zer0yu/awesome-cobaltstrike
List of Awesome CobaltStrike Resources
| Type | Name | Description | Popularity | Language |
|---|
| ALL | Malleable-C2-Profiles | Official Malleable C2 Profiles |  |  |
| ALL | Malleable-C2-Randomizer | This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage |  |  |
| ALL | malleable-c2 | Cobalt Strike Malleable C2 Design and Reference Guide |  |  |
| ALL | Malleable-C2-Profiles | A collection of profiles used in Cobalt Strike and Empire's Malleable C2 Listener. |  |  |
| ALL | random_c2_profile | Random C2 Profile Generator |  |  |
| ALL | SourcePoint | SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion. |  |  |
| ALL | C2concealer | C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike. |  |  |
| ALL | MalleableC2-Profiles | A collection of Cobalt Strike Malleable C2 profiles. now have Windows Updates Profile |  |  |
| ALL | MalleableC2-Profiles | Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike |  |  |
| ALL | pyMalleableC2 | A Python interpreter for Cobalt Strike Malleable C2 profiles that allows you to parse, modify, build them programmatically and validate syntax. |  |  |
| ALL | 1135-CobaltStrike-ToolKit | Cobalt Strike的Malleable C2配置文件，被设计用来对抗流量分析 |  |  |
| ALL | service_cobaltstrike | CobaltStrike profile |  |  |
| ALL | CobaltNotion | A spin-off research project. Cobalt Strike x Notion collab 2022. |  |  |
| ALL | Burp2Malleable | This is a quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles. |  |  |
| ALL | autoRebind | Automatically parse Malleable C2 profiled into CrossC2 rebinding library source code |  |  |
| ALL | goMalleable | Malleable C2 profiles parser and assembler written in golang |  |  |
| ALL | Malleable-CS-Profiles | A list of python tools to help create an OPSEC-safe Cobalt Strike profile. |  |  |
| Type | Name | Description | Popularity | Language |
|---|
| ALL | BOF_Collection | Various Cobalt Strike BOFs |  |  |
| ALL | cobaltstrike-bof-toolset | 收集网络中在cobaltstrike中使用的bof工具集。 |  |  |
| ALL | Situational Awareness BOF | Its larger goal is providing a code example and workflow for others to begin making more BOF files. Blog |  |  |
| ALL | bof_helper | Beacon Object File (BOF) Creation Helper |  |  |
| ALL | BOF-DLL-Inject | BOF DLL Inject is a custom Beacon Object File that uses manual map DLL injection in order to migrate a dll into a process all from memory. |  |  |
| ALL | cobaltstrike_bofs | BOF spawns a process of your choice under a specified parent, and injects a provided shellcode file via QueueUserAPC(). |  |  |
| ALL | BOF-RegSave | Beacon Object File(BOF) for CobaltStrike that will acquire the necessary privileges and dump SAM - SYSTEM - SECURITY registry keys for offline parsing and hash extraction. |  |  |
| ALL | CobaltStrike BOF | DCOM Lateral Movement; WMI Lateral Movement - Win32_Process Create; WMI Lateral Movement - Event Subscription |  |  |
| ALL | BOFs | ETW Patching; API Function Utility; Syscalls Shellcode Injection |  |  |
| ALL | Remote Operations BOF | This repo serves as an addition to our previously released SA Repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format. |  |  |
| ALL | OperatorsKit | This repository contains a collection of tools that integrate with Cobalt Strike through Beacon Object Files (BOFs). |  |  |
| Dev | bof | This is a template project for building Cobalt Strike BOFs in Visual Studio. |  |  |
| Dev | Needle_Sift_BOF | Strstr with user-supplied needle and filename as a BOF. |  |  |
| Dev | Quser-BOF | Beacon Object Files Quser implementation using Windows API |  |  |
| Dev | BOF.NET | A .NET Runtime for Cobalt Strike's Beacon Object Files. |  |  |
| Dev | beacon-object-file | The format, described by Mudge here, asks that the operator construct an COFF file using a mingw-w64 compiler or the msvc compiler that holds an symbol name indicating its entrypoint, and underlying function calls. |  |  |
| Dev | InlineWhispers | Demonstrate the ability to easily use syscalls using inline assembly in BOFs. |  |  |
| Dev | WdToggle | A Proof of Concept Cobalt Strike Beacon Object File which uses direct system calls to enable WDigest credential caching and circumvent Credential Guard (if enabled). |  |  |
| Dev | Situational Awareness BOF | This Repo intends to serve two purposes. First it provides a nice set of basic situational awareness commands implemented in BOF. This allows you to perform some checks on a host before you begin executing commands that may be more invasive. | | |
| Dev | MiniDumpWriteDump | Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemory. |  |  |
| Dev | COFF Loader | This is a quick and dirty COFF loader (AKA Beacon Object Files). Currently can run un-modified BOF's so it can be used for testing without a CS agent running it. The only exception is that the injection related beacon compatibility functions are just empty. |  |  |
| Dev | Self_Deletion_BOF | BOF implementation of the research by @jonasLyk and the drafted PoC from @LloydLabs |  |  |
