cobaltstrike 3.13

Question

这个东西我也不是经常使用偶尔会用用
最近 3.13 放出来了正好有时间就随便看看
3.13 官方去除了之前的空格指纹

common/License.class 验证
aggressor/dialogs/ListenerDialog.class 去除 listener 个数限制
一些指纹的去除
common/ArtifactUtils.class xor 修改添加
resources/xor.bin 添加 xor.bin 文件
resources/xor64.bin  添加 xor64.bin 文件

首先是 License.class 的验证破解

//改成这样
public static boolean isTrial() {
        return false;
    }

至于 checkLicenseConsole,checkLicenseGUI 随意

listener 个数限制

aggressor/dialogs/ListenerDialog.class

else if (Listener.isEgressBeacon(payload) && DataUtils.isBeaconDefined(this.datal) && !name.equals(DataUtils.getEgressBeaconListener(this.datal))) {
   DialogUtils.showError("You may only define one egress Beacon per team server.\nThere are a few things I need to sort before you can\nput multiple Beacon HTTP/DNS listeners on one server.\nSpin up a new team server and add your listener there.");
}

把这个删了

common.ListenerConfig

result.append("5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\u0000");

把这个改了

resources/template.x64.ps1、resources/template.x86.ps1

$eicar = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'

同样改掉

server.ProfileEdits

c2profile.addCommand(".http-get.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".http-post.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".http-stager.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".stage.transform-x86", "append", "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".stage.transform-x64", "append", "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");

删掉

common/WebTransforms.class

之前的空格指纹作者虽然删了但又跑到这里加上了

response.status += " ";

直接删掉这句

common/ArtifactUtils.class

cs xor 编码功能试用版没有此功能也没有 xor.bin xor64.bin 但可以加上

感谢此项目 https://github.com/verctor/CS_xor64

public class ArtifactUtils extends BaseArtifactUtils
{
    public ArtifactUtils(final AggressorClient client) {
        super(client);
    }
    
    public static byte[] _XorEncode(final byte[] data, final String arch) {
        return data;
    }
    
    public static byte[] XorEncode(final byte[] data, final String arch) {
        if (License.isTrial()) {
            CommonUtils.print_trial("Disabled " + arch + " payload stage encoding.");
        }
        return data;
    }
}

这里看 3.13 最终版吧原来的代码有问题而且不仅要改这里

别忘了添加 xor.bin 和 xor64.bin 到 resources：https://github.com/WBGlIl/CobaltStrike-xor

回编译 java 时直接 javac -cp cobaltstrike.jar name.java 就行然后把 class 文件拖到 cobaltstrike.jar 里面替换掉对应的文件
cobaltstrike 启动命令

javaw -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -Xms512m -Xmx1024m -jar cobaltstrike.jar