threatexpress / malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

Cobalt Strike Malleable C2 Design and Reference Guide

This project is intended to serve as reference when designing Cobalt Strike Malleable C2 profiles.

Always verify your profile with ./c2lint [/path/to/my.profile] prior to use!

Malleable C2 Profile Guidance

The following dive deeper into the understanding of Malleable C2

• MalleableExplained.md : Quick profile reference guide
• ThreatExpress - A Deep Dive into Cobalt Strike Malleable C2 : Orignal blog post the where the jquery reference profile was created
• Understanding Cobalt Strike Profiles : Revised (current) blog on profile guidance
• Random Profile Generator : Profile generator with more examples and options for settings

Changelog

20231017 - Updated for CS 4.9

• Added 4.9 reference profile
• Updated MalleableExplained.md with new 4.9 options
  • post-ex.cleanup
  • .http-beacon.library

20230801 - Updated for CS 4.8

• Added 4.8 reference profile
• Updated MalleableExplained.md with new 4.8 options
  • stage.syscall_method

20221022 - Updated for CS 4.7

• Added 4.7 reference profile
• Updated MalleableExplained.md with 4.7 considerations

20220421 - Updated for CS 4.6

• Added 4.6 reference profile
• No more '1MB' limit
  • Add section "Task and Proxy Max Size" with new options
    • set tasks_max_size "1048576";
    • set tasks_proxy_max_size "921600";
    • set tasks_dns_proxy_max_size "71680";
  • Additional Considerations for the 'task_' Settings
• Updated MalleableExplained.md with 4.6 considerations

202112 - Updated for CS 4.5

• Added 4.5 reference profile
• Updated MalleableExplained.md with 4.5 considerations

202108 - Added MalleableExplained.md

• Reference from Andy Gill (@ZephrFish)
• Reference blog: https://blog.zsec.uk/cobalt-strike-profiles/

202103 - Add CS 4.3 Reference Profile

• Add latest Malleable C2 profile options for Cobalt Strike 4.3
• Moved dns settings to new dns-beacon section
• 4.3 Additions
  • dns-beacon
    • beacon
    • get_A
    • get_AAAA
    • get_TXT
    • put_metadata
    • put_output
    • ns_response
  • http-config
    • block_useragents

202011 - Add CS 4.2 Reference Profile

• Add latest MalleablePE and MalleableC2 options for Cobalt Strike 4.1 and 4.2
• 4.1 Additions: tcp_frame_header, smb_frame_header, ssh_banner
• 4.2 Additions:
  • global
    • data_jitter
    • headers_remove
    • ssh_pipename
  • postex
    • pipename
    • thread_hint
    • keylogger
  • stage
    • allocator
    • magic_mz_86|magic_mz_64
    • magic_pe

202003 - CS 4.0 Reference Profile

• Add CS4.0 reference profile of available malleable C2 options
• Remove deprecated features (amsi_disable, disable for process injection techniques, etc)

Authors

• @joevest
• @001SPARTaN
• @andrewchiles
• @Charles-Foster-Kane

License

This project and all individual scripts are under the GNU GPL v3.0 license.

malleable-c2's Issues

Possible Issue Host Header Breaks TLS Intercepting Proxies

I was using this beacon payload recently and ran into a small potential bug.

When you set the Host: code.jquery.com
https://github.com/threatexpress/malleable-c2/blob/master/jquery-c2.4.0.profile#L250

When the SSL/TLS Proxy intercepts the requests, you may lose connections, since the Proxy sends traffic to the actual forged site.

I am not sure of the best way to over come this with malleable C2.

Have you encountered this before?

It seems that removing the host in the request fixes this.

Steps to Reproduce.
1. Connect Normally over HTTPS beacon. Should work fine.
2. On the host that is running the Beacon, Start a proxy like Fiddler, or Burp
3. The beacon is no longer responsive.

Feedback welcome, I may be missing something.

something wrong bro

[-] .spawnto_x86 is deprecated and has no effect. Set .post-ex.spawnto_x86 instead.
[-] .spawnto_x64 is deprecated and has no effect. Set .post-ex.spawnto_x64 instead.
[-] .process-inject disable "SetTreadContext" is deprecated and has no effect. Use process-inject -> execute instead.

