BypassAV |
BypassAV |
用于快速生成免杀的可执行文件 |
![](https://camo.githubusercontent.com/7b28af179c16e49678765730b84fc0c57c1da1132143ff561d65ee94b21b1958/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6861636b3266756e2f4279706173734156) |
![](https://camo.githubusercontent.com/27470a0eb96559ae65c1233510da87ab40beec5856ee73976ea9a885f3faf569/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6861636b3266756e2f4279706173734156) |
BypassAV |
scrun |
BypassAV ShellCode Loader (Cobaltstrike/Metasploit) Useage |
![](https://camo.githubusercontent.com/5d299ab6aa830e66849c2c2a591894d7112cc42458c25272b850966e93569c92/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6b38676567652f736372756e) |
![](https://camo.githubusercontent.com/213e2e208421d2756a3fa02f7010c0c9dd72cfcf374bb58d6b9290b64a58334e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6b38676567652f736372756e) |
BypassAV |
beacon-c2-go |
beacon-c2-go (Cobaltstrike/Metasploit) |
![](https://camo.githubusercontent.com/773bc3b21ba54fc9e3ff79f893478176470b2ca119534332d7e8db9213868da5/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f7761687975686164692f626561636f6e2d63322d676f) |
![](https://camo.githubusercontent.com/1eef0c207d99d2eeefe8452c23be1305fd29b17d15df33b7faf7e8e10886a33a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f7761687975686164692f626561636f6e2d63322d676f) |
BypassAV |
C--Shellcode |
python ShellCode Loader (Cobaltstrike&Metasploit) Useage |
![](https://camo.githubusercontent.com/2693b8cc53048f0d88f11660056af720909780e49a59c50cba8a8f09a5613b5d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f4f6e65486f6e652f432d2d5368656c6c636f6465) |
![](https://camo.githubusercontent.com/6da1b5a0aa5c7595dfb7bf3333692e3661c5630f972b76a7906ebef0d1d94e91/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f4f6e65486f6e652f432d2d5368656c6c636f6465) |
BypassAV |
Doge-Loader |
Cobalt Strike Shellcode Loader by Golang |
![](https://camo.githubusercontent.com/0aecbc4e071397979ef9ce859acb016ed1bd782eaab16831726653e6b46184f1/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f74696d77686974657a2f446f67652d4c6f61646572) |
![](https://camo.githubusercontent.com/e3d9f677087afade9c26e0528c574990ecbc3c9dc9fe07f31d47920469c4b41f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f74696d77686974657a2f446f67652d4c6f61646572) |
BypassAV |
CS-Loader |
CS免杀,包括python版和C版本的 |
![](https://camo.githubusercontent.com/907082d19d94eaa68067477009d38762212cfa020045477c0abd9aee131d86ea/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f47616c6974793336392f43532d4c6f61646572) |
![](https://camo.githubusercontent.com/9cfc1fee3e7ccfc4e2cabc738d2d2aea3637a5bb5397bcbb22f2e134473e664e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f47616c6974793336392f43532d4c6f61646572) |
BypassUAC |
UAC-SilentClean |
This project implements a DLL planting technique to bypass UAC Always Notify and execute code in a high integrity process. |
![](https://camo.githubusercontent.com/80ff0e5e4278644844a5445976ca280f1c0618c24fdc5f361876ca67f1f2e354/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f456e636f646547726f75702f5541432d53696c656e74436c65616e) |
![](https://camo.githubusercontent.com/4a10a0c18c94a6230da09ae382ded56197bd06bd86f8b9bdf175f15ef87e6ab4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f456e636f646547726f75702f5541432d53696c656e74436c65616e) |
Recon |
red-team-scripts |
perform some rudimentary Windows host enumeration with Beacon built-in commands |
![](https://camo.githubusercontent.com/3b1f015fd70b96534853e970f721a22e4ecf06927a8e9e5a7c409299d346c7c5/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f746872656174657870726573732f7265642d7465616d2d73637269707473) |
![](https://camo.githubusercontent.com/147fd0812faebe73d1610c2cd1b06a8bea706e457a741dc64dbc0fd7c4dd60aa/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f746872656174657870726573732f7265642d7465616d2d73637269707473) |
Recon |
aggressor-powerview |
All functions listed in the PowerView about page are included in this with all arguments for each function. PowerView |
![](https://camo.githubusercontent.com/d85cab47f44d9739c1b5962f1c0dbf8f9de72d57fe320eb8a74b04d0dcd29ea4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f7465766f72612d7468726561742f616767726573736f722d706f77657276696577) |
![](https://camo.githubusercontent.com/9d003b522548bf6c5a1c5237591d1c61f98ea8bdb1baca6d012372646ef12c56/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f7465766f72612d7468726561742f616767726573736f722d706f77657276696577) |
Recon |
PowerView3-Aggressor |
PowerView Aggressor Script for CobaltStrike PowerView |
![](https://camo.githubusercontent.com/225a40ddd2e40c460cbc7ba2a4a044f7a39899ead823d4c878cc26293b201f50/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f7465766f72612d7468726561742f506f77657256696577332d416767726573736f72) |
![](https://camo.githubusercontent.com/f2cc8358fb6378219661a905bb9008788bbea6048332343d1a427553385d68cb/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f7465766f72612d7468726561742f506f77657256696577332d416767726573736f72) |
Recon |
AggressorScripts |
Sharphound-Aggressor- A user menu for the SharpHound ingestor |
![](https://camo.githubusercontent.com/2f65fa378b9b0767fb677319c45b9f84bbef2ca2c71279038089caad7c92e11c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f43306178782f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/0da6b254ccbd47ff0b540a1d254e281706aefaaeae13af0eb49c2e3d8a4ea24b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f43306178782f416767726573736f7253637269707473) |
Recon |
ServerScan |
内网横向信息收集的高并发网络扫描、服务探测工具。 |
![](https://camo.githubusercontent.com/7e9918ff6f5b5294f30aa8ca6d6f72a0e9c6610743af1713df0984a190237f88/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f41646d696e69736d652f5365727665725363616e) |
