dissect.cobaltstrike 1.2.1.dev8__tar.gz → 1.2.1.dev10__tar.gz

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: dissect.cobaltstrike
-Version: 1.2.1.dev8
+Version: 1.2.1.dev10
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/

dissect_cobaltstrike-1.2.1.dev10/dissect/cobaltstrike/_version.py

@@ -0,0 +1,21 @@
+# file generated by setuptools-scm
+# don't change, don't track in version control
+
+__all__ = ["__version__", "__version_tuple__", "version", "version_tuple"]
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Tuple
+    from typing import Union
+
+    VERSION_TUPLE = Tuple[Union[int, str], ...]
+else:
+    VERSION_TUPLE = object
+
+version: str
+__version__: str
+__version_tuple__: VERSION_TUPLE
+version_tuple: VERSION_TUPLE
+
+__version__ = version = '1.2.1.dev10'
+__version_tuple__ = version_tuple = (1, 2, 1, 'dev10')

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/dissect/cobaltstrike/beacon.py

@@ -9,7 +9,6 @@ import functools
 import hashlib
 import io
 import ipaddress
-import itertools
 import logging
 import sys
 import time
@@ -36,8 +35,10 @@ from typing import (
 
 from dissect import cstruct
 from dissect.cobaltstrike import pe
+from dissect.cobaltstrike.guardrails import GuardrailMetadata, iter_guardrail_configs_with_beacon
 from dissect.cobaltstrike.utils import (
     catch_sigpipe,
+    grouper,
     iter_find_needle,
     p8,
     u16be,
@@ -175,6 +176,7 @@ enum BeaconSetting: uint16 {
     SETTING_DATA_STORE_SIZE = 76,
 
     // CobaltStrike version >= 4.10 (Jul 16, 2024)
+    SETTING_HTTP_DATA_REQUIRED = 77,
     SETTING_BEACON_GATE = 78,
 };
 
@@ -463,13 +465,6 @@ def iter_settings(fobj: Union[bytes, BinaryIO]) -> Iterator["Setting"]:
         yield setting
 
 
-def grouper(iterable, n, fillvalue=None):
-    "Collect data into fixed-length chunks or blocks"
-    # grouper('ABCDEFG', 3, 'x') --> ABC DEF Gxx"
-    args = [iter(iterable)] * n
-    return itertools.zip_longest(*args, fillvalue=fillvalue)
-
-
 def parse_recover_binary(program: bytes) -> List[Tuple[str, Union[int, bool]]]:
     """Parse ``SETTING_C2_RECOVER`` (`.http-get.server.output`) data"""
     rsteps: List[Tuple[str, Union[int, bool]]] = []
@@ -772,6 +767,8 @@ class BeaconConfig:
         """ PE compile timestamp, ``None`` if unknown. """
         self.architecture: Optional[str] = None
         """ PE architecture, ``"x86"`` or ``"x64"`` and  ``None`` if unknown. """
+        self.guardrails: Optional[GuardrailMetadata] = None
+        """ Guardrails metadata, ``None`` if not available. """
 
         # Used for caching
         self._settings: Optional[Mapping[str, Any]] = None
@@ -808,6 +805,22 @@ class BeaconConfig:
             bconfig.architecture = pe.find_architecture(fh)
             # Return the first found beacon config.
             return bconfig
+
+        # Try finding Beacon config protected with Guardrails
+        try:
+            fxor = XorEncodedFile.from_file(fobj)
+        except ValueError:
+            fxor = fobj
+        for grconfig in iter_guardrail_configs_with_beacon(fxor):
+            if not grconfig.unmasked_beacon_config:
+                continue
+            bconfig = cls(grconfig.unmasked_beacon_config)
+            bconfig.guardrails = grconfig
+            bconfig.xorkey = grconfig.beacon_xor_key
+            bconfig.pe_compile_stamp, bconfig.pe_export_stamp = pe.find_compile_stamps(fxor)
+            bconfig.architecture = pe.find_architecture(fxor)
+            return bconfig
+
         raise ValueError("No valid Beacon configuration found")
 
