Cobalt Strike 3.9 – Livin’ in a Stager’s Paradise

Cobalt Strike 3.9 is now available. This release brings several additions to Malleable C2 with an emphasis on staging flexibility. Malleable HTTP/S Staging Stagers are tiny programs that download the Beacon payload and pass control to it. Stagers are a way to use a size-constrained attack to deliver a large payload like Beacon. While I recommend […]

Read More… from Cobalt Strike 3.9 – Livin’ in a Stager’s Paradise

Cobalt Strike 3.8 – Who’s Your Daddy?

Cobalt Strike 3.8 is now available. This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. Processes with Alternate Parents A favorite hunt technique is to instrument a host to report all new processes, […]

Read More… from Cobalt Strike 3.8 – Who’s Your Daddy?

Cobalt Strike 3.7 – Cat, Meet Mouse

The 8th release of the Cobalt Strike 3.0 series is now available. The release extends Malleable C2 to influence how Beacon lives in memory, adds code-signing for executables, and gives operators control over which proxy server Beacon uses. There’s a lot of good stuff here. Let’s dig into it. Malleable PE A key goal of Cobalt Strike is to challenge […]

Read More… from Cobalt Strike 3.7 – Cat, Meet Mouse

Scripting Matt Nelson’s MMC20.Application Lateral Movement Technique

This is a short blog post with a long title. A few weeks ago, Matt Nelson published Lateral Movement Using the MMC20.APPLICATION COM Object (there’s a Part 2 as well!). The post documents an option, beyond the usual suspects (e.g., services, scheduled tasks, wmi, etc.), to ask a remote system to run a process for […]

Read More… from Scripting Matt Nelson’s MMC20.Application Lateral Movement Technique

Cobalt Strike 3.6 – A Path for Privilege Escalation

Cobalt Strike 3.6 is now available. This release adds an API to use third-party privilege escalation exploits with Beacon and extends Malleable C2 to allow HTTP C&C without HTTP POST. This release also includes fixes and improvements for existing features. Privilege Escalation API This release adds an API to integrate privilege escalation exploits into Beacon’s […]

Read More… from Cobalt Strike 3.6 – A Path for Privilege Escalation

Agentless Post Exploitation

Agentless Post Exploitation is using system administration capabilities to meet post-exploitation objectives, without an agent on the target. It’s just evil system administration. This talk is a survey of agentless post-exploitation techniques. It covers how to execute commands, upload/download files, harvest credential material, user exploitation, and pivoting. Enjoy! You may also download the slides as well. […]

Read More… from Agentless Post Exploitation