From a787eb7740e627c8eb6324661b4af42c0160cbb7 Mon Sep 17 00:00:00 2001 From: Mariusz B Date: Thu, 9 Apr 2020 11:26:12 -0400 Subject: [PATCH] Added cobalt-arsenal --- .gitmodules | 3 +++ red-teaming/README.md | 2 ++ red-teaming/cobalt-arsenal | 1 + 3 files changed, 6 insertions(+) create mode 160000 red-teaming/cobalt-arsenal diff --git a/.gitmodules b/.gitmodules index 8e210b8..71b0105 100644 --- a/.gitmodules +++ b/.gitmodules @@ -37,3 +37,6 @@ [submodule "red-teaming/malleable_redirector/proxy2"] path = red-teaming/malleable_redirector/proxy2 url = https://github.com/mgeeky/proxy2.git +[submodule "red-teaming/cobalt-arsenal"] + path = red-teaming/cobalt-arsenal + url = https://github.com/mgeeky/cobalt-arsenal.git diff --git a/red-teaming/README.md b/red-teaming/README.md index 9583c53..09fabd3 100644 --- a/red-teaming/README.md +++ b/red-teaming/README.md @@ -44,6 +44,8 @@ FullLanguage - **`clickOnceSharpPickTemplate.cs`** - This is a template for **C# Console Project** containing [SharpPick](https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerPick) technique of loading Powershell code from within C# application. The ClickOnce concept is to generate a windows self-updating Application that is specially privileged ([ClickOnce](https://www.slideshare.net/NetSPI/all-you-need-is-one-a-click-once-love-story-secure360-2015)) +- **cobalt-arsenal** - A set of my published Cobalt Strike 4.0+ compatible aggressor scripts. That includes couple of my handy utils I've used on various engagements. + - **`compressedPowershell.py`** - Creates a Powershell snippet containing GZIP-Compressed payload that will get decompressed and executed (IEX) . ([gist](https://gist.github.com/mgeeky/e30ceecc2082a11b99c7b24b42bd77fc)) diff --git a/red-teaming/cobalt-arsenal b/red-teaming/cobalt-arsenal new file mode 160000 index 0000000..31c89fb --- /dev/null +++ b/red-teaming/cobalt-arsenal @@ -0,0 +1 @@ +Subproject commit 31c89fb2d82c9a2d2cdbf877344249afa2c58877