sixdub

meta:
  id: beaconconfig
  title: Cobalt Strike Beacon Config
  endian: be
  
doc: |
  Cobalt Strike Beacon is a popular offensive security tool. Beacon itself
  is a DLL that gets injected into memory and can be staged from C2 servers.
  The Beacon DLL (in unencoded form) contains a configuration section that gets
  patched by the C2 server. This section is a fixed predictable structure

sixdub

######## SCRIPT EXAMPLE ########
function Do-SomethingStupid
{
	function local:Get-NumberFive
	{
		return 5
	}
	$value = Get-NumberFive
	if (value -ne 5)
	{

sixdub

Keybase proof

I hereby claim:

• I am sixdub on github.
• I am sixdub (https://keybase.io/sixdub) on keybase.
• I have a public key whose fingerprint is E477 7917 9253 D455 9007 8FE0 9F54 9507 2437 E38C

To claim this, I am signing this object:

sixdub

function Invoke-DllByteEncode
{
#Encoder used to take a dll and turn it into a base64 encoded byte array for Powersploit's
#Invoke-ReflectivePEInjection
Param(
	[Parameter(Position = 0)]
	[String]
	$InputPath,
	[Parameter(Position = 1)]
	[String]