https://github.com/fgfxf/HttpStageDownloader

cobaltstrike的http分阶段下载器 cpp版本;cobaltstrike stage downloader;
https://github.com/fgfxf/HttpStageDownloader

Last synced: 21 days ago
JSON representation

cobaltstrike的http分阶段下载器 cpp版本;cobaltstrike stage downloader;

• Host: GitHub
• URL: https://github.com/fgfxf/HttpStageDownloader
• Owner: fgfxf
• Created: 2023-03-15T04:04:31.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2023-03-15T04:19:00.000Z (over 1 year ago)
• Last Synced: 2024-08-05T17:27:06.317Z (4 months ago)
• Language: C++
• Size: 378 KB
• Stars: 3
• Watchers: 1
• Forks: 1
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - fgfxf/HttpStageDownloader - cobaltstrike的http分阶段下载器 cpp版本;cobaltstrike stage downloader; (C++)

README

        
# HttpStageDownloader

cobaltstrike的http分阶段下载器 cpp版本

cobaltstrike stage downloader writed by cpp

参考视频：https://www.bilibili.com/video/BV1MA4y1Z7Uz/

cobalt strike的http beacon很容易被查杀，这里用wininet和winhttp写了个分阶段下载器。

代码里的


   const WCHAR* szUrl = L"http://127.0.0.1/async/Newtab_promos";


    const WCHAR* szDomain = L"127.0.0.1";


    const WCHAR* szUrlPath = L"/async/Newtab_promos";


    const char* szFileName = "stage.bin";


自己根据profile文件进行修改.


![](https://github.com/fgfxf/HttpStageDownloader/blob/main/1.png) 


![](https://github.com/fgfxf/HttpStageDownloader/blob/main/2.png) 


![](https://github.com/fgfxf/HttpStageDownloader/blob/main/3.png) 


![](https://github.com/fgfxf/HttpStageDownloader/blob/main/4.png) 


![可以正常上线，但是有黑框](https://github.com/fgfxf/HttpStageDownloader/blob/main/5.png)