Cobalt Strike Linux Beacon

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/EricEsquivel/CobaltStrike-Linux-Beacon
• Blog Title: Cobalt Strike Linux Beacon
• Suggested Section: Windows Hardening -> Cobalt Strike (add subsection for custom implants / non-Windows beacons) or Generic Hacking -> Exfiltration / Tunneling and Port Forwarding (SOCKS pivoting via implant) with cross-reference from Cobalt Strike

🎯 Content Summary

What this is
This GitHub repository is a Proof-of-Concept (PoC) offensive implant: a custom Cobalt Strike “Beacon-like” agent for Linux written in C that can be controlled from a Cobalt Strike Team Server by correctly implementing the Cobalt Strike HTTP/S protocol (using the default C2 profile). It is not a CVE write-up or a product vulnerability; the “security impact” is that it provides an attacker-controlled implant that enables command exe...

🔧 Technical Details

Custom-implant technique: Implement the Cobalt Strike Team Server’s expected HTTP/S communication (here, the default C2 profile) to build a fully custom “Beacon-like” agent for any platform while retaining Cobalt Strike’s operator workflow. Once the protocol is matched, the operator can task the implant (sleep/cd/pwd/shell/ls/exit/upload/download) and receive responses via standard listener traffic.

Linux post-exploitation extensibility: Add modular capability by executing Linux Beacon Object Files (BOFs) within the implant process using an ELF loader (e.g., TrustedSec’s ELFLoader). This allows operators to run BOF-based functionality (including TrustedSec and Outflank-style BOFs) in-memory/in-process, effectively extending the implant beyond its built-in commands without rewriting the core agent.

Pivoting via implant: Embed a SOCKS proxy inside the beacon to tunnel/proxy operator traffic through the compromised host, enabling access to internal services and networks ...

🤖 Agent Actions

Updated windows-hardening/cobalt-strike.md with a new subsection on building custom/non-Windows Cobalt Strike implants (Linux beacon PoC): covering protocol compatibility with default HTTP/S profiles, Aggressor Script payload generation, implemented task handlers, Linux BOF execution via ELFLoader/Outflank templates, and embedded SOCKS pivoting behavior. Added a comprehensive References section citing the PoC repo and related protocol/BOF resources.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/EricEsquivel/CobaltStrike-Linux-Beacon

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Cobalt Strike (add subsection for custom implants / non-Windows beacons) or Generic Hacking -> Exfiltration / Tunneling and Port Forwarding (SOCKS pivoting via implant) with cross-reference from Cobalt Strike".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0