Cobalt Strike CheatSheet

General notes and advices for cobalt strike C2 framework.

Summary

• Cobalt Strike CheatSheet
  • Summary
  • Basic Menu Explanation
  • Listeners
  • Malleable C2 Profiles
  • Aggressor Scripts
  • Common Commands
  • Exploitation
  • Privilege Escalation
  • Pivoting
  • Lateral Movement
  • Exflitration
  • Miscellaneous
  • OPSEC Notes

Basic Menu Explanation

• Cobalt Strike: The first and most basic menu, it contains the functionality for connecting to a team server, set your preferences, change the view of beacon sessions, manage listeners and aggressor scripts.
• View: The view menu consists of elements that manages targets, logs, harvested credentials, screenshots, keystrokes etc. The main purpose of it is to provide an easy way to access the output of many modules, manage your loots and domain targets.
• Attacks: This menu contains numerous client side attack generating methods like phishing mails, website cloning and file hosting. Also provides numerous ways to generate your beacon payloads or just generate shellcode and save it for later use on another obfuscation tool.
• Reporting: It provides an easy way to generate pdf or spreadsheet files containing information about the execution of an attack, this way it assists you on organizing small reports, making the final report writing process easier.
• Help: Basic help menu of the tool.

Listeners

Egress Listeners

• HTTP/HTTPS: The most basic payloads for beacon, by default the listeners will listen on ports 80 and 443 with always the option to set custom ports. You have the options to set proxy settings, customize the HTTP header or specify a bind port to redirect beacon's traffic if the infrastructure uses redirector servers for the payload callbacks.
• DNS: A very stealthy payload options, provides stealthier traffic over the dns protocol, you need to specify the DNS server to connect to. The best situation to use this type of listener is in a really locked down environment that blocks even common traffic like port 80 and 443.

Pivot Listeners

• TCP: A basic tcp listener that bound on a spesific port.
• SMB: An amazing option for internal spread and lateral move, this payload uses named pipes over the smb protocol and is the best approach to bypass firewalls when even default ports like 80 and 443 are black listed.

Miscellaneous Listeners

• Foreign HTTP/HTTPS: These type of listeners give us the option to pass a session from the metasploit framework to cobalt strike using either http or https payloads. A useful example is to execute an exploit module from metasploit and gain a beacon session on cobalt strike.
• External C2: This is a special type of listener that gives the option to 3rd party applications to act as a communication medium for beacon.