What is the primary goal of the post-exploitation phase in a red team engagement?
To hunt down the operational objective by locating it, identifying who has access, and executing a plan to gain access without being detected.
List three examples of tactics, techniques, and procedures (TTPs) used during the post-exploitation phase.
Local/domain reconnaissance, privilege escalation, credential dumping, user impersonation, and lateral movement are all common post-exploitation TTPs.
In post-exploitation, what is the term for assessing the machine you have access to and its environment?
Situational awareness.
What Beacon command behavior category includes commands that only change or return values stored within Beacon’s memory?
House-Keeping.
The _____ command behavior category in Cobalt Strike includes the most benign commands that only call Windows APIs.
API-Only
The cd, cp, ls, ps, and pwd commands are all examples of what Beacon command behavior category?
API-Only.
What is a Beacon Object File (BOF)?
A BOF is a C program compiled without a linker that can be loaded and executed in memory by a Beacon.
What is the primary disadvantage of using a BOF for inline execution in Beacon?
If the code inside the BOF crashes, the Beacon process will die along with it.
The _____ execution pattern involves spawning a temporary process and injecting a reflective DLL into it, with output read over a named pipe.
Fork & Run
What is the main trade-off of using the ‘Fork & Run’ execution pattern compared to inline execution?
It provides better stability for Beacon but at the expense of a larger detection surface.
What are the two ‘flavors’ of the Fork & Run execution pattern in Cobalt Strike?
The two flavors are ‘spawn’ and ‘explicit’.
How does the ‘spawn’ variant of Fork & Run differ from the ‘explicit’ variant?
The ‘spawn’ variant creates a new temporary process for injection, while the ‘explicit’ variant injects into a process that already exists.
Which two arguments in a Beacon command’s help text indicate it supports the ‘explicit’ Fork & Run variant?
The presence of [pid] and [arch] arguments indicates support for the ‘explicit’ variant.
The execute-assembly and powerpick commands are examples of which Fork & Run variant?
The ‘spawn’ variant.
The psinject command is an example of which Fork & Run variant?
The ‘explicit’ variant.
What Cobalt Strike command injects a reflective VNC DLL to gain remote control of a user’s desktop?
The desktop command.
How does the VNC session initiated by the desktop command tunnel its traffic back to the team server?
It creates a reverse port forward on the target which the VNC DLL uses to tunnel traffic.
What is the default interaction mode for a VNC session started with the desktop command?
The session is in ‘view only’ mode by default.
Which Beacon command executes a given command using cmd.exe /c on the target?
The shell command.
Which Beacon command executes a target program directly without using cmd.exe?
The run command.
Why does the command dir only work with the shell command and not the run command?
Because dir is a command that exists only within cmd.exe and is not a separate program on disk.
For better OPSEC, what API-only command should be used as an alternative to shell dir?
The ls command.
For better OPSEC, what API-only command should be used as an alternative to shell whoami?
The getuid command.
Which Beacon command executes PowerShell by invoking powershell.exe?
The powershell command.
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