![](https://camo.githubusercontent.com/f3b705c2968fff1755c72bd5ccbb2615cad8051d6719f194a2826218d1f70de8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f41646d696e69736d652f5365727665725363616e) |
Recon |
AggressiveProxy |
LetMeOutSharp will try to enumerate all available proxy configurations and try to communicate with the Cobalt Strike server over HTTP(s) using the identified proxy configurations. |
![](https://camo.githubusercontent.com/642b9abdedf1c8749a06e1fc212f77e4458f3c08eac7d66864c9ad5cd7b8f3de/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f456e636f646547726f75702f4167677265737369766550726f7879) |
![](https://camo.githubusercontent.com/a366d6284f6a10b6aab47f4dc6959625e280a070eef35139a5b02693df44ac4b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f456e636f646547726f75702f4167677265737369766550726f7879) |
Exploit |
XSS-Fishing2-CS |
鱼儿在cs上线后自动收杆 / Automatically stop fishing in javascript after the fish is hooked |
![](https://camo.githubusercontent.com/28eb1ee96b632393f19a873ce7543dd18ed1e6ab650ef9401965db05a0783470/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5468654b696e674f664475636b2f5853532d46697368696e67322d4353) |
![](https://camo.githubusercontent.com/2ba84ec3483badd7ce22536497f7dd66482b6bb846988af13daa9ce43073aaa9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5468654b696e674f664475636b2f5853532d46697368696e67322d4353) |
Exploit |
XSS-Phishing |
xss钓鱼,cna插件配合php后端收杆 |
![](https://camo.githubusercontent.com/7e93896338b658715cdd881086e3f6469813ec8d32f30e1b9edc3229e460498a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f74696d77686974657a2f5853532d5068697368696e67) |
![](https://camo.githubusercontent.com/0f98eb5f0011f5fad95d26fc8ed67c02f5c403a4aec3e01305c77c3d8d623e53/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f74696d77686974657a2f5853532d5068697368696e67) |
Exploit |
custom_payload_generator |
CobaltStrike3.0+ --> creates various payloads for Cobalt Strike's Beacon. Current payload formats |
![](https://camo.githubusercontent.com/734547fb5cc181f025c94177cad5e5bb2d4a9b26e77951ddbf1fbf6491773ba9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6f666673656367696e6765722f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/81e1615638c1594020745c0d2d57fd62a2c58a3933049ba717ee544ee1e6aa66/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6f666673656367696e6765722f416767726573736f7253637269707473) |
Exploit |
CrossC2 |
CrossC2 framework - Generator CobaltStrike's cross-platform beacon |
![](https://camo.githubusercontent.com/4b78518d1f96fff1b0b1f82411893aa43b8494b250272d21a6e6d92cea22e86f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f676c6f7865632f43726f73734332) |
![](https://camo.githubusercontent.com/ae2920c36c93089a9cb6e69b0acf8c28b80ea068186a84e94784d9bb5ca6c9ee/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f676c6f7865632f43726f73734332) |
Exploit |
GECC |
Go External C2 Client implementation for cobalt strike. |
![](https://camo.githubusercontent.com/c64e7cda3f05e3446dea6905ac8e88c36f6822c17146f9690148eae7e343ebd8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f4c7a31792f47454343) |
![](https://camo.githubusercontent.com/d08acdf22d1523a9992a8411f01f25ffc303b744026d31a6cf89a093b58fc6e9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f4c7a31792f47454343) |
Exploit |
Cobaltstrike-MS17-010 |
ms17-010 exploit tool and scanner. |
![](https://camo.githubusercontent.com/b3309dde9cc4d40873e0343dfceb7148417b7b07269c60aa0a1909c4610699ac/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f7068696e6b2d7465616d2f436f62616c74737472696b652d4d5331372d303130) |
![](https://camo.githubusercontent.com/8ce8c5dbfe2c689275df10f7bae9207b113470d7e57cce509c1d70555b98f7b6/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f7068696e6b2d7465616d2f436f62616c74737472696b652d4d5331372d303130) |
Exploit |
AES-PowerShellCode |
Standalone version of my AES Powershell payload for Cobalt Strike. |
![](https://camo.githubusercontent.com/39481c7ca35cc0f5e321cd17412217f57cbbcaac84cb79f80a62c267fc2a0b26/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6f666673656367696e6765722f4145532d506f7765725368656c6c436f6465) |
![](https://camo.githubusercontent.com/7926b0fdb26e96633832ba97f8194b1544357fd01f243a2e82770a062e5f5a1d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6f666673656367696e6765722f4145532d506f7765725368656c6c436f6465) |
Exploit |
SweetPotato_CS |
CobaltStrike4.x --> SweetPotato |
![](https://camo.githubusercontent.com/32ecd8f3efbda937f4dac680ae34989268cc201a07d5405878e1275bd1cf27c2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f547963783272792f5377656574506f7461746f5f4353) |
![](https://camo.githubusercontent.com/4fb4404f702c1264054bb9e11c473675f51131b74b0cd5d9a2ed205cb4751f0c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f547963783272792f5377656574506f7461746f5f4353) |
Exploit |
ElevateKit |
privilege escalation exploits |
![](https://camo.githubusercontent.com/9a00f0c483f8a40bf72661160cd81506b823bf91c810bb84d0578de444ff81db/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f72736d756467652f456c65766174654b6974) |
![](https://camo.githubusercontent.com/b93ed8c0d4053e75162b1afb5673aa18188e1ca03da1cf0078f170ed8acc496c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f72736d756467652f456c65766174654b6974) |
Exploit |
CVE-2018-4878 |
CVE-2018-4878 |
![](https://camo.githubusercontent.com/d413e3aeac9ba539e33d4a962aab4178b0ac57b9a631ec2b2a1386df9962fd9c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f767973656375726974792f4356452d323031382d34383738) |
![](https://camo.githubusercontent.com/a56e496488bc99a2c3a6ebcbe8828f4b932e7c0ab49d41a57bb27e6e00a80f95/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f767973656375726974792f4356452d323031382d34383738) |
Exploit |
Aggressor-Scripts |
The only current public is UACBypass, whose readme can be found inside its associated folder. |
