cracked5pider/kaynstrike

UDRL for CS

KaynStrike

A User Defined Reflective Loader for Cobalt Strike Beacon that spoofs the thread start address and frees itself after entry point was executed.

Thread Start Address spoofing

Reflective Loader cleanup

Proof

How to use this

Just load the KaynStrike.cna agressor script and build a stageless beacon (tested this as an exe)

Credits

• S4ntiagoP. Had the idea from one of his tweets to free the reflective loader
• Austin Hudson (aka SecIdiot). Reflective Loader Design & ROP Chain

kaynstrike's Issues

'ptr' is not a NASM keyword

Not sure if I have the wrong version of something?

ubuntu@dev ~/KaynStrike (main)> make
Compile executable...
src/KAssembly.s:43: warning: `ptr' is not a NASM keyword [-w+ptr]
src/KAssembly.s:44: warning: `ptr' is not a NASM keyword [-w+ptr]
src/KAssembly.s:30: error: invalid combination of opcode and operands
src/KAssembly.s:37: error: invalid combination of opcode and operands
make: *** [makefile:17: x64] Error 1

can't run with some profile settings

it will break when profile set to:
set cleanup "true";
set sleep_mask "true";