# CSSG | Cobalt Strike Shellcode Generator

**URL:** <https://onehack.st/t/cssg-cobalt-strike-shellcode-generator/171348>\
**Category:** Tools & Scripts\
**Tags:** programming\
**Created:** [January 30, 2021, 10:51am UTC](https://onehack.st/t/cssg-cobalt-strike-shellcode-generator/171348 "2021-01-30T10:51:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [January 30, 2021, 10:51am UTC](https://onehack.st/t/cssg-cobalt-strike-shellcode-generator/171348/1 "2021-01-30T10:51:54Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/e/1/e116d39e22acd1d2c1f05070b72f75c2367ed658.png)

Adds Shellcode – Shellcode Generator to the Cobalt Strike top menu bar

CSSG is an aggressor and python script used to more easily generate and format beacon shellcode

Generates beacon stageless shellcode with exposed exit method, additional formatting, encryption, encoding, compression, multiline output, etc

**shellcode transforms are generally performed in descending menu order**

**Requirements:**  
The optional AES encryption option uses a python script in the /assets folder  
Depends on the pycryptodome package to be installed to perform the AES encryption

Install pycryptodome with pip depending on your python environment:

```auto
python -m pip install pycryptodomepython3 -m pip install pycryptodomepy -3 -m pip install pycryptodomepy -2 -m pip install pycryptodome

```

You can check that pycryptodome is present after the pip install with a command like:

```auto
python -m pip list | grep crypto

```

The generator will use the system’s default “python” command to launch the AES encryption script

_ **Options for the shellcode generator are:** _

**Listener:**  
Select a valid listener with the “…” button. Shellcode will be generated form this listener selection

**Delivery:**  
Stageless (Staged not supported for the shellcode generator)

**Exit Method:**  
process – exits the entire process that beacon is present in when the beacon is closed  
thread – exits only the thread in which beacon is running when the beacon is closed

**Local Shellcode Checkbox:**  
May use if you are going to execute the shellcode from an existing Beacon  
Generates a Beacon shellcode payload that inherits key function pointers from a same-arch parent Beacon

**Existing Session:**  
The parent Beacon session where the shellcode will pull session metadata  
Shellcode should be run from within this Beacon session

**x86 Checkbox:**  
Check to generate x86 shellcode, x64 is generated by default

**Or Use Shellcode File:**  
Use an externally generated raw shellcode file in lieu of generating Beacon shellcode  
This allows you to use previously exported shellcode files or output from other tools (Donut, msfvenom, etc)

**Formatting:**  
raw – raw binary shellcode output, no formatting applied  
hex – hex formatted shellcode output  
0x90,0x90,0x90 – shellcode formatted into a C# style byte array  
x90x90x90 – shellcode formatted into a CC++ style byte array  
b64 – option to base64 encode the shellcode early in the generation process (before any encryption)

**XOR Encrypt Shellcode Checkbox:**  
Check to XOR encrypt the shellcode (only one encryption type can be selected at a time)

**XOR Key(s):**  
Randomly generated and editable XOR key character(s) to use for encryption  
Multiple characters will result in multiple rounds of XOR encryption (i.e. ABCD)

**AES Encrypt Shellcode Checkbox:**  
Check to AES encrypt the shellcode (only one encryption type can be selected at a time)  
Uses a python script to perform AES Block Cipher AES-CBC encryption  
Shellcode is padded with values to reach block size requirements  
A randomly generated IV is prepended to the encrypted shellcode data

**AES Key:**  
Randomly generated and editable AES key to use for encryption  
32byte key is generated and preferred for 256bit encryption strength  
Encryption key byte lengths accepted are 16, 24, and 32

**Encoding/Compression:**  
none – No additional encoding or compression is done to the shellcode  
b64 – base64 encode the shellcode  
gzip then b64 – gzip compress then base64 the shellcode  
gzip – gzip compress the shellcode  
b64 then gzip – base64 then gzip compress the shellcode

**Multiline Output:**  
Can be used for non-raw/binary output formats  
none – no multiline formatting, shellcode is one long string  
quoted – Shellcode is broken up into lines surround by quotation marks  
chunks.push\_back – Shellcode is broken up into lines surrounded by chunks.push\_back(” and “);

**Multiline Length:**  
Number of shellcode characters in each line if a multiline output option is selected

**Generate Button:**  
Select directory for shellcode output  
Defalut filename will be beacon but can be changed  
Any encryption key used will be displayed in a popup and also written the Cobalt Strike Script Console  
The byte size of the raw beacon shellcode and final formatted beacon shellcode will be displayed in a popup and also written to the Script Console  
Location of files used to generate/build the shellcode are set the .cs file

Inspired by previous work of @offsec\_ginger [https://github.com/offsecginger/AggressorScripts](https://github.com/offsecginger/AggressorScripts)

## GitHub:

> **[GitHub - RCStep/CSSG: Cobalt Strike Shellcode Generator](https://github.com/RCStep/CSSG)**
>
> Cobalt Strike Shellcode Generator