Whether extracted from an EXE/Beacon via donut or generated directly from Cobalt Strike, shellcode is typically XOR/AES-encrypted and then executed through a standalone loader or a sideloaded DLL. This post walks through the full chain—generation, encryption, loading, and delivery—with two practical case studies.

When you land on a host (or only have a short-lived shell), the goal is rarely a full disk image. More often you need to filter a subset of files, pack them into a size-bounded archive, and get the result back to the operator side quickly.

C2 is designed for command control and lightweight interaction, not sustained large-file transfers. During authorized testing, bulk traffic can be moved to a temporary cloud upload service while C2 only sends commands and returns download links.

A practical recap of the optimizations applied to this site, so the setup can be reproduced against the current repository.

• Site: https://blog.leeissonba.com/
• Theme: LoveIt · Hosting: Cloudflare Workers static assets
• Repo: https://github.com/simonlee-hello/MyBlog

I recently looked into AI for video generation and intelligent editing. This post records what I learned.