Code Monkey home page Code Monkey logo

geacon's Introduction

Geacon

Using Go to implement CobaltStrike's Beacon


This project is for learning protocol analysis and reverse engineering only, if someone's rights have been violated, please contact me to remove the project, and the last DO NOT USE IT ILLEGALLY

How to play

  1. Setup the teamserver and start a http lisenter, the teamserver will generate the file .cobaltstrike.beacon_keys.
  2. Compile the BeaconTool with Jetbrains Idea, use command java -jar BeaconTool.jar to convert java keystore to PEM format.
  3. Replace the RSA key pair in the file cmd/config/config.go (the RSA private key is not required, I wrote it in the code just for the record)
  4. Compile the geacon whatever platform you want to run: for example, use the command export GOOS="darwin" && export GOARCH="amd64" && go build cmd/main.go to compile an executable binary running on MacOS.
  5. Having fun ! PR and issue is welcome ;)
  6. Geacon has just been tested on CobaltStrike 3.14 and only support default c2profile, so many hardcode in the project and I will not try to implement more C2profile support at this moment.
  7. Thanks for @xxxxxyyyy's PR, And now Geacon supports CobaltStrike 4.0, please checkout the branch 4.0 to compile.
  8. Geacon's branch master supports CobaltStrike 4.1, currently available functions include: executing commands, uploading, downloading, file browser, switching the current working directory, and exiting the current process.
  9. Geacon only focuses on protocol analysis, but if you want to experience more features, you can use another project of our partners, check out CrossC2 now!

Screenshot

Get the Geacon's command execution results on Linux. login

Protocol analysis

To be continued, I will update as soon as I have time ...

Todo

  1. Support CobaltStrike 4.x

  2. Fix the OS icon issue in session table

  3. String encoding issue

_DarkRay@RedCore

geacon's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

geacon's Issues

Refeneces for implementing more fuctions.

Where are these references can be found if more functions are intended to be implementing, such as the command "Net view" ?
That is also, how can the consts defined below be extended?
const (
CMD_TYPE_SLEEP = 4
CMD_TYPE_SHELL = 78
CMD_TYPE_UPLOAD_START = 10
CMD_TYPE_UPLOAD_LOOP = 67
CMD_TYPE_DOWNLOAD = 11
CMD_TYPE_EXIT = 3
CMD_TYPE_CD = 5
CMD_TYPE_PWD = 39
CMD_TYPE_FILE_BROWSE = 53
)

Keys are generated with with insufficient entropy

RandomInt seeds prng with insufficient entropy at each invocation

func RandomInt(min, max int) int {
	rand.Seed(time.Now().UnixNano())
	return min + rand.Intn(max-min)
}

RandomAESKey uses the non-cryptoprahically random prng to generate keys:

func RandomAESKey() {
        config.GlobalKey = make([]byte,16)
        _, err := rand.Read(config.GlobalKey[:])
        if err != nil {
                panic(err)
        }
}

If RandomInt has been called prior to RandomAESKey, the prng will be seeded with the unix time of that invocation. However, if it has not been called prior, it will generate the same bytes every time:

Package rand implements pseudo-random number generators.

Random numbers are generated by a Source. Top-level functions, such as Float64 and Int, use a default shared Source that produces a deterministic sequence of values each time a program is run. Use the Seed function to initialize the default Source if different behavior is required for each run. The default Source is safe for concurrent use by multiple goroutines, but Sources created by NewSource are not.

Mathematical interval notation such as [0, n) is used throughout the documentation for this package.

For random numbers suitable for security-sensitive work, see the crypto/rand package.

How to compile on Linux?

Hello can u provide some instructions how to compile BeaconTool.jar from sources?

-[~/Desktop/Github/geacon]
โ””โ”€$ mvn compile
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.043 s
[INFO] Finished at: 2023-01-26T01:12:04-07:00
[INFO] ------------------------------------------------------------------------
[ERROR] The goal you specified requires a project to execute but there is no POM in this directory (/home/host/Desktop/Github/geacon). Please verify you invoked Maven from the correct directory. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MissingProjectException

cannot find package "geacon/cmd/config" in any of

cmd\main.go:6:2: cannot find package "geacon/cmd/config" in any of:
D:\Program Files\Go\src\geacon\cmd\config (from $GOROOT)
C:\Users\shley\go\src\geacon\cmd\config (from $GOPATH)
cmd\main.go:7:2: cannot find package "geacon/cmd/crypt" in any of:
D:\Program Files\Go\src\geacon\cmd\crypt (from $GOROOT)
C:\Users\shley\go\src\geacon\cmd\crypt (from $GOPATH)
cmd\main.go:8:2: cannot find package "geacon/cmd/packet" in any of:
D:\Program Files\Go\src\geacon\cmd\packet (from $GOROOT)
C:\Users\shley\go\src\geacon\cmd\packet (from $GOPATH)
cmd\main.go:9:2: cannot find package "geacon/cmd/util" in any of:
D:\Program Files\Go\src\geacon\cmd\util (from $GOROOT)
C:\Users\shley\go\src\geacon\cmd\util (from $GOPATH)

HTTPS beacon error

If it is https beacon, httpRequest.Post and httpRequest.Post will report an error indicating that the SSL certificate is invalid. But this problem has been solved, just add an init() function to http.go and set "httpRequest.EnableInsecureTLS(true)"

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.