CobaltStrike優質學習資源

0x00 前言

1. 第一部分是關於CobaltStrike優質文章的集合
2. 關於新特性BOF資源的整合
3. 解決要用的時候找不到合適aggressor script或者BOF的問題
4. 如果有本repo沒有涉及的優質內容，歡迎大家提交pr

0x01 相關文章合集

1. 基礎知識參考

1. Cobalt_Strike_wiki
2. CobaltStrike4.0筆記
3. cobaltstrike4.1筆記
4. CobaltStrike相關網絡文章集合
5. Cobalt Strike 外部 C2【一、原理篇】
6. Cobalt Strike 桌面控制問題的解決（以及屏幕截圖等后滲透工具）
7. Cobalt Strike & MetaSploit 聯動

2. 破解以及定制參考

1. IntelliJ-IDEA修改cobaltstrike
2. CobaltStrike二次開發環境准備
3. Cobal Strike 自定義OneLiner
4. 通過反射DLL注入來構建后滲透模塊（第一課）
5. Cobalt Strike Aggressor Script （第一課）
6. Cobalt Strike Aggressor Script （第二課）

3. 使用技巧參考

1. Cobalt Strike Spear Phish
2. run CS in win -- teamserver.bat
3. Remote NTLM relaying through CS -- related to CVE_2018_8581
4. Cobalt Strike Convet VPN
5. 滲透神器CS3.14搭建使用及流量分析
6. CobaltStrike生成免殺shellcode
7. CS-notes--一系列CS的使用技巧筆記
8. 使用 Cobalt Strike 對 Linux 主機進行后滲透
9. Cobalt Strike Listener with Proxy
10. Cobalt Strike Convet VPN
11. CS 4.0 SMB Beacon
12. Cobalt Strike 瀏覽器跳板攻擊
13. Cobalt Strike 中 Bypass UAC

4. CobaltStrike隱匿參考

1. CobaltStrike證書修改躲避流量審查
2. CS 合法證書 + Powershell 上線
3. Cobalt Strike 團隊服務器隱匿

5. CobaltStrike分析參考

1. Volatility Plugin for Detecting Cobalt Strike Beacon. blog|Toolset
2. 逆向分析Cobalt Strike安裝后門
3. 分析cobaltstrike c2 協議
4. Small tool to decrypt a Cobalt Strike auth file

0x02 C2 Profiles

Type	Name	Description	Popularity	Language
ALL	Malleable-C2-Profiles	Official Malleable C2 Profiles
ALL	Malleable-C2-Randomizer	This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage
ALL	malleable-c2	Cobalt Strike Malleable C2 Design and Reference Guide
ALL	C2concealer	C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.

0x03 BOF

Type	Name	Description	Popularity	Language
ALL	BOF_Collection	Various Cobalt Strike BOFs
ALL	Situational Awareness BOF	Its larger goal is providing a code example and workflow for others to begin making more BOF files. Blog
ALL	QueueUserAPC_PPID	BOF spawns a process of your choice under a specified parent, and injects a provided shellcode file via QueueUserAPC().
ALL	bof_helper	Beacon Object File (BOF) Creation Helper

