• Stars
    star
    122
  • Rank 292,031 (Top 6 %)
  • Language
    C
  • Created over 7 years ago
  • Updated over 3 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

POC for Cobalt Strike external C2

Synopsis

Cobalt Strike contains a new / experimental feature called external_c2. This bypasses the mallable profiles and allows the developper to craft it's own channels. This code is a POC, that in the end appeared to be the solution to a real life problem.

Code content

  • c2file.c: a C implementation of the client (the process in talking to beacon)
  • c2file_dll.c, c2file_dll.h, c2file.py: A python implementation of the client (using a dll, the process in talking to beacon) allowing for quick development of complex channels
  • python_c2ex.py: The server talking to the external_c2 plugin of teamserver.
  • externalc2_start.cna: the script needed to start the external_c2 on teamserver.

Blog

Read our blog for more info: https://outflank.nl/blog/2017/09/17/blogpost-cobalt-strike-over-external-c2-beacon-home-in-the-most-obscure-ways/

Installation

i686-w64-mingw32-gcc -shared c2file_dll.c -o c2file.dll

Contributors

Thanks to @armitagehacker for providing info on external_c2 functionality including C sample code that was essentially to make this work. Thanks to Marc Smeets (@mramsmeets), author of the blog and the one to implement this POC in a real assignment. Code written by Mark Bergman (@xychix) but heavily relying on @armitagehacker initial C example.

License

BSD license

More Repositories

1

RedELK

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
Python
2,342
star
2

EvilClippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
C#
2,095
star
3

Dumpert

LSASS memory dumper using direct system calls and API unhooking.
C
1,464
star
4

C2-Tool-Collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
C
1,090
star
5

Invoke-ADLabDeployer

Automated deployment of Windows and Active Directory test lab networks. Useful for red and blue teams.
PowerShell
477
star
6

SharpHide

Tool to create hidden registry keys.
C#
463
star
7

Spray-AD

A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.
C++
419
star
8

PrintNightmare

C
331
star
9

Ps-Tools

Ps-Tools, an advanced process monitoring toolkit for offensive operations
C
327
star
10

Excel4-DCOM

PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
PowerShell
321
star
11

Recon-AD

Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
C++
312
star
12

InlineWhispers

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)
Assembly
299
star
13

Scripts

Small scripts that make life better
JavaScript
289
star
14

FindObjects-BOF

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.
266
star
15

WdToggle

A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching.
213
star
16

edr-internals

Tools for analyzing EDR agents
C++
191
star
17

Zipper

Zipper, a CobaltStrike file and folder compression utility.
C
189
star
18

HelpColor

Agressor script that lists available Cobalt Strike beacon commands and colors them based on their type
188
star
19

TamperETW

PoC to demonstrate how CLR ETW events can be tampered.
C
186
star
20

Presentations

Presentation material presented by Outflank team members at public events.
177
star
21

NetshHelperBeacon

Example DLL to load from Windows NetShell
C++
174
star
22

Net-GPPPassword

.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
C#
163
star
23

DoH_c2_Trigger

Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/
PowerShell
54
star
24

Training-MSOfficeOffensiveTradecraft

Info related to the Outflank training: Microsoft Office Offensive Tradecraft
50
star
25

unmanaged-dotnet-patch

Modify managed functions from unmanaged code
C++
50
star
26

PasswordDump2ELK

Clean public password dump files and store in ELK
Shell
36
star
27

RedELK-workshop

Items related to the RedELK workshop given at security conferences
25
star
28

Exploits

Exploits developped by Outflank B.V. team members
Python
21
star
29

RedFile

Serving files with conditions, serverside keying and more.
Python
19
star
30

Invoke-Templator

A PowerShell script to parse the docx/docm file format and update the template location.
PowerShell
17
star