imactrlu Goto Github PK

aggressorscripts

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

aggressorscripts-1

Aggressor scripts for use with Cobalt Strike 3.0+

bof-dll-inject

Manual Map DLL injection implemented with Cobalt Strike's Beacon Object Files.

bof-regsave

Dumping SAM / SECURITY / SYSTEM registry hives with a Beacon Object File

bofs

Beacon Object Files

cobalt_strike_extension_kit

Attempting to be an all in one repo for others' userful aggressor scripts as well as things we've found useful during Red Team Operations.

cobaltstrike

CobaltStrike

credbandit

Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel

detect-hooks

Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR

f8x

红/蓝队环境自动化部署工具 | Red/Blue team environment automation deployment tool

findobjects-bof

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.

handlekatz_bof

A BOF port of the research of @thefLinkk and @codewhitesec

hollow

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode

injectamsibypass

Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.

inlineexecute-assembly

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

lstar

LSTAR - CobaltStrike 综合后渗透插件

nanodump

Dump LSASS like you mean it

phant0m

Windows Event Log Killer

smbeagle

snaffler

a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

spawn

Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.

spoolsystem

Print Spooler Named Pipe Impersonation for Cobalt Strike

wdtoggle

A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching.

whereami

Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.

winrmdll

C++ WinRM API via Reflective DLL