CRTO - Certified Red Team Operator

项目说明

CRTO

Certified Red Team Operator

* Course Introduction
* Command & Control
* External Reconnaissance
* Initial Compromise
* Host Reconnaissance
* Host Persistence
* Host Pri Escalation
* Domain Reconnaissance
* Lateral Mo
* Credentials & User Impersonation
* Password Cracking Tips & Tricks
* Session Passing
* Pi
* Data Protection API
* Kerberos
* Acti Certificate Services
* Group Policy
* Discretionary Access Control Lists
* MS SQL Servers
* Domain Dominance
* Forest & Domain Trusts
* Local Administrator Password Solution
* Bypassing Defences
* Data Hunting & Exfiltration
* Post-Engagement & Reporting
* Extending Cobalt Strike

<p align="center">
<img width="300" height="300" src="
</p>

Cobalt Strike

> Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and e mature security programs. Cobalt Strike exploits network , launches spear phishing campaigns, hosts web drive-by attacks, and generates malware infected files from a powerful graphical user interface that encourages collaboration and reports all activity.

Summary

* Infrastructure
* Redirectors
* Domain fronting
* OpSec
* Customer ID
* Payloads
* DNS Beacon
* SMB Beacon
* Metasploit compatibility
* Custom Payloads
* Malleable C2
* Files
* Powershell and .NET
* Powershell commabds
* .NET remote execution
* Lateral Mo
* VPN & Pivots
* Kits
* Elevate Kit
* Persistence Kit
* Resource Kit
* Artifact Kit
* Mimikatz Kit
* Beacon Object Files
* NTLM Relaying Strike
* References

Infrastructure

Redirectors

Domain Fronting

* New Listener > HTTP Host Header
* Choose a domain in "Finance & Healthcare" sector

OpSec

Don't
* Use default self-signed HTTPS certificate
* Use default port (50050)
* Use 0.0.0.0 DNS response
* Metasploit compatibility, ask for a payload : wget -U "Internet Explorer"

Do
* Use a redirector (Apache, CDN, ...)
* Firewall to only accept HTTP/S from the redirectors
* Firewall 50050 and access via SSH tunnel
* Edit default HTTP 404 page and Content type: text/plain
* No staging set hosts_stage to false in Malleable C2
* Use Malleable Profile to taylor your attack to specific actors

Customer ID

> The Customer ID is a 4-byte number associated with a Cobalt Strike license key. Cobalt Strike 3.9 and later embed this information into the payload stagers and stages generated by Cobalt Strike.

* The Customer ID value is the last 4-bytes of a Cobalt Strike payload stager in Cobalt Strike 3.9 and later.
* The trial has a Customer ID value of 0.
* Cobalt Strike does not use the Customer ID value in its network traffic or other parts of the tool

Payloads

DNS Beacon

* Edit the Zone File for the domain
* Create an A record for Cobalt Strike system
* Create an NS record that points to FQDN of your Cobalt Strike system

Your Cobalt Strike team ser must be authoritative for the domains you specify. Create a DNS A record and point it to your Cobalt Strike team server. Use DNS NS records to delegate several domains or sub-domains to your Cobalt Strike team server's A record.

* nslookup jibberish.beacon polling.campaigns.domain.com
* nslookup jibberish.beacon campaigns.domain.com

Example of DNS on Digital Ocean:

Configuration:
1. host: campaigns.domain.com
2. beacon: polling.campaigns.domain.com
3. Interact with a beacon, and sleep 0

SMB Beacon

SMB Beacon uses Named Pipes. You might encounter these error code while running it.

| Error Code | Meaning | Description |
|------------|----------------------|----------------------------------------------------|
| 2 | File Not Found | There is no beacon for you to link to |
| 5 | Access is denied | Invalid credentials or you don't ha |
| 53 | Bad Netpath | You have no trust relationship with the target system. It may or may not be a beacon there. |

SSH Beacon

Metasploit compatibility

* Payload: windows/meterpreter/re or windows/meterpreter/re
* Set LHOST and LPORT to the beacon
* Set DisablePayloadHandler to True
* Set PrependMigrate to True
* exploit -j

Custom Payloads

Malleable C2

List of Malleable Profiles hosted on Github
* Cobalt Strike - Malleable C2 Profiles
* Cobalt Strike Malleable C2 Design and Reference Guide
* Malleable-C2-Profiles
* SourcePoint is a C2 profile generator

Example of syntax

Check a profile with ./c2lint.
* A result of 0 is returned if c2lint completes with no errors
* A result of 1 is returned if c2lint completes with only warnings
* A result of 2 is returned if c2lint completes with only errors
* A result of 3 is returned if c2lint completes with both errors and warning

Files

Powershell and .NET

Powershell commands

.NET remote execution

Run a local .NET executable as a Beacon post-exploitation job.