| Dev | PE Import Enumerator BOF | This is a BOF to enumerate DLL files to-be-loaded by a given PE file. Depending on the number of arguments, this will allow an operator to either view a listing of anticipated imported DLL files, or to view the imported functions for an anticipated DLL. |  |  |
| Dev | Visual-Studio-BOF-template | A Visual Studio template used to create Cobalt Strike BOFs |  |  |
| Dev | BOF-Builder | C# .Net 5.0 project to build BOF (Beacon Object Files) in mass based on them all being in a folder directory struct somewhere. |  |  |
| Dev | ELFLoader | This is a ELF object in memory loader/runner. The goal is to create a single elf loader that can be used to run follow on capabilities across all x86_64 and x86 nix operating systems. |  |  |
| Dev | Rust BOFs for Cobalt Strike | This took me like 4 days, but I got it working... rust core + alloc for Cobalt Strike BOFs. This is very much a PoC, but I'd love to see others playing around with it and contributing. |  |  |
| Dev | CoffeeLdr | CoffeeLdr is a loader for so called Beacon Object Files. This project can be used for testing Beacon Object files without using the Cobalt Strike framework or can be used to give custom implants a way to execute BOFs that where designed for Cobalt strike. |  |  |
| Dev | HalosGate Processlist Cobalt Strike BOF | Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes. |  |  |
| Dev | PPLFaultDumpBOF | Takes the original PPLFault and the original included DumpShellcode and combinds it all into a BOF targeting cobalt strike. |  |  |
| Dev | Winsocky | Winsocket implementation for Cobalt Strike. Used to communicate with the victim using winsockets instead of the traditional ways. |  |  |
| Dev | bof-vs | A Beacon Object File (BOF) template for Visual Studio. |  |  |
| Auxiliary | Defender Exclusions BOF | A BOF to determine Windows Defender exclusions. |  |  |
| Auxiliary | ScreenShot-BOF | ScreenShot bof for Cobalt Strike . All in memory and no spawn/inject. |  |  |
| Auxiliary | BofRoast | Beacon Object File repo for roasting Active Directory. |  |  |
| Auxiliary | EnumCLR.c | Cobalt Strike BOF to identify processes with the CLR loaded with a goal of identifying SpawnTo / injection candidates. |  |  |
| Auxiliary | PPEnum | Simple BOF to read the protection level of a process. |  |  |
| Auxiliary | secinject | Section Mapping Process Injection (secinject): Cobalt Strike BOF |  |  |
| Auxiliary | FindObjects-BOF | A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles. |  |  |
| Auxiliary | Inject-assembly | Inject-assembly - Execute .NET in an Existing Process. This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly. |  |  |
| Auxiliary | WhereAmiI | WhereAmiI - Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's. |  | |
| Auxiliary | GetWebDAVStatus | Small project to determine if the Web Client service (WebDAV) is running on a remote system by checking for the presence of the DAV RPC SERVICE named pipe. |  |  |
| Auxiliary | ChromeKeyDump | BOF implementation of Chlonium tool to dump Chrome Masterkey and download Cookie/Login Data files |  |  |
| Auxiliary | Sleeper | BOF to call the SetThreadExecutionState function to prevent host from Sleeping | | |
| Auxiliary | LSASS | Beacon Object File to dump Lsass memory by obtaining a snapshot handle. Does MiniDumpWriteDump/NtReadVirtualMemory on SnapShot of LSASS instad of original LSASS itself hence evades some AV/EDR. |  |  |
| Auxiliary | getsystem | get system by duplicating winlogon's token. | | |
| Auxiliary | Silent Lsass Dump | Silent Lsass Dump |  |  |
| Auxiliary | unhook-bof | This is a Beacon Object File to refresh DLLs and remove their hooks. |  |  |
| Auxiliary | Beacon Health Check Aggressor Script | This aggressor script uses a beacon's note field to indicate the health status of a beacon. |  |  |
| Auxiliary | Registry BOF | A beacon object file for use with cobalt strike v4.1+. Supports querying, adding, and deleting keys/values of local and remote registries. |  |  |
| Auxiliary | InlineExecute-Assembly | InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module |  |  |
| Auxiliary | CredBandit | CredBandit is a proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel. The memory dump is done by using NTFS transactions which allows us to write the dump to memory and the MiniDumpWriteDump API has been replaced with an adaptation of ReactOS's implementation of MiniDumpWriteDump. |  |  |
| Auxiliary | Inject AMSI Bypass | Cobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection. |  |  |
| Auxiliary | Firewall_Enumerator_BOF | Cobalt Strike Beacon Object File (BOF) that bypasses AMSI in a remote process with code injection. |  |  |
| Auxiliary | Detect-Hooks | Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR |  |  |
| Auxiliary | unhook-bof | Remove API hooks from a Beacon process. |  |  |
| Auxiliary | whereami | Cobalt Strike "Where Am I?" Beacon Object File |  |  |