![](https://camo.githubusercontent.com/069bb18a25c8c7ff66367acda8e25b1e6736daa6a02df3c4d4080f1bae9afd16/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5268696e6f53656375726974794c6162732f416767726573736f722d53637269707473) |
![](https://camo.githubusercontent.com/c9574136d89b7c68860072330566e1d0eb8f63f0aa2fe15020a26d94cddeae40/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5268696e6f53656375726974794c6162732f416767726573736f722d53637269707473) |
Exploit |
CVE_2020_0796_CNA |
基于ReflectiveDLLInjection实现的本地提权漏洞 |
![](https://camo.githubusercontent.com/e62198b3fbeaa0cab138ad36a5348fcf3dd279923cc6dd383374712b5189b360/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f52766e307873792f4356455f323032305f303739365f434e41) |
![](https://camo.githubusercontent.com/2fe18e2e69be05706d270683e8e06b329323b6b742d0fb98ed18b6316d860422/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f52766e307873792f4356455f323032305f303739365f434e41) |
Exploit |
DDEAutoCS |
setup our stage(d) Web Delivery attack |
![](https://camo.githubusercontent.com/b2406bd879048ef33717be4aa8cdc5ed08cf3e7432f178b8c452a7fed4c08f63/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f703239322f4444454175746f4353) |
![](https://camo.githubusercontent.com/0bfa0904e07ab54b1a21cf35bc935b59a65eb854ddb7426653f688a18b13693f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f703239322f4444454175746f4353) |
Exploit |
geacon |
Implement CobaltStrike's Beacon in Go (can be used in Linux) |
![](https://camo.githubusercontent.com/f2c84ac2ab255c4d072afd42a15a0a61ddd48a3701817483ae6f110e8dc47a6f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6461726b7234792f676561636f6e) |
![](https://camo.githubusercontent.com/247c984e8a102735e9a138f10499a1a99e10b38d27114202e216b27392d666b9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6461726b7234792f676561636f6e) |
Persistence |
persistence-aggressor-script |
persistence-aggressor-script |
![](https://camo.githubusercontent.com/031f2431190bc7b14ce721a0305c148617151b7ba5f55927904125305bde1d85/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5a6f6e6b5365632f70657273697374656e63652d616767726573736f722d736372697074) |
![](https://camo.githubusercontent.com/6046d8ee69d7cb442ee442a69f4bad2a12dbe4b300a99ac2cadb58f3b54cc3c3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5a6f6e6b5365632f70657273697374656e63652d616767726573736f722d736372697074) |
Persistence |
Peinject_dll |
弃用winexec函数,使用shellexecute函数,程序流不在卡顿,达到真正的无感。 |
![](https://camo.githubusercontent.com/6cc0000555ce89f984523a82291c2dfdb7bcf1f6cabbe922d199419346b83c28/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d306e676f3073652f5065696e6a6563745f646c6c) |
![](https://camo.githubusercontent.com/aefae4e97baf638e141443f40f21da5abdfea78c8b72e736d1457af67e213e14/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6d306e676f3073652f5065696e6a6563745f646c6c) |
Persistence |
TikiTorch |
TikiTorch follows the same concept(CACTUSTORCH) but has multiple types of process injection available, which can be specified by the user at compile time. |
![](https://camo.githubusercontent.com/31d159fbc4d7b20302fd6979b88b08b83d0eb23d79bd73a7ca573f43744f5f07/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f72617374612d6d6f7573652f54696b69546f726368) |
![](https://camo.githubusercontent.com/ad2777150962a2c5dc37cf4b609b830fe7e07bc79702aefb72f77ae13300bced/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f72617374612d6d6f7573652f54696b69546f726368) |
Persistence |
CACTUSTORCH |
A JavaScript and VBScript shellcode launcher. This will spawn a 32 bit version of the binary specified and inject shellcode into it. |
![](https://camo.githubusercontent.com/6836e226c73f60b89204e5ed03ab9b5cdf659bc906733153796cf5eb2ebb9fdc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d647365636163746976656272656163682f434143545553544f524348) |
![](https://camo.githubusercontent.com/f9006a77ec432b034b05417e40ddc509e9e29c0f2fe632388ce621bb881cfc6a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6d647365636163746976656272656163682f434143545553544f524348) |
Persistence |
UploadAndRunFrp |
上传frpc并且运行frpc |
![](https://camo.githubusercontent.com/db230ad532f1ae7eeb567515ed2c4c19e3f43c8616c3c0a870f2dd3312fb5dfc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f4368316e67672f416767726573736f725363726970742d55706c6f6164416e6452756e467270) |
![](https://camo.githubusercontent.com/65d34a177e106107c3aba67fd79db01c93f6fa370ddaad2a5a1d5d1529833e77/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f4368316e67672f416767726573736f725363726970742d55706c6f6164416e6452756e467270) |
Persistence |
persistence-aggressor-script |
Persistence Aggressor Script |
![](https://camo.githubusercontent.com/089d517796ab175f741ae500aae98baeaf6861757fee86cb9452d9fc4eb9b4b2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f746872656174657870726573732f70657273697374656e63652d616767726573736f722d736372697074) |
![](https://camo.githubusercontent.com/6ecbeb8b010b95cd158225057fbbfc58cb6c89136d0e0fe4d712ef1dc2e94b19/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f746872656174657870726573732f70657273697374656e63652d616767726573736f722d736372697074) |
Persistence |
AggressiveGadgetToJScript |
Automate the generation of payloads using the GadgetToJScript technique. |
![](https://camo.githubusercontent.com/a0373232906e0961160abee0fb1a8b63985363f3b089891451e5302fd1683394/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f456e636f646547726f75702f41676772657373697665476164676574546f4a536372697074) |
![](https://camo.githubusercontent.com/dbea85eb636532dc22965df01287ba8023da1eb2c0ad201d803e660966f30300/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f456e636f646547726f75702f41676772657373697665476164676574546f4a536372697074) |
Auxiliary |
Cobaltstrike-atexec |
利用任务计划进行横向,需要与135端口、445端口进行通信 |