Require:
* Binaries compiled with the "Any CPU" configuration.

Lateral Mo

:warning: OPSEC Advice: Use the spawnto command to change the process Beacon will launch for its post-exploitation jobs. The default is rundll32.exe

portscan: Performs a portscan on a spesific target.

runas: A wrapper of runas.exe, using credentials you can run a command as another user.

pth: By pro a username and a NTLM hash you can perform a Pass The Hash attack and inject a TGT on the current process. \

:exclamation: This module needs Administrator pri.

steal_token: Steal a token from a specified process.

make_token: By pro credentials you can create an impersonation token into the current process and execute commands from the context of the impersonated user.

jump: Provides easy and quick way to mo using winrm or psexec to spawn a new beacon session on a target. \

:exclamation: The jump module will use the current delegation/impersonation token to authenticate on the remote target. \
:muscle: We can combine the jump module with the make_token or pth module for a quick "jump" to another target on the network.

remote-exec: Execute a command on a remote target using psexec, winrm or wmi. \

:exclamation: The remote-exec module will use the current delegation/impersonation token to authenticate on the remote target.

ssh/ssh-key: Authenticate using ssh with password or private key. Works for both linux and windows hosts.

:warning: All the commands launch powershell.exe

Opsec safe Pass-the-Hash:
1. mimikatz sekurlsa::pth /user:xxx /domain:xxx /ntlm:xxxx /run:"powershell -w hidden"
2. steal_token PID

Assume Control of Artifact

* Use link to connect to SMB Beacon
* Use connect to connect to TCP Beacon

VPN & Pivots

:warning: Covert 't work with W10, and requires Administrator access to deploy.

> Use socks 8080 to setup a SOCKS4a proxy server on port 8080 (or any other port you choose). This will setup a SOCKS proxy server to tunnel traffic through Beacon. Beacon's sleep time adds latency to any traffic you tunnel through it. Use sleep 0 to make Beacon check-in several times a second.

Kits

* Cobalt Strike Community Kit - Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike

Elevate Kit

UAC Token Duplication : Fixed in Windows 10 Red Stone 5 (October 2018)

Persistence Kit

*
*

Resource Kit

> The Resource Kit is Cobalt Strike's means to change the HTA, PowerShell, Python, VBA, and templates Cobalt Strike uses in its workflows

Artifact Kit

> Cobalt Strike uses the Artifact Kit to generate its executables and DLLs. The Artifact Kit is a source code framework to build executables and DLLs that evade some anti-virus products. The Artifact Kit build script creates a folder with template artifacts for each Artifact Kit technique. To use a technique with Cobalt Strike, go to Cobalt Strike -> Script Manager, and load the artifact.cna script from that technique's folder.

Artifact Kit (Cobalt Strike 4.0) - :

Download the artifact kit : Go to Help -> Arsenal to download Artifact Kit (requires a licensed of Cobalt Strike)

Install the dependencies : sudo apt-get install mingw-w64

Edit the Artifact code

* Change pipename strings
* Change in patch.c/patch.exe, e.g: HeapAlloc
* Change Import

Build the Artifact

Cobalt Strike -> Script Manager > Load .cna

Mimikatz Kit

* Download and extract the .tgz from the Arsenal (Note: The uses the Mimikatz release naming (i.e., 2.2.0.20210724)
* Load the mimikatz.cna aggressor script
* Use mimikatz functions as normal

Sleep Mask Kit

> The Sleep Mask Kit is the source code for the sleep mask function that is executed to obfuscate Beacon, in memory, prior to sleeping.

Use the included build.sh or build.bat script to build the Sleep Mask Kit on Kali Linux or Microsoft Windows. The script builds the sleep mask object file for the three types of Beacons (default, SMB, and TCP) on both x86 and x64 architectures in the sleepmask directory. The default type supports HTTP, HTTPS, and DNS Beacons.