     @classmethod
@@ -1107,7 +1120,7 @@ def build_parser():
     import argparse
 
     parser = argparse.ArgumentParser(formatter_class=argparse.ArgumentDefaultsHelpFormatter)
-    parser.add_argument("input", metavar="FILE", help="Beacon to dump")
+    parser.add_argument("input", metavar="FILE", nargs="+", help="Beacon to dump")
     parser.add_argument(
         "-x",
         "--xorkey",
@@ -1115,10 +1128,9 @@ def build_parser():
         help="override default xor key(s) (default: -x 0x69 -x 0x2e -x 0x00)",
     )
     parser.add_argument(
-        "-a",
-        "--all",
+        "--default-xor-keys-only",
         action="store_true",
-        help="try all other single byte xor keys when default ones fail",
+        help="only try the default xor keys instead of all possible ones",
     )
     parser.add_argument(
         "-t",
@@ -1149,63 +1161,71 @@ def main():
     level = levels[min(len(levels) - 1, args.verbose)]
     logging.basicConfig(
         level=level,
-        datefmt="[%X]",
-        format="%(asctime)s %(name)s %(message)s",
+        format="%(asctime)s %(levelname)s %(name)s: %(message)s",
     )
 
     xor_keys = None
     if args.xorkey:
         xor_keys = tuple(utils.pack_be(int(x, 0)) for x in args.xorkey)
 
-    try:
-        if args.input in ("-", "/dev/stdin"):
-            with io.BytesIO(sys.stdin.buffer.read()) as fin:
-                config = BeaconConfig.from_file(fin, xor_keys=xor_keys, all_xor_keys=args.all)
-        else:
-            config = BeaconConfig.from_path(args.input, xor_keys=xor_keys, all_xor_keys=args.all)
-    except ValueError:
-        print(f"{args.input}: No beacon configuration found.", file=sys.stderr)
-        return 1
-
-    if args.type == "raw":
-        for setting in config.settings_tuple:
-            print(setting)
-    elif args.type == "dumpstruct":
-        cstruct.hexdump(config.config_block)
-        print("-----")
-        for setting in config.settings_tuple:
-            cstruct.dumpstruct(setting)
-            print("-" * 10)
-    elif args.type == "normal":
-        settings = config.settings
-        for setting, value in settings.items():
-            print(f"{setting} = {value!r}")
-        if args.verbose >= 1:
-            print("-" * 50)
-            print(
-                "pe_export_stamp = {}, {}, {}".format(
-                    config.pe_export_stamp,
-                    hex(config.pe_export_stamp),
-                    time.ctime(config.pe_export_stamp),
+    dumped = False
+    for fname in args.input:
+        logging.info("Processing: %r", fname)
+        try:
+            if fname in ("-", "/dev/stdin"):
+                with io.BytesIO(sys.stdin.buffer.read()) as fin:
+                    config = BeaconConfig.from_file(fin, xor_keys=xor_keys, all_xor_keys=not args.default_xor_keys_only)
+            else:
+                config = BeaconConfig.from_path(fname, xor_keys=xor_keys, all_xor_keys=not args.default_xor_keys_only)
+        except ValueError:
+            print(f"{fname}: No beacon configuration found.", file=sys.stderr)
+            continue
+
+        dumped = True
+        if args.type == "raw":
+            for setting in config.settings_tuple:
+                print(setting)
+        elif args.type == "dumpstruct":
+            cstruct.hexdump(config.config_block)
+            print("-----")
+            for setting in config.settings_tuple:
+                cstruct.dumpstruct(setting)
+                print("-" * 10)
+        elif args.type == "normal":
+            settings = config.settings
+            for setting, value in settings.items():
+                print(f"{setting} = {value!r}")
+            if args.verbose >= 1:
+                print("-" * 50)
+                print(
+                    "pe_export_stamp = {}, {}, {}".format(
+                        config.pe_export_stamp,
+                        hex(config.pe_export_stamp),
+                        time.ctime(config.pe_export_stamp),
+                    )
                 )
-            )
-            print(
-                "pe_compile_stamp = {}, {}, {}".format(
-                    config.pe_compile_stamp,
-                    hex(config.pe_compile_stamp),
-                    time.ctime(config.pe_compile_stamp),
+                print(
+                    "pe_compile_stamp = {}, {}, {}".format(
+                        config.pe_compile_stamp,
+                        hex(config.pe_compile_stamp),
+                        time.ctime(config.pe_compile_stamp),
+                    )
                 )
-            )
-            print(
-                "max_setting_enum = {} - {}".format(
-                    config.max_setting_enum,
-                    BeaconSetting(config.max_setting_enum),
+                print(
+                    "max_setting_enum = {} - {}".format(
+                        config.max_setting_enum,
+                        BeaconSetting(config.max_setting_enum),
+                    )
                 )
-            )
-            print("beacon_version =", config.version)
-    elif args.type == "c2profile":
-        profile = c2profile.C2Profile.from_beacon_config(config)
-        print(profile.as_text())
+                print("beacon_version =", config.version)
+                if config.guardrails:
+                    print("guardrail payload xor key =", config.guardrails.payload_xor_key)
+                    print("guardrail options =", [s.option for s in config.guardrails.settings])
+        elif args.type == "c2profile":
+            profile = c2profile.C2Profile.from_beacon_config(config)
+            print(profile.as_text())
+
+    return 0 if dumped else 1
 