| Auxiliary | HOLLOW | EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode |  |  |
| Auxiliary | BOFs | send_shellcode_via_pipe;cat;wts_enum_remote_processes |  |  |
| Auxiliary | SCShell | SCShell is a fileless lateral movement tool that relies on ChangeServiceConfigA to run commands. |  |  |
| Auxiliary | WinRMDLL | A while ago I produced CSharpWinRM which was alright, but I wanted to look at the WinRM C++ API properly. |  |  |
| Auxiliary | LSASS Dumping With Foreign Handles | LSASS Dumping With Foreign Handles |  |  |
| Auxiliary | PPLDump BOF | this is a fully-fledged BOF to dump an arbitrary protected process.(LSASS) |  |  |
| Auxiliary | PortBender | PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP). |  |  |
| Auxiliary | BOF2Shellcode | POC tool to convert a Cobalt Strike BOF into raw shellcode. |  |  |
| Auxiliary | DLL Hijack Search Order BOF | DLL Hijack Search Order Enumeration BOF |  |  |
| Auxiliary | InlineWhispers2 | Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2 |  |  |
| Auxiliary | NetUser | 使用windows api添加用户，可用于net无法使用时 |  |  |
| Auxiliary | BOF-Nim | 用Nim语言写BoF |  |  |
| Auxiliary | Invoke-Bof | Load any Beacon Object File using Powershell! |  |  |
| Auxiliary | Cobalt-Clip | Cobalt-clip is clipboard addons for cobaltstrike to interact with clipboard. With this you can dump, edit and monitor the content of q clipboard. |  |  |
| Auxiliary | CoffLoader | Load and execute COFF files and Cobalt Strike BOFs in-memory |  |  |
| Auxiliary | COFFLoader2 | Load and execute COFF files and Cobalt Strike BOFs in-memory |  |  |
| Auxiliary | Process Protection Level Enumerator BOF | A Syscall-only BOF file intended to grab process protection attributes, limited to a handful that Red Team operators and pentesters would commonly be interested in. |  |  |
| Auxiliary | Toggle_Token_Privileges_BOF | AAn (almost) syscall-only BOF file intended to either add or remove token privileges within the context of your current process. |  |  |
| Auxiliary | Cobalt Strike BOF - Inject ETW Bypass | Inject ETW Bypass into Remote Process via Syscalls (HellsGate | HalosGate) |  |
| Auxiliary | HandleKatz_BOF | PIC your Katz! Say hello to HandleKatz, our position independent Lsass dumper abusing cloned handles, direct system calls and a modified version of minidumpwritedump() |  |  |
| Auxiliary | tgtdelegation | tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick" |  |  |
| Auxiliary | nanodump | A Beacon Object File that creates a minidump of the LSASS process. |  |  |
| Auxiliary | xPipe Cobalt Strike BOF (x64) | Cobalt Strike Beacon Object File (BOF) to list active Pipes & return their Owner & Discretionary Access Control List (DACL) permissions. |  |  |
| Auxiliary | AddUser-Bof | Cobalt Strike BOF that Add an admin user |  |  |
| Auxiliary | ServiceMove-BOF | Lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking |  |  |
| Auxiliary | Detect-Hooks | Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR |  |  |
| Auxiliary | MemReader BoF | MemReader Beacon Object File will allow you to search and extract specific strings from a target process memory and return what is found to the beacon output. |  |  |
| Auxiliary | Readfile BoF | Not the prettiest code, short sweet and to the point and will allow you to read file contents to beacon output. |  |  |
| Auxiliary | ChromiumKeyDump | BOF implementation of Chlonium tool to dump Chrome/Edge Masterkey and download Cookie/Login Data files | | |
| Auxiliary | LdapSignCheck | Beacon Object File to scan a Domain Controller to see if LdapEnforceChannelBinding or LdapServerIntegrity has been modified to mitigate against relaying attacks. |  |  |
| Auxiliary | DelegationBOF | This tool uses LDAP to check a domain for known abusable Kerberos delegation settings. Currently, it supports RBCD, Constrained, Constrained w/Protocol Transition, and Unconstrained Delegation checks. |  |  |
| Auxiliary | RunOF | A tool to run object files, mainly beacon object files (BOF), in .Net. |  |  |
| Auxiliary | KillDefender_BOF | Beacon Object File implementation of pwn1sher's KillDefender. |  |  |
| Auxiliary | TokenStripBOF | TokenStrip is a Beacon Object File implementation of pwn1sher's KillDefender project utilizing syscalls via InlineWhispers. |  |  |
| Auxiliary | BOF - RDPHijack | Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking. |  |  |
| Auxiliary | Koh | Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking. |  |  |
| Auxiliary | RDPHijack | Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking. | | |
| Auxiliary | KDStab | BOF combination of KillDefender and Backstab. |  |  |
| Auxiliary | Token Vault BOF for Cobalt Strike | This Beacon Object File (BOF) creates in-memory storage for stolen/duplicated Windows access tokens. |  |  |
| Auxiliary | ASRenum | Identify ASR rules, actions, and exclusion locations. |  |  |
| Auxiliary | ThreadlessInject-BOF | BOF implementation of @EthicalChaos's ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023. |  |  |
