threatexpress / random_c2_profile

Cobalt Strike random C2 Profile generator

Threatexpress Blog

---

Quickstart

This blog is written in markdown and uses mkdocs to generate the HTML hosted using Git Pages on github

Workflow

• Create new content
• Push content

git add .
git commit -a -m "new stuff"
git push

• Push to Git Pages

mkdocs gh-deploy

Reference

• https://www.mkdocs.org/user-guide/deploying-your-docs/

---

Mkdocs

This wiki use mkdocs and the mkdocs-material theme

MkDocs is a static site generator that's geared towards building project documentation. Documentation source files are written in Markdown, and configured with a single YAML configuration file.

• https://www.mkdocs.org
• https://squidfunk.github.io/mkdocs-material/

---

Font Awesome

Reference: http://bwmarrin.github.io/MkDocsPlus/fontawesome/

Requirements and Setup

Note: This has been tested with python 3.6 running on MacOS.

Requirements

pip3.6 install mkdocs
pip3.6 install mkdocs-material
pip3.6 install pygments
pip3.6 install pymdown-extensions
pip3.6 install fontawesome-markdown

References

• Material Theme Documentation and Reference: http://mkdocs.github.io/mkdocs-bootswatch/#installation-usage
• https://squidfunk.github.io/mkdocs-material/getting-started/
• https://facelessuser.github.io/pymdown-extensions/

---

Directory and File Info

• ./docs/ : mkdocs content
• ./docs/img/ : Store all course images here
• mkdocs.yml : mkdocs configuration file
• ./site/ : Prod version of site. Not tracked in git. Used for testing or manual deployment

random_c2_profile's Issues

Typo in functions.py line 291

Line contains return str(random.randint(1,4=5) which ends up in:

random_c2_profile/core/functions.py", line 291
    return str(random.randint(1,4=5))
                                ^
SyntaxError: expression cannot contain assignment, perhaps you meant "=="?

Probably you intended to type 4*5 (for whatever reason)?

random HTTP content is not OPSEC safe

Hello,

thanks for the great project.

the get_http_content() function returns non OPSEC safe HTTP blob.

random_c2_profile/core/functions.py

Line 91 in cb71b2e

def get_http_content():

Thanks

Downgrade markupsafe

Hi,

Just a little update ^^
Since the version 2.1.0 of markupsafe they removed soft_unicode.
Release note: https://markupsafe.palletsprojects.com/en/2.1.x/changes/#version-2-1-0
You can add in requirements.txt:
markupsafe==2.0.1

cheers

Jinja2 Error

Received error for jinja2 execution after following installation instructions. For some reason during dependency installation, Jinja2 doesn't download the latest version.
Fix: pip3 install --upgrade jinja2

Error: cannot import name 'soft_unicode' from 'markupsafe'

Hello

I am following the installation process on latest kali and experience the error:

    git clone https://github.com/threatexpress/random_c2_profile
    cd random_c2_profile
    pip3 install -r requirements.txt
    pip3 install Pipfile
    python3 random_c2profile.py

Error:

python3 random_c2profile.py
Traceback (most recent call last):
  File "/opt/random_c2_profile/random_c2profile.py", line 15, in <module>
    from jinja2 import Template
  File "/usr/local/lib/python3.10/dist-packages/jinja2/__init__.py", line 12, in <module>
    from .environment import Environment
  File "/usr/local/lib/python3.10/dist-packages/jinja2/environment.py", line 25, in <module>
    from .defaults import BLOCK_END_STRING
  File "/usr/local/lib/python3.10/dist-packages/jinja2/defaults.py", line 3, in <module>
    from .filters import FILTERS as DEFAULT_FILTERS  # noqa: F401
  File "/usr/local/lib/python3.10/dist-packages/jinja2/filters.py", line 13, in <module>
    from markupsafe import soft_unicode
ImportError: cannot import name 'soft_unicode' from 'markupsafe' (/usr/lib/python3/dist-packages/markupsafe/__init__.py)

To solve this i need to downgrade markupsafe:

pip3 install markupsafe==2.0.1

client host

profile client have not header "Host" "www.domain.com" ， use domain Parse server ip