support

PowerShell One-liner

Cobalt Strike has several options to run a command in another context (e.g., runas, runu, runasadmin, etc.). The session-contained PowerShell one-liner feature is a complement to these features. This features hosts a PowerShell script, within your Beacon session, that runs a payload. The feature also provides a one-liner that will download this hosted script and run it.

Go to [beacon] -> Access -> One-liner to use this feature.

PowerShell One-liner

PowerShell One-liner

Choose your payload. If you select an SMB or TCP Beacon, be aware that you will need to manually link or connect to it. Also, if you opt to spawn an x64 payload, be aware that this payload will not work if the x86 PowerShell is in your $PATH