BC-SECURITY/Malleable-C2-Profiles

Stars
333
Rank 126,599 (Top 3 %)
Language
Created about 4 years ago
Updated over 1 year ago

BC-SECURITY/Malleable-C2-Profiles

BC-SECURITY

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike & Empire.

Keep up-to-date on our blog at https://www.bc-security.org/blog

Check out the Empire 3 Post-Exploitation Framework

Malleable-C2-Profiles

A collection of profiles used in Cobalt Strike and Empire's Malleable C2 Listener. The list of profiles have all been tested and work successfully with Empire. Please feel free to contribute and add to the collection.

Acknowledgements

Thank you to the following repos for generating and publishing many of these.

Documentation

Starkiller

Starkiller is a Frontend for PowerShell Empire.

Beginners-Guide-to-Obfuscation

Moriarty

Moriarty is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments.

Invoke-ZeroLogon

Invoke-ZeroLogon allows attackers to impersonate any computer, including the domain controller itself, and execute remote procedure calls on their behalf.

Invoke-PrintDemon

This is a PowerShell Empire launcher PoC using PrintDemon and Faxhell.

DEFCON27

DEFCON 27 slides and workshop materials.

Offensive-VBA-and-XLS-Entanglement

IronSharpPack

IronSharpPack is a repo of popular C# projects that have been embedded into IronPython scripts that execute an AMSI bypass and then reflective load the C# project.

Long-Live-The-Empire

A comprehensive workshop aimed to equip participants with an in-depth understanding of modern Command and Control (C2) concepts, focusing on the open-source Empire C2 framework.

ScriptBlock-Smuggling

Example code samples from our ScriptBlock Smuggling Blog post

Empire-Cli

CLI Frontend for PowerShell Empire.

Taming-Offensive-IronPython

This workshop is designed to provide you with a solid understanding of IronPython, its integration with the .NET framework, and how it can be used to interact with other .NET languages.

Red-Team-Village-CTF-2023

Secure Terminal CTF Challenge for DC31 Red Team Village

SocksProxyServer-Plugin

Socks Proxy Server Plugin for Invoke-SocksProxy

DeathStarPlugin

Deathstar is an Empire plugin that automates gaining Domain and/or Enterprise Admin rights in Active Directory environments using common offensive tactics, techniques, and procedures (TTPs).

empire-docs

https://bc-security.gitbook.io/empire-wiki/

DEFCONSafeMode

DEFCON Safe Mode Slides

ChiselServer-Plugin

DEFCON24

DEFCON 24 slides and materials.

intro-ctf

Empire-Compiler

Twilio-Plugin

Empire-Launcher

denylist-plugin

Report-Generation-Plugin

Plugin for replacing the original reporting functionality in Empire with customizable PDFs.

AutoRun-Plugin

Plugin to automatically execute an agent tasking on checkin