Name: Cobalt Strike
Author: Fortra

Help Desk

Kiosk

Web and Video Conferencing

Customer Support

AI Code Generation

Automation Testing

Beta Testing

Feature Management

Development

Virtual Classroom

Education

AI Document Creation

Business Intelligence (BI)

Collaboration

Demand Planning

Internal Communications

Knowledge Management

Quality Management

Supply Chain Visibility

Whistleblowing

Enterprise

Accounting

Cash Flow Management

Finance and Accounting

Applicant Tracking

Corporate Learning Management

Employee Monitoring

HR Management

Payroll

Talent Intelligence

Talent Management

Video Interview

Workforce Analytics

Workforce Management

eLearning Content

Human Resources

Blockchain-as-a-Service (BaaS)

Business Process Automation

Cloud Data Warehouse

Cloud Storage

Data Integration

Data Replication

Database-as-a-Service (DBaaS)

Embedded Database

Encryption Key Management

Fraud Detection

IT Alert Management

Integration Platform as a Service (iPaaS)

Network Performance Monitoring

OpenStack Cloud

Scale-Out Storage

Test Management

User Activity Monitoring

Value Stream Management

WAN Optimization

Web Content Filtering

Information Technology

A/B Testing

Ad Serving & Retargeting

All-in-One Marketing

Content Management

Email Marketing

Enterprise Marketing Management

Grant Management Software

Livestream

Marketing Automation

Social Media Management

Survey & Forms Building

Web Analytics

Marketing

Project Management

Professional Services

Auction Software

Customer Relationship Management (CRM)

Sales Consulting

Sales Incentive Compensation Management

Sales Training

Sales

Agriculture

Inventory Management

Last Mile Delivery

Military and Defense

Online Ordering

Shipping

Vertical-Specific

Find top rated software and services based on in-depth reviews from verified users. 400+ software categories including PaaS, NoSQL, BI, HR, and more.

Metasploit

Rapid7

Pantheon

Intruder

Intruder Systems

Pentest-Tools.com

PortSwigger Burp Suite

PortSwigger Web Security

Kali Linux

Offensive Security

AttackIQ Security Optimization Platform

AttackIQ

Beagle Security

Cobalt Offensive Security Testing

Cobalt Labs, Inc

John the Ripper

Open Source

Nikto

Cobalt Strike is an adversary simulation for penetration testing, developed by Strategic Cyber LLC and acquired by HelpSystems in 2020. Cobalt Strike is now a HelpSystems solution.

Wireshark is a free and open source network troubleshooting tool.

Wireshark

AcuSensor from Maltese company Acunetix is application security and testing software.

Websites Scanned: 5

Websites Scanned: 6-10

Websites Scanned: 11-20

Websites Scanned: 21-35

Websites Scanned: 36-50

Websites Scanned: Over 50

Acunetix by Invicti

Cobalt Strike

Application Security Testing is a key element of ensuring that web applications remain secure. Various tools and managed services exist to provide continuous testing, besides application security platforms that include app testing as part of their functionality. Penetration Testing (Pen Testing) Tools provide means to conduct authorized, ethical hacking of applications in production, to locate vulnerabilities that may be exploited by hackers.

Penetration Testing

This video serves as a brief demo of a sample attack simulation using Cobalt Strike against a fully updated system with AV enabled. The attack flow is as follows:

1. Victim is sent lnk file disguised as pdf.
2. Victim double clicks the file which opens a sample pdf and spawns a Cobalt Strike beacon.
3. Attacker interacts with the Cobalt Strike beacon to run a custom UAC Bypass that launches a privileged beacon.
4. The attacker initializes BOFNET in the privileged beacon and loads a custom AMSI & ETW Bypass.
5. SharpKatz is loaded and executed with BOFNET in order to dump passwords from the victim's computer.
6. Persistence is installed on the system via a custom scheduled task.

As you may have noticed, the attack flow depends on many custom tools and scripts that are required to bypass AV. The UAC Bypass and Persistence mechanism are simple shell scripts created by myself, whereas the other tools I used are publicly available with little modification. Below is a list of publicly available resources that helped me to accomplish this:

SysWhispers Integrated with Artifact Kit: https://br-sn.github.io/Implementing-Syscalls-In-The-CobaltStrike-Artifact-Kit/
BOFNET: https://github.com/CCob/BOF.NET
SharpUnhooker: https://github.com/GetRektBoy724/SharpUnhooker

Chapters:
0:00 Introduction
0:19 Checking for Updates
1:03 Malicious Lnk File
1:54 Initial Beacon + UAC Bypass
3:15 Password Dump with BOFNET
5:14 Scheduled Task Persistence

I hope you enjoy the video!

Cobalt Strike Attack Simulation with AV Enabled

This video of Cobalt Strike highlights several key features through a guided walkthrough in a practice cyber range. Several security topics are used to demonstrate features and the focus is not on understanding these topics, but rather to explore Cobalt Strike. References are provided if you like to learn more about the techniques used throughout the demo.