| Auxiliary | Inline-Execute-PE | Execute unmanaged Windows executables in CobaltStrike Beacons. This enables Operators to use many third party tools (Mimikatz, Dsquery, Sysinternals tools, etc) without needing to drop them to disk, reformat them to position independent code using a tool like Donut, or create a new process to run them. |  |  |
| Auxiliary | BOFs | Subscribes to WNF notifications for a number of seconds. && Backdoors SCManager SDDL. |  |  |
| Auxiliary | DomainPasswordSpray | Perform LDAP-based or Kerberos-based password spray using Windows API LogonUserSSPI. Skip disabled accounts, locked accounts and large BadPwdCount (if specified). |  |  |
| Auxiliary | BOF-CredUI | Credentials Collection via CredUIPromptForWindowsCredentials |  |  |
| Auxiliary | Cookie-Graber-BOF | C or BOF file to extract WebKit master key to decrypt user cookie. The C code can be used to compile an executable or a bof script for Cobalt Strike. |  |  |
| Auxiliary | ScreenshotBOF | An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory. |  |  |
| Auxiliary | ScreenshotBOFPlus | Take a screenshot without injection for Cobalt Strike. I only made minor optimizations to the existing code, and made it support the ability to get a complete screenshot when global scaling is initiated on Windows. |  |  |
| Auxiliary | Elevate-System-Trusted-BOF | This BOF can be used to elevate the current beacon to SYSTEM and obtain the TrustedInstaller group privilege. The impersonation is done through the SetThreadToken API. |  |  |
| Auxiliary | Hidden Desktop BOF | Hidden Desktop (often referred to as HVNC) is a tool that allows operators to interact with a remote desktop session without the user knowing. |  |  |
| Auxiliary | DropSpawn | DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. |  |  |
| Auxiliary | Nanorobeus | COFF file (BOF) for managing Kerberos tickets. |  |  |
| Auxiliary | SelfDel | Delete file regardless of whether the handle is used via SetFileInformationByHandle |  |  |
| Auxiliary | GetWeChatBOF | 用于获取微信信息的BOF测试文件, 仅支持3.9.6.33版本的偏移 |  |  |
| Auxiliary | ShadowRDP | 用This repository contains two applications. One is a beacon object file, which is used to retrieve the authentication string, also known as the invitation. The other is a graphical user interface program that can be run on the operator's system behind a SOCKS proxy to connect to the remote desktop session. |  |  |
| Auxiliary | SharpHound4Cobalt | The SharpHound data (test file, json, zip, cache file) will not be written on the disk but only sent to Cobalt Strike downloads through BOF.NET library. |  |  |
| Exploit | CVE-2020-0796-BOF | SMBGhost LPE |  |  |
| Exploit | ZeroLogon-BOF | ZeroLogon |  |  |
| Exploit | kernel-mii | Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551. |  |  |
| Exploit | PrivKit | PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS. |  |  |
| Exploit | CVE-2023-36874 | About | ||
| Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE. |  |  | ||
| Persistence | SPAWN | Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing. |  |  |
| Persistence | PersistBOF | A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User). |  |  |
| BypassAV | ClipboardWindow-Inject | Beacon Object File (BOF) that injects beacon shellcode into remote process, avoiding the usage of common monitored APIs. |  |  |
| BypassAV | SigFlip | SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality. |  |  |
| BypassAV | BokuLoader | Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities. |  |  |
| BypassAV | AddDefenderExclusions | AddDefenderExclusions Beacon Object File Resources. |  |  |
| BypassAV | BOFMask | it demonstrates a technique to stealthily run BOFs without exposing Beacon to detection. |  |  |
| BypassUAC | Trusted Path UAC Bypass | Beacon object file implementation for trusted path UAC bypass. The target executable will be called without involving "cmd.exe" by using DCOM object. |  |  |
| BypassUAC | EventViewerUAC_BOF | This is a Beacon Object File implementation of the Event Viewer deserialization UAC bypass discovered by @orange_8361 and the POC put together by CsEnox. |  |  |
| Type | Name | Description | Popularity | Language |
|---|
| BypassAV | BypassAV | 用于快速生成免杀的可执行文件 |  |  |
| BypassAV | BypassAV | 本质上利用的ps2exe.ps1脚本编译为exe，只是不想在命令行里操作，将其写为cna脚本，方便直接快速生成免杀的可执行文件且只有50KB，目前支持exe、ps1文件格式。 |  |  |
| BypassAV | scrun | BypassAV ShellCode Loader (Cobaltstrike/Metasploit) Useage |  |  |
| BypassAV | ShellCode_Loader | Msf&CobaltStrike免杀ShellCode加载器 |  |  |
| BypassAV | beacon-c2-go | beacon-c2-go (Cobaltstrike/Metasploit) |  |  |
| BypassAV | C--Shellcode | python ShellCode Loader (Cobaltstrike&Metasploit) Useage |  |  |
| BypassAV | Doge-Loader | Cobalt Strike Shellcode Loader by Golang |  |  |
| BypassAV | CS-Loader | CS免杀,包括python版和C版本的 |  |  |
