1.1. 破解CS

原版:https://github.com/microidz/Cobaltstrike-Trial

校验:https://verify.cobaltstrike.com/

xor.bin:https://github.com/verctor/CS_xor64

1.1.1. 文件位置

common/License.class  # 修改时间及提示框
common/ArtifactUtils.class  # 去除后门特征指纹
server/ProfileEdits.class # 去除后门特征指纹
aggressor/dialogs/ListenerDialog.class  # 去除listener个数限制
aggressor/AggressorClient.class  # 标题栏修改,改变改吧
resources/template.x64.ps1、template.x86.ps1 # 去除后门特征指纹
resources/xor.bin  # 放入xor.bin文件
resources/xor64.bin  # 放入xor.bin文件

1.1.2. License.class

首先将cobaltstrike.jar以压缩包格式打开,复制License.class出来,然后运行jad.exe License.class,jad目录下就会生成License.jad,修改后缀为Java,即是源码文件了。

别用jad去反编译class,太坑了,就是因为这玩意儿,我搞了一下午,这玩意儿反编译出来的java,当你要给他编译成class的时候,可能会报错!!!建议用jd-gui

这里将提供两种破解思路。

  • (1) 直接修改试用时间
    private static long life = 21L;
    将21天的试用期修改成
    private static long life = 99999L;
  • (2) 修改isTrail的判断逻辑
     public static boolean isTrial()
     {
     return true;
     }
    修改成
     public static boolean isTrial()
     {
     return false;
     }

往下:

public static void checkLicenseGUI(Authorization auth)
{
 ....
}
修改成
public static void checkLicenseGUI(Authorization authorization)
{
}
同理
public static void checkLicenseConsole(Authorization authorization)

1.1.3. 去除listener个数限制

文件在aggressor/dialogs/ListenerDialog.class

去除

if(Listener.isEgressBeacon(payload) && DataUtils.isBeaconDefined(datal) && !name.equals(DataUtils.getEgressBeaconListener(datal)))
 {
 DialogUtils.showError("You may only define one egress Beacon per team server.\nThere are a few things I need to sort before you can\nput multiple Beacon HTTP/DNS listeners on one server.\nSpin up a new team server and add your listener there.");
 } else

1.1.4. 后门特征指纹

试用版本的Cobalt Strike有固定的指纹:

X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

存在后门特征指纹的其中几个地方

  • common/ArtifactUtils.class
packer.addString("X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
  • resources/template.x64.ps1、template.x86.ps1
$eicar = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
  • server/ProfileEdits.class
c2profile.addCommand(".http-get.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".http-post.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".http-stager.server", "!header", "X-Malware: X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".stage.transform-x86", "append", "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");
c2profile.addCommand(".stage.transform-x64", "append", "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*");

1.1.5. 编译成class

最后使用

javac -classpath cobaltstrike.jar xxxx.java

或者

javac -cp cobaltstrike.jar xxx.java

进行编译成class

1.1.6. 打包

将这些class全部打包成jar

jar cvfm xxx.jar ./META-INF/MANIFEST.MF ./

或者

使用解压工具打开jar包,然后将class放入对应位置替换原class即可

1.1.7. 参考

https://xz.aliyun.com/t/2170

https://www.cnblogs.com/ssooking/p/9825917.html

https://www.bilibili.com/video/av34171888/

https://github.com/Lz1y/cobalt_strike_3.12_patch

修改jar包内的class

Copyright © d4m1ts 2022 all right reserved,powered by Gitbook该文章修订时间: 2021-10-09 15:03:11

results matching ""

    No results matching ""