dissect.cobaltstrike 1.2.1.dev10__tar.gz → 1.2.1.dev12__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/.readthedocs.yml +3 -0
  2. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/PKG-INFO +1 -1
  3. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/_version.py +2 -2
  4. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/guardrails.py +6 -5
  5. dissect_cobaltstrike-1.2.1.dev12/docs/structures/guardrails_def.rst +8 -0
  6. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/structures/index.rst +1 -0
  7. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/.github/workflows/dissect-ci.yml +0 -0
  8. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/.gitignore +0 -0
  9. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/.lfs-assets-id +0 -0
  10. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/.pre-commit-config.yaml +0 -0
  11. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/LICENSE +0 -0
  12. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/README.rst +0 -0
  13. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/codecov.yml +0 -0
  14. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/__init__.py +0 -0
  15. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/artifact.py +0 -0
  16. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/beacon.py +0 -0
  17. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/c2.py +0 -0
  18. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/c2profile.lark +0 -0
  19. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/c2profile.py +0 -0
  20. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/c_c2.py +0 -0
  21. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/client.py +0 -0
  22. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/pcap.py +0 -0
  23. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/pe.py +0 -0
  24. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/utils.py +0 -0
  25. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/version.py +0 -0
  26. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/xordecode.py +0 -0
  27. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/Makefile +0 -0
  28. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/c2profile-grammar.rst +0 -0
  29. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/codespell-ignore-words.txt +0 -0
  30. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/conf.py +0 -0
  31. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/examples.rst +0 -0
  32. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/images/beacon-client.png +0 -0
  33. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/images/teamserver-echoclient.png +0 -0
  34. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/images/teamserver_ls.png +0 -0
  35. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
  36. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/index.rst +0 -0
  37. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/installation.rst +0 -0
  38. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/license.rst +0 -0
  39. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/scripts/checksum8-accesslogs.rst +0 -0
  40. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/scripts/dump_beacon_keys.rst +0 -0
  41. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/scripts/example_client.rst +0 -0
  42. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/scripts/index.rst +0 -0
  43. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/structures/c2_def.rst +0 -0
  44. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/structures/cs_def.rst +0 -0
  45. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/structures/pe_def.rst +0 -0
  46. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tools/beacon-artifact.rst +0 -0
  47. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tools/beacon-client.rst +0 -0
  48. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tools/beacon-dump.rst +0 -0
  49. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tools/beacon-pcap.rst +0 -0
  50. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tools/beacon-xordecode.rst +0 -0
  51. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tools/c2profile-dump.rst +0 -0
  52. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +0 -0
  53. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tutorials/index.rst +0 -0
  54. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/tutorials/minimal_beacon_client.rst +0 -0
  55. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/pyproject.toml +0 -0
  56. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/scripts/checksum8-accesslogs.py +0 -0
  57. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/scripts/dump_beacon_keys.py +0 -0
  58. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/scripts/example_client.py +0 -0
  59. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/conftest.py +0 -0
  60. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_beacon.py +0 -0
  61. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_c2.py +0 -0
  62. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_c2profile.py +0 -0
  63. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_client.py +0 -0
  64. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_guardrails.py +0 -0
  65. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_pe.py +0 -0
  66. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_utils.py +0 -0
  67. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_version.py +0 -0
  68. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tests/test_xordecode.py +0 -0
  69. {dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/tox.ini +0 -0
{dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/.readthedocs.yml RENAMED
@@ -1,5 +1,8 @@
1
1
  version: 2
2
2
 
3
+ sphinx:
4
+ configuration: docs/conf.py
5
+
3
6
  build:
4
7
  os: ubuntu-lts-latest
5
8
  tools:
{dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: dissect.cobaltstrike
3
- Version: 1.2.1.dev10
3
+ Version: 1.2.1.dev12
4
4
  Summary: a Python library for dissecting Cobalt Strike related data
5
5
  Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
6
6
  Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
{dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/_version.py RENAMED
@@ -17,5 +17,5 @@ __version__: str
17
17
  __version_tuple__: VERSION_TUPLE
18
18
  version_tuple: VERSION_TUPLE
19
19
 
20
- __version__ = version = '1.2.1.dev10'
21
- __version_tuple__ = version_tuple = (1, 2, 1, 'dev10')
20
+ __version__ = version = '1.2.1.dev12'
21
+ __version_tuple__ = version_tuple = (1, 2, 1, 'dev12')
{dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/dissect/cobaltstrike/guardrails.py RENAMED
@@ -2,15 +2,16 @@
2
2
  This module is responsible for finding and recovering Beacon Guardrails configuration from Cobalt Strike payloads.
3
3
  Guardrails is an additional layer of protection to the beacon config by using environmental keying (`T1480`_).
4
4
 
5
- Beacon Guardrails was introduced in Cobalt Strike 4.8:
5
+ .. note::
6
+ Beacon Guardrails was introduced in Cobalt Strike 4.8:
6
7
 
7
- - https://www.cobaltstrike.com/blog/cobalt-strike-4-8-system-call-me-maybe
8
+ - https://www.cobaltstrike.com/blog/cobalt-strike-4-8-system-call-me-maybe
8
9
 
9
- Other research on Beacon Guardrails:
10
+ Other research on Beacon Guardrails:
10
11
 
11
- - https://itea.org/journals/volume-45-3/cobalt-strike-cyber-assessment-challenge/
12
+ - https://itea.org/journals/volume-45-3/cobalt-strike-cyber-assessment-challenge/
12
13
 
13
- .. _T1480: https://attack.mitre.org/techniques/T1480/
14
+ .. _T1480: https://attack.mitre.org/techniques/T1480/
14
15
  """
15
16
 
16
17
  from __future__ import annotations
dissect_cobaltstrike-1.2.1.dev12/docs/structures/guardrails_def.rst ADDED
@@ -0,0 +1,8 @@
1
+ :attr:`dissect.cobaltstrike.guardrails.C_GUARDRAILS_DEF`
2
+ ----------------------------------------
3
+ Structures for parsing Beacon Guardrails metadata.
4
+
5
+ .. literalinclude:: ../../dissect/cobaltstrike/guardrails.py
6
+ :start-after: C_GUARDRAILS_DEF
7
+ :end-before: """
8
+ :language: c
{dissect_cobaltstrike-1.2.1.dev10 → dissect_cobaltstrike-1.2.1.dev12}/docs/structures/index.rst RENAMED
@@ -12,3 +12,4 @@ Structure definitions
12
12
  cs_def
13
13
  pe_def
14
14
  c2_def
15
+ guardrails_def