Loading vulnerability…
A Denial-of-Service (DoS) vulnerability exists in the Team Server component of HelpSystems Cobalt Strike versions 4.2 and 4.3. Remote attackers can exploit this flaw to crash the C2 server thread, thereby disrupting the communication between the server and its beacons.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a proof-of-concept exploit for CVE-2021-36798, a Denial of Service (DoS) vulnerability affecting Cobalt Strike C2 servers prior to version 4.3. The main exploit script, CVE-2021-36798.py, connects to a specified Cobalt Strike C2 server URL, retrieves beacon configuration data, and then forges a random beacon registration. It sends specially crafted and oversized task data to the server, exploiting the vulnerability to crash or halt the C2 server's operations. The exploit leverages knowledge of Cobalt Strike's malleable C2 profiles and communication protocol, as implemented in the supporting modules (beacon_utils.py, comm.py, parse_beacon_config.py). The attack vector is network-based, requiring only HTTP(S) access to the C2 server. The repository is structured with modular Python scripts: the main exploit, utilities for beacon parsing and communication, and a configuration parser. No hardcoded IPs or domains are present; the target endpoint is provided by the user at runtime. The exploit is operational as a DoS tool and does not provide post-exploitation capabilities beyond service disruption.
This repository contains a Python exploit script (CobaltStrikeDos.py) and a README.md. The exploit targets Cobalt Strike C2 servers vulnerable to CVE-2021-36798 (versions prior to 4.4), which are susceptible to a denial of service (DoS) attack. The script works by crafting and sending specially formed payloads that mimic or manipulate beacon registration traffic, exploiting the server's handling of such data to crash or halt the C2 service. The README provides usage instructions, example output, and references to further information about the vulnerability. The exploit is operational and requires network access to the target Cobalt Strike C2 server. No detection or scanning functionality is present; the script is designed to actively exploit and disrupt the target service.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.