KaynStrike
A User Defined Reflective Loader for Cobalt Strike Beacon that spoofs the thread start address and frees itself after entry point was executed.
Thread Start Address spoofing
Reflective Loader cleanup
Proof
How to use this
Just load the KaynStrike.cna agressor script and build a stageless beacon (tested this as an exe)
Credits
- S4ntiagoP. Had the idea from one of his tweets to free the reflective loader
- Austin Hudson (aka SecIdiot). Reflective Loader Design & ROP Chain