Hands-On Red Team Tactics

Foreign-based listeners

This listener is used to pass a session to multiple cobalt strike instances or even to Metasploit/Armitage. Let's take a quick look at how this is done. We must already have at least one compromised host so that we can pass its session somewhere else. In the following example, we already have a connected host on Cobalt Strike via the beacon payload:

As we can see, we already have a connected beacon. We now want to pass the session to Metasploit for further exploitation. We will start Metasploit/Armitage and run a handler, as shown in the following screenshot:

Once the handler is running, we go to our Cobalt Strike ...