Help

hello could you tell me why when I add a certain number of ips this happens?

[] dropping 192.168.1.22/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.21/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.20/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.19/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.18/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.17/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.22/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.21/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.20/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.19/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.18/jquery-3.3.1.min.js from Beacon profile for size
[] dropping 192.168.1.17/jquery-3.3.1.min.js from Beacon profile for size
[+] Listener: test started!

cobaltstrike4.8 profile

Can you update the profile file for version 4.8

No command output

I am running the jquery-2.4.0.profile on my test lab. The stageless beacon reaches back to the team server. Unfortunately there is no command output at all even with a sleep time set to 0.
Profiles from Raphael Mudge's repo work fine.
Any idea what is wrong here?

Sample:
beacon> getuid
[] Tasked beacon to get userid
[+] host called home, sent: 8 bytes
beacon> ps
[] Tasked beacon to list processes
[+] host called home, sent: 12 bytes

Valid error

./c2lint jquery-c2.4.3.profile
[-] Your authorization file is not valid: Decryption error

I can't valid it , what should I do?

Error

[-] Error(s) while compiling jquery-c2.4.3.profile
Error: option <.stage.compile_time> requires a 'dd MMM YYYY hh:mm:ss' date at line 377

jquery-c2.4.3.profile not working

Trying to load the profile : ./teamserver ip password jquery-c2.4.3.profile and keep getting this error! all other profiles work fine

*] Will use existing X509 certificate and keystore (for SSL) Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true [-] Error(s) while compiling jquery-c2.4.3.profile Error: invalid option for <Global> at line 71 data_jitter Error: Block is not valid for <Global> at line 190 dns-beacon Error: invalid option for <Global> at line 222 ssh_pipename Error: invalid option for <.post-ex> at line 322 pipename Error: invalid option for <.post-ex> at line 323 keylogger Error: invalid option for <.stage> at line 361 allocator Error: invalid option for <.stage> at line 364 magic_pe Error: invalid option for <.http-config> at line 512 block_useragents [-] exiting because of errors in jquery-c2.4.3.profile. Use ./c2lint to check the file

4.8 profile

At first thank you for you work and youtube videos, which are still helpfull today.
i am new one in c2 and after uncommenting a Beacon get section , got that error in c2lint. What i made wrong?

./TeamServerImage c2lint /root/Desktop/Server/jquery-c2.4.8.profile
[-] Error(s) while compiling /root/Desktop/Server/jquery-c2.4.8.profile
Error: Program is terminated. Can't add transform statements to <.http-post.client.id> at line 696
mask
Error: Program is terminated. Can't add transform statements to <.http-post.client.id> at line 697
base64url
Error: Program is terminated. Can't add transform statements to <.http-post.client.id> at line 698
parameter
Error: Program is terminated. Can't add transform statements to <.http-post.client.output> at line 702
mask
Error: Program is terminated. Can't add transform statements to <.http-post.client.output> at line 703
base64url
Error: Program is terminated. Can't add transform statements to <.http-post.client.output> at line 704
parameter
Error: Program is terminated. Can't add transform statements to <.http-post.server.output> at line 717
mask
Error: Program is terminated. Can't add transform statements to <.http-post.server.output> at line 718
base64url
Error: Program is terminated. Can't add transform statements to <.http-post.server.output> at line 721
prepend
Error: Program is terminated. Can't add transform statements to <.http-post.server.output> at line 723
prepend
Error: Program is terminated. Can't add transform statements to <.http-post.server.output> at line 724
append
Error: Program is terminated. Can't add transform statements to <.http-post.server.output> at line 725
print
[-] Unable to load the Beacon profile

update - Comment a block for HTTP-POST Post method - now all work fine with Only Get beacon. Hope understand right. Thanks!

set compile_time BUG

[-] Error(s) while compiling ./malleable-c2/jquery-c2.4.2.profile
Error: option <.stage.compile_time> requires a 'dd MMM YYYY hh:mm:ss' date at line 352
"11 Nov 2016 04:08:32"

。。。

Just FYI

Just wanted to let you know the link in the README.md is dead.

~reno