![](https://camo.githubusercontent.com/5ee6f3222f8902d8cbdafdd7c2e642901af5617be563211fafe7620a2dc604ab/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f52766e307873792f436f62616c74737472696b652d617465786563) |
![](https://camo.githubusercontent.com/e86481b8bfb7e2c004faba5bc7e156a4f9961d58a50189be078141fba41a8c2a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f52766e307873792f436f62616c74737472696b652d617465786563) |
Auxiliary |
Sharp-HackBrowserData |
C#的HackBrowserData工具,方便在cs中直接内存加载 |
![](https://camo.githubusercontent.com/48d8a3420a0eb84ef9a1f1005cf2618ae5acb3344718b315f1032e9067eada5e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f53336375723354683173536831742f53686172702d4861636b42726f7773657244617461) |
![](https://camo.githubusercontent.com/8659d80cc96077724b437383e22173ad0a479d552c320770080b6ff027e58dfd/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f53336375723354683173536831742f53686172702d4861636b42726f7773657244617461) |
Auxiliary |
SharpeningCobaltStrike |
In realtime compiling of dotnet v35/v40 exe/dll binaries + obfuscation with ConfuserEx on your linux cobalt strike server. |
![](https://camo.githubusercontent.com/5d294a3080a87f27a7fca933a8e9747f13fb506848615cd30aebd6ea334b728a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f637562653078302f5368617270656e696e67436f62616c74537472696b65) |
![](https://camo.githubusercontent.com/316fa01e1f4083029736601ccdc3fcb270552e3c9bca1179c66a1a54522c105e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f637562653078302f5368617270656e696e67436f62616c74537472696b65) |
Auxiliary |
SharpCompile |
SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime. |
![](https://camo.githubusercontent.com/97e11acd952c957c002387ac85fa294d503f0c371f9c4102a3617e7caa45ef6d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5370696465724c6162732f5368617270436f6d70696c65) |
![](https://camo.githubusercontent.com/7007d8b41d6d9358d860b6d2494a0d55515ed31bcf8339d5e4486b36a2041633/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5370696465724c6162732f5368617270436f6d70696c65) |
Auxiliary |
Quickrundown |
Utilizing QRD will allow an operator to quickly characterize what processes are both known and unknown on a host through the use of colors and notes about the processes displayed. |
![](https://camo.githubusercontent.com/286cc986dd0be7543894885ff4a021940958aaf8c31d849fbb342d4a7597eb6c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f69636562656172667269656e642f517569636b72756e646f776e) |
![](https://camo.githubusercontent.com/081d69ec395f901cfac8922aa90f521055c234c9ec10b4ab7f60477be83e7f9e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f69636562656172667269656e642f517569636b72756e646f776e) |
Auxiliary |
Phant0m_cobaltstrike |
This script walks thread stacks of Event Log Service process (spesific svchost.exe) and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running. |
![](https://camo.githubusercontent.com/952b8f5f37d7db422c15151b7932f9768e70497e93363b805629eb4f5a8c4ecc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f703239322f5068616e74306d5f636f62616c74737472696b65) |
![](https://camo.githubusercontent.com/f0172cb9821288d8b762eef2e68a68364dac82e75edc28a2e1ba7aa1b78318c6/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f703239322f5068616e74306d5f636f62616c74737472696b65) |
Auxiliary |
NoPowerShell |
NoPowerShell is a tool implemented in C# which supports executing PowerShell-like commands while remaining invisible to any PowerShell logging mechanisms. |
![](https://camo.githubusercontent.com/ba7afaa354aa5ee69c6393922aa3b8d83e779319f93bf5a2a2959ca4112409a3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6269747361646d696e2f6e6f706f7765727368656c6c) |
![](https://camo.githubusercontent.com/53a3f7ee7ef920a95d4631ab7e161090830f0431b601fa7a00a9f693f1010477/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6269747361646d696e2f6e6f706f7765727368656c6c) |
Auxiliary |
EventLogMaster |
RDP EventLog Master |
![](https://camo.githubusercontent.com/1c75b6fc303f86c124b07db7bb8aff8c45fd4c9c75459bfe5e0fd37d0a73abdc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5141582d412d5465616d2f4576656e744c6f674d6173746572) |
![](https://camo.githubusercontent.com/9e93ab41c06a2024dd5436ff65d22ea89743d8e134ab925d06c79604b6f73fc5/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5141582d412d5465616d2f4576656e744c6f674d6173746572) |
Auxiliary |
ANGRYPUPPY |
Bloodhound Attack Path Execution for Cobalt Strike |
![](https://camo.githubusercontent.com/911e929f148f4dc9df86d30fbcc8b745af29e633ea8c536385eb4a0c3e023f65/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f767973656375726974792f414e4752595055505059) |
![](https://camo.githubusercontent.com/be909d6331f2a9e2fc949d1faa0b1dba8385ef30f73130b01f6d75788fd698bb/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f767973656375726974792f414e4752595055505059) |
Auxiliary |
CobaltStrike_Script_Wechat_Push |
上线微信提醒的插件,通过微信Server酱提醒 |
![](https://camo.githubusercontent.com/10a1fc81761174258fe49e85625e8f566aadd1fc101de66de323f3811dcb95b1/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6131696365732f436f62616c74537472696b655f5363726970745f5765636861745f50757368) |
![](https://camo.githubusercontent.com/d3b51d3a28eaa23cc01e03bc7b7a69810daac356de767fce980d29947423ca7a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6131696365732f436f62616c74537472696b655f5363726970745f5765636861745f50757368) |
Auxiliary |
CS-Aggressor-Scripts |
slack and webhooks reminder |
![](https://camo.githubusercontent.com/3fb8acfeb9a16c06e986b202a596d0222195f768de91316657a995610c12cac5/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f73656367726f756e647a65726f2f43532d416767726573736f722d53637269707473) |
![](https://camo.githubusercontent.com/744d8015bef7430ba85cc4b629526786078b6c46d8a7421dface523f6b02b7b2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f73656367726f756e647a65726f2f43532d416767726573736f722d53637269707473) |
Auxiliary |
