dissect.cobaltstrike.client

Beacon client that can actively connect to a Cobalt Strike Team Server.

Danger

The client actively connects to a Cobalt Strike Team Server, caution should be taken when using this. A default client will perform check-ins and only log the tasks it receives unless implemented otherwise.

Attributes

logger
FIRST_NAMES
LAST_NAMES
PROCESS_NAMES
COMPUTERNAME_TEMPLATES

Classes

HttpBeaconClient

A Beacon Client that can communicate with a Cobalt Strike Team Server over HTTP.

Functions

random_computer_name(→ str)	Returns a random Windows like computer name, if username is set it can also return <USERNAME>-PC
random_username_name(→ str)	Returns a random username in the form of john.smith or John Smith.
random_windows_ver(→ Tuple[int, int, int])	Return a random Windows version in the form of the tuple (major, minor, build).
random_process_name(→ str)	Return a random process name.
random_internal_ip(→ ipaddress.IPv4Address)	Return a random internal RFC1918 IP address.
log_task(task)
CallbackError(→ Tuple[int, bytes])
CallbackDebugMessage(→ Tuple[int, bytes])	This will output '[-] DEBUG: <message>' to the Team Server console.
CallbackOutputMessage(→ Tuple[int, bytes])	This will output '[+] received output: <message>' to the Team Server console.
build_parser(→ argparse.ArgumentParser)	Return the default ArgumentParser for the beacon client.
parse_commandline_options(→ Tuple[argparse.Namespace, ...)	Helper function to parse commandline options and return a tuple of (args, options).
main()

Module Contents

dissect.cobaltstrike.client.logger

dissect.cobaltstrike.client.FIRST_NAMES = ['Michael', 'James', 'John', 'Robert', 'David', 'William', 'Mary', 'Christopher', 'Joseph',...

dissect.cobaltstrike.client.LAST_NAMES = ['SMITH', 'JOHNSON', 'WILLIAMS', 'BROWN', 'JONES', 'GARCIA', 'RODRIGUEZ', 'MILLER', 'MARTINEZ',...

dissect.cobaltstrike.client.PROCESS_NAMES = ['rundll32.exe', 'dllhost.exe', 'gpupdate.exe', 'svchost.exe', 'mstsc.exe', 'WerFault.exe',...

dissect.cobaltstrike.client.COMPUTERNAME_TEMPLATES

dissect.cobaltstrike.client.random_computer_name(username: str | None = None) → str

Returns a random Windows like computer name, if username is set it can also return <USERNAME>-PC

dissect.cobaltstrike.client.random_username_name() → str

Returns a random username in the form of john.smith or John Smith.

dissect.cobaltstrike.client.random_windows_ver() → Tuple[int, int, int]

Return a random Windows version in the form of the tuple (major, minor, build).

dissect.cobaltstrike.client.random_process_name() → str

Return a random process name.

dissect.cobaltstrike.client.random_internal_ip() → ipaddress.IPv4Address

Return a random internal RFC1918 IP address.

dissect.cobaltstrike.client.log_task(task)

dissect.cobaltstrike.client.CallbackError(code: int, n1: int, n2: int, message: str) → Tuple[int, bytes]

dissect.cobaltstrike.client.CallbackDebugMessage(message: str) → Tuple[int, bytes]

This will output '[-] DEBUG: <message>' to the Team Server console.

dissect.cobaltstrike.client.CallbackOutputMessage(message: str) → Tuple[int, bytes]

This will output '[+] received output: <message>' to the Team Server console.

class dissect.cobaltstrike.client.HttpBeaconClient

A Beacon Client that can communicate with a Cobalt Strike Team Server over HTTP.

task_map

logger

run(bconfig: dissect.cobaltstrike.c2.BeaconConfig, dry_run=False, scheme=None, domain=None, port=None, beacon_id=None, pid=None, computer=None, user=None, process=None, internal_ip=None, arch=None, barch=None, ansi_cp=58372, oem_cp=46337, high_integrity=False, sleeptime=None, jitter=None, user_agent=None, host_header=None, verbose=None, silent=None, writer=None)

Run the Beacon Client.

_initial_get_request() → dissect.cobaltstrike.c2.HttpRequest

Return the initial HttpRequest object for retrieving tasks from the Team Server.

_initial_post_request() → dissect.cobaltstrike.c2.HttpRequest

Return the initial HttpRequest object for sending callback data to the Team Server.

get_sleep_time() → float

Return the sleep time with jitter for the beacon loop.

register_task(command_id: None | int, func)

Register a task handler for a given command ID.

Parameters:

• command_id – The command ID to register the handler for. None is handler for empty tasks. -1 is a catch-all handler.

• func – The function to call when a task with the given command ID is received.

get_task() → dissect.cobaltstrike.c2.TaskPacket | None

Get a task from the Team Server.

send_callback(callback_id: int, data: bytes)

Send callback data to the Team Server.

handle(command: None | int | dissect.cobaltstrike.c2.BeaconCommand)

decorator to register a handler for command, if None it registers a handler for empty tasks

catch_all()

decorator to handle all unhandled commands.

print_settings()

get_handlers(command_id: int | None) → List[Callable]

Get a list of handlers for a given command ID.

_beacon_loop()

dissect.cobaltstrike.client.build_parser() → argparse.ArgumentParser

Return the default ArgumentParser for the beacon client.

dissect.cobaltstrike.client.parse_commandline_options(parser=None, defaults=None) → Tuple[argparse.Namespace, Dict[str, Any]]

Helper function to parse commandline options and return a tuple of (args, options).

This method is useful for creating default commandline options for a Beacon client. The returned options can be passed to HttpBeaconClient.run() as follows:

from dissect.cobaltstrike.client import HttpBeaconClient, parse_commandline_options

beacon = HttpBeaconClient()

args, options = parse_commandline_options(defaults={
    "beacon_id": 1234,
    "computer": "dissect",
    "user": "cobaltstrike",
    "process": "calc.exe",
})

beacon.run(**options)

If parser is not defined it will use the default argparse parser created by build_parser(). The defaults dictionary can be used to override the default argparse settings.

Parameters:

• parser – an instance of argparse.ArgumentParser, if None it will use the parser created by client.build_parser().

• defaults – A dictionary to override the default settings for the argument parser. Unknown keys will be ignored.

Returns:

Tuple of (args, options) where args is the parsed arguments from the commandline and options is a dictionary of options that can be passed to HttpBeaconClient.run().

dissect.cobaltstrike.client.main()