search

boku7 / BokuLoader

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!
MIT License
1.23k stars 242 forks source link

Executables fail to start #34

Closed ghost closed 7 months ago

ghost commented 7 months ago

I discovered this wonderful project but I am not able to test its performance on my lab enviroment. The malleable c2 that I'm using is the recommended jquery-c2.4.7. The same malleable C2 works for other loaders without any issues so It might no be that. I don't know.

I'm running Cobalt Strike version 4.9.1 and I'm using the most recent version of Bokuloader. The script gave me back a "correct" output in the script console but when I try to run the .exe on the machine I got this error. AV is disabled for this test.

C2 profile boku

Any help appreciated! Thanks very much for your time and your amazing work.

boku7 commented 7 months ago

Yeah that is normal behavior. You either have to modify the cs artifact kit to support the bigger 100k beacon or you have to DIY your own loader that can support the 100k beacon size. There is instructions by fortra on how to increase artifact size somewhere. I think there’s a link in this readme. If it’s broken just search around for it and you will find