Aggressor-Scripts |
surveying of powershell on targets (在对应的目标上检测powershell的相关信息) |
![](https://camo.githubusercontent.com/20f54ac7d5250430c0e4324c7b1c2297b321a2a859435d2cb57fbcf94f85e42f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f736b796c65726f6e6b656e2f416767726573736f722d53637269707473) |
![](https://camo.githubusercontent.com/39e8e1be90b59e1bd9c4b43ef551773d272acb6ffc915da9eb8dab0ca497874f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f736b796c65726f6e6b656e2f416767726573736f722d53637269707473) |
Auxiliary |
cs-magik |
Implements an events channel and job queue using Redis for Cobalt Strike. |
![](https://camo.githubusercontent.com/863251327e9f8cd2a99ce2a519303e50426326d36e7a5e3a4f990470241c7bce/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f746f6d737465656c652f63732d6d6167696b) |
![](https://camo.githubusercontent.com/7a355a24dc54cddad7ddc0db24c831810a2d0319eb6c920b7c3d9e9a4c20fd9f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f746f6d737465656c652f63732d6d6167696b) |
Auxiliary |
AggressorScripts |
查看进程的时候讲av进程标注为红色 |
![](https://camo.githubusercontent.com/bc75df60a7cb775b9b5eec2aafe0f1dc3c985d7d2321adc5c4814c0fc9fb0298/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f7a65723079752f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/1d5a49c1a692c68bdeddc10d18dcbd648842a5106546a178b108ebfd5db3594c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f7a65723079752f416767726573736f7253637269707473) |
Auxiliary |
Raven |
CobaltStrike External C2 for Websockets |
![](https://camo.githubusercontent.com/d784c8112736e662a37c2c34cb36f6f90d16913938566500a4c25ef0ae24c309/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f786f7272696f722f726176656e) |
![](https://camo.githubusercontent.com/0cb9eca5730b31ebc51f43e1c556dc7d9bea175d3efa9be18db15d3acaaa0031/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f786f7272696f722f726176656e) |
Auxiliary |
CobaltStrikeParser |
Python parser for CobaltStrike Beacon's configuration |
![](https://camo.githubusercontent.com/a23717cb08ae18ef5a7017da80eb6b9ff0959f7ef827009ed3a0d30dffbed53b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f53656e74696e656c2d4f6e652f436f62616c74537472696b65506172736572) |
![](https://camo.githubusercontent.com/cb236854a1b6b6c07b17f84c729db2d6f3927c4e050eeb7079035ce33f165cb3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f53656e74696e656c2d4f6e652f436f62616c74537472696b65506172736572) |
Auxiliary |
fakelogonscreen |
FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password. |
![](https://camo.githubusercontent.com/d66e525304bcf15c04f8525062f4c88650a79c1f4aed575515b228932d650208/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6269747361646d696e2f66616b656c6f676f6e73637265656e) |
![](https://camo.githubusercontent.com/946c5c6b9c950dfe206add89964e234700a31be09c17dcd1b24796840efbeee8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6269747361646d696e2f66616b656c6f676f6e73637265656e) |
Auxiliary |
SyncDog |
Make bloodhound sync with cobaltstrike. |
![](https://camo.githubusercontent.com/90a79a36d10e6c69e6912d04cb7524d57ad0361595049d6c8eaf48f31c9e82ba/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f4c7a31792f53796e63446f67) |
![](https://camo.githubusercontent.com/3639868e76cea44863bb491468f33e55c63d6d3b44ce54ab7201820fbf49df4f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f4c7a31792f53796e63446f67) |
Auxiliary |
360SafeBrowsergetpass |
一键辅助抓取360安全浏览器密码的CobaltStrike脚本,通过下载浏览器数据库、记录密钥来离线解密浏览器密码。 |
![](https://camo.githubusercontent.com/9ea1a2faaff71d239fda2d031753fd5dad017ed71209354dfda2502cb45d857d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f686179617365632f3336305361666542726f7773657267657470617373) |
![](https://camo.githubusercontent.com/5ae0904cc0e61cb1b6d0570e5c43d1b1b0d6a804e06cd65f69fc8bc50a2936e1/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f686179617365632f3336305361666542726f7773657267657470617373) |
Auxiliary |
SharpDecryptPwd |
对密码已保存在 Windwos 系统上的部分程序进行解析,包括:Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品(Xshell,Xftp)。 |
![](https://camo.githubusercontent.com/99ae0fcbc49c5b6ec10eefc6a9d64e9d06d8266ce6cc026a6fd88746df30fbc2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f756b6e6f777365632f536861727044656372797074507764) |
![](https://camo.githubusercontent.com/763a0d2f9e69b032b1c9064b802577da95c19e18e9c836feaf8e89fc52833c04/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f756b6e6f777365632f536861727044656372797074507764) |
Auxiliary |
List-GitHubAssembly |
Fetch a list of avaialble artifacts from the configured GitHub repo. |
![](https://camo.githubusercontent.com/9f4f093bf801c4c642d8fa07cd562320a0de3c1c4badbb18fd158c370f3bf176/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d647365636163746976656272656163682f457865637574652d476974687562417373656d626c792d416767726573736f72) |
![](https://camo.githubusercontent.com/b5c52b35016ef064fb9c825e14b7e781cd1451918b857d507522d2321da145dd/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6d647365636163746976656272656163682f457865637574652d476974687562417373656d626c792d416767726573736f72) |
Synthesis |
Erebus |
CobaltStrike4.x --> Erebus CobaltStrike后渗透测试插件 |
![](https://camo.githubusercontent.com/d5a2ac23c0b6730e2048e6723485ef8bfac0b8fdff8b970b9805c5167bb08988/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f44654570696e47683073742f457265627573) |
![](https://camo.githubusercontent.com/b3186a5d5b9aedb723a10786d10a6783cb726806bdc2549102b8d6671366153a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f44654570696e47683073742f457265627573) |
Synthesis |
Cobalt-Strike-Aggressor-Scripts |
CobaltStrike后渗透测试插件集合 Usage |
![](https://camo.githubusercontent.com/997d9da4bb208355862e4ee92dd32a4b14a6eb467d51a0ea3e845c0fbe46460b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f74696d77686974657a2f436f62616c742d537472696b652d416767726573736f722d53637269707473) |
