小白也能看懂的CobaltStrike CDN域前置+Nginx前置代理

wget -O install.sh http://download.bt.cn/install/install-ubuntu_6.0.sh && sudo bash install.sh

./teamserver 192.168.1.1 123456  zoom.profile 

server{    listen 80;    server_name test.xxxxx.cdn.dnsv1.com;    index index.php index.html index.htm default.php default.htm default.html;    root /www/wwwroot/test.xxxx.cdn.dnsv1.com;    #CERT-APPLY-CHECK--START    # 用于SSL证书申请时的文件验证相关配置 -- 请勿删除    include /www/server/panel/vhost/nginx/well-known/test.xxxxx.cdn.dnsv1.com.conf;    #CERT-APPLY-CHECK--END    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则    #error_page 404/404.html;    #SSL-END    #ERROR-PAGE-START  错误页配置，可以注释、删除或修改    error_page 404 /404.html;    #error_page 502 /502.html;    #ERROR-PAGE-END    #PHP-INFO-START  PHP引用配置，可以注释或修改    include enable-php-00.conf;    #PHP-INFO-END    #REWRITE-START URL重写规则引用,修改后将导致面板设置的伪静态规则失效    include /www/server/panel/vhost/rewrite/test.xxxx.cdn.dnsv1.com.conf;    #REWRITE-END    #禁止访问的文件或目录    location ~ ^/(.user.ini|.htaccess|.git|.env|.svn|.project|LICENSE|README.md)    {        return 404;    }    #一键申请SSL证书验证目录相关设置    location ~ .well-known{        allow all;    }    #禁止在证书验证目录放入敏感文件    if ( $uri ~ "^/.well-known/.*.(php|jsp|py|js|css|lua|ts|go|zip|tar.gz|rar|7z|sql|bak)$" ) {        return 403;    }    location ~* ^(/signin.*)$ {    set $blocked 0;    if ($http_user_agent != "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/16C104") {        set $blocked 1;    }    if ($blocked) {        return 302 https://www.baidu.com;    }    proxy_pass          http://127.0.0.1:7000;//替换为cobaltstrike侦听端口    expires             off;    proxy_redirect      off;     proxy_set_header        Host $host;    proxy_set_header        X-Real-IP $remote_addr;    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;    proxy_set_header        X-Forwarded-Proto $scheme;    }        # 处理 GET 请求        location ~* ^(/s/58462514417|/wc/58462514417)$ {            set $blocked 0;            if ($http_user_agent != "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/16C104") {                set $blocked 1;            }            if ($blocked) {                return 302 https://www.baidu.com;            }            proxy_pass http://127.0.0.1:7000;  # 根据实际情况设置目标            expires off;            proxy_redirect off;             proxy_set_header Host $host;            proxy_set_header X-Real-IP $remote_addr;            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;            proxy_set_header X-Forwarded-Proto $scheme;        }        # 处理 POST 请求        location ~* ^/meeting/save$ {            set $blocked 0;            if ($http_user_agent != "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/16C104") {                set $blocked 1;            }            if ($blocked) {                return 302 https://www.baidu.com;            }            proxy_pass http://127.0.0.1:7000;  # 根据实际cobaltstrike侦听端口            expires off;            proxy_redirect off;             proxy_set_header Host $host;            proxy_set_header X-Real-IP $remote_addr;            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;            proxy_set_header X-Forwarded-Proto $scheme;            proxy_method POST;  # 明确使用 POST 方法        }    location ~ .*.(gif|jpg|jpeg|png|bmp|swf)$    {        expires      30d;        error_log /dev/null;        access_log /dev/null;    }    location ~ .*.(js|css)?$    {        expires      12h;        error_log /dev/null;        access_log /dev/null;    }    access_log  /www/wwwlogs/test.xxxx.cn.cdn.dnsv1.com.log;    error_log  /www/wwwlogs/test.xxxx.cn.cdn.dnsv1.com.error.log;}

set trust_x_forwarded_for "true";

header "Host" "test.xxx.cn"; 你实际的域名