互联网对红队利器Cobalt Strike一个历史遗留漏洞的研究( 三 )
请注意 ， 这在Cobalt Strike 4.0中有所更改 ， 其中添加了许多新字段 。 下面的代码涵盖3.5和4.0版本 。
import M2Crypto
import requests
PRIVATE_KEY_TEMPLATE = "-----BEGIN PRIVATE KEY-----{}-----END PRIVATE KEY-----"
PUBLIC_KEY_TEMPLATE = "-----BEGIN PUBLIC KEY-----{}-----END PUBLIC KEY-----"
class Metadata(object):
"""
Class to represent a beacon Metadata object
"""
def __init__(self, data="", private_key="", public_key="", cs_version=4):
self.cs_version = cs_version
self.data = http://news.hoteastday.com/a/data
self.public_key = public_key
self.private_key = private_key
self.port = 0
self.ciphertext = ""
【互联网对红队利器Cobalt Strike一个历史遗留漏洞的研究】self.charset = ""
self.charset_oem = ""
self.ver = ""
self.intz = ""
self.comp = ""
self.user = ""
self.pid = ""
self.bid = ""
self.barch = ""
self.raw_aes_keys = ""
self.aes_key = ""
self.hmac_key = ""
self.is64 = False
self.high_integrity = False
if data and len(data) != 128:
raise AttributeError("Metadata should be 128 bytes")
if data and private_key:
self.rsa_decrypt()
self.unpack()
def calculate_aes(self):
h = hashlib.sha256(self.raw_aes_keys)
digest = h.digest()
self.aes_key = digest[0:16]
self.hmac_key = digest[16:]
def rsa_decrypt(self):
pkey = M2Crypto.RSA.load_key_string(PRIVATE_KEY_TEMPLATE.format(self.private_key))
plaintext = pkey.private_decrypt(self.data, M2Crypto.RSA.pkcs1_padding)
assert plaintext[0:4] == "x00x00xBExEF"
self.data = http://news.hoteastday.com/a/StringIO.StringIO(plaintext[8:])
def readInt(self, byteorder=">"):
fmt = byteorder + "L"
return struct.unpack(fmt, self.data.read(struct.calcsize(fmt)))[0]
def readShort(self, byteorder=">"):
fmt = byteorder + "H"
return struct.unpack(fmt, self.data.read(struct.calcsize(fmt)))[0]
def readByte(self):
fmt = "b"
return struct.unpack(fmt, self.data.read(struct.calcsize(fmt)))[0]
def flag(self, b, s):
return b & s == s
def print_config(self):
print "raw AES key: %s" % self.raw_aes_keys[0:8].encode("hex")
print "raw HMAC key: %s" % self.raw_aes_keys[8:].encode("hex")
print "AES key: %s" % self.aes_key.encode("hex")
print "HMAC key: %s" % self.hmac_key.encode("hex")
print "ver: %s" % self.ver
print "host: %s" % self.intz
print "computer: %s" % self.comp
print "user: %s" % self.user
print "pid: %s" % self.pid
print "id: %s" % self.bid
print "barch: %s" % self.barch
print "is64: %s" % self.is64
if self.cs_version > 3:
print "charset: %s" % self.charset
print "port: %s" % self.port
def unpack(self):
self.data.seek(0)
self.raw_aes_keys = self.data.read(16)
推荐阅读
- 字母哥|强强对话，字母哥狂砍36+18不敌红队5人得分上双，哈登威少55分
- 互联网乱侃秀|专注28nm或以上芯片，或探索去美化，中芯国际投270亿再成立公司
- 互联网支付宝搜索流量全面开放：麦当劳、肯德基、星巴克等抢先升级“品牌直达”
- 互联网支付宝：首页搜索“品牌直达”能力正式面向全行业品牌商家开放
- 干衣机|米家互联网热泵干衣机发布：35分钟快烘 3499元
- 亚马逊建设卫星互联网系统获批
- 行业互联网同比增长26.4%，上汽大通MAXUS 7月热销超万台
- 行业互联网澳柯玛，智慧冷链疫苗存储，内循环经济智能家居，叠加芯片概念
- 新华网|“中国互联网联合辟谣平台”学习强国号上线运行
- 科技微视界|助力中小企业进入移动互联网，“MUP移动营销云”