| BypassAV | CSSG | Cobalt Strike Shellcode Generator. Generates beacon stageless shellcode with exposed exit method, additional formatting, encryption, encoding, compression, multiline output, etc |  |  |
| BypassAV | Alaris | Alaris is a new and sneaky shellcode loader capable of bypassing most EDR systems as of today (02/28/2021). It uses several known TTP’s that help protect the malware and it’s execution flow. |  |  |
| BypassAV | CarbonMonoxide | EDR Evasion - Combination of SwampThing - TikiTorch |  |  |
| BypassAV | bypassAV-1 | 条件触发式远控 VT 6/70 免杀国内杀软及defender、卡巴斯基等主流杀软. |  |  |
| BypassAV | ScareCrow | ScareCrow is a payload creation framework for generating loaders for the use of side loading (not injection) into a legitimate Windows process (bypassing Application Whitelisting controls). |  |  |
| BypassAV | Dent | A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors. |  |  |
| BypassAV | PEzor | Open-Source PE Packer. |  |  |
| BypassAV | FuckThatPacker | A simple python packer to easily bypass Windows Defender |  |  |
| BypassAV | goShellCodeByPassVT | Go编译-race参数实现VT全免杀 |  |  |
| BypassAV | HouQing | Advanced AV Evasion Tool For Red Team Ops |  |  |
| BypassAV | DesertFox | 使用Golang实现免杀加载CobaltStrike和Metasploit的shellcode，目前免杀火绒、Avast、腾讯安全管家、360全家桶等主机安全软件。 |  |  |
| BypassAV | DInjector | This repository is an accumulation of code snippets for various shellcode injection techniques using fantastic D/Invoke API |  |  |
| BypassAV | GoBypass | Golang免杀马生成工具（该工具仅针对Windows系统） |  |  |
| BypassAV | Bypass-script | 使用 GoBypass 来进行免杀生成 |  |  |
| BypassAV | CobaltWhispers | CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. |  |  |
| BypassAV | AceLdr | Cobalt Strike UDRL for memory scanner evasion. |  |  |
| BypassAV | SharpTerminator | Terminate AV/EDR Processes using kernel driver |  |  |
| BypassUAC | UAC-SilentClean | This project implements a DLL planting technique to bypass UAC Always Notify and execute code in a high integrity process. |  |  |
| BypassUAC | csload.net | A cobaltStrike Shellcode loader, can bypass most of AV |  |  |
| Dev | cs-rdll-example | This is an example code pattern for using named pipes for IPC with ReflectiveDlls in Cobalt Strike. |  |  |
| Dev | Titan | Titan: A generic user defined reflective DLL for Cobalt Strike. |  |  |
| Dev | GECC | Go External C2 Client implementation for cobalt strike. |  |  |
| Dev | CobaltStrike beacon in rust | CobaltStrike beacon in rust. |  |  |
| Recon | red-team-scripts | perform some rudimentary Windows host enumeration with Beacon built-in commands |  |  |
| Recon | Registry-Recon | Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. |  |  |
| Recon | aggressor-powerview | All functions listed in the PowerView about page are included in this with all arguments for each function. PowerView |  |  |
| Recon | PowerView3-Aggressor | PowerView Aggressor Script for CobaltStrike PowerView |  |  |
| Recon | AggressorScripts | Sharphound-Aggressor- A user menu for the SharpHound ingestor |  |  |
| Recon | ServerScan | 内网横向信息收集的高并发网络扫描、服务探测工具。 |  |  |
| Recon | TailorScan | 端口扫描+探测网卡+ms17010探测 |  |  |
| Recon | AggressiveProxy | LetMeOutSharp will try to enumerate all available proxy configurations and try to communicate with the Cobalt Strike server over HTTP(s) using the identified proxy configurations. |  |  |
| Recon | Spray-AD | A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords. |  |  |
| Recon | Ladon | Ladon一款用于大型网络渗透的多线程插件化综合扫描神器，含端口扫描、服务识别、网络资产、密码爆破、高危漏洞检测以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描。 |  |  |
| Recon | Ladon for Cobalt Strike | Ladon for Cobalt Strike(巨龙拉冬套件) |  |  |
| Recon | Recon-AD | Recon-AD, an AD recon tool based on ADSI and reflective DLL’s |  |  |
| Exploit | XSS-Fishing2-CS | 鱼儿在cs上线后自动收杆 / Automatically stop fishing in javascript after the fish is hooked |  |  |
| Exploit | XSS-Phishing | xss钓鱼，cna插件配合php后端收杆 |  |  |
| Exploit | custom_payload_generator | CobaltStrike3.0+ --> creates various payloads for Cobalt Strike's Beacon. Current payload formats |  |  |
| Exploit | CrossC2 | CrossC2 framework - Generator CobaltStrike's cross-platform beacon |  |  |
| Exploit | CrossC2 Kit | CrossC2Kit provides some interfaces for users to call to manipulate the CrossC2 Beacon session, thereby extending the functionality of Cobalt Strike. |  |  |
| Exploit | Cobaltstrike-MS17-010 | ms17-010 exploit tool and scanner. |  |  |
| Exploit | AES-PowerShellCode | Standalone version of my AES Powershell payload for Cobalt Strike. |  |  |
| Exploit | SweetPotato_CS | CobaltStrike4.x --> SweetPotato |  |  |
| Exploit | ElevateKit | privilege escalation exploits |  |  |
| Exploit | CVE-2018-4878 | CVE-2018-4878 |  |  |
| Exploit | Aggressor-Scripts | The only current public is UACBypass, whose readme can be found inside its associated folder. |  |  |
| Exploit | CVE_2020_0796_CNA | 基于ReflectiveDLLInjection实现的本地提权漏洞 |  |  |
| Exploit | DDEAutoCS | setup our stage(d) Web Delivery attack |  |  |
| Exploit | geacon | Implement CobaltStrike's Beacon in Go (can be used in Linux) |  |  |
