Cobalt strike beacon multiple hosts update#

To set up Beaconpire, load the beaconpire.cna script on your Cobalt Strike and start Empire’s RESTful API server with. I borrowed heavily from that script to make Beaconpire. Empire 2.0 support is planned for the future.Ī big thanks to Will Schroeder ( for his awesome veil_evasion.cna script.

Cobalt strike beacon multiple hosts update#

Beaconpire currently supports the latest update in the master Empire branch. Interacting with the RESTful API requires curl to be installed on the teamserver. Beaconpire is written in Sleep and Aggressor Script and is entirely self-contained - no third party JSON scripts/libraries are required. This post introduces beaconpire.cna - a script to help increase interoperability efficiency.īeaconpire uses Beacon functionality and Empire’s RESTful API to manage Empire listeners and pass sessions between the toolsets, all from within Cobalt Strike. While this process isn’t inherently difficult, it is Manual session passing with Cobalt Strike and Empire is a tedious process andthat can interrupt a flow during post-exploitation, where efficiency is paramount.

For example, passing a Beacon to Empire requires the tester to start an Empire listener, generate a launcher, and paste the code in each session to be passed. Currently, the most efficient way to pass sessions from one toolset to another is to use an existing session to run a payload for the target toolset. Sometimes, an assessment requires migrating from one toolset to another for a specific task or, worse, if incident responders block your primary toolset. Two toolsets I frequently use are Cobalt Strike and Empire. Justin Warner ( wrote about the importance of tool diversity in his post Empire & Tool Diversity: Integration is Key. Achieving an assessment’s objective often requires the use of multiple toolsets.

Tester flexibility and the ability to adapt to each environment’s unique controls and technologies is critical on assessments.