NothingBlog

cs官网更新查看地址:
cobaltstrike.com/releasenotes.txt


查看CDN地址:
nslookup 域名/子域名


流量混淆profile:
https://github.com/rsmudge/Malleable-C2-Profiles

1. 修改teamserver

vi teamserver

java -XX:ParallelGCThreads=4 -Dcobaltstrike.server_port=修改端口 -Dcobaltstrike.server_bindto=0.0.0.0 -Djavax.net.ssl.keyStore=./cobaltstrike.store -Djavax.net.ssl.keyStorePassword=修改密码 -server -XX:+AggressiveHeap -XX:+UseParallelGC -classpath ./cobaltstrike.jar:. -Duser.language=en -javaagent:CSAgent.jar=3a4425490f389aeec312bdd758ad2b99 server.TeamServer $* 

2. 生成cobaltstrike.store

sudo keytool -keystore ./cobaltstrike.store -storepass 修改密码 -keypass 修改密码 -genkey -keyalg RSA -alias google.com -dname "CN=WWW.GOOGLE.COM, OU=GOOGLE, O=GOOGLE, L=GOOGLE, S=GOOGLE, C=US"

3. 服务端启动并保持后台运行（https://github.com/threatexpress/malleable-c2）

nohup ./teamserver IP地址 链接密码 ./c2.4.x.profile &

4. 查看运行情况

ps aux | grep nohup

5. 客户端启动

各个版本的官方解密key：
4.0 1be5be52c6255c33558e8a1cb667cb06
4.1 80e32a742060b884419ba0c171c9aa76
4.2 b20d487addd4713418f2d5a3ae02a7a0
4.3 3a4425490f389aeec312bdd758ad2b99
4.4 5e98194a01c6b48fa582a6a9fcbb92d6
4.5 f38eb3d1a335b252b58bc2acde81b542
4.7 5cc4e4df156579cbd01a09dd4c1daca513113f771cb5034a22c1e1dfb3ba424b

linux：./cobaltstrike

win：cobaltstrike.bat
java -XX:ParallelGCThreads=4 -XX:+AggressiveHeap -XX:+UseParallelGC -javaagent:CSAgent.jar=5e98194a01c6b48fa582a6a9fcbb92d6 -Duser.language=en -jar cobaltstrike.jar

6. namesilo注册域名并删除所有解析，修改NameServer1为 candy.ns.cloudflare.com ，修改NameServer2为 dale.ns.cloudflare.com
   
   
7. 注册Cloudflare添加免费CDN并配置DNS

8. 配置监听器
   

赏 支付宝扫码打赏 微信打赏