红队-C2 Server基础构建

qing@ubuntu:~/cs_server$ keytool -list -v -keystore cobaltstrike.store
Enter keystore password:
Keystore type: jks
Keystore provider: SUN
?
Your keystore contains 1 entry
?
Alias name: cobaltstrike
Creation date: Jun 14, 2019
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, ST=Cyberspace, C=Earth
Issuer: CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, ST=Cyberspace, C=Earth
Serial number: 3312d415
Valid from: Fri Jun 14 04:17:43 PDT 2019 until: Thu Sep 12 04:17:43 PDT 2019
Certificate fingerprints:
         MD5:  AB:D2:A4:18:5E:A7:6A:32:CC:1E:74:8C:67:D9:AB:3C
         SHA1: 25:32:9C:8F:A7:14:3A:F4:43:65:AD:DD:63:2E:AA:25:82:31:E1:3B
         SHA256: 64:25:7F:C0:FA:C3:1C:01:A5:CC:D8:16:C7:3E:A8:6E:63:92:60:DA:16:04:D0:4D:B8:69:BB:60:3C:28:86:E6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

python apache_redirector_setup.py --malleable="<Path to C2 Profile>" --block_url="https://google.com" --block_mode="redirect" --allow_url="team server Address" --allow_mode="proxy"

python apache_redirector_setup.py --ip_blacklist="1.1.1.1;1.1.1.2" --block_url="https://google.com" --block_mode="redirect" --allow_url="<Team server Address>" --allow_mode="proxy

python apache_redirector_setup.py --mobile_url="https://mobile-payload.com" --mobile_mode="proxy" --valid_uris="payload;uploads" --ir --ip_blacklist="1.1.1" --block_url="https://GetBlockedNerd.com" --block_mode="redirect" --allow_url="https://Teamserver.com" --allow_mode="proxy"

./teamserver [IP] [password] [/path/to/my.profile]

set sample_name "Putter Panda";
?
set sleeptime "500";
?
http-get {
    # Beacon will randomly choose from this pool of URIs
    set uri "/MicrosoftUpdate/ShellEx/KB242742/default.aspx";
?
    client {
        header "User-Agent" "Mozilla/4.0 (Compatible; MSIE 6.0;Windows NT 5.1)";
?
        # deliberate attempt to reproduce bug in HTTPCLIENT
        header "Accept" "*/*, ..., ......, ."; 
?
        # encode session metadata into tmp var
        metadata {
            netbiosu;
            parameter "tmp";
        }
    }
?
    # no special server side indicators as the report didn‘t say anything one way
    # or the other about these.
    server {
        header "Content-Type" "application/octet-stream";
?
        output {
            print;
        }
    }
}
?
http-post {
    set uri "/MicrosoftUpdate/GetUpdate/KB";
?
    client {
        header "Content-Type" "application/octet-stream";
        header "User-Agent" "Mozilla/4.0 (Compatible; MSIE 6.0;Windows NT 5.1)";
?
        id {
            append "/default.asp";
            uri-append;
        }
?
        output {
            print;
        }
    }
?
    server {
        header "Content-Type" "text/html";
?
        output {
            print;
        }
    }
}

metadata {
            netbiosu;
            parameter "tmp";
        }

http-get {
    server {
        header "API-URI" "aliyun";
        
http-get {
    client {
        parameter "qing" "good";
 

server {
?
                header "Server" "Apache/2.4.39 (Unix)";
                header "Content-Type" "application/javascript; charset=utf-8";
                header "Vary" "Accept-Encoding";
                header "Server" "Microsoft-IIS/8.5";
                header "Connection" "close";
?
       output {
?
                   base64;
                   prepend "/*! * jquery.base64.js 0.1 - https://github.com/yckart/jquery.base64.js * Makes Base64 en & -decoding simpler as it is. * * Based upon:";
                   append "r64 = [256],r256 = [256],i = 0;var UTF8 = {/***Encode multi-byte Unicode string into utf-8 multiple single-byte characters* (BMP / basic multilingual plane only)";
                    print;
?
                }
        }
}

http-stager {
    server {
        header "Cache-Control" "private, max-age=0";
        header "Content-Type" "text/html; charset=utf-8";
        header "Vary" "Accept-Encoding";
        header "Server" "Microsoft-IIS/8.5";
        header "Connection" "close";
    }
}　

set uri_x86 "/favicon1.ico";
set uri_x64 "/favicon2.ico";
set uri "/jquery.min.js";

http-config {
    set headers "Date, Server, Content-Length, Keep-Alive, Connection, Content-Type";
    header "Server" "Apache";
    header "Keep-Alive" "timeout=5, max=100";
    header "Connection" "Keep-Alive";
    set trust_x_forwarded_for "false";
}

https-certificate {
    set CN       "bobsmalware.com";
    set O        "Bob‘s Malware";
}

https-certificate {
    set keystore "domain.store";
    set password "mypassword";
}

keytool 
密钥和证书管理工具
?
命令:
?
 -certreq            生成证书请求
 -changealias        更改条目的别名
 -delete             删除条目
 -exportcert         导出证书
 -genkeypair         生成密钥对
 -genseckey          生成密钥
 -gencert            根据证书请求生成证书
 -importcert         导入证书或证书链
 -importpass         导入口令
 -importkeystore     从其他密钥库导入一个或所有条目
 -keypasswd          更改条目的密钥口令
 -list               列出密钥库中的条目
 -printcert          打印证书内容
 -printcertreq       打印证书请求的内容
 -printcrl           打印 CRL 文件的内容
 -storepasswd        更改密钥库的存储口令

qing@ubuntu:~/cs_server$ keytool -genkey -alias qing -keyalg RSA -validity 36500 -keystore qing.store
Enter keystore password:
What is your first and last name?
  [Unknown]:  qing
What is the name of your organizational unit?
  [Unknown]:  qing
What is the name of your organization?
  [Unknown]:  qing
What is the name of your City or Locality?
  [Unknown]:  qing
What is the name of your State or Province?
  [Unknown]:  qing
What is the two-letter country code for this unit?
  [Unknown]:  qing
Is CN=qing, OU=qing, O=qing, L=qing, ST=qing, C=qing correct?
  [no]:  yes
?
Enter key password for <qing>
        (RETURN if same as keystore password):
Re-enter new password:
?
Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore qing.store -destkeystore qing.store -deststoretype pkcs12".

https-certificate {
    set CN       "qing"; 
    set O        "qing";   
    set C        "qing";
    set L        "qing";
    set OU       "qing";  
    set ST       "qing";
    set validity "365";
}

#证书名称和证书密码
code-signer{
    set keystore "qing.store";
    set password "123456";
    set alias "qing";
}
 

./c2lint [path/to/my.profile]
qing@ubuntu:~/cs_server$ ./c2lint qing.profile