Beacon Object Files

> A BOF is just a block of position-independent code that recei to some Beacon internal APIs

Example:

* Compile

* Execute: inline-execute /path/to/hello.o

NTLM Relaying Strike

References

* Red Team Ops with Cobalt Strike (1 of 9): Operations
* Red Team Ops with Cobalt Strike (2 of 9): Infrastructure
* Red Team Ops with Cobalt Strike (3 of 9): C2
* Red Team Ops with Cobalt Strike (4 of 9): Weaponization
* Red Team Ops with Cobalt Strike (5 of 9): Initial Access
* Red Team Ops with Cobalt Strike (6 of 9): Post Exploitation
* Red Team Ops with Cobalt Strike (7 of 9): Pri Escalation
* Red Team Ops with Cobalt Strike (8 of 9): Lateral Mo
* Red Team Ops with Cobalt Strike (9 of 9): Pi
* A Deep Dive into Cobalt Strike Malleable C2 - Joe Vest - Sep 5, 2018
* Cobalt Strike. Walkthrough for Red Teamers - Neil Lines - 15 Apr 2019
* TALES OF A RED TEAMER: HOW TO SETUP A C2 INFRASTRUCTURE FOR COBALT STRIKE – UB 2018 - NOV 25 2018
* Cobalt Strike - DNS Beacon
* How to Write Malleable C2 Profiles for Cobalt Strike - January 24, 2017
* NTLM Relaying Strike - July 29, 2021 - Rasta Mouse
* Cobalt Strike - User Guide
* Cobalt Strike 4.5 - User Guide PDF

------------------------------------------------------------------------------------------------------------------------------------------------------

Cobalt Strike CheatSheet

General notes and advices for cobalt strike C2 framework.

Summary

Cobalt Strike CheatSheet

- Summary
- Basic Menu Explanation
- Listeners
- Malleable C2 Profiles
- Aggressor Scripts
- Common Commands
- Exploitation
- Pri Escalation
- Pi
- Lateral Mo
- Exflitration
- Miscellaneous
- OPSEC Notes

Basic Menu Explanation

Cobalt Strike: The first and most basic menu, it contains the functionality for connecting to a team server, set your preferences, change the view of beacon sessions, manage listeners and aggressor scripts.

View: The view menu consists of elements that manages targets, logs, har credentials, screenshots, keystrokes etc. The main purpose of it is to provide an easy way to access the output of many modules, manage your loots and domain targets.

Attacks: This menu contains numerous client side attack generating methods like phishing mails, website cloning and file hosting. Also provides numerous ways to generate your beacon payloads or just generate shellcode and save it for later use on another obfuscation tool.

Reporting: It provides an easy way to generate pdf or spreadsheet files containing information about the execution of an attack, this way it assists you on organizing small reports, making the final report writing process easier.

Help: Basic help menu of the tool.

Listeners

Egress Listeners

- HTTP/HTTPS: The most basic payloads for beacon, by default the listeners will listen on ports 80 and 443 with always the option to set custom ports. You have the options to set proxy settings, customize the HTTP header or specify a bind port to redirect beacon's traffic if the infrastructure uses redirector servers for the payload callbacks.
- DNS: A very stealthy payload options, provides stealthier traffic over the dns protocol, you need to specify the DNS server to connect to. The best situation to use this type of listener is in a really locked down en that blocks e traffic like port 80 and 443.

Pi

- TCP: A basic tcp listener that bound on a specific port.
- SMB: An amazing option for internal spread and lateral move, this payload uses named pipes over the smb protocol and is the best approach to bypass firewalls when e ports like 80 and 443 are black listed.

Miscellaneous Listeners

- Foreign HTTP/HTTPS: These type of listeners give us the option to pass a session from the metasploit framework to cobalt strike using either http or https payloads. A useful example is to execute an exploit module from metasploit and gain a beacon session on cobalt strike.
- External C2: This is a special type of listener that gives the option to 3rd party applications to act as a communication medium for beacon.

Malleable C2 Profiles

In simple words a malleable c2 profile is a configuration file that defines how beacon will communicate and behave when executes modules, spawns processes and threads, injects dlls or touches disk and memory. Not only that, but it configures how the payload's traffic will look like on a pcap, the communication interval and jitter etc.

The big ad of custom malleable c2 profiles, is that we can configure and customize our payload to match our situation and target en, that way we make our selves more stealthy as we can blend with the en's traffic.