 
 if __name__ == "__main__":

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/dissect/cobaltstrike/c2profile.lark

@@ -11,6 +11,7 @@ start: value*
     | "process-inject" "{" process_inject_options* "}"                  -> process_inject
     | "post-ex" "{" postex_options* "}"                                 -> post_ex
     | "dns-beacon" "{" dns_beacon_options* "}"                          -> dns_beacon
+    | "http-beacon" "{" http_beacon_options* "}"                        -> http_beacon
 
 OPTION: "sample_name"
     | "data_jitter"
@@ -214,6 +215,10 @@ dns_beacon_options: "set" "dns_idle" string ";" -> dns_idle
     | "set" "ns_response" string ";"            -> ns_response
     | "#" "dns_resolver" string ";"             -> comment_dns_resolver
 
+http_beacon_options: "set" "library" string ";" -> library              // introduced in Cobalt Strike 4.9
+    | "set" "data_required" string ";"          -> data_required        // introduced in Cobalt Strike 4.10
+    | "set" "data_required_length" string ";"   -> data_required_length // introduced in Cobalt Strike 4.10
+
 header: string
 string: STRING
 variant: string

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/dissect/cobaltstrike/c2profile.py

@@ -309,6 +309,12 @@ class DnsBeaconBlock(ConfigBlock):
     __name__ = "dns_beacon"
 
 
+class HttpBeaconBlock(ConfigBlock):
+    """`.http-beacon` block"""
+
+    __name__ = "http_beacon"
+
+
 class ExecuteOptionsBlock(ConfigBlock):
     """`.process-inject.execute` block"""
 
@@ -446,6 +452,7 @@ class C2Profile(ConfigBlock):
         http_post_client = HttpOptionsBlock()
         proc_inj = ProcessInjectBlock()
         dns_beacon = DnsBeaconBlock()
+        http_beacon = HttpBeaconBlock()
         # http_get_server = HttpOptionsBlock()
 
         for setting, value in config.settings_by_index.items():
@@ -668,6 +675,8 @@ class C2Profile(ConfigBlock):
                 proc_inj.set_option("bof_allocator", value)
             elif setting == BeaconSetting.SETTING_DATA_STORE_SIZE:
                 stage.set_option("data_store_size", value)
+            elif setting == BeaconSetting.SETTING_HTTP_DATA_REQUIRED and value:
+                http_beacon.set_option("data_required", "true")
             elif setting == BeaconSetting.SETTING_BEACON_GATE and value:
                 block = BeaconGateBlock.from_beacon_gate_option_strings(value)
                 stage.set_config_block("beacon_gate", block)
@@ -681,6 +690,7 @@ class C2Profile(ConfigBlock):
         profile.set_non_empty_config_block("stage", stage)
         profile.set_non_empty_config_block("process_inject", proc_inj)
         profile.set_non_empty_config_block("dns_beacon", dns_beacon)
+        profile.set_non_empty_config_block("http_beacon", http_beacon)
         return profile
 
     def __str__(self) -> str:

