/
hydra-cobaltstrike.c
126 lines (109 loc) · 3.4 KB
/
hydra-cobaltstrike.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#include "hydra-mod.h"
#define CSLEN 256
extern char *HYDRA_EXIT;
char *buf;
int32_t start_cobaltstrike(int32_t s, char *ip, int32_t port, unsigned char options, char *miscptr, FILE *fp) {
char *empty = "";
char *pass, buffer[4 + 1 + 256];
char cs_pass[CSLEN + 1];
unsigned char len_pass;
unsigned char reply_byte_0;
unsigned char reply_byte_1;
unsigned char reply_byte_2;
unsigned char reply_byte_3;
int32_t ret = -1;
if (strlen(pass = hydra_get_next_password()) == 0)
pass = empty;
if (strlen(pass) > CSLEN)
pass[CSLEN - 1] = 0;
len_pass = strlen(pass);
memset(cs_pass, 0, CSLEN + 1);
strcpy(cs_pass, pass);
memset(buffer, 0x41, sizeof(buffer));
buffer[0] = 0x00;
buffer[1] = 0x00;
buffer[2] = 0xBE;
buffer[3] = 0xEF;
memcpy(buffer + 4, &len_pass, 1);
memcpy(buffer + 5, cs_pass, len_pass);
if (hydra_send(s, buffer, sizeof(buffer), 0) < 0)
return 1;
reply_byte_0 = 0x00;
ret = hydra_recv_nb(s, &reply_byte_0, 1);
if (ret <= 0)
return 3;
reply_byte_1 = 0x00;
ret = hydra_recv_nb(s, &reply_byte_1, 1);
if (ret <= 0)
return 3;
reply_byte_2 = 0x00;
ret = hydra_recv_nb(s, &reply_byte_2, 1);
if (ret <= 0)
return 3;
reply_byte_3 = 0x00;
ret = hydra_recv_nb(s, &reply_byte_3, 1);
if (ret <= 0)
return 3;
if (reply_byte_0 == 0x00 && reply_byte_1 == 0x00 && reply_byte_2 == 0xCA && reply_byte_3 == 0xFE) {
hydra_report_found_host(port, ip, "cobaltstrike", fp);
hydra_completed_pair_found();
free(buf);
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return 2;
return 1;
}
free(buf);
hydra_completed_pair();
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return 2;
return 1;
}
void service_cobaltstrike(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
int32_t run = 1, next_run = 1, sock = -1;
int32_t mysslport = PORT_COBALTSTRIKE_SSL;
hydra_register_socket(sp);
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return;
while (1) {
switch (run) {
case 1: /* connect and service init function */
if (port != 0)
mysslport = port;
sock = hydra_connect_ssl(ip, mysslport, hostname);
port = mysslport;
if (sock < 0) {
hydra_report(stderr, "[ERROR] Child with pid %d terminating, can not connect\n", (int32_t)getpid());
hydra_child_exit(1);
}
next_run = start_cobaltstrike(sock, ip, port, options, miscptr, fp);
hydra_disconnect(sock);
break;
case 2: /* clean exit */
if (sock >= 0)
sock = hydra_disconnect(sock);
hydra_child_exit(0);
return;
case 3: /* clean exit */
if (sock >= 0)
sock = hydra_disconnect(sock);
hydra_child_exit(2);
return;
default:
hydra_report(stderr, "[ERROR] Caught unknown return code, exiting!\n");
hydra_child_exit(2);
}
run = next_run;
}
}
int32_t service_cobaltstrike_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
// called before the childrens are forked off, so this is the function
// which should be filled if initial connections and service setup has to be
// performed once only.
//
// fill if needed.
//
// return codes:
// 0 all OK
// -1 error, hydra will exit, so print a good error message here
return 0;
}