Aggressor Scripts

Aggressor Script is the scripting language built into Cobalt Strike, 3.0, and later. Aggresor Script allows you to modify and extend the Cobalt Strike client. These scripts can add additional functions on existing modules or create new ones. \
Aggressor Script Tutorial

Common Commands

- help: Listing of the a commands.
- help \<module>: Show the help menu of the selected module.
- jobs: List the running jobs of beacon.
- jobkill \<id>: Kill selected job.
- run: Execute OS commands using Win32 API calls.
- shell: Execute OS commands by spawning "cmd.exe /c".
- powershell: Execute commands by spawning "powershell.exe"
- powershell-import: Import a local powershell module in the current beacon process.
- powerpick: Execute powershell commands without spawning "powershell.exe", using only .net libraries and assemblies. (Bypasses AMSI and CLM)
- drives: List current system drives.
- getuid: Get current user uid.
- sleep: Set the interval and jitter of beacon's call back.
- sleep Usage:

i.e.

- ps: Listing processes.
- cd: Change directory.
- cp: Copy a local file on another local location.
- download/upload: Download a file and upload a local file.
- download/upload Usage:

- cancel: Cancel a file download.
- reg: Query Registry.

Exploitation

- browserpivot: Will hijack a web session of internet explorer and make possible for us to browse the web as the 's browser, including it's sessions, cookies and sa.
- dcsync: Perform the DCsync attack using mimikatz.
- dcsync Usage:

i.e.

- desktop: Inject a on the beacon process and get a remote desktop view of the target.
- desktop Usage:

i.e.

:exclamation: The high/low arguments specify the quality of the session.
- dllinject/dllload: Inject a reflective dll into a process/Load a dll on current process.
- execute-assembly: Loads and executes a .NET compiled assembly executable completely on memory.
- execute-assembly Usage:

- inject: Inject a beacon payload on a specified process and spawn a new beacon session under it's security context.
- inject Usage:

i.e.

- kerberos\*: Manipulate kerberos tickets.
- ppid: Spoofs the parent process of beacon for any post-exploitation child spawning job. That way we can hide our malicious post-exploitation jobs.
- psinject: Inject on a specified process and execute a command using powerpick's functionality. \
:notebook: Powershell modules imported with powershell-import are a.
- runu: Run a command under a spoofed process PID.
- shinject: Inject shellcode into another a running process.
- shspawn: Create a new process and inject shellcode into it.
- shspawn Usage:

i.e.

## Pri Escalation
- elevate: Contains numerous ways to escalate your pri to Administrator or SYSTEM using kernel exploits and UAC bypasses.
- elevate Usage:

i.e.

- getsystem: Attempts to impersonate system, if it fails we can use steal_token to steal a token from a process that runs as SYSTEM.
- getprivs: Same as metasploit's function, enables all the a pri on the current token.
- runasadmin: Attempts to run a command on an elevated context of Administrator or SYSTEM using a local kernel or UAC bypass exploit. The difference with elevate is that it doesnt spawn a new beacon, but executes a specified application of our choice under the new context.
- runasadmin Usage:

i.e.

## Pi
- socks: Start a socks4a proxy server and listen on a specified port. Access through the proxy server can achie a proxy client like proxychains or redsocks.
- socks Usage:

i.e.

:exclamation: This requires your /etc/proxychains.conf to be configured to match the port specified. If operating on Windows, your proxychains.conf file may be located in %USERPROFILE%\.proxychains\proxychains.conf, (SYSCONFDIR)/proxychains.conf, or (Global programdata dir)\Proxychains\proxychains.conf.
- co: Deploy a VPN on the current system, will create a new interface and merge it into a specified IP. Using this we can use a local interface to access the internal target network like we would do if we had a real connection through a router.

## Lateral Mo
- portscan: Performs a portscan on a specific target.
- portscan Usage:

i.e.

The abo will scan the entire 172.16.48.0/24 subnet on ports 1 to 2048, 3000 and 8080. This can be utilized for single IPs as well.
- runas: A wrapper of runas.exe, using credentials you can run a command as another user.
- runas Usage:

i.e.

- pth: By pro a username and a NTLM hash you can perform a Pass The Hash attack and inject a TGT on the current process. \
:exclamation: This module needs Administrator pri.
- pth Usage:

- steal_token: Steal a token from a specified process.
- make_token: By pro credentials you can create an impersonation token into the current process and execute commands from the context of the impersonated user.
- jump: Provides easy and quick way to mo using winrm or psexec to spawn a new beacon session on a target. \
:exclamation: The jump module will use the current delegation/impersonation token to authenticate on the remote target. \
:muscle: We can combine the jump module with the make_token or pth module for a quick "jump" to another target on the network.
- jump Usage:

i.e.