![](https://camo.githubusercontent.com/9a6cc4e08af876d32a99a08835cc649f694dc1dcb941f8d702fa2ba571f0bf77/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f74696d77686974657a2f436f62616c742d537472696b652d416767726573736f722d53637269707473) |
Synthesis |
AggressorScripts |
Aggressor scripts for use with Cobalt Strike 3.0+ |
![](https://camo.githubusercontent.com/340c624b3b6dd55ee5c8d0a66224e897f579b2f4f70b6ad3a4fd9f6e5bdde771/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f626c7573637265656e6f666a6566662f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/10f82a96fc0121fbca7d750c565c76a2bed741df89c0ad112a00378afd263c25/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f626c7573637265656e6f666a6566662f416767726573736f7253637269707473) |
Synthesis |
RedTeamTools |
RedTeamTools for use with Cobalt Strike |
![](https://camo.githubusercontent.com/e5c13c11f7c994ee5107202e93e7bfed1c281227e240d0b32a72f541e1c6d730/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6c656e676a69626f2f5265645465616d546f6f6c73) |
![](https://camo.githubusercontent.com/392070ba3309bf605780bddd97cd0661f8535b69cdc52dddaf39e33cda96b9bd/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6c656e676a69626f2f5265645465616d546f6f6c73) |
Synthesis |
cobalt-arsenal |
Aggressor Scripts for Cobalt Strike 4.0+ |
![](https://camo.githubusercontent.com/3654289afad7b16a879de0e63b543dd8cb639078fa929a7e8c53facc63bae8ce/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d6765656b792f636f62616c742d617273656e616c) |
![](https://camo.githubusercontent.com/7665892999d5f3bc2331b7554425b0ae74ef779d2d4e9c20456887bb7ea4bb33/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6d6765656b792f636f62616c742d617273656e616c) |
Synthesis |
MoveKit |
The aggressor script handles payload creation by reading the template files for a specific execution type. intro |
![](https://camo.githubusercontent.com/2d750ac1e0be5378d1c8cf8fbe55d7e993a629342bd2d72ee3121a89c0ac9731/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f3078746869727465656e2f4d6f76654b6974) |
![](https://camo.githubusercontent.com/1e92832439486a65d70f01117cebce4f62d552a0664699dc5d52896a2026e266/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f3078746869727465656e2f4d6f76654b6974) |
Synthesis |
StayKit |
The aggressor script handles payload creation by reading the template files for a specific execution type. intro |
![](https://camo.githubusercontent.com/0a85bdc4b7b4a9e60b86a1f6928bcb880009d5ca0aadfed962fd900e5efbcce2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f3078746869727465656e2f537461794b6974) |
![](https://camo.githubusercontent.com/78e27a981d8807a4b5ac019fa0d173083303bf8fa313b6e95d9c93711491afd0/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f3078746869727465656e2f537461794b6974) |
Synthesis |
AggressorScripts |
AggressorScripts |
![](https://camo.githubusercontent.com/a36ab8536f138a0ae3298d5c4fec6aa869e00329d45bd2d7e1450f0b2fe30faf/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f72616d656e307833662f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/d10fb32cfca98eab2ed3356987f029ef34b662f8514cbf180ca0df705fb2d9cc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f72616d656e307833662f416767726573736f7253637269707473) |
Synthesis |
AggressorScripts |
Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources |
![](https://camo.githubusercontent.com/ff21bad544dd74d4a81e2e2f0439626b5e57a6dfa0b17021b2f711ef13109c01/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6861726c65795175316e6e2f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/ee5db8047cef2cc9231e4afa6646bc22cc3f0a48969716b301a38fdfba6612fd/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6861726c65795175316e6e2f416767726573736f7253637269707473) |
Synthesis |
AggressorScripts |
AggressorScripts |
![](https://camo.githubusercontent.com/a36ab8536f138a0ae3298d5c4fec6aa869e00329d45bd2d7e1450f0b2fe30faf/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f72616d656e307833662f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/d10fb32cfca98eab2ed3356987f029ef34b662f8514cbf180ca0df705fb2d9cc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f72616d656e307833662f416767726573736f7253637269707473) |
Synthesis |
Aggressor-VYSEC |
Contains a bunch of CobaltStrike Aggressor Scripts |
![](https://camo.githubusercontent.com/8d76b018ecca2d13952a3516a40ef6f81bcb666357b7515cd070d1c308b9c959/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f767973656375726974792f416767726573736f722d5659534543) |
![](https://camo.githubusercontent.com/090d8512d23947449c3139bc254224919e099a281392ad964ba7e9291c7b0892/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f767973656375726974792f416767726573736f722d5659534543) |
Synthesis |
AggressorAssessor |
AggressorAssessor |
![](https://camo.githubusercontent.com/d75049959378e94594c54453701caa37d4d98aa10760a1801a76b443d413330a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f466f7274794e6f72746853656375726974792f416767726573736f724173736573736f72) |
![](https://camo.githubusercontent.com/0beb57337aed1a3b1d14f5bcc3cfa77dba8027b2169ce2fe727850526fc2f0ba/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f466f7274794e6f72746853656375726974792f416767726573736f724173736573736f72) |
Synthesis |
AggressorAssessor |
AggressorAssessor |
![](https://camo.githubusercontent.com/d75049959378e94594c54453701caa37d4d98aa10760a1801a76b443d413330a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f466f7274794e6f72746853656375726974792f416767726573736f724173736573736f72) |
![](https://camo.githubusercontent.com/0beb57337aed1a3b1d14f5bcc3cfa77dba8027b2169ce2fe727850526fc2f0ba/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f466f7274794e6f72746853656375726974792f416767726573736f724173736573736f72) |
Synthesis |
aggressor-scripts |
Collection of Cobalt Strike Aggressor Scripts |
