The cobalt strike integrates the port scan, the location is in explore -> port scan. Of course, as a powerful collaborative work platform + penetration weapon, how could there be some common scanning function. Then we can proxy through the proxychains within the network penetration. In the network penetration, in a shell machine on the deployment of a socks, you can use the local tools to penetrate the network, so the blend strike is also integrated function, pivoting -> socks server established successfully, will be shown below: If you do not want to find their own account password, you can view in the credentials, it is convenient.

Now we can catch the password, in the cobal strike also integrated mimikatz, in the access -> Run mimikatz, and then you can see the password down. In fact, through the stri strike, strike may be achieved, the use of Bypass UACĬlick on the target, right -> access -> bypass uac, and then wait, the following will be prompted whether the success of success, and after the success of the list will be generated in the above a user with * number of host, as shown below To establish a connection, even after we still the same first to establish listener, and then generate exe Trojans, not too much to say, and then we upload the exe to webshell and implementation, Found in the client has been on the line.īut our authority is not very high, just a webserver permissions, commonly used to mention the script has been tried, but not how to do?

How to install cobalt strike