Closed nov3mb3r closed 9 months ago
There is an error once i try to run graphstrike.py. I have made sure that there is no changes to the original graphstrike.profile and made sure that all requirements are met. I am running both teamserver and graphstrike inside the same virtual env.
The error from graphstrike
The error output from teamserver
Hi there,
You can ignore the TS error shown in your second screenshot - this is expected as part of setup to make sure that GraphStrike.py can connect to the TS.
In regards to the real error/issue, you can modify the 'GetBeaconId' function within GraphStrike.py to print out what the real issue/result of trying to parse the beaconId is like so:
def GetBeaconId(metadata):
beaconId = None
output = subprocess.getoutput(metadataCommand + metadata).split()
print("\n".join(output)) # <------------------------------------------------------------ Add this line
for line in output:
if "bid:" in line:
beaconId = output[output.index(line) + 2]
# Make sure the metadata parser actually runs
if beaconId == None:
p_err("Cannot parse BeaconId: are you running in a venv / have you installed all dependencies?", True)
else:
return beaconId
The GetBeaconId function calls the external cs-decrypt-metadata.py script in order to parse the returned Beacon metadata; if this script fails or is inaccessible for any reason, you get the error shown in your first image. If you can provide more info from the cs-decrypt-metadata.py script I may be of further assistance.
This is the output upon changing the script with your suggestion
Input:
CJiEHXhRUOPpl01gMiNCjzyr-jrEW-SA_N4eb7pZCcqEWFnHonwGjp4BuUfdQYCCn-XN808FAkOfgt0Nq_3YdOdlnjJMmX7jMVGj_wZ0hBOFL7U4XfyAERy0sU-M93j7_kcmmzk985qRyMe5-aXxL4w9WRqJOMBOcT22l54lkk8
Encrypted
metadata:
0898841d785150e3e9974d603223428f3cabfa3ac45be480fcde1e6fba5909ca845859c7a27c068e9e01b947dd4180829fe5cdf34f0502439f82dd0dabfdd874e7659e324c997ee33151a3ff06748413852fb5385dfc80111cb4b14f8cf778fbfe47269b393df39a91c8c7b9f9a5f12f8c3d591a8938c04e713db6979e25924f
Decrypted
is
null!
[-] Cannot parse BeaconId: are you running in a venv / have you installed all dependencies?
The cs-decrypt-metadata.py script uses the '.cobaltstrike.beacon_keys' file that is found within the TS directory to decrypt the metadata. This file is generated if it doesn't already exist when the TS starts. The script will error / fail the way you have shown when it tries to decrypt Beacon metadata that was encrypted using a different '.cobaltstrike.beacon_keys' file.
I was able to reproduce your error with the following steps:
Did you happen to use multiple TS's at any point during your setup / use? That is most likely explanation, the second being that somehow your '.cobaltstrike.beacon_keys' file was deleted after a beacon had been executed / shown up in SharePoint.
In any case, for remediation I would recommend logging into your sharepoint site manually and deleting any created Beacon files up there. If you can't manage that, run the provisioner in delete mode to erase all of the azure assets and repeat the setup process.
If that doesn't resolve the issue I'm not sure what else could be going on.
There is an error once i try to run graphstrike.py. I have made sure that there is no changes to the original graphstrike.profile and made sure that all requirements are met. I am running both teamserver and graphstrike inside the same virtual env.
The error from graphstrike
The error output from teamserver
The requirements output