- remote-exec: Execute a command on a remote target using psexec, winrm or wmi. \
:exclamation: The remote-exec module will use the current delegation/impersonation token to authenticate on the remote target.
- remote-exec Usage:

- ssh/ssh-key: Authenticate using ssh with password or private key. Works for both linux and windows hosts. It gives you basic ssh functionality with some additional post exploitation modules.

## Exflitration
- hashdump: Dump the local SAM hive's NTLM hashes. This only dumps local machine user credentials.
- keylogger: Will capture keystrokes of a specified process and save them on a database.
- keylogger Usage:

i.e.

This command can also be used without specifying arguments to spawn a temporary process and inject the keystroke logger into it.
- screenshot: Will capture the screen of a current process and save it on the database.
- screenshot Usage:

i.e.

- logonpassword: Executes the well know logonpasswords function of mimikatz on the current machine. This function of course uses process injection so isn't OPSEC safe, use it with precaution.
- mimikatz: You can execute any function of mimikatz, mimikatz dri is not included.

## Miscellaneous
- spawn: Spawn a new beacon on the current machine, you can choose any type of listener you want.
- spawn Usage:

i.e.

- spawnas: Spawn a new beacon on the current machine as another user by pro credentials.
- spawnas Usage:

i.e.

- spawnto: Sets the executable that beacon will use to spawn and inject shellcode into it for it's post-exploitation functionality. You must specify a full path to the executable.

i.e.

- spawnu: Attempt to spawn a session with a spoofer PID as its parent, the context of the process will match the identity of the specified PID.

i.e.

- argue: Will mask/spoof the arguments of a malicious command of our choice with legitimate ones.
- blockdlls: This module will create and set a custom policy on beacon's child processes that will block the injection of any 3rd party dll that is not signed by microsoft, that way we can block any blue team tool that uses dll injection to inspect and kill malicious processes and actions.
- blockdlls Usage:

- timestomp: Tamper the timestamp of a file, by applying another file's timestamp.
- timestomp Usage:

i.e.

OPSEC Notes

- Session Prepping: Before engaging in any post-exploitation action after we ha a host, we should prepare our beacon to match the en behaviour, that way we will generate a lesser amount of IOCs (Indicators Of Compromise). To do that we can use the "spawnto" module to specify which binary our child processes will use to execute post exploitation actions, also we can use the "ppid" module to spoof the parent process that our child processes will spawn under. Both those tricks will provide us with a good amount of stealth and will hide our presence on the compromised host.
- En Behaviour Blending: On a post exploitation context even when we are using the http(s) protocols to blend in with the en's traffic, a good endpoint security solution or a Next Generation firewall can figure out that some traffic is unusual to exist within the en and will probably block and create telemetry to a SOC endpoint for the blue team to examine it. Thats where "Malleable C2" profiles come in, it is a configuration file that each cobalt strike team server can use and it provides customization and flexibility for: beacon's traffic, process injection, process spawning, behaviour, antivirus e etc. So the best practise is to never use default beacon behaviour and always use a custom profile for every assessment.

EDR E Tools and Methods

- PEzor: PE Packer for EDR e.
- SharpBlock: A method of bypassing EDR's acti DLL's by pre entry point execution.
- TikiTorch: AV/EDR e using Process Hollowing Injection.
- Donut: Donut is a position-independent code that enables in-memory execution of , JScript, EXE, DLL files and dotNET assemblies.
- Dynamic-Invoke: Bypassing EDR solution by hiding malicious win32 API calls from within C# managed code.

General Post-Exploitation TIPS

- Before executing anything be sure you know how it behaves and what IOCs (Indicators Of Compromise) it generates.
- Try to not touch disk as much as you can and operate in memory for the most part.
- Check AppLocker policies to determine what type of files you can execute and from which locations.
- Clean up artifacts immediately after finishing a post-exploitation task.
- Clean event logs after finishing with a host.

-------------------------------------------------------------------------------------------------------------------------------------------------------

Additional References:

*
*
*
*
*
*
*
*
*
*
*

项目信息

开发语言：HTML

Star 数：478

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Certified Red Team Operator展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。