RedSiege / C2concealer

C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.
GNU General Public License v3.0
985 stars 169 forks source link

Powershell HTTPS reverse shell Exception #2

Closed djerryz closed 4 years ago

djerryz commented 4 years ago

EXECUTE POWERSHELL: image

CS LISTENER: image

Nginx:

server {
    listen 443 ssl;
    root /var/www/html/;
    index index.html;
    charset utf-8;
    server_name xxxxxxxxx;
    ssl_certificate  /etc/nginx/sites-available/csserver.crt;
    ssl_certificate_key /etc/nginx/sites-available/csserver_nopass.key;
    location / {
        try_files $uri $uri/ @c2;
    }
    location @c2 {
        proxy_pass https://172.17.0.2:444;
        proxy_redirect off;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}
djerryz commented 4 years ago

IF start teamserver without use profile , it's normal with not exception

Also try variant_2,variant_1,default, if start teamserver with profile which create by c2concealer it will be exception.

But http reverse shell is okay.

ChrisTruncer commented 4 years ago

We haven't run into an issue with reverse https stagers, as of yet. Unfortunately, we don't have enough information based on your report to recreate the issue. Can you paste the actual (and full) PowerShell error that you are receiving vs only part of it? Can you try running the stager command manually on the command line and post the error?

djerryz commented 4 years ago

Hello, i try to rebuild profile again with level 5, and everything is fine, Thank you❤❤❤