| Exploit | geacon_pro | geacon_pro is an Anti-Virus bypassing CobaltStrike Beacon written in Golang based on geacon project. |  |  |
| Exploit | geacon_plus | golang实现的CobaltStrike stageless http(s) beacon,在geacon项目基础上进行了较多扩展 |  |  |
| Exploit | SpoolSystem | SpoolSystem is a CNA script for Cobalt Strike which uses the Print Spooler named pipe impersonation trick to gain SYSTEM privileges. | | |
| Exploit | CVE-2021-1675_RDL_LPE | PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR |  |  |
| Exploit | KRBTGS | KRBTGS is a post-exploitation option for Cobalt Strike to retrieve a working TGT for the current user that Beacon is running as, or impersonating. The attack does not require the user's password, and only assumes that the user you are running as is within a domain-joined environment. It attempts to guess the encryption type by choosing the strongest to least strong. The resulting .ccache can be converted into KIRBI format to be imported into other Beacons, or passed to other toolsets such as Impacket's example scripts to perform your post-exploitation endeavours. |  |  |
| Exploit | PrintSpoofer-ReflectiveDLL | PrintSpoofer的反射dll实现，结合Cobalt Strike使用 |  |  |
| Persistence | persistence-aggressor-script | persistence-aggressor-script |  |  |
| Persistence | Peinject_dll | 弃用winexec函数，使用shellexecute函数，程序流不在卡顿，达到真正的无感。 |  |  |
| Persistence | TikiTorch | TikiTorch follows the same concept(CACTUSTORCH) but has multiple types of process injection available, which can be specified by the user at compile time. |  |  |
| Persistence | CACTUSTORCH | A JavaScript and VBScript shellcode launcher. This will spawn a 32 bit version of the binary specified and inject shellcode into it. |  |  |
| Persistence | UploadAndRunFrp | 上传frpc并且运行frpc |  |  |
| Persistence | persistence-aggressor-script | Persistence Aggressor Script |  |  |
| Persistence | AggressiveGadgetToJScript | Automate the generation of payloads using the GadgetToJScript technique. |  |  |
| Persistence | FrpProPlugin | frp0.33修改版,过流量检测,免杀,支持加载远程配置文件可用于cs直接使用的插件 |  |  |
| Persistence | Automatic-permission-maintenance | CobaltStrike 上线自动权限维持插件 |  |  |
| Persistence | cobalt-strike-persistence | 使用者通过cobalt strike生成Web Delivery类型的payload，然后加载此脚本可以到达自启动效果 |  |  |
| Persistence | Cobalt_Strike_CNA | 使用多种WinAPI进行权限维持的CobaltStrike脚本，包含API设置系统服务，设置计划任务，管理用户等。 |  |  |
| Persistence | CustomKeyboardLayoutPersistence | Achieve execution using a custom keyboard layout, tested in Windows 11 Home version 21H2 |  |  |
| Persistence | SharpEventPersist | Persistence by writing/reading shellcode from Event Log. |  |  |
| Auxiliary | SharpZippo | List/Read contents of Zip files (in memory and without extraction) using CobaltStrike's Execute-Assembly |  |  |
| Auxiliary | SharpExcelibur | Read Excel Spreadsheets (XLS/XLSX) using Cobalt Strike's Execute-Assembly |  |  |
| Auxiliary | SharpSword | Read the contents of DOCX files using Cobalt Strike's Execute-Assembly |  |  |
| Auxiliary | SharpCat | C# alternative to the linux "cat" command... Prints file contents to console. For use with Cobalt Strike's Execute-Assembly |  |  |
| Auxiliary | TabRenamer CNA | This will allow programmatic renaming of tabs as you see fit, with toggles of your history as you see fit. |  |  |
| Auxiliary | Liquid Snake | LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript |  |  |
| Auxiliary | TaskShell | TaskShell 计划任务相关自动化操作 |  |  |
| Auxiliary | generate-rotating-beacon | 1. Generate a beacon for a given listener; 2. Host the file at a specified location;3. Monitor the weblog for fetching of the specified location; |  |  |
| Auxiliary | ScareCrow-CobaltStrike | A Cobalt Strike script for ScareCrow payload generation. Works with all Loaders. |  |  |
| Auxiliary | AggressorScripts | CreateTicket; Seatbelt; SharpHound |  |  |
| Auxiliary | SharpeningCobaltStrike | In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server. |  |  |
| Auxiliary | CS_Mail_Tip | Cobalt Strike主机上线邮件提醒插件 |  |  |
| Auxiliary | Cobalt_Strike_Bot | CobaltStrike上线通知，飞书群聊机器人、server酱通知 |  |  |
| Auxiliary | Cobaltstrike-atexec | 利用任务计划进行横向，需要与135端口、445端口进行通信 |  |  |
| Auxiliary | Sharp-HackBrowserData | C#的HackBrowserData工具，方便在cs中直接内存加载 |  |  |
| Auxiliary | HackBrowserData | HackBrowserData的反射模块 |  |  |
| Auxiliary | cobalt_sync | Standalone Cobalt Strike Operation Logging Aggressor script for Ghostwriter 2.0+ |  |  |
| Auxiliary | samdump | Cobalt Strike samdump |  |  |
| Auxiliary | CallBackDump | 能过卡巴、核晶、defender等杀软的dump lsass进程工具 |  |  |
| Auxiliary | SharpeningCobaltStrike | In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server. | | |
| Auxiliary | SharpCompile | SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime. |  |  |
| Auxiliary | Quickrundown | Utilizing QRD will allow an operator to quickly characterize what processes are both known and unknown on a host through the use of colors and notes about the processes displayed. |  |  |