![](https://camo.githubusercontent.com/a765a4cbfba8cf41e22b3742ae52c47679ea71fcd0685bbe7c5a909ed8273b7a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f746872656174657870726573732f616767726573736f722d73637269707473) |
![](https://camo.githubusercontent.com/c2aa54265d51a3fa455f495bdffe42e905c73c0dc1602b664390c723865354fc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f746872656174657870726573732f616767726573736f722d73637269707473) |
Synthesis |
Aggressor-scripts |
This is just a random collection of Aggressor Scripts I've written for Cobalt Strike 3.x. (其中有一个debug脚本比较好用) |
![](https://camo.githubusercontent.com/49064722a4dfa94c9a0192e04171e35ac9063954fbd4a4aecc96ece666389d4b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f556e643372663130772f416767726573736f722d73637269707473) |
![](https://camo.githubusercontent.com/78f216f8e6daec8c992bd8649e954c5c5d4d3782b8f6fd9559cb19450814bb77/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f556e643372663130772f416767726573736f722d73637269707473) |
Synthesis |
Aggressor-Script |
Collection of Aggressor Scripts for Cobalt Strike(主要包含了提权和权限维持脚本) |
![](https://camo.githubusercontent.com/2516bbbd1d4c3b0d056347ea7e19ff9d8940c40bd5da2f56c7608391868d5f4d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f72617374612d6d6f7573652f416767726573736f722d536372697074) |
![](https://camo.githubusercontent.com/cf452345a25529324d0488f0c6d5816eec403243c324a7026051a14e19d86333/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f72617374612d6d6f7573652f416767726573736f722d536372697074) |
Synthesis |
Aggressor-Script |
Aggressor Script, Kit, Malleable C2 Profiles, External C2 and so on |
![](https://camo.githubusercontent.com/b64498e92c2b98bb6a228488e4eb4ea80a1a9153ad2da668ef2fcb880c4773e2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5141582d412d5465616d2f436f62616c74537472696b652d546f6f6c736574) |
![](https://camo.githubusercontent.com/7d1ccb38bc3766ecf40216555616c94c35cc17bd3f826a90afb8249059cb6769/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5141582d412d5465616d2f436f62616c74537472696b652d546f6f6c736574) |
Synthesis |
aggressor_scripts_collection |
Collection of various aggressor scripts for Cobalt Strike from awesome people. Will be sure to update this repo with credit to each person. |
![](https://camo.githubusercontent.com/1d1e4a114182c9618a53a09dd6760bd148c2632e62bc4abbf3650f863997e4c2/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d696368616c6b6f637a776172612f616767726573736f725f736372697074735f636f6c6c656374696f6e) |
![](https://camo.githubusercontent.com/21684ff6ae7088864ea1318a197f16c0badbb040f02fd943dd649ace56821acb/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6d696368616c6b6f637a776172612f616767726573736f725f736372697074735f636f6c6c656374696f6e) |
Synthesis |
CobaltStrike-ToolKit |
googlesearch.profile and script related to AD. |
![](https://camo.githubusercontent.com/3bd4c6b6f4a1d96152fceed5b0445000e6896401bfe4f466de2da7dd59f96bcc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6b696c6c7377697463682d4755492f436f62616c74537472696b652d546f6f6c4b6974) |
![](https://camo.githubusercontent.com/886606ff476bcde1c04d90184a0c15a992aef70764680ea714ce2792b38b4b92/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6b696c6c7377697463682d4755492f436f62616c74537472696b652d546f6f6c4b6974) |
Synthesis |
Arsenal |
Cobalt Strike 3.13 Arsenal Kit |
![](https://camo.githubusercontent.com/4706f8e8e3566233da5fdafce33881f28d83b92feb11ed0cb89b04ac25e40be5/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f436c696f762f417273656e616c) |
![](https://camo.githubusercontent.com/00601a805822a33a37ce5387f22b6c78f8b0f6ea419ffa25933ee8f753e5b3aa/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f436c696f762f417273656e616c) |
Synthesis |
cobalt-arsenal |
My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+ |
![](https://camo.githubusercontent.com/3654289afad7b16a879de0e63b543dd8cb639078fa929a7e8c53facc63bae8ce/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d6765656b792f636f62616c742d617273656e616c) |
![](https://camo.githubusercontent.com/7665892999d5f3bc2331b7554425b0ae74ef779d2d4e9c20456887bb7ea4bb33/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6d6765656b792f636f62616c742d617273656e616c) |
Synthesis |
aggressor_scripts |
code execution via DCOM;the privilege escalation techniques included in ElevateKit;etc. |
![](https://camo.githubusercontent.com/4706f8e8e3566233da5fdafce33881f28d83b92feb11ed0cb89b04ac25e40be5/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f436c696f762f417273656e616c) |
![](https://camo.githubusercontent.com/00601a805822a33a37ce5387f22b6c78f8b0f6ea419ffa25933ee8f753e5b3aa/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f436c696f762f417273656e616c) |
Synthesis |
aggressor_scripts |
code execution via DCOM;the privilege escalation techniques included in ElevateKit;etc. |
![](https://camo.githubusercontent.com/78a17217e72b7b9c527010b0266b3e54aca2b48708f56e3d38fa24799d2ce30d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f3030315350415254614e2f616767726573736f725f73637269707473) |
![](https://camo.githubusercontent.com/f06229df950c8caa308d6e1a74355f852bc2b2738b160261b963c4a6f110d4af/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f3030315350415254614e2f616767726573736f725f73637269707473) |
Synthesis |
aggressor |
creating tunnels with netsh; changed default to bit.ly redirect to mcdonalds;using powershell to kill parent process; |
![](https://camo.githubusercontent.com/78a17217e72b7b9c527010b0266b3e54aca2b48708f56e3d38fa24799d2ce30d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f3030315350415254614e2f616767726573736f725f73637269707473) |
![](https://camo.githubusercontent.com/f06229df950c8caa308d6e1a74355f852bc2b2738b160261b963c4a6f110d4af/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f3030315350415254614e2f616767726573736f725f73637269707473) |
