Collaborate Disseminate
If I had to describe Cobalt Strike in one word, I’d say ‘flexible’. There are a lot of options to control Cobalt Strike’s features and indicators. In this post, I’ll introduce these options, explain the rationale for each, and point you to resources to explore them further. Aggressor Script Aggressor Script is Cobalt Strike’s built-in […]
Continue reading Kits, Profiles, and Scripts… Oh my!
Cobalt Strike 3.9 is now available. This release brings several additions to Malleable C2 with an emphasis on staging flexibility. Malleable HTTP/S Staging Stagers are tiny programs that download the Beacon payload and pass control to it. Stagers are a way to use a size-constrained attack to deliver a large payload like Beacon. While I […]
Continue reading Cobalt Strike 3.9 – Livin’ in a Stager’s Paradise
Cobalt Strike 3.8 is now available. This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. Processes with Alternate Parents A favorite hunt technique is to instrument a host to report all new processes, […]
Continue reading Cobalt Strike 3.8 – Who’s Your Daddy?
If you recently updated your penetration testing environment, it’s possible you were greeted with a special surprise. Cobalt Strike and its team server will no longer start. Instead of Cobalt Strike, you’re now greeted with this very intuitive and helpful error: The Parallel GC can not be combined with -XX:ParallelGCThreads=0. I’ve had a few emails […]
Continue reading Java Startup Bug in Java 1.8u131
The 8th release of the Cobalt Strike 3.0 series is now available. The release extends Malleable C2 to influence how Beacon lives in memory, adds code-signing for executables, and gives operators control over which proxy server Beacon uses. There’s a lot of good stuff here. Let’s dig into it. Malleable PE A key goal of Cobalt […]
Continue reading Cobalt Strike 3.7 – Cat, Meet Mouse
This is a short blog post with a long title. A few weeks ago, Matt Nelson published Lateral Movement Using the MMC20.APPLICATION COM Object (there’s a Part 2 as well!). The post documents an option, beyond the usual suspects (e.g., services, scheduled tasks, wmi, etc.), to ask a remote system to run a process for […]
Continue reading Scripting Matt Nelson’s MMC20.Application Lateral Movement Technique
Cobalt Strike 3.6 is now available. This release adds an API to use third-party privilege escalation exploits with Beacon and extends Malleable C2 to allow HTTP C&C without HTTP POST. This release also includes fixes and improvements for existing features. Privilege Escalation API This release adds an API to integrate privilege escalation exploits into Beacon’s […]
Continue reading Cobalt Strike 3.6 – A Path for Privilege Escalation
Cobalt Strike 3.5.1 is now available. This release addresses a remote code execution vulnerability in Cobalt Strike. This vulnerability was discovered after a report of in-the-wild exploitation by a third-party. Cobalt Strike 3.5 and all prior versions are vulnerable. This includes 2.5 and below. Read last week’s advisory for more details. Strategic Cyber LLC advises […]
Continue reading Cobalt Strike 3.5.1 – Important Security Update
Summary There is a remote code execution vulnerability in the Cobalt Strike team server. A hot fix that breaks this particular exploit chain is available. Customers may use the built-in update program to download an update with this hotfix. The latest trial download has this hotfix as well. Strategic Cyber LLC is working on a […]
Continue reading Cobalt Strike RCE. Active Exploitation Reported.
Cobalt Strike 3.5 is now available. This release adds an SSH client with a Beacon-like interface. This client allows you to conduct post-exploitation actions against UNIX targets from Cobalt Strike. In this post, I’ll take you through the specifics. The SSH Client Cobalt Strike’s SSH client is a Reflective DLL that receives tasks from and […]
Continue reading Cobalt Strike 3.5 – UNIX Post Exploitation