dissect.cobaltstrike 1.2.1.dev13__tar.gz → 1.2.2.dev2__tar.gz

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.cobaltstrike
-Version: 1.2.1.dev13
+Version: 1.2.2.dev2
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
@@ -29,7 +29,7 @@ Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
 Requires-Python: >=3.9
-Requires-Dist: dissect-cstruct>=4.2
+Requires-Dist: dissect-cstruct>=4.6.dev
 Requires-Dist: lark
 Provides-Extra: c2
 Requires-Dist: flow-record; extra == 'c2'

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '1.2.1.dev13'
-__version_tuple__ = version_tuple = (1, 2, 1, 'dev13')
+__version__ = version = '1.2.2.dev2'
+__version_tuple__ = version_tuple = (1, 2, 2, 'dev2')

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/beacon.py

@@ -617,7 +617,7 @@ def parse_beacon_gate(data: bytes) -> BeaconGateOptions:
 
 def beacon_gate_options_string(bgo: BeaconGateOptions) -> list[str]:
     """Return the enabled BeaconGate WinAPI's as a list of strings"""
-    options = {k for k, v in bgo._values.items() if v}
+    options = {k for k, v in bgo.__values__.items() if v}
 
     comms = {"InternetOpenA", "InternetConnectA"}
     core = {

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/pcap.py

@@ -77,7 +77,7 @@ def c2packet_to_record(c2packet: C2Packet) -> Record:
     """Convert `c2packet` to a flow.record."""
     fields = []
     fields.append(("bytes", "raw_http"))
-    kv = c2packet._values
+    kv = c2packet.__values__
     for field in c2packet._type.fields:
         ftype = str(field.type)
         if ftype.startswith("char"):

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/version.py

@@ -88,6 +88,7 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
     0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x66915024: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x66915027: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x6691503D: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x674E0D02: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
     0x674E0D13: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
     0x674E0D17: "Cobalt Strike 4.10.1 (Dec 10, 2024)",

dissect_cobaltstrike-1.2.2.dev2/docs/_ext/generate_beacon_version_csv.py

@@ -0,0 +1,30 @@
+import csv
+from datetime import datetime, timezone
+
+from dissect.cobaltstrike.version import PE_EXPORT_STAMP_TO_VERSION
+
+
+def setup(app):
+    """Set up the extension"""
+    app.connect("builder-inited", generate_csv)
+    return {
+        "version": "0.1",
+        "parallel_read_safe": True,
+        "parallel_write_safe": True,
+    }
+
+
+def generate_csv(app):
+    """Generate the CSV file"""
+    with open("cobaltstrike-beacon-versions.csv", "w", newline="") as csvfile:
+        writer = csv.writer(csvfile, lineterminator="\n")
+        writer.writerow(["Export Stamp", "Hex", "PE Export Date", "Cobalt Strike version"])
+        for pe_export_stamp, version in sorted(PE_EXPORT_STAMP_TO_VERSION.items(), reverse=True):
+            writer.writerow(
+                [
+                    pe_export_stamp,
+                    f"0x{pe_export_stamp:08x}",
+                    datetime.fromtimestamp(pe_export_stamp, timezone.utc).strftime("%a %b %d %H:%M:%S %Y"),
+                    version,
+                ]
+            )

dissect_cobaltstrike-1.2.2.dev2/docs/beacon-version-identification.rst

@@ -0,0 +1,26 @@
+Beacon version identification
+=============================
+
+:py:mod:`dissect.cobaltstrike.version` can identify the version of a Cobalt Strike beacon based on the PE export timestamp. 
+The following table lists the PE export timestamp and the corresponding Cobalt Strike version that have been collected and identified in the wild.
+
+.. csv-table:: Beacon version detection based on PE export timestamp
+   :file: cobaltstrike-beacon-versions.csv
+   :header-rows: 1
+   :class: longtable
+
+Use the ``beacon-dump`` command to identify the version of a Cobalt Strike beacon.
+Use the ``-v`` flag to print extra information, including the PE export timestamp and the version of the beacon.
+
+.. code-block::
+
+   $ beacon-dump -v beacon.bin
+
+   --------------------------------------------------
+   pe_export_stamp = 1720799264, 0x66915020, Fri Jul 12 17:47:44 2024 - Cobalt Strike 4.10 (Jul 16, 2024)
+   pe_compile_stamp = 1478837312, 0x58254440, Fri Nov 11 05:08:32 2016
+   max_setting_enum = 78 - BeaconSetting.SETTING_BEACON_GATE
+   beacon_version = Cobalt Strike 4.10 (Jul 16, 2024)
+
+If the version is unknown, the ``beacon-dump`` command will print the PE export timestamp and the version ``Unknown``.
+A GitHub issue is welcome to add the PE export timestamp and the corresponding Cobalt Strike version to the table.

