Cobalt Strike Postex Kit 套件

voidPostexMain(PPOSTEX_DATA postexData) {    RETURN_ON_NULL(postexData);// do my stuff    return;}// postexmain.cpp

datap parser;BeaconDataParse(&parser,    postexData->UserArgumentInfo.Buffer,    postexData->UserArgumentInfo.Size);// postexmain.cpp

char* name = BeaconDataExtract(&parser, NULL);BeaconPrintf(CALLBACK_OUTPUT, "Hello %sn", name);

voidmain() {    BOOL startPipeServer = false;    PostexDataPacker userArguments;    userArguments.pack<constchar*>("Rasta");    DebugEntryPoint(userArguments.getData(), userArguments.size(), startPipeServer);}// postexmain.cpp

DWORD bytesAvailable = BeaconInputAvailable();if (bytesAvailable > 0) {char* input = newchar[bytesAvailable];    BeaconInputRead(input, bytesAvailable);// do something with input}// postexmain.cpp

gPipeHandle = CreateNamedPipeA(const_cast<LPCSTR>(gPipeName),PIPE_ACCESS_DUPLEX,PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE,1,  // nMaxInstances    BUFFER_SIZE,    BUFFER_SIZE,    0,    NULL);// pipes.cpp

BOOL ClientConnected() {if (!PeekNamedPipe(gPipeHandle, NULL, 0, NULL, NULL, 0))if (GetLastError() == ERROR_BROKEN_PIPE)returnFALSE;returnTRUE;}void PostexMain(PPOSTEX_DATA postexData) {int counter = 1;while (true) {        BeaconPrintf(CALLBACK_OUTPUT, "Counter: %d", counter);        counter++;        Sleep(3000);if (!ClientConnected())break;    }return;}// postexmain.cpp

beacon> help execute-dllUse: execute-dll [pid] [/path/to/postex.dll] [args]execute-dll [/path/to/postex.dll] [args]Inject the provided postex DLL into the specified process. This DLL must be generated by the postex kit in the ArsenalKit to make use of Cobalt Strike's existing job architecture. Use execute-dll with no pid to spawn a temporary processand inject the postex DLL into it.Utilize the POSTEX_RDLL_GENERATE hook to specify a UDRL and/or use PROCESS_INJECT to specify the injection method.

beacon>execute-dll C:Toolscobaltstrikearsenal-kitkitspostexx64Releasedemo.dll[*] Tasked beacon toexecute a User-Defined Postex Task[+] host called home, sent: 138560 bytes[+] job registered with id 4[+] [job 4] received output:Counter: 1[+] [job 4] received output:Counter: 2[+] [job 4] received output:Counter: 3[+] [job 4] received output:Counter: 4[+] [job 4] received output:Counter: 5beacon> jobkill 4[*] Tasked beacon to kill job 4[+] host called home, sent: 10 bytes[+] job 4 completed

$callback= lambda({    local('$bid$data$result%info $type');    this('$jid');    # get arguments passed to lambda    ($bid, $result, %info) =@_;    # get the job status/type    # can be job_registered, output, error, or job_completed.$type=%info["type"];    # get the job id$jid=%info['jid'];    # do something based on status});# run the postex task...beacon_execute_postex_job($1, $null, $postex_dll, $null, $callback);

if ($type eq 'output') {    bjoblog($bid, $jid, $result);} elseif ($type eq 'error') {    bjoberror($bid, $jid, $result);}

bjob_send_data($bid, $jid, $data);

aliastest {    bjob_send_data($1, $2, $3);}

if ($type eq 'job_registered') {    beacon_job_hide_output($bid, $jid, 1);}