Author Archives: rsmudge

Time to time, I find myself in an email exchange about payload security and payload staging. The payload security discussion revolves around Beacon’s security features. Once it is running on target, Beacon takes steps to authenticate its controller and establish a session-specific key to decrypt tasks and encrypt output. I discuss these security features at the end […] Continue reading Talk to your children about Payload Staging→

I’ve had a few questions about Cobalt Strike’s stageless payloads and how these compare to other payload varieties. In this blog post, I’ll explain stageless payloads and why you might prefer stageless payload artifacts in different situations. What is payload staging? A stageless payload artifact is an artifact [think executable, DLL, etc.] that runs a […] Continue reading What is a stageless payload artifact?→

Session passing is using one payload to spawn another payload. Sometimes, the payloads are from the same toolset. Other times, they’re not. Session passing options allow you to hand-off accesses between toolkits and infrastructure. In this blog post, I’ll take you through the session passing options in Cobalt Strike. Multi-server Cobalt Strike (Beacon) If you […] Continue reading Session Passing from Cobalt Strike→

This blog post is a fast overview of Cobalt Strike. I assume that you are familiar with Meterpreter, Mimikatz, and make use of Offensive PowerShell in your work. This post does not replace the documentation or videos, but it’s a quick way to become familiar with Cobalt Strike concepts that are not immediately obvious. Starting Cobalt […] Continue reading Raffi’s Abridged Guide to Cobalt Strike→

Cobalt Strike 3.3 – Now with less PowerShell.exe. 🙂 Continue reading Cobalt Strike 3.3 – Now with less PowerShell.exe→

Some hackers only think about access. It’s the precious. How to get that first shell? I don’t care too much about this. I’m concerned about the problems that come from having a lot of accesses. One of these problems has to do with user exploitation. If you have access to 50 or more systems at […] Continue reading User Exploitation at Scale→

Aggressor Script is the scripting engine in Cobalt Strike 3.0 and later. If you want to learn more about it, I recommend reading the documentation. In this blog post, I’ll provide some history around Aggressor Script so you can better understand it and where it comes from. The mIRC Factor mIRC is a popular client for […] Continue reading Aggressor Script’s Secret mIRC Scripting Past→

One of the most important things in a red teamer’s job is evidence. If you can’t demonstrate impact and make a risk real, it’s as if you didn’t find the problem. Screenshots go a long way towards this. Cobalt Strike has several options to capture screenshots during your engagement. In this post, I’ll quickly take […] Continue reading Pics or it didn’t happen…→