dissect_cobaltstrike-1.2.2.dev2/docs/cobaltstrike-beacon-versions.csv

@@ -0,0 +1,54 @@
+Export Stamp,Hex,PE Export Date,Cobalt Strike version
+1733168407,0x674e0d17,Mon Dec 02 19:40:07 2024,"Cobalt Strike 4.10.1 (Dec 10, 2024)"
+1733168403,0x674e0d13,Mon Dec 02 19:40:03 2024,"Cobalt Strike 4.10.1 (Dec 10, 2024)"
+1733168386,0x674e0d02,Mon Dec 02 19:39:46 2024,"Cobalt Strike 4.10.1 (Dec 10, 2024)"
+1720799271,0x66915027,Fri Jul 12 15:47:51 2024,"Cobalt Strike 4.10 (Jul 16, 2024)"
+1720799268,0x66915024,Fri Jul 12 15:47:48 2024,"Cobalt Strike 4.10 (Jul 16, 2024)"
+1720799266,0x66915022,Fri Jul 12 15:47:46 2024,"Cobalt Strike 4.10 (Jul 16, 2024)"
+1720799264,0x66915020,Fri Jul 12 15:47:44 2024,"Cobalt Strike 4.10 (Jul 16, 2024)"
+1720799247,0x6691500f,Fri Jul 12 15:47:27 2024,"Cobalt Strike 4.10 (Jul 16, 2024)"
+1694010590,0x64f88cde,Wed Sep 06 14:29:50 2023,"Cobalt Strike 4.9 (Sep 19, 2023)"
+1694010526,0x64f88c9e,Wed Sep 06 14:28:46 2023,"Cobalt Strike 4.9 (Sep 19, 2023)"
+1694010494,0x64f88c7e,Wed Sep 06 14:28:14 2023,"Cobalt Strike 4.9 (Sep 19, 2023)"
+1694010462,0x64f88c5e,Wed Sep 06 14:27:42 2023,"Cobalt Strike 4.9 (Sep 19, 2023)"
+1676543367,0x63ee0587,Thu Feb 16 10:29:27 2023,"Cobalt Strike 4.8 (Feb 28, 2023)"
+1676543340,0x63ee056c,Thu Feb 16 10:29:00 2023,"Cobalt Strike 4.8 (Feb 28, 2023)"
+1676543314,0x63ee0552,Thu Feb 16 10:28:34 2023,"Cobalt Strike 4.8 (Feb 28, 2023)"
+1661785433,0x630cd559,Mon Aug 29 15:03:53 2022,"Cobalt Strike 4.7.1 (Sep 16, 2022)"
+1661785403,0x630cd53b,Mon Aug 29 15:03:23 2022,"Cobalt Strike 4.7.1 (Sep 16, 2022)"
+1661785372,0x630cd51c,Mon Aug 29 15:02:52 2022,"Cobalt Strike 4.7.1 (Sep 16, 2022)"
+1659630329,0x62ebf2f9,Thu Aug 04 16:25:29 2022,"Cobalt Strike 4.7 (Aug 17, 2022)"
+1659630298,0x62ebf2da,Thu Aug 04 16:24:58 2022,"Cobalt Strike 4.7 (Aug 17, 2022)"
+1659630264,0x62ebf2b8,Thu Aug 04 16:24:24 2022,"Cobalt Strike 4.7 (Aug 17, 2022)"
+1649798033,0x6255eb91,Tue Apr 12 21:13:53 2022,"Cobalt Strike 4.6 (Apr 12, 2022)"
+1649797998,0x6255eb6e,Tue Apr 12 21:13:18 2022,"Cobalt Strike 4.6 (Apr 12, 2022)"
+1649797966,0x6255eb4e,Tue Apr 12 21:12:46 2022,"Cobalt Strike 4.6 (Apr 12, 2022)"
+1637694016,0x619d3a40,Tue Nov 23 19:00:16 2021,"Cobalt Strike 4.5 (Dec 14, 2021)"
+1637693979,0x619d3a1b,Tue Nov 23 18:59:39 2021,"Cobalt Strike 4.5 (Dec 14, 2021)"
+1627994782,0x61093a9e,Tue Aug 03 12:46:22 2021,"Cobalt Strike 4.4 (Aug 04, 2021)"
+1627994693,0x61093a45,Tue Aug 03 12:44:53 2021,"Cobalt Strike 4.4 (Aug 04, 2021)"
+1614781725,0x603f9d1d,Wed Mar 03 14:28:45 2021,"Cobalt Strike 4.3 (Mar 03, 2021)"
+1614696183,0x603e4ef7,Tue Mar 02 14:43:03 2021,"Cobalt Strike 4.3 (Mar 03, 2021)"
+1614687645,0x603e2d9d,Tue Mar 02 12:20:45 2021,"Cobalt Strike 4.3 (Mar 03, 2021)"
+1604366948,0x5fa0b264,Tue Nov 03 01:29:08 2020,"Cobalt Strike 4.2 (Nov 06, 2020)"
+1604366849,0x5fa0b201,Tue Nov 03 01:27:29 2020,"Cobalt Strike 4.2 (Nov 06, 2020)"
+1603584534,0x5f94c216,Sun Oct 25 00:08:54 2020,"Cobalt Strike 4.2 (Nov 06, 2020)"
+1592939923,0x5ef25593,Tue Jun 23 19:18:43 2020,"Cobalt Strike 4.1 (Jun 25, 2020)"
+1592939867,0x5ef2555b,Tue Jun 23 19:17:47 2020,"Cobalt Strike 4.1 (Jun 25, 2020)"
+1575547386,0x5de8f1fa,Thu Dec 05 12:03:06 2019,"Cobalt Strike 4.0 (Dec 05, 2019)"
+1575547248,0x5de8f170,Thu Dec 05 12:00:48 2019,"Cobalt Strike 4.0 (Dec 05, 2019)"
+1575497188,0x5de82de4,Wed Dec 04 22:06:28 2019,"Cobalt Strike 4.0 (Dec 05, 2019)"
+1569306883,0x5d89b903,Tue Sep 24 06:34:43 2019,"Cobalt Strike 4.0 (Dec 05, 2019)"
+1556924433,0x5cccc811,Fri May 03 23:00:33 2019,"Cobalt Strike 3.14 (May 04, 2019)"
+1555631605,0x5cb90df5,Thu Apr 18 23:53:25 2019,"Cobalt Strike 3.14 (May 02, 2019)"
+1546037702,0x5c26a9c6,Fri Dec 28 22:55:02 2018,"Cobalt Strike 3.13 (Jan 02, 2019)"
+1536184396,0x5b90504c,Wed Sep 05 21:53:16 2018,"Cobalt Strike 3.12 (Sep 06, 2018)"
+1527022389,0x5b048335,Tue May 22 20:53:09 2018,"Cobalt Strike 3.11 (May 24, 2018)"
+1523134121,0x5ac92ea9,Sat Apr 07 20:48:41 2018,"Cobalt Strike 3.11 (Apr 09, 2018)"
+1512682653,0x5a29b49d,Thu Dec 07 21:37:33 2017,"Cobalt Strike 3.10 (Dec 11, 2017)"
+1505657962,0x59be846a,Sun Sep 17 14:19:22 2017,"Cobalt Strike 3.9 (Sep 26, 2017)"
+1495488077,0x5923564d,Mon May 22 21:21:17 2017,"Cobalt Strike 3.8 (May 23, 2017)"
+1488758730,0x58bca7ca,Mon Mar 06 00:05:30 2017,"Cobalt Strike 3.7 (Mar 15, 2017)"
+1481145921,0x58487e41,Wed Dec 07 21:25:21 2016,"Cobalt Strike 3.6 (Dec 08, 2016)"
+1474078204,0x57dca5fc,Sat Sep 17 02:10:04 2016,"Cobalt Strike 3.5 (Sep 22, 2016)"
+1469737033,0x579a6849,Thu Jul 28 20:17:13 2016,"Cobalt Strike 3.4 (Jul 29, 2016)"

