Covert VPN - VPN pivoting technology added to Cobalt Strike / Armitage

Covert VPN is a VPN pivoting technology recently added to CobaltStrike (the commercial Armitage). Once deployed, you have a layer 2 tunnel into your target's network. This allows you to sniff packets,use external tools, host rogue services, and inject spoofed packets.

To activate Covert VPN, right-click a compromised host, go to Meterpreter -> Pivoting -> Deploy VPN. Select the remote interface you would like Covert VPN to bind to. If no local interface is present, press Add to create one.

Check Clone host MAC address to make your local interface have the same MAC address as the remote interface. It’s safest to leave this option checked.Select Inject VPN client into memory to deploy Covert VPN directly into memory. If this box is not checked, Cobalt Strike will upload and execute the Covert VPN client for you. The inject into memory option does not work reliably on Windows Vista, Windows 7, or 64-bit Windows XP.Press Deploy to start the Covert VPN client on the target. Covert VPN requires SYSTEM access to deploy.

A 21-day trial of Cobalt Strike is available to try it out.

Download Cobalt Strike

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email