Beacons logs are always saved to the logs directory, but this is an alternate way to track the in memory logs with an alternate viewer. If the teamserver is restarted the in memory logs are lost and you must refer to the logs stored in the logs directory on the teamserver. This script keep in memory logs sync'd to the file beaconlogs.json. This way you have a quick and easy way to visualize all data without digging through the logs directory even if Cobalt Strike is restarted.

Start the script by having it connect to your teamserver to sync logs every 30 seconds

Usage:

python3 beaconlogtracker.py 127.0.0.1 50050 logtracker password ~/cobaltstrike

This will keep beaconlogs.json sync'd with saved and running beacon logs. It syncs every 30 seconds

Start a webserver from output/html directory

python3 http.server

Connect to http://localhost:8000/beaconlogs.html

Payload Generator

A feature often requested by red team operators is the ability to create payloads programmatically with the need for the Cobalt Strike GUI. The reference project did this with a payload generator. This was great, but there is a unique challenge. Aggressor provides several hooks to influence how a payload is built. These hooks are used by the various kits (i.e., artifact kit, sleep mask kit, or UDRL kit). They are normally used by loading an aggressor script through the GUI. This project was extended to allow the loading of external scripts. Without this, using this payload hooks would be difficult. This code could easily be extended to pass the payloads to external functions to add custom obfuscation, embed in a customer loader, or any other modification.

The payload generator script connecta to the teamserver, loads the additional scripts, and creates payloads.

Usage:

• Update payload_scripts.cna with external scripts (if needed. and see the note below on external scripts)
• Add external scripts to the payload_scripts directory
• run python3 payloadgenerator.py 127.0.0.1 50050 payloads password ~/cobaltstrike

NOTE: Loading of external scripts

Loading external scripts is not always needed but it used for payload modification scripts that include payload hooks (i.e., artifiact, sleepmask, and udrl kits). If you load scripts from the Cobalt Strike GUI, payloads will honor these scripts from the GUI but not from the agscript client (These are different clients). You must load the scripts in your python code.

• scripts must be added to a 'scripts' directory
• the data should be flat for best file path resolution
• Currently there is no feedback provided that allows you to know if a script was successfully loaded. You can use the elog function to monitor the event log for dirty debugging.

The default script_resource function adds "/scripts/" to the path during resolution. This must be changed or paths built with the expected usage. Without updating, this function flow to loaded scripts and can cause weird path issues. The playloadgenerator script has an inline patch to help with this.

Code references for loading external scripts

striker.py

	def ag_load_script(self, script_path):
		command = f"include(getFileProper('{script_path}'))"
		self.ag_sendline(command)

init.cna

Overloads script_resource to point to the root of the scripts directory

Timing

The script needs time to load. Currently there is no feedback provide that allows you to know if a script was successfully loaded. You can use the elog function to monitor the event log for dirty debugging.

cs.ag_load_script(script_path.name)
time.sleep(3) # Allow time for the script to load

Beacon Grapher

This is beta code that will display beacon in a directed graph.

The script updates the file output/data/beacons.json

Start a webserver and open http://localhost:8000/beacons.html

Usage:

python3 beacongrapher.py 127.0.0.1 50050 grapher password ~/cobaltstrike

This will create the beacons.json file used by the javascript grapher.

Start a webserver from output/html directory

python3 http.server

Connect to http://localhost:8000/beacons.html