Learn more about Cobalt Strike at https://www.cobaltstrike.com


--------REFERENCES------
00:00:00 - Introduction
00:07:21 - Interacting With Beacon
00:10:34 - Situational Awareness Using Built In Commands
00:20:45 - Situational Awareness Using Execute Assembly
00:26:44 - Enumeration of Internal Website
00:31:50 - Kerberoasting
00:35:18 - Privilege Escalation via Lateral Movement

Cobalt Strike Demo Walkthrough - https://impacttrial.coresecurity.com/docs/doc/walkthrough/cobaltstrike/cobalt_strike_walkthrough/

Introduction:
Red Team Ops with Cobalt Strike - https://www.youtube.com/watch?v=q7VQeK533zI
Red Teaming Fundamentals - https://redteam.guide
Cobalt Strike Training Resources - https://cobaltstrike.com/training
Listener and Infrastructure Management Documentation - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/listener-infrastructue_main.htm#_Toc65482731
Cobalt Strike Malleable C2 Profile Documentation - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_main.htm#_Toc65482834
Third-Party Malleable C2 Reference Guide - https://github.com/threatexpress/malleable-c2
Aggressor Scripting Documentation - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/agressor_script.htm
Beacon Object Files Documentation - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/beacon-object-files_main.htm
Cobalt Strike Community Kit - https://cobalt-strike.github.io/community_kit

Interacting With a Beacon
Beacon 101 - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_main.htm#_Toc65482780
HelpColor Script - https://github.com/outflanknl/HelpColor
ProcessColor Script - https://github.com/harleyQu1nn/AggressorScripts/blob/master/ProcessColor.cna

Situational Awareness Using Built In Commands
What is Situational Awareness - https://redteam.guide/docs/definitions#situational-awareness
Running Commands in Cobalt Strike - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_running-commands.htm
Post Exploitation Commands - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_main.htm#_Toc65482780
Operational Security (OPSEC) Considerations - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/appendix-a_beacon-opsec-considerations.htm

Situational Awareness Using Execute Assembly
Execute Assembly - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_running-commands.htm#_Toc65482784
Seatbelt Script - https://github.com/GhostPack/Seatbelt
SharpUp Script - https://github.com/GhostPack/SharpUp

Enumeration of Internal Website
SOCKS Proxy - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/pivoting_socks-proxy.htm?cshid=1071

Kerberoasting
MITRE ATT&CK - https://attack.mitre.org/techniques/T1558/003/ Rubeus - https://github.com/GhostPack/Rubeus 
hashcat - https://hashcat.net/hashcat/

Privilege Escalation via Lateral Movement
SMB Beacon - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/listener-infrastructue_beacon-smb.htm?
Beacon with Aggressor Script - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics_aggressor-scripts/as_beacon.htm
PsExec MITRE ATT&CK - https://attack.mitre.org/software/S0029/

Cobalt Strike Demo

This video demonstrates the Beacon Object File feature introduced in Cobalt Strike 4.1.

https://www.cobaltstrike.com/help-beacon-object-files

Beacon Object Files - Luser Demo

Hello everyone! This video serves as a demonstration of the new update for my Shhhloader tool in which I've implemented process hollowing. I show how the tool can allow both Meterpreter and Cobalt Strike to run on fully updated Windows Server 2019 and Windows 10 PC virtual machines with Windows Defender enabled.

Check it out on my github: https://github.com/icyguider/Shhhloader

0:00 Introduction + Overview
1:37 Usage Explanation
2:42 Start Meterpreter Demo
3:56 Checking Windows for Updates
5:00 Executing Meterpreter Payloads
7:37 Cobalt Strike Demo
11:37 Scanning Payload
12:27 Conclusion

References Mentioned:
https://github.com/snovvcrash/NimHollow
https://labs.f-secure.com/blog/bypassing-windows-defender-runtime-scanning/

Shhhloader Process Hollowing Update (Meterpreter & Cobalt Strike Demo)

You loved the first community webcast so much, we had to do a sequel! In this recording of our community webcast, product experts provide an overview of the Cobalt Strike 4.7 release and demo some of its new features. Additionally, they highlight some of what the research team is currently working on and talk briefly about the roadmap for the winter release.

Cobalt Strike Community Webcast: 4.7 Release Highlights

Demo video of a POC released at HackCon 2022, you can find the github project at https://github.com/Flangvik/CobaltBus

CobaltBus: Cobalt Strike C2 Traffic Via Azure Servicebus

This demo shows how to download, compile and run C# on a remote target via cobalt strike.

The demo uses visual studio installed on a Windows 7 VM during the install of VS only “.NET desktop development” and “Desktop development with C++” were ticked. 

https://visualstudio.microsoft.com/vs/community/ version vs_community__125362648.1559567145 was used.

Rebeus is created by HarmJ0y’s Version 1.4.2 was used 

https://github.com/GhostPack/Rubeus

A Cobalt Strike trail copy was used for the demo.

The command to run compile executables on a remote target from beacon is.

execute-assembly /root/Desktop/Rubeus.exe

How to compile C# and run on a remote target using Cobalt Strike

Cobalt Strike Community Webcast: 4.5 Release Highlights

Shhhloader Release & Demo (SysWhispers Shellcode Loader)

NTLM Relaying via Cobalt Strike (AD CS Exploit Demo)

Detecting Cobalt Strike Attacks using the NetWitness Platform

Fortra is a leading provider of systems and network management, business intelligence, and security and compliance solutions. Our software reduces data center costs by improving operational control and delivery of IT services. Founded in 1982, we have offices worldwide and more than 8,700 customers from small businesses to Fortune 100 companies. Based in Minneapolis, Minnesota, our mission is to be an expert provider of data center software that solves real business problems. We take pride in offering the best service in the industry. Our calls are answered the old fashioned way—by a live person. We do not use interactive voice response. And our support teams provide award-winning, knowledgeable, and friendly service.

Fortra

TrustRadius is a technology and business research firm based in Austin, Texas. The company is known as a review platform for verified B2B technology and software reviews through a proprietary algorithm and human verification.

TrustRadius

Home

Penetration Testing Tools