Cooolis-ms

Wiki Documentation

---

Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team personnel to transition more conveniently and quickly from a web container environment to a C2 environment for further work.

How to download it?

• You can clone the repository directly from Github to get the source code: git clone https://github.com/Rvn0xsy/Cooolis-ms
• You can also download the latest compiled version from the Release page

Basic Instructions

1. Cooolis-ms references the Metasploit API documentation to implement the RPC service client functionality, allowing the Cooolis-ms server to send arbitrary payloads, thereby increasing the flexibility of Cooolis-ms.
2. Cooolis-ms borrows from MemoryModule to implement PE loading, reducing the execution characteristics of Cooolis-ms and lowering the chance of detection.
3. Cooolis-ms borrows from ReflectiveDLLInjection to implement reflective DLL loading, execution, and injection, reducing the execution characteristics of Cooolis-ms and lowering the chance of detection.
4. Cooolis-ms references External C2 (Third-party Command and Control) to implement basic External C2 execution, reducing the execution characteristics of Cooolis-ms and lowering the chance of detection.
5. Cooolis-ms also considers using files from an Aliyun OSS server as execution code, automatically loading them into memory for execution, thereby increasing the flexibility of Cooolis-ms.

Usage

Currently Cooolis-ms has the following subcommands:

[~\Documents\Cooolis-ms\Cooolis-ms-Loader\Release]> .\Cooolis-ms.exe -h
Version v1.2.6
Usage: C:\Users\Administrator\Documents\Cooolis-ms\Cooolis-ms-Loader\Release\Cooolis-ms.exe [OPTIONS] SUBCOMMAND

Options:
  -h,--help                   Print this help message and exit

Subcommands:
  metasploit                  Metasploit RPC Loader
  cobaltstrike                Cobalt Strike External C2 Loader
  reflective                  Reflective DLL injection
  shellcode                   Shellcode Loader

Get detailed parameters for subcommands by adding -h/--help after the subcommand:

[~\Documents\Cooolis-ms\Cooolis-ms-Loader\Release]> .\Cooolis-ms.exe metasploit -h
Metasploit RPC Loader
Usage: C:\Users\Administrator\Documents\Cooolis-ms\Cooolis-ms-Loader\Release\Cooolis-ms.exe metasploit [OPTIONS]

Options:
  -h,--help                   Print this help message and exit
  -p,--payload TEXT=windows/meterpreter/reverse_tcp
                              Payload Name, e.g. windows/meterpreter/reverse_tcp
  -o,--options TEXT           Payload options, e.g. LHOST=1.1.1.1,LPORT=8866
  -P,--PORT UINT:INT in [1 - 65535]=8899 REQUIRED
                              RPC Server Port
  -H,--HOST TEXT:IPV4 REQUIRED
                              RPC Server Host

Detailed Subcommand Usage

• metasploit
• cobaltstrike
• reflective
• shellcode

Learning and Extension

You can refer here to create your own good projects

• Static Malicious Code Evasion (Lesson 1)
• Static Malicious Code Evasion (Lesson 2)
• Static Malicious Code Evasion (Lesson 3)
• Static Malicious Code Evasion (Lesson 4)
• Static Malicious Code Evasion (Lesson 5)
• Static Malicious Code Evasion (Lesson 6)
• Static Malicious Code Evasion (Lesson 7)
• Static Malicious Code Evasion (Lesson 8)
• Static Malicious Code Evasion (Lesson 9)

Miscellaneous

If you like this project, please give me a Star～

Issue

Submit suggestions or issues

LICENSE

GNU General Public License v3.0