`dissect.cobaltstrike.client`

Beacon client that can actively connect to a Cobalt Strike Team Server.

Danger

The client actively connects to a Cobalt Strike Team Server, caution should be taken when using this. A default client will perform check-ins and only log the tasks it receives unless implemented otherwise.

Module Contents

Classes

HttpBeaconClient

A Beacon Client that can communicate with a Cobalt Strike Team Server over HTTP.

Functions

`random_computer_name`(→ str)	Returns a random Windows like computer name, if username is set it can also return `<USERNAME>-PC`
`random_username_name`(→ str)	Returns a random username in the form of `john.smith` or `John Smith`.
`random_windows_ver`(→ Tuple[int, int, int])	Return a random Windows version in the form of the tuple (major, minor, build).
`random_process_name`(→ str)	Return a random process name.
`random_internal_ip`(→ ipaddress.IPv4Address)	Return a random internal RFC1918 IP address.
`log_task`(task)
`CallbackError`(→ Tuple[int, bytes])
`CallbackDebugMessage`(→ Tuple[int, bytes])	This will output `'[-] DEBUG: <message>'` to the Team Server console.
`CallbackOutputMessage`(→ Tuple[int, bytes])	This will output `'[+] received output: <message>'` to the Team Server console.
`build_parser`(→ argparse.ArgumentParser)	Return the default ArgumentParser for the beacon client.
`parse_commandline_options`(→ Tuple[argparse.Namespace, ...)	Helper function to parse commandline options and return a tuple of (args, options).
`main`()

Attributes

`logger`
`FIRST_NAMES`
`LAST_NAMES`
`PROCESS_NAMES`
`COMPUTERNAME_TEMPLATES`

dissect.cobaltstrike.client.logger[source]

dissect.cobaltstrike.client.FIRST_NAMES = ['Michael', 'James', 'John', 'Robert', 'David', 'William', 'Mary', 'Christopher', 'Joseph',...[source]

dissect.cobaltstrike.client.LAST_NAMES = ['SMITH', 'JOHNSON', 'WILLIAMS', 'BROWN', 'JONES', 'GARCIA', 'RODRIGUEZ', 'MILLER', 'MARTINEZ',...[source]

dissect.cobaltstrike.client.PROCESS_NAMES = ['rundll32.exe', 'dllhost.exe', 'gpupdate.exe', 'svchost.exe', 'mstsc.exe', 'WerFault.exe',...[source]

dissect.cobaltstrike.client.COMPUTERNAME_TEMPLATES[source]

dissect.cobaltstrike.client.random_computer_name(username: str | None = None) → str[source]: Returns a random Windows like computer name, if username is set it can also return <USERNAME>-PC

dissect.cobaltstrike.client.random_username_name() → str[source]: Returns a random username in the form of john.smith or John Smith.

dissect.cobaltstrike.client.random_windows_ver() → Tuple[int, int, int][source]: Return a random Windows version in the form of the tuple (major, minor, build).

dissect.cobaltstrike.client.random_process_name() → str[source]: Return a random process name.

dissect.cobaltstrike.client.random_internal_ip() → ipaddress.IPv4Address[source]: Return a random internal RFC1918 IP address.

dissect.cobaltstrike.client.log_task(task)[source]

dissect.cobaltstrike.client.CallbackError(code: int, n1: int, n2: int, message: str) → Tuple[int, bytes][source]

dissect.cobaltstrike.client.CallbackDebugMessage(message: str) → Tuple[int, bytes][source]: This will output '[-] DEBUG: <message>' to the Team Server console.

dissect.cobaltstrike.client.CallbackOutputMessage(message: str) → Tuple[int, bytes][source]: This will output '[+] received output: <message>' to the Team Server console.

class dissect.cobaltstrike.client.HttpBeaconClient[source]

A Beacon Client that can communicate with a Cobalt Strike Team Server over HTTP.

run(bconfig: dissect.cobaltstrike.c2.BeaconConfig, dry_run=False, scheme=None, domain=None, port=None, beacon_id=None, pid=None, computer=None, user=None, process=None, internal_ip=None, arch=None, barch=None, ansi_cp=58372, oem_cp=46337, high_integrity=False, sleeptime=None, jitter=None, user_agent=None, host_header=None, verbose=None, silent=None, writer=None)[source]: Run the Beacon Client.

_initial_get_request() → dissect.cobaltstrike.c2.HttpRequest[source]: Return the initial HttpRequest object for retrieving tasks from the Team Server.

_initial_post_request() → dissect.cobaltstrike.c2.HttpRequest[source]: Return the initial HttpRequest object for sending callback data to the Team Server.

get_sleep_time() → float[source]: Return the sleep time with jitter for the beacon loop.

register_task(command_id: None | int, func)[source]

Register a task handler for a given command ID.

Parameters:

command_id – The command ID to register the handler for. None is handler for empty tasks. -1 is a catch-all handler.
func – The function to call when a task with the given command ID is received.

get_task() → dissect.cobaltstrike.c2.TaskPacket | None[source]: Get a task from the Team Server.

send_callback(callback_id: int, data: bytes)[source]: Send callback data to the Team Server.

handle(command: None | int | dissect.cobaltstrike.c2.BeaconCommand)[source]: decorator to register a handler for command, if None it registers a handler for empty tasks

catch_all()[source]: decorator to handle all unhandled commands.

print_settings()[source]

get_handlers(command_id: int | None) → List[Callable][source]: Get a list of handlers for a given command ID.

_beacon_loop()[source]

dissect.cobaltstrike.client.build_parser() → argparse.ArgumentParser[source]: Return the default ArgumentParser for the beacon client.

dissect.cobaltstrike.client.parse_commandline_options(parser=None, defaults=None) → Tuple[argparse.Namespace, Dict[str, Any]][source]

Helper function to parse commandline options and return a tuple of (args, options).

This method is useful for creating default commandline options for a Beacon client. The returned options can be passed to HttpBeaconClient.run() as follows:

from dissect.cobaltstrike.client import HttpBeaconClient, parse_commandline_options

beacon = HttpBeaconClient()

args, options = parse_commandline_options(defaults={
    "beacon_id": 1234,
    "computer": "dissect",
    "user": "cobaltstrike",
    "process": "calc.exe",
})

beacon.run(**options)

If parser is not defined it will use the default argparse parser created by build_parser(). The defaults dictionary can be used to override the default argparse settings.

Parameters:

parser – an instance of argparse.ArgumentParser, if None it will use the parser created by client.build_parser().
defaults – A dictionary to override the default settings for the argument parser. Unknown keys will be ignored.

Returns:

Tuple of (args, options) where args is the parsed arguments from the commandline and options is a dictionary of options that can be passed to HttpBeaconClient.run().

dissect.cobaltstrike.client.main()[source]

dissect.cobaltstrike.client