dissect_cobaltstrike-1.2.1.dev10/dissect/cobaltstrike/guardrails.py

@@ -0,0 +1,195 @@
+"""
+This module is responsible for finding and recovering Beacon Guardrails configuration from Cobalt Strike payloads.
+Guardrails is an additional layer of protection to the beacon config by using environmental keying (`T1480`_).
+
+Beacon Guardrails was introduced in Cobalt Strike 4.8:
+
+ - https://www.cobaltstrike.com/blog/cobalt-strike-4-8-system-call-me-maybe
+
+Other research on Beacon Guardrails:
+
+ - https://itea.org/journals/volume-45-3/cobalt-strike-cyber-assessment-challenge/
+
+.. _T1480: https://attack.mitre.org/techniques/T1480/
+"""
+
+from __future__ import annotations
+
+import collections
+import functools
+import io
+import logging
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, BinaryIO
+
+from dissect.cobaltstrike.utils import grouper, u32be, xor
+from dissect.cstruct import cstruct
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+log = logging.getLogger(__name__)
+
+C_GUARDRAILS_DEF = """
+enum GuardOption: uint16 {
+    GUARD_USER = 5,
+    GUARD_COMPUTER = 6,
+    GUARD_DOMAIN = 7,
+    GUARD_LOCAL_IP = 8,
+    GUARD_PAYLOAD_CHECKSUM = 9,
+};
+
+enum SettingsType: uint16 {
+    TYPE_NONE = 0,
+    TYPE_SHORT = 1,
+    TYPE_INT = 2,
+    TYPE_PTR = 3,
+};
+
+struct GuardrailSetting {
+    GuardOption option;         // uint16
+    SettingsType type;          // uint16
+    uint16 length;              // uint16
+    char value[length];
+};
+"""
+
+BEACON_CONFIG_PATCH_SIZE = 6144
+GUARD_PATCH_SIZE = 2048
+
+GUARD_CONFIG_STARTS = [
+    b"\x00\x05\x00\x01\x00\x02",  # GUARD_USER
+    b"\x00\x06\x00\x01\x00\x02",  # GUARD_COMPUTER
+    b"\x00\x07\x00\x01\x00\x02",  # GUARD_DOMAIN
+    b"\x00\x08\x00\x02\x00\x04",  # GUARD_LOCAL_IP
+]
+
+c_guardrails = cstruct(endian=">").load(C_GUARDRAILS_DEF)
+GuardrailSetting = c_guardrails.GuardrailSetting
+GuardOption = c_guardrails.GuardOption
+
+
+@dataclass
+class GuardrailMetadata:
+    """Class for holding Guardrail related data"""
+
+    beacon_config_offset: int
+    """ Offset of the beacon configuration in the payload """
+    guard_config_offset: int
+    """ Offset of the guardrail configuration in the payload """
+    masked_beacon_config: bytes
+    """ Masked raw beacon configuration """
+    masked_guard_config: bytes
+    """ Masked raw guardrail configuration """
+    beacon_xor_key: bytes
+    """ Single byte XOR key used to mask the beacon configuration. (0x2e by default unless modified beacon) """
+    guardrail_xor_key: bytes
+    """ Single byte XOR key used to unmask the guardrail configuration (0x8a by default unless modified beacon) """
+    unmasked_guard_config: bytes
+    """ Unmasked guardrail configuration """
+    checksum: int
+    """ Extracted payload checksum from guardrail configuration. This is used to validate the beacon configuration """
+    payload_xor_key: bytes | None
+    """ XOR key used to unmask the guarded beacon configuration. This is the environmental key """
+    unmasked_beacon_config: bytes
+    """ Unmasked beacon configuration """
+    settings: list[GuardrailSetting]
+    """ List of guardrail settings """
+
+
+def iter_guardrail_configs(fh: BinaryIO, xorkey: bytes = b"\x8a") -> Iterator[GuardrailMetadata]:
+    xorred_guardconfig_starts = [xor(x, xorkey) for x in GUARD_CONFIG_STARTS]
+    size = len(xorred_guardconfig_starts[0])
+    offset = 0
+    while True:
+        fh.seek(offset)
+        block = fh.read(size * 2)
+        if not block:
+            break
+        a, b = block[:size], block[size:]
+        if xor(a[::-1], b) in xorred_guardconfig_starts:
+            log.info("Found guardrail config at offset: %u in %r", offset, fh)
