search

improsec / SharpEventPersist

Persistence by writing/reading shellcode from Event Log
364 stars 48 forks source link

problem #1

Closed m0s30 closed 2 years ago

m0s30 commented 2 years ago

can u show me a example for the file shellcode.bin? Is it generated by cs which is raw format?

m0s30 commented 2 years ago

is that mean,i don't need to convert the bin to hex by myself? And the program will convert the raw bin to hex automatically? I hope to get your answer.thanks

nfp-improsec commented 2 years ago

Hi PANDA-MS. You can get the shellcode from Cobalt Strike by selecting "Attacks -> Packages -> Windows Executable (S)" and choose "Raw" output. Remember to select "Use x64 payload". You can also use stageless raw x64 shellcode from Cobalt Strike. You don't need to convert it to anything. Just save the shellcode from Cobalt Strike as "whatever.bin" and run the tool with "-file C:\path\to\whatever.bin".