gloxec
commented
2 years ago CS4.0 ， 在LINUX下运行后，teamserver一直下面信息。
�[01;31m[-]�[0m Beacon entry did not validate internal address 'root' is not an address �[01;31m[-]�[0m Session 54323 -> Beacon @2383, 0ms metadata validation failed.
很明显，你使用了 cs4.x (>= 4.0) 的生成器版本
cs4.0 请使用 对应分支中的生成器： https://github.com/gloxec/CrossC2/tree/cs4.0/src 建议使用 >= cs4.1 版本，cs4.0对应版本已两年多未更新
CS4.0 ， 在LINUX下运行后，teamserver一直下面信息。
生成文件命令 ./genCrossC2.Linux XXXXXX 443 ./.cobaltstrike.beacon_keys ./rebind_x64.so Linux x64 t_cc2.out
启动teamsever时使用了demo中的httpprofile rebind.so使用了demo中的 c文件
'Host' = 'www.google.com' 'Referer' = 'https://www.google.com/' 'REMOTE_ADDRESS' = '/xxxxx' 'Connection' = 'close'
[01;31m[-][0m Beacon entry did not validate internal address 'root' is not an address [01;31m[-][0m Session 54323 -> Beacon @2383, 0ms metadata validation failed. Dropping [01;31m[-][0m A Malleable C2 attempt to recover data from a '.http-get.client.metadata' transaction failed. This could be due to a bug in the profile, a change made to the profile after this Beacon was run, or a change made to the transaction by some device between your target and your Cobalt Strike controller. The following information will (hopefully) help narrow down what happened.
From 'xxxxx' URI '/aaaaaaaaa'
Headers
'User-Agent' = 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1' 'Cookie' = 'SESSION=gt4gNaGtB0v9bkxvl9HDNSoPSBMm3QnA7VskDwWvsjI9aqtujTlFhaBYHAX9dfjltOsge9GteWr6B8th5dqioMBfhSFD/aQrr21IemajFzGH4GY2afovY+H7owI6Px90jFbqWJmtDl/CtqpZBwDY+g8a88VotvLUYk1BtfHVL+I=' 'Accept' = 'accccccc' 'Accept-Encoding' = 'gzip, br' 'Host' = 'www.google.com' 'Referer' = 'https://www.google.com/' 'REMOTE_ADDRESS' = '/xxxxx' 'Connection' = 'close'