt-clip is clipboard addons for cobaltstrike to interact with clipboard. With this you can dump, edit and monitor the content of q clipboard.
You load clipmon.cna in your cobaltstrike and you have 3 new commands :
- dumpclip : Dump the content of the clipboard and send the output to an operator
- set-clipboard-data : Change the content of a clipboard
- clipmon : Monitor the clipboard. For each clipboard updated, you have the content of the clipboard, the current window and the date with hours.
⚠️ clipmon is reflective dll launched as post-exploitation jobs with bdllspawn function (.cna script). cobaltstrike have a buffer to receive output of reflective dll, you don't receive it directly.
For dumpclip and set-clipboard-data. Iis Beacon Object Files, you have a .sh script to compil in x64. For clipmon. It was made on visualstudio. the source code was based on : https://github.com/stephenfewer/ReflectiveDLLInjection.
Thanks to @MeltraActor (https://twitter.com/meltraactor) and @Sh0ckFR (https://twitter.com/sh0ckfr) for advise