0x04 Aggressor Script

Type	Name	Description	Popularity	Language
BypassAV	BypassAV	用於快速生成免殺的可執行文件
BypassAV	scrun	BypassAV ShellCode Loader (Cobaltstrike/Metasploit) Useage
BypassAV	beacon-c2-go	beacon-c2-go (Cobaltstrike/Metasploit)
BypassAV	C--Shellcode	python ShellCode Loader (Cobaltstrike&Metasploit) Useage
Recon	red-team-scripts	perform some rudimentary Windows host enumeration with Beacon built-in commands
Recon	aggressor-powerview	All functions listed in the PowerView about page are included in this with all arguments for each function. PowerView
Recon	PowerView3-Aggressor	PowerView Aggressor Script for CobaltStrike PowerView
Recon	AggressorScripts	Sharphound-Aggressor- A user menu for the SharpHound ingestor
Recon	ServerScan	內網橫向信息收集的高並發網絡掃描、服務探測工具。
Exploit	XSS-Fishing2-CS	魚兒在cs上線后自動收桿 / Automatically stop fishing in javascript after the fish is hooked
Exploit	XSS-Phishing	xss釣魚，cna插件配合php后端收桿
Exploit	custom_payload_generator	CobaltStrike3.0+ --> creates various payloads for Cobalt Strike's Beacon. Current payload formats
Exploit	CrossC2	CrossC2 framework - Generator CobaltStrike's cross-platform beacon
Exploit	GECC	Go External C2 Client implementation for cobalt strike.
Exploit	Cobaltstrike-MS17-010	ms17-010 exploit tool and scanner.
Exploit	AES-PowerShellCode	Standalone version of my AES Powershell payload for Cobalt Strike.
Exploit	SweetPotato_CS	CobaltStrike4.x --> SweetPotato
Exploit	ElevateKit	privilege escalation exploits
Exploit	CVE-2018-4878	CVE-2018-4878
Exploit	Aggressor-Scripts	The only current public is UACBypass, whose readme can be found inside its associated folder.
Exploit	CVE_2020_0796_CNA	基於ReflectiveDLLInjection實現的本地提權漏洞
Exploit	DDEAutoCS	setup our stage(d) Web Delivery attack
Exploit	geacon	Implement CobaltStrike's Beacon in Go (can be used in Linux)
Persistence	persistence-aggressor-script	persistence-aggressor-script
Persistence	Peinject_dll	棄用winexec函數，使用shellexecute函數，程序流不在卡頓，達到真正的無感。
Persistence	TikiTorch	TikiTorch follows the same concept(CACTUSTORCH) but has multiple types of process injection available, which can be specified by the user at compile time.
Persistence	CACTUSTORCH	A JavaScript and VBScript shellcode launcher. This will spawn a 32 bit version of the binary specified and inject shellcode into it.
Persistence	UploadAndRunFrp	上傳frpc並且運行frpc
Persistence	persistence-aggressor-script	Persistence Aggressor Script
Auxiliary	Cobaltstrike-atexec	利用任務計划進行橫向，需要與135端口、445端口進行通信
Auxiliary	SharpCompile	SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime.
Auxiliary	Quickrundown	Utilizing QRD will allow an operator to quickly characterize what processes are both known and unknown on a host through the use of colors and notes about the processes displayed.
Auxiliary	Phant0m_cobaltstrike	This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running.
Auxiliary	NoPowerShell	NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms.
Auxiliary	EventLogMaster	RDP EventLog Master
Auxiliary	ANGRYPUPPY	Bloodhound Attack Path Execution for Cobalt Strike
Auxiliary	CobaltStrike_Script_Wechat_Push	上線微信提醒的插件,通過微信Server醬提醒
Auxiliary	CS-Aggressor-Scripts	slack and webhooks reminder
Auxiliary	Aggressor-Scripts	surveying of powershell on targets (在對應的目標上檢測powershell的相關信息)
Auxiliary	cs-magik	Implements an events channel and job queue using Redis for Cobalt Strike.
Auxiliary	AggressorScripts	查看進程的時候講av進程標注為紅色
Auxiliary	Raven	CobaltStrike External C2 for Websockets
Auxiliary	CobaltStrikeParser	Python parser for CobaltStrike Beacon's configuration
Auxiliary	fakelogonscreen	FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password.
Auxiliary	SyncDog	Make bloodhound sync with cobaltstrike.
Synthesis	Erebus	CobaltStrike4.x --> Erebus CobaltStrike后滲透測試插件
Synthesis	Cobalt-Strike-Aggressor-Scripts	CobaltStrike后滲透測試插件集合 Usage
Synthesis	AggressorScripts	Aggressor scripts for use with Cobalt Strike 3.0+
Synthesis	RedTeamTools	RedTeamTools for use with Cobalt Strike
Synthesis	cobalt-arsenal	Aggressor Scripts for Cobalt Strike 4.0+
Synthesis	MoveKit	The aggressor script handles payload creation by reading the template files for a specific execution type. intro
Synthesis	StayKit	The aggressor script handles payload creation by reading the template files for a specific execution type. intro
Synthesis	AggressorScripts	AggressorScripts
Synthesis	AggressorScripts	Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
Synthesis	AggressorScripts	AggressorScripts
Synthesis	Aggressor-VYSEC	Contains a bunch of CobaltStrike Aggressor Scripts
Synthesis	AggressorAssessor	AggressorAssessor
Synthesis	AggressorAssessor	AggressorAssessor
Synthesis	aggressor-scripts	Collection of Cobalt Strike Aggressor Scripts
Synthesis	Aggressor-scripts	This is just a random collection of Aggressor Scripts I've written for Cobalt Strike 3.x. (其中有一個debug腳本比較好用)
Synthesis	Aggressor-Script	Collection of Aggressor Scripts for Cobalt Strike(主要包含了提權和權限維持腳本)
Synthesis	Aggressor-Script	Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on
Synthesis	aggressor_scripts_collection	Collection of various aggressor scripts for Cobalt Strike from awesome people. Will be sure to update this repo with credit to each person.
Synthesis	CobaltStrike-ToolKit	googlesearch.profile and script related to AD.
Synthesis	Arsenal	Cobalt Strike 3.13 Arsenal Kit
Synthesis	cobalt-arsenal	My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+
Synthesis	aggressor_scripts	code execution via DCOM;the privilege escalation techniques included in ElevateKit;etc.
Synthesis	aggressor_scripts	code execution via DCOM;the privilege escalation techniques included in ElevateKit;etc.
Synthesis	aggressor	creating tunnels with netsh; changed default to bit.ly redirect to mcdonalds;using powershell to kill parent process;
Synthesis	CobaltStrikeCNA	A collection of scripts - from various sources - see script for more info.
Synthesis	AggressorScripts	Highlights selected processes from the ps command in beacon;Loads various aliases into beacon;sets a few defaults for scripts to be used later..
Synthesis	AggressorAssessor	從C2生成到橫向移動的全輔助腳本套件
Synthesis	AggressorCollection	Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors
Synthesis	Cobaltstrike-Aggressor-Scripts-Collection	The collection of tested cobaltstrike aggressor scripts.
Synthesis	aggressorScripts	CobaltStrike AggressorScripts for the lazy
Synthesis	cobalt_strike_extension_kit	集成了SharpHound,SharpRDP,SharpWMI等在內的各種內網工具，使用AggressorScripts構建workflow

0x05 Related Tools

Type	Name	Description	Popularity	Language
AntiCS	cobaltstrike_brute	Cobalt Strike Team Server Password Brute Forcer
Auxiliary	redshell	An interactive command prompt that executes commands through proxychains and automatically logs them on a Cobalt Strike team server.
Auxiliary	Ansible-Cobalt-Strike	An Ansible role to install cobalt-strike on debian based architectures, let's be honest it's for kali.
Synthesis	redi	Automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt)
Synthesis	cs2modrewrite	Automatically Generate Rulesets for Apache mod_rewrite or Nginx for Intelligent HTTP C2 Redirection
Synthesis	Red-EC2	Deploy RedTeam Specific EC2 via ansible.)

0x06 Source Code

Type	Name	Description
Source	cobalt-strike-source	Cobalt Strike 3.12 Source Code (Decompiled and Fixed)