The difference between Windows Executeable (s) and Windows Executeable#

Windows Executeable (s) corresponds to a stage (stageless) Windows Executeable corresponds to a stager A stager is a small program whose job is to download a stage and run it. A stage, on the other hand, is a large payload that contains many features and is used to receive and execute tasks from our C2 and return the results. The process of a stager downloading a stage through various means and running it is called Payload Staging. Cobalt Strike also offers a way similar to traditional RAT check-ins: packaging all functionality together so it can communicate with the teamserver immediately after running — this is called Payload Stageless. To generate a Stageless payload, you can do it directly under Attack -> Package -> Windows Executeable (s).

Removing the CS certificate fingerprint#

The CS certificate store default password is 123456. First add a certificate, then delete the default one.

View the certificates

1
keytool -list -v -keystore cobaltstrike.store

Add a certificate

1
keytool -keystore ./cobaltstrike.store -storepass 123456 -keypass 123456 -genkey -keyalg RSA -alias microsoft -dname "CN=microsoft, OU=Microsoft, O=SoftwareSecurity, L=Washington, S=DC, C=US"

Delete the default certificate

1
keytool -delete -alias cobaltstrike

DNS beacon#

In general, a service called systemd-resolved occupies port 53, so you need to manually release the port before you can use CS’s DNS listener.

Finally, use nslook ns1.xxxxx to verify the configuration is correct.

When setting up the listener, DNS Host (Stager) doesn’t have to be an IP address — you can fill in any one of the DNS Host entries above.

Hiding C&C behind Cloudflare#

Register a domain at Freenom, then add it to Cloudflare.

Cloudflare -> SSL/TLS -> Origin Server -> Create Certificate

Choose the PEM format, save the origin certificate as server.pem. Save the private key as server.key. Then

1
openssl pkcs12 -export -in server.pem -inkey server.key -out cfcert.p12 -name cloudflare_cert -passout pass:123456
2

3
sudo keytool -importkeystore -deststorepass 123456 -destkeypass 123456 -destkeystore cfcert.store -srckeystore cfcert.p12  -srcstoretype PKCS12 -srcstorepass 123456 -alias cloudflare_cert

Then add this to the Malleable C2

1
https-certificate {
2
    set keystore "cfcert.store";
3
    set password "123456";
4
}

Also, be sure to modify the X-Forwarded-For header configuration, otherwise the check-in IP will be Cloudflare’s datacenter.

1
http-config {
2
    set trust_x_forwarded_for "true";
3
}

Then you can visit https://www.cloudflare.com/ips/ to add all Cloudflare addresses to the cloud server’s security group, allowing only Cloudflare connections.