Session Cloning

Main Functions

Copy the Session to ensure that permissions are not lost when a Session drops, or use it to migrate permissions to Cobalt Strike.

Operation Methods

Session Cloning

• There is a Windows - type Session (both x64 and x86 are acceptable).

• There is a corresponding real listener.

• Open the module and select the corresponding listener.

• Execute the module, and a newly cloned Session will appear on the panel.

Cobalt Strike Beaconing

• VIPER can facilitate Cobalt Strike beaconing through the method of virtual listening + Session cloning.
• First, create a listener in Cobalt Strike.

• Create a corresponding virtual listener in VIPER.

Virtual listening means only adding listener configuration information without actually establishing a listener. Note that the LURI needs to be empty.

• Select the corresponding Session, and then run the Session Cloning module.

• After running, Cobalt Strike will beacon.