+            guard_config_offset = offset + 6
+            beacon_config_offset = guard_config_offset - BEACON_CONFIG_PATCH_SIZE
+            fh.seek(beacon_config_offset)
+            masked_beacon_config = fh.read(BEACON_CONFIG_PATCH_SIZE)
+            masked_guard_config = fh.read(GUARD_PATCH_SIZE)
+            unmasked_guard_config = xor(xor(masked_guard_config, masked_beacon_config[::-1]), xorkey)
+
+            fh_guard = io.BufferedReader(io.BytesIO(unmasked_guard_config))
+            checksum = 0
+            settings: list[GuardrailSetting] = []
+            while True:
+                if fh_guard.peek(2)[:2] == b"\x00\x00":
+                    break
+                setting = GuardrailSetting(fh_guard)
+                settings.append(setting)
+                log.debug(setting)
+                if setting.option == GuardOption.GUARD_PAYLOAD_CHECKSUM:
+                    checksum = u32be(setting.value)
+                    log.debug("%s = 0x%08x", setting.option.name, checksum)
+
+            yield GuardrailMetadata(
+                beacon_config_offset=beacon_config_offset,
+                guard_config_offset=guard_config_offset,
+                checksum=checksum,
+                masked_guard_config=masked_guard_config,
+                masked_beacon_config=masked_beacon_config,
+                unmasked_guard_config=unmasked_guard_config,
+                guardrail_xor_key=xorkey,
+                beacon_xor_key=b"\x2e",  # we currently only support the XOR default key
+                payload_xor_key=None,
+                unmasked_beacon_config=None,
+                settings=settings,
+            )
+        offset += 1
+
+
+def find_xor_key_candidates(fh: BinaryIO) -> Iterator[bytes]:
+    for keylen in range(2, 257):
+        fh.seek(0)
+        counter = collections.Counter()
+        for chunk in iter(functools.partial(fh.read, io.DEFAULT_BUFFER_SIZE), b""):
+            grams = grouper(chunk, n=keylen, fillvalue=0)
+            counter.update(bytes(gram) for gram in grams)
+
+        first_count = 0
+        for key, count in counter.most_common(2):
+            if count >= first_count:
+                first_count = count
+                yield key
+            else:
+                break
+
+
+def payload_checksum(data: bytes) -> int:
+    n = 0
+    for i in range(len(data)):
+        n = (n + (data[i] & 0xFF) * (i % 3 + 1)) % 99999999
+    return n
+
+
+def iter_guardrail_configs_with_beacon(fh: BinaryIO) -> Iterator[GuardrailMetadata]:
+    for grconfig in iter_guardrail_configs(fh):
+
+        # Unmask the beacon config, static single byte xor key should be 0x2E unless modified beacon
+        # The beacon config is still masked with the environmental key
+        grconfig.beacon_xor_key = b"\x2e"  # we currently only support the XOR default key
+        guarded_config = xor(grconfig.masked_beacon_config, grconfig.beacon_xor_key)
+
+        for xorkey in find_xor_key_candidates(io.BytesIO(guarded_config)):
+            unguarded = xor(guarded_config, xorkey)
+
+            checksum = payload_checksum(unguarded) + 1
+            log.debug("payload checksum: 0x%08x for xorkey: %r", checksum, xorkey)
+
+            if grconfig.checksum == checksum:
+                log.info("Found guardrail payload xorkey: %r", xorkey)
+                grconfig.payload_xor_key = xorkey
+                grconfig.unmasked_beacon_config = unguarded
+                yield grconfig
+                break
+        else:
+            # No valid xor key found, so not able to unmask the beacon config
+            # but we can still return the guardrail config
+            yield grconfig

