Exploitation
Cobalt Strike is a commercial penetration testing platform designed for adversary simulation and red team operations. It features a post-exploitation agent called Beacon and supports covert communication channels to model advanced persistent threats.
Download from helpsystems.com (commercial license required)
./teamserver <IP> <password>
Cobalt Strike is the industry-standard adversary simulation platform for professional red teams. It provides a comprehensive post-exploitation agent called Beacon, flexible command and control channels, and tools for every phase of a red team engagement from initial access to exfiltration.
Cobalt Strike's power comes from its Malleable C2 framework, which allows operators to customize network traffic patterns to evade detection. By mimicking legitimate application traffic, Cobalt Strike can blend in with normal network activity while maintaining persistent, encrypted command and control channels.
The platform includes collaboration features for team servers, a graphical timeline for visualizing operations, automated reporting, and extensive logging. Its modular design supports custom aggressor scripts extending functionality for specific engagement requirements.
./teamserver 10.10.10.10 <PASS>Start the team server bound to an IP with a shared password for clients./teamserver 10.10.10.10 <PASS> c2.profileStart the team server using a specific Malleable C2 profile./cobaltstrikeLaunch the Cobalt Strike GUI client to connect to a team server./cobaltstrike.shLaunch the client via the wrapper script on Linuxc2lint c2.profileValidate a Malleable C2 profile with the bundled linter before usesleep 60 30Beacon: set 60s check-in with 30% jitter to reduce predictabilitysleep 0Beacon: switch to interactive mode with no delay between check-insshell whoamiBeacon: run a Windows command via cmd.exe on the hostrun net userBeacon: execute a program directly without cmd.exepowershell Get-ProcessBeacon: run a PowerShell command through the imported contextpowerpick Get-ProcessBeacon: run PowerShell via unmanaged injection (no powershell.exe)execute-assembly /path/to/Seatbelt.exeBeacon: run a .NET assembly in memory without touching diskinline-execute /path/to/bof.oBeacon: run a Beacon Object File (BOF) in-processgetsystemBeacon: attempt to elevate to SYSTEM via token duplicationgetuidBeacon: show the current user token the Beacon is running asModel advanced persistent threat behaviors with custom C2 profiles and TTPs matching real threat actors.
Full-spectrum red team engagements from initial access to data exfiltration with team collaboration.
Execute commands, dump credentials, pivot laterally, and maintain persistence through Beacon payloads.
Design and execute spear phishing campaigns with embedded Beacon payloads for initial access.
Deploy domain fronting, redirectors, and Malleable C2 profiles for resilient command and control.
Provide realistic adversary emulation for defensive teams to detect and respond to advanced threats.
Exploitation
Free exploitation framework for vulnerability discovery and initial access.
Post Exploitation
Open-source post-exploitation framework with PowerShell agents.
Post Exploitation
Windows credential extraction tool integrated into Beacon's mimikatz command.
Post Exploitation
Automated Windows/AD lateral movement and post-exploitation toolkit.
Post Exploitation
Python Windows protocol toolkit for remote execution and credential dumping.
Post Exploitation
WinRM shell for remote Windows administration and lateral movement.
The graphical dashboard visually represents compromised hosts. Each session provides details on connection timing, privileges, and system architecture. A comprehensive log captures every keystroke and command.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.