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/docs/conf.py

@@ -12,8 +12,11 @@
 #
 import os
 import sys
+from datetime import datetime
 
 sys.path.insert(0, os.path.abspath("../"))
+sys.path.append(os.path.abspath("_ext"))
+
 
 # Get version info from dissect.cobaltstrike._version
 try:
@@ -27,7 +30,7 @@ except ModuleNotFoundError:
 # -- Project information -----------------------------------------------------
 
 project = "dissect.cobaltstrike"
-copyright = "2022, Fox-IT part of NCC Group"
+copyright = f"2022-{datetime.now().year}, Fox-IT part of NCC Group"
 author = "Fox-IT part of NCC Group"
 
 
@@ -48,6 +51,7 @@ extensions = [
     "sphinx_copybutton",
     "autoapi.extension",
     "sphinx_argparse_cli",
+    "generate_beacon_version_csv",
 ]
 
 # Add any paths that contain templates here, relative to this directory.

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/docs/index.rst

@@ -43,6 +43,7 @@ Source code can be found here:
    API reference <autoapi/dissect/cobaltstrike/index>
    structures/index
    c2profile-grammar
+   beacon-version-identification
 
 .. toctree::
    :caption: Links

{dissect_cobaltstrike-1.2.1.dev13 → dissect_cobaltstrike-1.2.2.dev2}/pyproject.toml

@@ -13,7 +13,7 @@ authors = [
     {name = "Yun Zheng Hu", email = "hu@fox-it.com"},
 ]
 dependencies = [
-    "dissect.cstruct >= 4.2",
+    "dissect.cstruct >= 4.6.dev",
     "lark",
 ]
 keywords = ["dissect", "cobaltstrike", "beacon", "parser", "parsing", "lark", "cstruct"]