Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support more Cobalt Strike C2 profiles #121

Open
4 tasks
jsf9k opened this issue May 27, 2021 · 0 comments
Open
4 tasks

Support more Cobalt Strike C2 profiles #121

jsf9k opened this issue May 27, 2021 · 0 comments
Labels
good first issue This issue or pull request is well-defined and good for newcomers improvement This issue or pull request will add or improve functionality, maintainability, or ease of use

Comments

@jsf9k
Copy link
Member

jsf9k commented May 27, 2021

💡 Summary

In #118 we add an https-certificate block to the Amazon and OCSP Cobalt Strike C2 profiles from rsmudge/Malleable-C2-Profiles. It would be a nice improvement to instead allow the user to provide a list of C2 profiles to which an https-certificate block should be added; alternatively, the user could provide as an input one or more directories containing C2 profiles and we could add an https-certificate block to each *.profile files in those directories.

It also makes sense to allow the user to specify the location of the Java keystore.

Motivation and context

@dav3r mentioned in #118 that this would be a nice improvement to this repository. It would support a more general use case beyond just the Amazon and OCSP Cobalt Strike C2 profiles.

Acceptance criteria

  • The Terraform template add-https-certificate-block-to-cs-profiles.tpl.sh takes as an input a list of Cobalt Strike C2 profile files (or, alternatively, a list of directories containing such profiles) to which an https-certificate block should be added.
  • add-https-certificate-block-to-cs-profiles.tpl.sh adds an https-certificate block to each of the Cobalt Strike C2 profiles in the previous list item.
  • The Terraform template add-https-certificate-block-to-cs-profiles.tpl.sh takes as an input the location of the Java keystore to be created.
  • add-https-certificate-block-to-cs-profiles.tpl.sh uses the Java keystore location when populating the https-certificate blocks in the Cobalt Strike C2 profiles.
@jsf9k jsf9k added good first issue This issue or pull request is well-defined and good for newcomers improvement This issue or pull request will add or improve functionality, maintainability, or ease of use labels May 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue This issue or pull request is well-defined and good for newcomers improvement This issue or pull request will add or improve functionality, maintainability, or ease of use
Projects
None yet
Development

No branches or pull requests

1 participant