CodeX

Webcam capture capability for Cobalt Strike as a BOF, with in-memory download options

Quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles

WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

My collection of malware dev links

template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.

Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client.

Open Source Implementation of Cobalt Strike's Malleable C2

A simple ExternalC2 POC for Havoc C2. Communicates over Notion using a custom python agent, handler and extc2 channel. Not operationally safe or stable, built as a PoC to showcase Havoc C2's modular C2 channel interface.

Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog post as a tutorial sample

open source port/reimplementation of the Cobalt Strike BOF Loader as is

open source implementation of the UDC2 spec used in Cobalt Strike

BOF template with boflink and mutator kit support

Adaptix C2 extender to support Cobalt Strike Malleable C2 profiles

This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built in Sleep() call. Most of the structure e.g. Sleep hook, shellcode exec etc. are taken from mgeeky's https://github.com/mgeeky/ShellcodeFluctuation.

Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"

Cobalt Strike BOF to obtain location data

Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs

Active Directory forensic framework

No description.

Light and more OPSEC friendly way for red teamers to gain quick situational awareness of both the host and the user.

No description.

No description.

Probably the easiest way to setup new beacon notifications in Cobalt Strike

No description.

No description.

No description.

Pops a shell on a goautodial server

Adversary Emulation Framework

No description.

A novel technique to communicate between threads using the standard ETHREAD structure

A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge years ago.

Misc utils I made here and there, collected in one place

Cobalt Strike UDRL for memory scanner evasion.

Titan: A generic user defined reflective DLL for Cobalt Strike

codextf2.github.io

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

A python library that allows importing of Postman 2.1 JSON collections into ready to use requests objects

My bashrc file

forked for safekeeping

Improved version of the james server RCE. Spawns a reverse shell that can bypass rbash ;)

Dynamically Loads Assembly and Calls Methods from JScript

No description.

Sleep Obfuscation

No description.

No description.

Robust Cobalt Strike shellcode loader with multiple advanced evasion features

No description.

The repository of popular C2 (sources).

A sample client/server architecture

A barebones template of 'rogue' aka a simple recon and agent deployment I built to communicate over ICMP. Well, without the ICMP code.

No description.