Synthesis |
CobaltStrikeCNA |
A collection of scripts - from various sources - see script for more info. |
![](https://camo.githubusercontent.com/8115aca863e5c0a26d6397267a1d59ee1e605bffd17371e84218e6e600af7ee8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6272616e7468616c652f436f62616c74537472696b65434e41) |
![](https://camo.githubusercontent.com/6a2c96a094377345abfe1a39ddc38704e60efe7e033d5edfbcf8995247b5dee4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6272616e7468616c652f436f62616c74537472696b65434e41) |
Synthesis |
AggressorScripts |
Highlights selected processes from the ps command in beacon;Loads various aliases into beacon;sets a few defaults for scripts to be used later.. |
![](https://camo.githubusercontent.com/2297eed9cb251d14399311901d2b780a59f51ae3fb4e4d9f8b65caabab5c8a47/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6f6c64623030742f416767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/d190e613cd4fc0f042a0f6dd44d7237d337a4c1986a9f5b0687bee7c0c7925b4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6f6c64623030742f416767726573736f7253637269707473) |
Synthesis |
AggressorAssessor |
从C2生成到横向移动的全辅助脚本套件 |
![](https://camo.githubusercontent.com/d75049959378e94594c54453701caa37d4d98aa10760a1801a76b443d413330a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f466f7274794e6f72746853656375726974792f416767726573736f724173736573736f72) |
![](https://camo.githubusercontent.com/0beb57337aed1a3b1d14f5bcc3cfa77dba8027b2169ce2fe727850526fc2f0ba/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f466f7274794e6f72746853656375726974792f416767726573736f724173736573736f72) |
Synthesis |
AggressorCollection |
Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors |
![](https://camo.githubusercontent.com/697a4c2be28e1e6ded325cbeab45388e5ef8edd5843e62d86d01277e6611fb62/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f696e766f6b657468726561746775792f416767726573736f72436f6c6c656374696f6e) |
![](https://camo.githubusercontent.com/4447853508f91d095a2f2e4967db13909dcd8b44703357fb7b0ca2c6abb32ea9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f696e766f6b657468726561746775792f416767726573736f72436f6c6c656374696f6e) |
Synthesis |
Cobaltstrike-Aggressor-Scripts-Collection |
The collection of tested cobaltstrike aggressor scripts. |
![](https://camo.githubusercontent.com/14fef8368ff7cc9f7fcfe743113148e6b6735cda77dd818e418f421834626db9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f62797465636f6433722f436f62616c74737472696b652d416767726573736f722d536372697074732d436f6c6c656374696f6e) |
![](https://camo.githubusercontent.com/bab458cf71ff23fb146af3a610a512d820f3066d20267aae227e8bb8b25c505b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f62797465636f6433722f436f62616c74737472696b652d416767726573736f722d536372697074732d436f6c6c656374696f6e) |
Synthesis |
aggressorScripts |
CobaltStrike AggressorScripts for the lazy |
![](https://camo.githubusercontent.com/48fba7ef27ea1194d830cfa61a5bdd580381d564abfb69ff3dae03dbb9a37a69/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f4d617472697832303038352f616767726573736f7253637269707473) |
![](https://camo.githubusercontent.com/f5392277dcd48cb16a49a58e92d0d7e3426cba435a187a62813f77be4c6cfb4b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f4d617472697832303038352f616767726573736f7253637269707473) |
Synthesis |
cobalt_strike_extension_kit |
集成了SharpHound,SharpRDP,SharpWMI等在内的各种内网工具,使用AggressorScripts构建workflow |
![](https://camo.githubusercontent.com/14805389625d2d5301c79c9570ee15f73f4704e4cd2a8e2f3f037e8f78280d0e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6a6f736570686b696e6773746f6e652f636f62616c745f737472696b655f657874656e73696f6e5f6b6974) |
![](https://camo.githubusercontent.com/ffaaccc34da4a4bb2902932f10315baa0ac1b2744e7d1e4c0652235a7a7c3d6a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f6a6f736570686b696e6773746f6e652f636f62616c745f737472696b655f657874656e73696f6e5f6b6974) |
Synthesis |
cobaltstrike |
具备域管理员定位、域信息收集、权限维持、内网扫描、数据库hash dump、Everything内网搜索文件等功能的插件集合 |
![](https://camo.githubusercontent.com/ab5bbdf973245d9fc7c917c0a05ca88e0e86d397f1673ed71ed829109313ee49/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f776166696e666f2f636f62616c74737472696b65) |
![](https://camo.githubusercontent.com/61e3cc3d7a9f1c6840d7ba1bce739478880052c5d92558c8260312a853f1ec60/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f776166696e666f2f636f62616c74737472696b65) |
Synthesis |
365CobaltStrike |
兼容CobaltStrike4.0的插件集合 |
![](https://camo.githubusercontent.com/739dd6f8081d512ed52b4bb1181e6d9701c02740d4e5ae562117a9e8636a6550/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f306530772f436f62616c74537472696b65) |
![](https://camo.githubusercontent.com/3d408b63d456a946debfd1169a2c3c7d60288986778fa36615ac5b61fc37fd55/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f306530772f436f62616c74537472696b65) |
Synthesis |
CSPlugins |
一个对Cobaltstrike第三方插件进行收集的项目,持续更新。 |
![](https://camo.githubusercontent.com/f59fe68a2926acc176fc7e8e730a7d28c018f09b86568d3bee5018b5ddf9672f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f416c3165782f4353506c7567696e73) |
![](https://camo.githubusercontent.com/5ea2ea988249032c27daa49eaf5f957f5dd4c976334f3d75f36e237f45392c27/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f416c3165782f4353506c7567696e73) |
Synthesis |
CobaltStrike-xor |
third-party --> vnc_x86_dll and vnc_x64_dll |
![](https://camo.githubusercontent.com/9443ec951d83be41136693b1c72180007cdc186a1ad4b37c528dcc38b1d2a983/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f5742476c496c2f436f62616c74537472696b652d66696c65) |
![](https://camo.githubusercontent.com/4ac3276823f425cb0e2468a580d51830f14417017618a52e3b8ba23574cc40f4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f5742476c496c2f436f62616c74537472696b652d66696c65) |