Getting Started
Command & Control
External Reconnaissance
Initial Compromise
Host Reconnaissance
Host Persistence
Host Privilege Escalation
Elevated Host Persistence
Credential Theft
Password Cracking Tips & Tricks
Domain Reconnaissance
User Impersonation
Lateral Movement
Session Passing
Pivoting
Data Protection API
Kerberos
Active Directory Certificate Services
Group Policy
MS SQL Servers
Domain Dominance
Forest & Domain Trusts
Local Administrator Password Solution
Microsoft Defender Antivirus
Application Whitelisting
Data Hunting & Exfiltration
Extending Cobalt Strike

Powered by GitBook

On this page

Beacon Passing

PreviousSession Passing NextForeign Listener

Last updated 1 year ago

The spawn command will spawn an x86 or x64 process and inject shellcode for the specified listener into it.

In this example, I have a DNS Beacon checking in from bfarmer every 1 minute. Instead of operating through this Beacon, I want to leave it open as a lifeline on a slow check-in. In which case, I can spawn a new HTTP session and work from there instead.

\