| Auxiliary | NetUser | This tool achieves "net user" in Window API. I made this to be used with Cobalt Strike's execute-assembly，所以可以内存加载添加用户 |  |  |
| Auxiliary | FileSearch | C++枚举磁盘列表、遍历指定盘搜索特定类型文件包括反射DLL版本。 |  |  |
| Auxiliary | Phant0m_cobaltstrike | This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running. |  |  |
| Auxiliary | NoPowerShell | NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. |  |  |
| Auxiliary | EventLogMaster | RDP EventLog Master |  |  |
| Auxiliary | ANGRYPUPPY | Bloodhound Attack Path Execution for Cobalt Strike |  |  |
| Auxiliary | CobaltStrike_Script_Wechat_Push | 上线微信提醒的插件,通过微信Server酱提醒 |  |  |
| Auxiliary | CS-Aggressor-Scripts | slack and webhooks reminder |  |  |
| Auxiliary | Aggressor-Scripts | surveying of powershell on targets (在对应的目标上检测powershell的相关信息) |  |  |
| Auxiliary | cs-magik | Implements an events channel and job queue using Redis for Cobalt Strike. |  |  |
| Auxiliary | GetClipboard | Cobalt Strike Reflective DLL Get clipboard content. The code basically comes from ReflectiveDLLInjection |  |  |
| Auxiliary | AggressorScripts | 查看进程的时候讲av进程标注为红色 |  |  |
| Auxiliary | Beaconator | Beaconator is an aggressor script for Cobalt Strike used to generate a raw stageless shellcode and packing the generated shellcode using PEzor. |  |  |
| Auxiliary | Raven | CobaltStrike External C2 for Websockets |  |  |
| Auxiliary | CobaltStrikeParser | Python parser for CobaltStrike Beacon's configuration |  |  |
| Auxiliary | fakelogonscreen | FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password. |  |  |
| Auxiliary | SyncDog | Make bloodhound sync with cobaltstrike. |  |  |
| Auxiliary | 360SafeBrowsergetpass | 一键辅助抓取360安全浏览器密码的CobaltStrike脚本，通过下载浏览器数据库、记录密钥来离线解密浏览器密码。 |  |  |
| Auxiliary | SharpDecryptPwd | 对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。 |  |  |
| Auxiliary | List-GitHubAssembly | Fetch a list of avaialble artifacts from the configured GitHub repo. |  |  |
| Auxiliary | ExecuteAssembly | ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs via superfasthash hashing algorithm. |  |  |
| Auxiliary | aggrokatz | aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. |  |  |
| Auxiliary | Zipper | This CobaltStrike tool allows Red teams to compress files and folders from local and UNC paths. This could be useful in situations where large files or folders need to be exfiltrated. After compressing a file or folder a random named zipfile is created within the user temp folder. |  |  |
| Auxiliary | CS-ServerChan | 通过 CobaltStike 服务端 / 客户端 挂载脚本，将上线主机信息通过 Server 酱通知到微信 |  |  |
| Auxiliary | CS-PushPlus | 使用免费且支持微信模板消息推送的 PushPlus 进行上线主机提醒 |  |  |
| Auxiliary | HelpColor | Aggressor script that lists available Cobalt Strike beacon commands and colors them based on their type |  |  |
| Auxiliary | CobaltStrike Helpmsg CNA | This cna contains error messages for Win32 error codes, HRESULT defintions, and NTSTATUS definitions. This cna can be helpful for those operating out of linux/mac clients without access to the net.exe program, or as a quick way to looking hresult/ntstatus codes without having to do a google search. |  |  |
| Auxiliary | YouMayPasser | Stable PeSieve Bypass and Stable Moneta Bypass. |  |  |
| Auxiliary | Sync Downloads | This is meant as a fine-tuned control mechanism for syncing files from the Cobalt Strike Downloads entries in the data model |  |  |
| Auxiliary | Headless Strike | Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client. |  |  |
| Auxiliary | Headless Strike | 内网渗透\红队工具\C#内存加载\cobaltstrike |  |  |
| Auxiliary | Cohab_Processes | A small Aggressor script to help Red Teams identify foreign processes on a host machine |  |  |
| Auxiliary | EnumStrike | Cobalt Strike Aggressor script to automate host and domain enumeration. |  |  |
| Synthesis | AM0N-Eye | AM0N-Eye is a compilation of a group of the most important scripts that were written specifically for Cobaltsetrike and the rest of the files such as de for modification in colors and images. |  |  |
| Synthesis | aggressor_snippets | A collection of random small Aggressor snippets that don't warrant their own repo |  |  |
| Synthesis | Erebus | CobaltStrike4.x --> Erebus CobaltStrike后渗透测试插件 |  |  |
| Synthesis | CSplugins | CobaltStrike后渗透测试插件集合 |  |  |
| Synthesis | Cobalt-Strike-Aggressor-Scripts | CobaltStrike后渗透测试插件集合 Usage |  |  |
| Synthesis | AggressorScripts | Aggressor scripts for use with Cobalt Strike 3.0+ |  |  |
| Synthesis | RedTeamTools | RedTeamTools for use with Cobalt Strike |  |  |
| Synthesis | cobalt-arsenal | Aggressor Scripts for Cobalt Strike 4.0+ |  |  |
| Synthesis | MoveKit | The aggressor script handles payload creation by reading the template files for a specific execution type. intro |  |  |
| Synthesis | StayKit | The aggressor script handles payload creation by reading the template files for a specific execution type. intro |  |  |
| Synthesis | AggressorScripts | AggressorScripts |  |  |
