I hereby claim:
- I am sixdub on github.
- I am sixdub (https://keybase.io/sixdub) on keybase.
- I have a public key whose fingerprint is E477 7917 9253 D455 9007 8FE0 9F54 9507 2437 E38C
To claim this, I am signing this object:
| meta: | |
| id: beaconconfig | |
| title: Cobalt Strike Beacon Config | |
| endian: be | |
| doc: | | |
| Cobalt Strike Beacon is a popular offensive security tool. Beacon itself | |
| is a DLL that gets injected into memory and can be staged from C2 servers. | |
| The Beacon DLL (in unencoded form) contains a configuration section that gets | |
| patched by the C2 server. This section is a fixed predictable structure |
| ######## SCRIPT EXAMPLE ######## | |
| function Do-SomethingStupid | |
| { | |
| function local:Get-NumberFive | |
| { | |
| return 5 | |
| } | |
| $value = Get-NumberFive | |
| if (value -ne 5) | |
| { |
I hereby claim:
To claim this, I am signing this object:
| function Invoke-DllByteEncode | |
| { | |
| #Encoder used to take a dll and turn it into a base64 encoded byte array for Powersploit's | |
| #Invoke-ReflectivePEInjection | |
| Param( | |
| [Parameter(Position = 0)] | |
| [String] | |
| $InputPath, | |
| [Parameter(Position = 1)] | |
| [String] |