# Cobalt Strike Published articles for Cobalt Strike. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Merging C# Assemblies using dnMerge DevFeed: [Merging C# Assemblies using dnMerge]() Original publisher: [Read original article]() Author: CCob Published: 2021-07-04T08:32:55Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [C#](), [Linux](), [.NET](), [C2](), [Compression](), [Deployment]() Tags: [assembly](), [c-sharp](), [c2](), [cobalt-strike](), [compression](), [costura](), [deployment](), [dnmerge](), [linux](), [merge](), [net](), [tooling]() ### AI overview This developer article explains why Costura can introduce .NET Core assembly references when merging C# assemblies during Linux-based cross-compilation. It introduces dnMerge, an MSBuild plugin that merges and compresses reference assemblies while retaining Linux cross-compilation support, and describes its use of LZMA compression. ### Source excerpt Introduction When it comes to automating builds for any project that I undertake, my goto OS is usually Linux. Generally I find the deployment of build nodes easier to deploy and manage and usually cheaper than their Windows counterparts. The problem with this of course is Windows based software generally needs cross-compiling in someway or [...] The post Merging C# Assemblies using dnMerge appeared first on Ethical Chaos. ## Attacking Smart Card Based Active Directory Networks DevFeed: [Attacking Smart Card Based Active Directory Networks]() Original publisher: [Read original article]() Author: CCob Published: 2020-10-04T19:31:42Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [active directory](), [Authentication](), [certificates](), [private key](), [Cryptography](), [kerberos](), [public key]() Tags: [active-directory](), [attacks](), [authentication](), [certificates](), [cobalt-strike](), [hooking](), [kerberos](), [pin](), [pinswipe](), [pki](), [private-key](), [public-key](), [rubeus](), [smart-card](), [swipe](), [weaponize]() ### AI overview This article examines attacks against smart-card-enforced Active Directory networks. It explains that a physical smart card is not necessarily required for smart-card logon when the corresponding private key is available, describes certificate requirements and policy-related certificate abuse, and introduces PKINIT as public-key support for Kerberos pre-authentication. ### Source excerpt Introduction Recently I was involved in an engagement where I was attacking smart card based Active Directory networks. The fact is though, you don't need a physical smart card at all to authenticate to Active Directory that enforces smart card logon. The attributes of the certificate determine if it can be used for smart card [...] The post Attacking Smart Card Based Active Directory Networks appeared first on Ethical Chaos. ## EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls DevFeed: [EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls]() Original publisher: [Read original article]() Author: CCob Published: 2020-06-14T10:47:09Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [Endpoint Security & XDR](), [Code](), [API](), [Processes]() Tags: [antivirus](), [api](), [av](), [boilerplate](), [bypass](), [cobalt-strike](), [code](), [edr](), [hooking](), [process](), [sharpblock](), [trampoline]() ### AI overview This tutorial examines methods for bypassing an active-protection EDR, including avoiding suspicious RWX memory changes, unhooking API calls, and using direct syscall instructions. It also introduces SharpBlock and accompanying code. ### Source excerpt A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part 2 I introduce SharpBlock, a method of bypassing EDR's. The post Lets Create An EDR... And Bypass It! Part 2 appeared first on Ethical Chaos. ## SweetPotato - Local Service to SYSTEM DevFeed: [SweetPotato - Local Service to SYSTEM]() Original publisher: [Read original article]() Author: CCob Published: 2020-04-13T17:30:53Z Content type: article Language: en Sources: [Ethical Chaos]() Topics: [Exploit](), [Windows](), [.NET](), [Security](), [C2]() Tags: [c-sharp](), [c2](), [cobalt-strike](), [dcom](), [exploit](), [juicypotato](), [privesc](), [rottenpotato](), [sweetpotato](), [weaponize](), [windows](), [winrm]() ### AI overview This article introduces SweetPotato, a C# rewrite of JuicyPotato that performs local service-account to SYSTEM privilege escalation on Windows. It adds a BITS/WinRM-based technique and can automatically select between exploit methods depending on the Windows version. ### Source excerpt Upgraded JuicyPotato performing Local Service to SYSTEM privilege escalation on Windows 7 to the latest Windows 10 / Server 2019. The post SweetPotato - Local Service to SYSTEM appeared first on Ethical Chaos. ## Weaponizing your favorite Go program for Cobalt Strike DevFeed: [Weaponizing your favorite Go program for Cobalt Strike]() Original publisher: [Read original article]() Author: CCob Published: 2020-01-26T17:40:54Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [Go Language](), [CMake](), [gcc](), [Compiler](), [GitHub]() Tags: [bypass](), [cmake](), [cobalt-strike](), [compiler](), [edr](), [gcc](), [github](), [go](), [golang](), [reflective-dll](), [weaponize](), [weaponizing]() ### AI overview This tutorial explains how to adapt a Go program into a reflective DLL for in-memory execution within Cobalt Strike. It presents a GitHub template based on gobuster and describes its use of CMake, GCC, the Go compiler, and CGO. ### Source excerpt How to convert a Go program to a reflective DLL for Cobalt Strike The post Weaponizing your favorite Go program for Cobalt Strike appeared first on Ethical Chaos.