Cobalt Strike 3.14 finally delivered some of the process injection flexibility I’ve long wanted to see in the product. In this post, I’d like to write about my thoughts on process injection, and share a few details on how Cobalt Strike’s implementation(s) work. Along the way, I will share details about which methods you might […]
Read More… from Cobalt Strike’s Process Injection: The Details
Cobalt Strike 3.13 is now available. This release adds a TCP Beacon, process argument spoofing, and extends the Obfuscate and Sleep capability to the SMB and TCP Beacons. TCP Beacon Cobalt Strike has long had the ability to pivot over named pipes. Cobalt Strike 3.13 expands this peer-to-peer pivoting model with the TCP Beacon. Now, you can […]
Cobalt Strike 3.12 is now available. This release adds an “obfuscate and sleep” in-memory evasion feature, gives operators [some] control over process injection, and introduces hooks to shape how Beacon launches PowerShell. Obfuscate and Sleep One method to find adversary presence in an environment is to sweep all running processes for common strings that indicate […]
Read More… from Cobalt Strike 3.12 – Blink and you’ll miss it
Cobalt Strike’s process to inject shellcode, via PowerShell, does not work with the latest Windows 10 update (v1803). While it’s possible to work without this capability, a lot of CS automation uses PowerShell. I’ve pushed an out-of-band update to Cobalt Strike 3.11 with a fix for this issue. What happened? The PowerShell shellcode injection scripts […]
Read More… from PowerShell Shellcode Injection on Win 10 (v1803)
Cobalt Strike 3.8 is now available. This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. Processes with Alternate Parents A favorite hunt technique is to instrument a host to report all new processes, […]
If you recently updated your penetration testing environment, it’s possible you were greeted with a special surprise. Cobalt Strike and its team server will no longer start. Instead of Cobalt Strike, you’re now greeted with this very intuitive and helpful error: The Parallel GC can not be combined with -XX:ParallelGCThreads=0. I’ve had a few emails […]
The 8th release of the Cobalt Strike 3.0 series is now available. The release extends Malleable C2 to influence how Beacon lives in memory, adds code-signing for executables, and gives operators control over which proxy server Beacon uses. There’s a lot of good stuff here. Let’s dig into it. Malleable PE A key goal of Cobalt Strike is to challenge […]
Cobalt Strike 3.6 is now available. This release adds an API to use third-party privilege escalation exploits with Beacon and extends Malleable C2 to allow HTTP C&C without HTTP POST. This release also includes fixes and improvements for existing features. Privilege Escalation API This release adds an API to integrate privilege escalation exploits into Beacon’s […]
Read More… from Cobalt Strike 3.6 – A Path for Privilege Escalation
Cobalt Strike 3.5.1 is now available. This release addresses a remote code execution vulnerability in Cobalt Strike. This vulnerability was discovered after a report of in-the-wild exploitation by a third-party. Cobalt Strike 3.5 and all prior versions are vulnerable. This includes 2.5 and below. Read last week’s advisory for more details. Strategic Cyber LLC advises all Cobalt […]
Read More… from Cobalt Strike 3.5.1 – Important Security Update
Summary There is a remote code execution vulnerability in the Cobalt Strike team server. A hot fix that breaks this particular exploit chain is available. Customers may use the built-in update program to download an update with this hotfix. The latest trial download has this hotfix as well. Strategic Cyber LLC is working on a comprehensive update […]
Read More… from Cobalt Strike RCE. Active Exploitation Reported.