Tylous / SourcePoint

SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.
1.01k stars 150 forks source link

[Bug] When specifying self-signed cert, does not write the correct header for "https-certificate" #12

Closed AnubisSec closed 2 years ago

AnubisSec commented 2 years ago

Everything works great, I love this tool. The only issue is that when you don't specify a keystore for the certificate, the header for the section of "https-certificate" isn't written to the final profile.

The following command: SourcePoint -Injector VirtualAllocEx -Jitter 21 -Keylogger SetWindowsHookEx -PE_Clone 24 -PostEX_Name 17 -Outfile deez.profile -Host www.bing.com -Profile 2

Results in the following last 20 lines of the profile

$ tail -20 deez.profile

header "Cache-Control" "private, no-cache, no-store, must-revalidate";
header "X-Frame-Options" "SAMEORIGIN";
header "Vary" "Accept-Encoding";
header "X-Via" "haproxy-www-suhx";

}

}

set CN       "www.bing.com"; #Common Name
set O        "Slack Technologies Inc"; #Organization Name
set C        "US"; #Country
set L        "San Francisco"; #Locality
set OU       "DigiCert Inc"; #Organizational Unit Name
set ST       "CA"; #State or Province
set validity "365"; #Number of days the cert is valid for
}
        %

Note, right about set CN there is no https-certificate { as there should be

Tylous commented 2 years ago

Yes that is a odd logic bug I will have to look into

Tylous commented 2 years ago

This has been fixed in v2.3.

AnubisSec commented 2 years ago

Not sure if this will actually alert you to a new message, but if it does, there is still some weirdness with it, which is the same as the fix for this, but the \r before set needs to be changed to \n as well.

I can always do a PR if that's easier :)

Tylous commented 2 years ago

the \n was causing the issue you originally reported. Are you still experiencing it?

AnubisSec commented 2 years ago

Yeah so there is just one other \n that is causing issues on MacOS seen below (one being the original file and one being the lib I updated to fix it): image

image