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/dissect/cobaltstrike/utils.py

@@ -4,6 +4,7 @@ This module contains generic helper functions used by ``dissect.cobaltstrike``.
 
 import errno
 import io
+import itertools
 import os
 import random
 import re
@@ -280,3 +281,10 @@ class LRUDict(OrderedDict):
         if len(self) > self.maxsize:
             oldest = next(iter(self))
             del self[oldest]
+
+
+def grouper(iterable, n, fillvalue=None):
+    "Collect data into fixed-length chunks or blocks"
+    # grouper('ABCDEFG', 3, 'x') --> ABC DEF Gxx"
+    args = [iter(iterable)] * n
+    return itertools.zip_longest(*args, fillvalue=fillvalue)

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/dissect/cobaltstrike/version.py

@@ -80,11 +80,13 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
     0x63EE056C: "Cobalt Strike 4.8 (Feb 28, 2023)",
     0x63EE0587: "Cobalt Strike 4.8 (Feb 28, 2023)",
     0x64F88C5E: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x64F88C7E: "Cobalt Strike 4.9 (Sep 19, 2023)",
     0x64F88C9E: "Cobalt Strike 4.9 (Sep 19, 2023)",
     0x64F88CDE: "Cobalt Strike 4.9 (Sep 19, 2023)",
     0x6691500F: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x66915020: "Cobalt Strike 4.10 (Jul 16, 2024)",
     0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x66915024: "Cobalt Strike 4.10 (Jul 16, 2024)",
 }
 """ PE export timestamp to Cobalt Strike version mapping """
 

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/tests/conftest.py

@@ -19,6 +19,8 @@ beacons = {
     "c2test_beacon": "37882262c9b5e971067fd989b26afe28.bin.zip",
     # beacon with unicode in domain
     "punycode_beacon": "5a197a8bb628a2555f5a86c51b85abd7.bin.zip",
+    # guardrails protected beacon
+    "guardrails_beacon": "124552cf674b362e0c916ab79b9e7a56.bin.zip",
 }
 
 

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/tests/test_beacon.py

@@ -323,3 +323,45 @@ def test_beacon_setting_unknown_enum():
     config = beacon.BeaconConfig(data)
     assert None not in config.settings
     assert dict(config.settings) == {"BeaconSetting_6969": b"foo"}
+
+
+def test_beacon_dump_multiple_files(beacon_x86_path, beacon_x64_path):
+    proc = subprocess.run(
+        [sys.executable, "-m", "dissect.cobaltstrike.beacon", str(beacon_x86_path), str(beacon_x64_path)],
+        capture_output=True,
+    )
+    proc.check_returncode()
+    assert "9b9e85b111d9bef8d599905a06be0d207c388c4acaab8e74a01c04406fe26309" in proc.stdout.decode()
+    assert "71fab2149cbdce552f00e6d75372494d3f7755d366fd6849a6d5c9e0f73bc40f" in proc.stdout.decode()
+
+
+def test_beacon_dump_default_xor_keys_only(beacon_custom_xorkey_path):
+    # default behavior is to try all xor keys, and we should find a valid beacon
+    proc = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "dissect.cobaltstrike.beacon",
+            str(beacon_custom_xorkey_path),
+        ],
+        capture_output=True,
+    )
+    assert proc.returncode == 0
+    assert b"SETTING_PUBKEY = '36aff0b273cb7aa704e4219ad3be78defcc8c1d7ecb779d55f438e82c7138673'" in proc.stdout
+    proc.check_returncode()
+
+    # when we enable --default-xor-keys-only, we should not find a valid beacon
+    proc = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "dissect.cobaltstrike.beacon",
+            str(beacon_custom_xorkey_path),
+            "--default-xor-keys-only",
+        ],
+        capture_output=True,
+    )
+    assert proc.returncode == 1
+    assert b"No beacon configuration found" in proc.stderr
+    with pytest.raises(subprocess.CalledProcessError):
+        proc.check_returncode()

{dissect_cobaltstrike-1.2.1.dev8 → dissect_cobaltstrike-1.2.1.dev10}/tests/test_c2profile.py

@@ -395,3 +395,25 @@ def test_c2profile_beacon_gate():
     bconfig = beacon.BeaconConfig(data)
     profile = c2profile.C2Profile.from_beacon_config(bconfig)
     assert "stage.beacon_gate" not in profile.properties
+
+
+@pytest.mark.parametrize(
+    ("http_data_required",),
+    [
+        (True,),
+        (False,),
+    ],
+)
+def test_c2profile_http_data_required(http_data_required: bool):
+    data = beacon.Setting(
+        index=beacon.BeaconSetting.SETTING_HTTP_DATA_REQUIRED,
+        type=beacon.SettingsType.TYPE_SHORT,
+        length=0x2,
+        value=beacon.cs_struct.uint16(http_data_required).dumps(),
+    ).dumps()
+    bconfig = beacon.BeaconConfig(data)
+    profile = c2profile.C2Profile.from_beacon_config(bconfig)
+    if not http_data_required:
+        assert "http-beacon.data_required" not in profile.properties
+    else:
+        assert profile.properties["http-beacon.data_required"] == ["true"]