| Synthesis | AggressorScripts | Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources |  |  |
| Synthesis | AggressorScripts | AggressorScripts | | |
| Synthesis | Aggressor-VYSEC | Contains a bunch of CobaltStrike Aggressor Scripts |  |  |
| Synthesis | AggressorAssessor | AggressorAssessor |  |  |
| Synthesis | AggressorAssessor | AggressorAssessor | | |
| Synthesis | aggressor-scripts | Collection of Cobalt Strike Aggressor Scripts |  |  |
| Synthesis | 梼杌 | 基于cobalt strike平台的红队自动化框架 |  |  |
| Synthesis | Aggressor-scripts | This is just a random collection of Aggressor Scripts I've written for Cobalt Strike 3.x. (其中有一个debug脚本比较好用) |  |  |
| Synthesis | Aggressor-Script | Collection of Aggressor Scripts for Cobalt Strike(主要包含了提权和权限维持脚本) |  |  |
| Synthesis | Aggressor-Script | Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on |  |  |
| Synthesis | aggressor_scripts_collection | Collection of various aggressor scripts for Cobalt Strike from awesome people. Will be sure to update this repo with credit to each person. |  |  |
| Synthesis | CobaltStrike-ToolKit | googlesearch.profile and script related to AD. |  |  |
| Synthesis | Arsenal | Cobalt Strike 3.13 Arsenal Kit |  |  |
| Synthesis | cobalt-arsenal | My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+ | | |
| Synthesis | aggressor_scripts | A collection of useful scripts for Cobalt Strike.(powershell.cna;bot.cna;dcom_lateral_movement.cna;ElevateKit) |  |  |
| Synthesis | aggressor | creating tunnels with netsh; changed default to bit.ly redirect to mcdonalds;using powershell to kill parent process; | | |
| Synthesis | CobaltStrikeCNA | A collection of scripts - from various sources - see script for more info. |  |  |
| Synthesis | AggressorScripts | Highlights selected processes from the ps command in beacon;Loads various aliases into beacon;sets a few defaults for scripts to be used later.. |  |  |
| Synthesis | AggressorAssessor | 从C2生成到横向移动的全辅助脚本套件 | | |
| Synthesis | AggressorCollection | Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors |  |  |
| Synthesis | Cobaltstrike-Aggressor-Scripts-Collection | The collection of tested cobaltstrike aggressor scripts. |  |  |
| Synthesis | aggressorScripts | CobaltStrike AggressorScripts for the lazy |  |  |
| Synthesis | Aggressor_Scripts | A compilation of Aggressor/Sleep scripts for operational purposes that I've made. |  |  |
| Synthesis | cobalt_strike_extension_kit | 集成了SharpHound,SharpRDP,SharpWMI等在内的各种内网工具，使用AggressorScripts构建workflow |  |  |
| Synthesis | cobaltstrike | 具备域管理员定位、域信息收集、权限维持、内网扫描、数据库hash dump、Everything内网搜索文件等功能的插件集合 |  |  |
| Synthesis | 365CobaltStrike | 兼容CobaltStrike4.0的插件集合 |  |  |
| Synthesis | Cobalt-Strike | 内容有横向移动、密码抓取、权限提升、权限维持等,尽可能将内网渗透中常用到的东西整理一下,方便使用 |  |  |
| Synthesis | CSPlugins | 一个对Cobaltstrike第三方插件进行收集的项目，持续更新。 |  |  |
| Synthesis | CobaltStrike-xor | third-party --> vnc_x86_dll and vnc_x64_dll |  |  |
| Synthesis | Z1-AggressorScripts | 适用于Cobalt Strike 3.x & 4.x 的内网渗透插件集合 |  |  |
| Synthesis | csplugin | 导入PowerView脚本，和常见的功能使用 |  |  |
| Synthesis | CSplugins | 涉及工作目录、信息收集、凭据获取、权限维持、权限提升、用户相关、RDP相关、防火墙相关、域渗透、powershell相关、内网穿透、内网探测、远程文件下载、痕迹清除的综合型插件系统 | | |
| Synthesis | LSTAR | 本着简化 CS 右键和方便自己集成的目的，对 Reference 里的项目进行了缝合以及二次开 (抄) 发 (袭)并添加了虚拟机/AV 检测、主机相关密码抓取、 Cxk 限时免杀的 Mimikatz 和 Adduser 等功能 |  |  |
| Synthesis | SharpUtils | A collection of C# utilities intended to be used with Cobalt Strike's execute-assembly. |  |  |
| Synthesis | SharpToolsAggressor | 内网渗透中常用的c#程序整合成cs脚本，直接内存加载。持续更新~ |  |  |
| Synthesis | C.Ex | CobaltStrike Plugin to start and utilize Cobalt Strike (locally or remotely) from within Sifter |  |  |
| Synthesis | OLa | 一款CS后渗透模块插件，让大家使用一款插件就够了，本插件集大家之所长 |  |  |
| Type | Name | Description | Popularity | Language |
|---|
| AntiCobaltStrike | cobaltstrike_brute | Cobalt Strike Team Server Password Brute Forcer |  |  |
| AntiCobaltStrike | Dissecting Cobalt Strike using Python | dissect.cobaltstrike is a Python library for dissecting and parsing Cobalt Strike related data such as beacon payloads and Malleable C2 Profiles. |  |  |
| AntiCobaltStrike | CobaltSpam | Cobalt Strike Team Server Password Brute Forcer |  |  |
| AntiCobaltStrike | CobaltStrikeDos | CVE-2021-36798 Exp: Cobalt Strike < 4.4 Dos |  |  |
| AntiCobaltStrike | CS_mock | 模拟cobalt strike beacon上线包 |  |  |
| AntiCobaltStrike | CS_fakesubmit | 一个可以伪装上线Cobaltstrike的脚本 | |  |
| AntiCobaltStrike | CobaltStrikeScan | Scan files or process memory for Cobalt Strike beacons and parse their configuration. |  |  |
| AntiCobaltStrike | grab_beacon_config | Simple PoC script to scan and acquire CobaltStrike Beacon configurations. |  |  |
| AntiCobaltStrike | C2-JARM | 通过ssl实现所产生的JARM hash来识别不同的c2，例如CobaltStrike |  |  |
| AntiCobaltStrike | JARM | JARM fingerprints scanner |  |  |
| AntiCobaltStrike | DetectCobaltStomp | A quick(and perhaps dirty!) PoC tool to detect Module Stomping as implemented by Cobalt Strike with moderate to high confidence |  |  |
