Und3rf10w / external_c2_framework

Python api for usage with cobalt strike's External C2 specification

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

On session start, client should notify server that it is ready for a stager

Und3rf10w opened this issue · comments

Currently, when a client starts, it is expecting that a stager is ready for it to retrieve. Instead the client should notify the server that is is ready to recieve a new stager.

This will allow us to pass client specific options, such as the client's block_time and beacon_id to the server, which will allow it to instantiate a unique beacon.Beacon object for every beacon. This is required for multi-client support.

The now bugged logic worked fine if the server was only ever going to interact with one beacon, but if we need to handle multiple ones that can have differing configurations, we need fix this logic.

Please refer to the below sequence diagrams for a better visualization of this:

Current, bugged logic

image

Desired, fixed logic

image

Tasks

  • Add logic to client to upload a dataframe with client's id and desired block_time before executing go(). - deca936
  • Add logic to server to check for a notification that a new beacon is ready for a stager, extract the beacon_id and block_time from it, then use that to instantiate a beacon.Beacon() object and begin the thread. - d520faa

Going to add a section above to independently track tasks that need to be accomplished specifically for this issue.

Commit deca936 adds the logic to the client, and creates the need for a transport.send_server_notification() function.

Commit d520faa adds commonUtils.get_new_client() which will call transport.check_for_new_clients(), and return a zero if there is no new clients, else will return a new client dataframe, which will then get decoded.

This basically fixes the task, as we're already tracking transport modifications in #14. Going to annotate this there and close this one out.