dissect_cobaltstrike-1.2.1.dev10/tests/test_guardrails.py

@@ -0,0 +1,60 @@
+import subprocess
+import sys
+
+import pytest
+
+from dissect.cobaltstrike.beacon import BeaconConfig
+from dissect.cobaltstrike.guardrails import GUARD_CONFIG_STARTS, c_guardrails
+
+
+def test_guard_config_start_size() -> None:
+    """Test that all GUARD_CONFIG_STARTS have the same length."""
+    sizes = map(len, GUARD_CONFIG_STARTS)
+    assert len(set(sizes)) == 1
+
+
+@pytest.mark.parametrize(
+    "guard_option,settings_type,length",
+    [
+        (c_guardrails.GuardOption.GUARD_USER, c_guardrails.SettingsType.TYPE_SHORT, 2),
+        (c_guardrails.GuardOption.GUARD_COMPUTER, c_guardrails.SettingsType.TYPE_SHORT, 2),
+        (c_guardrails.GuardOption.GUARD_DOMAIN, c_guardrails.SettingsType.TYPE_SHORT, 2),
+        (c_guardrails.GuardOption.GUARD_LOCAL_IP, c_guardrails.SettingsType.TYPE_INT, 4),
+    ],
+)
+def test_guard_config_start_settings(guard_option, settings_type, length) -> None:
+    """Test correctness of the known Guardrail start bytes by constructing the GuardrailSetting."""
+    guard_option_user = c_guardrails.GuardrailSetting(
+        option=guard_option,
+        type=settings_type,
+        length=length,
+        value=b"",  # ignored
+    ).dumps()
+    assert guard_option_user in GUARD_CONFIG_STARTS
+
+
+def test_beacon_dump_guardrails(guardrails_beacon_path):
+    proc = subprocess.run(
+        [sys.executable, "-m", "dissect.cobaltstrike.beacon", "-v", "-t", "normal", str(guardrails_beacon_path)],
+        capture_output=True,
+    )
+    proc.check_returncode()
+    stdout = proc.stdout
+    stderr = proc.stderr
+
+    assert b"Found guardrail payload xorkey: b'desktop-r4vgq8o'" in stderr
+    assert b"guardrail payload xor key = b'desktop-r4vgq8o'" in stdout
+    assert b"guardrail options = [<GuardOption.GUARD_COMPUTER: 6>, <GuardOption.GUARD_PAYLOAD_CHECKSUM: 9>]" in stdout
+
+
+def test_beacon_guardrails_metadata(guardrails_beacon_file, beacon_x64_file):
+    beacon = BeaconConfig.from_file(guardrails_beacon_file)
+    assert beacon.guardrails is not None
+    assert beacon.guardrails.payload_xor_key == b"desktop-r4vgq8o"
+    assert beacon.guardrails.settings[0].option == c_guardrails.GuardOption.GUARD_COMPUTER
+    assert beacon.guardrails.settings[1].option == c_guardrails.GuardOption.GUARD_PAYLOAD_CHECKSUM
+    assert beacon.guardrails.checksum == 0xA5AD1
+    assert beacon.guardrails.guardrail_xor_key == b"\x8a"
+
+    beacon = BeaconConfig.from_file(beacon_x64_file)
+    assert beacon.guardrails is None

dissect_cobaltstrike-1.2.1.dev8/dissect/cobaltstrike/_version.py

@@ -1,16 +0,0 @@
-# file generated by setuptools_scm
-# don't change, don't track in version control
-TYPE_CHECKING = False
-if TYPE_CHECKING:
-    from typing import Tuple, Union
-    VERSION_TUPLE = Tuple[Union[int, str], ...]
-else:
-    VERSION_TUPLE = object
-
-version: str
-__version__: str
-__version_tuple__: VERSION_TUPLE
-version_tuple: VERSION_TUPLE
-
-__version__ = version = '1.2.1.dev8'
-__version_tuple__ = version_tuple = (1, 2, 1, 'dev8')