Hands-On Red Team Tactics

What is a team server?

• This is the main controller for the payloads that are used in Cobalt Strike.
• It logs all of the events that occur in Cobalt Strike.
• It collects all the credentials that are discovered in the post-exploitation phase or used by the attacker on the target systems to log in.
• It is a simple bash script that calls for the Metasploit RPC service (msfrpcd) and starts the server with cobaltstrike.jar. This script can be customized according to the needs.

Cobalt Strike works on a client-server model in which the red-teamer connects to the team server via the Cobalt Strike client. All the connections (bind/reverse) to/from the victims are managed by the team server.

The system requirements for running the team server are as ...