CS4.5优化Beacon回显编码

menu "Soldier " {    # Last Soldier       item "&Setchar" {           $bid = $1;           $dialog = dialog("Setchar", %(charsets => ""), &Setchar);           dialog_description($dialog, "Set the Beacon's Charset ");           drow_combobox($dialog, "charsets", "charset:", @("", "UTF-8", "GBK", "GB2312", "GB18030", "ISO-8859-1", "BIG5", "UTF-16", "UTF-16LE", "UTF-16BE"));           dbutton_action($dialog, "Setchar");           dialog_show($dialog);       }
       sub Setchar {           binput($bid, "setchar $3['charsets']");           beacon_setchar($bid, $3['charsets']);       }}

//新增setcharelse if (var11.is("setchar")) {   if (var11.verify("Z")) {      var4 = var11.popString();      this.master.setChar(var4);   } else if (var11.isMissingArguments()) {      this.master.setChar("");   }}

//新增 setchar else if (var8.is("setchar")) {   if (var8.verify("Z")) {      var4 = var8.popString();      this.master.setChar(var4);   } else if (var8.isMissingArguments()) {      this.master.setChar("");   }}

protected String[] cols = new String[]{" ", "external", "internal", "listener", "user", "computer", "charset", "note", "process", "pid", "arch", "last"};

//新增 setCharset 函数public void setCharset(String var1) {   this.chst = var1;}
注意:类本身已存在其他功能，因此只需要添加set函数。实质就是修改和调用 this.chst 这个变量

//新增 charsets HashMapprotected HashMap charsets;

//public void register 新增存入set_char键值对var1.put("beacons.set_char", this);

//   public Map buildBeaconModel()   新增 获取 charsets值String var5 = (String)this.charsets.get(var4.getId());if (var5 != null && !var5.equals("")) {   var4.setCharset(var5);} else {   var4.setCharset(var4.getCharset());}

// public Beacons(Resources var1)  新增 赋值 charsetsthis.charsets = new HashMap();

//新增setChar函数public void setChar(String var1, String var2) {   synchronized(this){}   try {      var2 = var2.toUpperCase();      this.charsets.put(var1, var2);      this.setup.getController().setCustomCharset(var1, var2);   } catch (Throwable var5) {      throw var5;   }}

//新增 set_char 函数处理else if (var1.is("beacons.set_char", 2)) {   this.setChar((String)var1.arg(0), (String)var1.arg(1));}

// public class BeaconC2  新增 customCharsets 变量protected HashMap customCharsets;

// public BeaconC2(Resources var1)  新增 customCharsets 赋值this.customCharsets = new HashMap();

//新增 setCustomCharset 函数public void setCustomCharset(String var1, String var2) {   var2 = var2.toUpperCase();   this.customCharsets.put(var1, var2);}

// Last Soldier getCharsets编码注册逻辑String var13 = (String)this.customCharsets.get(var12.getId());
if (!var12.sane()) {   CommonUtils.print_error("Session " + var12 + " metadata validation failed. Dropping");   return null;} else {   //this.getCharsets().register(var12.getId(), var9, var10);   //修改 getCharsets编码注册逻辑 ===============   if (var13 != null && !var13.equals("")) {      this.getCharsets().register(var12.getId(), var13, var13);   } else {      this.getCharsets().register(var12.getId(), var9, var10);   }   //修改 getCharsets编码注册逻辑 ===============

   //public String eventName() 新增 set_charcase 13:   return this.prefix("set_char");

//新增 SetChar 命令 调用函数public static final BeaconOutput SetChar(String var0, String var1) {   return new BeaconOutput(var0, (short)13, var1);}

//public void scriptLoaded(ScriptInstance var1)  存入 beacon_setcharCortana.put(var1, "&beacon_setchar", this);

// public Scalar evaluate(String var1, ScriptInstance var2, Stack var3) 新增 beacon_setchar 命令处理if (var1.equals("&beacon_setchar")) {   String[] beaconIds = bids(var3);   String argument = BridgeUtilities.getString(var3, "");   for(int index = 0; index < beaconIds.length; ++index) {      this.conn.call("beacons.set_char", CommonUtils.args(beaconIds[index], argument));      this.conn.call("beacons.log_write", CommonUtils.args(BeaconOutput.SetChar(beaconIds[index], argument)));   }}

///新增 setChar 处理函数public void setChar(String var1) {   for(int var2 = 0; var2 < this.bids.length; ++var2) {      this.conn.call("beacons.set_char", CommonUtils.args(this.bids[var2], var1));      this.conn.call("beacons.log_write", CommonUtils.args(BeaconOutput.SetChar(this.bids[var2], var1)));   }}

CobaltStrike Charset Improvementhttps://xz.aliyun.com/t/11055
Cobalt Strike快乐星球https://mp.weixin.qq.com/s/v3e2Ac5WRFsk_iVNORog5Q