dissect.cobaltstrike 1.2.1.dev3__tar.gz → 1.2.1.dev5__tar.gz

{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: dissect.cobaltstrike
-Version: 1.2.1.dev3
+Version: 1.2.1.dev5
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/

{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev5}/dissect/cobaltstrike/_version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '1.2.1.dev3'
-__version_tuple__ = version_tuple = (1, 2, 1, 'dev3')
+__version__ = version = '1.2.1.dev5'
+__version_tuple__ = version_tuple = (1, 2, 1, 'dev5')

{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev5}/dissect/cobaltstrike/beacon.py

@@ -247,6 +247,12 @@ enum InjectExecutor: uint8 {
     CreateRemoteThread_ = 7,
     NtQueueApcThread_s = 8
 };
+
+enum BofAllocator: uint16 {
+    VirtualAlloc = 0,
+    MapViewOfFile = 1,
+    HeapAlloc = 2,
+};
 """
 
 cs_struct = cstruct.cstruct(endian=">")
@@ -262,6 +268,7 @@ CryptoScheme = cs_struct.CryptoScheme
 ProxyServer = cs_struct.ProxyServer
 InjectAllocator = cs_struct.InjectAllocator
 InjectExecutor = cs_struct.InjectExecutor
+BofAllocator = cs_struct.BofAllocator
 
 DEFAULT_XOR_KEYS: List[bytes] = [b"\x69", b"\x2e", b"\x00"]
 """ Default XOR keys used by Cobalt Strike for obfuscating Beacon config bytes """
@@ -635,6 +642,7 @@ SETTING_TO_PRETTYFUNC: Dict[BeaconSetting, Callable] = {
     BeaconSetting.SETTING_DNS_IDLE: lambda x: str(ipaddress.IPv4Address(x)),
     BeaconSetting.SETTING_WATERMARKHASH: lambda x: null_terminated_bytes(x) if isinstance(x, bytes) else x,
     BeaconSetting.SETTING_MASKED_WATERMARK: lambda x: x.hex(),
+    BeaconSetting.SETTING_BOF_ALLOCATOR: lambda x: BofAllocator(x).name,
     # BeaconSetting.SETTING_PROTOCOL: lambda x: BeaconProtocol(x).name,
     # BeaconSetting.SETTING_CRYPTO_SCHEME: lambda x: CryptoScheme(x).name,
     # BeaconSetting.SETTING_PROXY_BEHAVIOR: lambda x: ProxyServer(x).name,

{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev5}/dissect/cobaltstrike/c2profile.py

@@ -618,6 +618,10 @@ class C2Profile(ConfigBlock):
                 dns_beacon.set_option("dns_sleep", value)
             elif setting == BeaconSetting.SETTING_MAXDNS:
                 dns_beacon.set_option("maxdns", value)
+            elif setting == BeaconSetting.SETTING_PROCINJ_BOF_REUSE_MEM and value:
+                proc_inj.set_option("bof_reuse_memory", "true")
+            elif setting == BeaconSetting.SETTING_BOF_ALLOCATOR:
+                proc_inj.set_option("bof_allocator", value)
 
         if c2_recover:
             http_get.set_non_empty_config_block("server", HttpOptionsBlock(output=DataTransformBlock(steps=c2_recover)))

{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev5}/dissect/cobaltstrike/version.py

@@ -32,6 +32,8 @@ MAX_ENUM_TO_VERSION: Dict[int, str] = {
     70: "Cobalt Strike 4.3 (Mar 03, 2021)",
     73: "Cobalt Strike 4.5 (Dec 14, 2021)",
     74: "Cobalt Strike 4.7 (Aug 17, 2022)",
+    76: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    78: "Cobalt Strike 4.10 (Jul 16, 2024)",
 }
 """ Max setting enum to Cobalt Strike version mapping """
 
@@ -77,6 +79,12 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
     0x63EE0552: "Cobalt Strike 4.8 (Feb 28, 2023)",
     0x63EE056C: "Cobalt Strike 4.8 (Feb 28, 2023)",
     0x63EE0587: "Cobalt Strike 4.8 (Feb 28, 2023)",
+    0x64F88C5E: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x64F88C9E: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x64F88CDE: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x6691500F: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x66915020: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
 }
 """ PE export timestamp to Cobalt Strike version mapping """
 

{dissect_cobaltstrike-1.2.1.dev3 → dissect_cobaltstrike-1.2.1.dev5}/tests/test_c2profile.py

@@ -1,3 +1,5 @@
+import pytest
+
 from dissect.cobaltstrike import beacon, c2profile
 
 C2PROFILE_SOURCE = """
@@ -294,3 +296,45 @@ def test_c2profile_v48():
     """
     profile = c2profile.C2Profile.from_text(c2profile_fragment)
     assert profile.properties["stage.syscall_method"] == ["direct"]
+
+
+@pytest.mark.parametrize(
+    ("allocator_enum", "bof_allocator"),
+    [
+        (beacon.BofAllocator.HeapAlloc, "HeapAlloc"),
+        (beacon.BofAllocator.MapViewOfFile, "MapViewOfFile"),
+        (beacon.BofAllocator.HeapAlloc, "HeapAlloc"),
+    ],
+)
+def test_c2profile_bof_allocator(allocator_enum, bof_allocator):
+    data = beacon.Setting(
+        index=beacon.BeaconSetting.SETTING_BOF_ALLOCATOR,
+        type=beacon.SettingsType.TYPE_SHORT,
+        length=0x2,
+        value=allocator_enum.dumps(),
+    ).dumps()
+    bconfig = beacon.BeaconConfig(data)
+    profile = c2profile.C2Profile.from_beacon_config(bconfig)
+    assert profile.properties["process-inject.bof_allocator"] == [bof_allocator]
+
+
+@pytest.mark.parametrize(
+    ("bof_reuse_memory",),
+    [
+        (True,),
+        (False,),
+    ],
+)
+def test_c2profile_bof_reuse_memory(bof_reuse_memory):
+    data = beacon.Setting(
+        index=beacon.BeaconSetting.SETTING_PROCINJ_BOF_REUSE_MEM,
+        type=beacon.SettingsType.TYPE_SHORT,
+        length=0x2,
+        value=beacon.cs_struct.uint16(bof_reuse_memory).dumps(),
+    ).dumps()
+    bconfig = beacon.BeaconConfig(data)
+    profile = c2profile.C2Profile.from_beacon_config(bconfig)
+    if bof_reuse_memory:
+        assert profile.properties["process-inject.bof_reuse_memory"] == ["true"]
+    else:
+        assert "project.inject.bof_reuse_memory" not in profile.properties