Install cobalt strike kali 2 code#
Install cobalt strike kali 2 download#

The certutil attack vector was identified by Matthew Graeber which allows you to take a binary file, move it into a base64 format and use certutil on the victim machine to convert it back to a binary for you. You can run msfconsole -r unicorn.rc to launch the listener for Metasploit.Ī user must click allow and accept when using the HTA attack in order for the PowerShell injection to work properly. The first is index.html, second Launcher.hta and the last, the unicorn.rc file. All files are exported to the hta_access/ folder and there will be three main files. The HTA attack will automatically generate two files, the first the index.html which tells the browser to use Launcher.hta which contains the malicious PowerShell injection code.

Install cobalt strike kali 2 code#

NOTE: When copying and pasting the excel, if there are additional spaces that are added you need to remove these after each of the PowerShell code sections under variable “x” or a syntax error will happen! HTA ATTACK INSTRUCTIONS The name of the macro itself must also be “AutoOpen” instead of the legacy “Auto_Open” naming scheme. If you are deploying this against Office365/2016+ versions of Word you need to modify the first line of the output from Sub Auto_Open() You should get a shell through PowerShell injection after that.

THIS IS NORMAL BEHAVIOR! This is tricking the victim into thinking the excel document is corrupted. Note that a message will prompt to the user saying that the file is corrupt and automatically close the excel document. Create a new macro, call it Auto_Open and paste the generated code into that. Once you do that, you will have a developer tab. MACRO ATTACK INSTRUCTIONSįor the macro attack, you will need to go to File, Properties, Ribbons, and select Developer. Note: You will need to have a listener enabled in order to capture the attack.

Install cobalt strike kali 2 download#

When using the download and exec, simply put python unicorn.py windows/download_exec url= and the PowerShell code will download the payload and execute. This attack also supports windows/download_exec for a payload method instead of just Meterpreter payloads. Simply paste the powershell_attack.txt command in any command prompt window or where you have the ability to call the PowerShell executable and it will give a shell back to you. There are so many implications and scenarios to where you can use this attack at. Often times this could be through an excel/word doc or through psexec_commands inside of Metasploit, SQLi, etc. Note you will need a place that supports remote command injection of some sort. The text file contains all of the code needed in order to inject the PowerShell attack into memory. Unicorn supports your own shellcode, cobalt strike, and Metasploit.Īlso Read Onion nmap To Scan Hidden Onion Services POWERSHELL ATTACK INSTRUCTIONSĮverything is now generated in two files, powershell_attack.txt and unicorn.rc. Usage is simple, just run Magic Unicorn (ensure Metasploit is installed if using Metasploit methods and in the right path) and the magic unicorn will automatically generate a PowerShell command that you need to simply cut and paste the Powershell code into a command line window or through a payload delivery system. Based on Matthew Graeber’s PowerShell attacks and the PowerShell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18. A unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory.