CobaltStrike 4.3 破解修复暗桩

关键词: CobaltStrike

记录过程，自己动手，丰衣足食

破解目标

替换authkey.pub文件
修改源码中authkay.pub的md5值
修改过期时间
修复becon/BeaconData.class中暗桩

破解第一步，反编译,Reserve_Cobalt_src目录需自行创建，否则会报目录不存在错误，出现其他错误更换Java版本，比如

Error: A JNI error has occurred, please check your installation and try again

使用Idea自带的反编译工具

java -cp "C:\Program Files\JetBrains\IntelliJ IDEA 2021.1.1\plugins\java-decompiler\lib\java-decompiler.jar" org.jetbrains.java.decompiler.main.decompiler.ConsoleDecompiler -dgs=true cobaltstrike.jar Reserve_Cobalt_src

破解第二步

新建Idea项目-导入原版cobaltstrike.jar和反编译的源码。结构如下

/images/CobaltStrike-2021-0501/Untitled.png

lib中使用原版

Reserve_Cobalt_src中存放反编译源码

src中存放修改过后的源码，建议使用到什么源码文件，从Reserve文件夹中拷贝重构，不然所有代码中有因Java版本及语法兼容问题导致构建不通过

破解第三步：

修改文件→项目结构如下

/images/CobaltStrike-2021-0501/Untitled%201.png

/images/CobaltStrike-2021-0501/Untitled%202.png

修改运行配置

/images/CobaltStrike-2021-0501/Untitled%203.png

破解第四步

从反编译源码中获取如下java源文件放入src目录，目录对应好

/images/CobaltStrike-2021-0501/Untitled%204.png

破解第五步

快去看破解原理？

破解原理及加密算法分析参考

https://rcoil.me/2020/11/【知识回顾】Cobalt Strike 4.0认证及修补过程/

使用其代码

package KeyGen;

import common.CommonUtils;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import java.io.*;
import java.security.*;
import java.util.Base64;

public class RSAKeyPairGenerator {
    private PrivateKey privateKey;
    private PublicKey publicKey;

    public RSAKeyPairGenerator() throws NoSuchAlgorithmException {
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
        keyGen.initialize(2048);
        KeyPair pair = keyGen.generateKeyPair();
        this.privateKey = pair.getPrivate();
        this.publicKey = pair.getPublic();
    }

    // 将byte 写入文件
    public void byte2File(String path, byte[] data) throws IOException {
        File f = new File(path);
        f.getParentFile().mkdirs();

        FileOutputStream fos = new FileOutputStream(f);
        fos.write(data);
        fos.flush();
        fos.close();
    }

    public PrivateKey getPrivateKey() {
        return privateKey;
    }

    public PublicKey getPublicKey() {
        return publicKey;
    }

    // 加密数据
    public byte[] encryptPri(byte[] data, PrivateKey privateKey) throws BadPaddingException, IllegalBlockSizeException, InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException {
        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.ENCRYPT_MODE, this.privateKey);
        return cipher.doFinal(data);
    }

    public static void main(String[] args) throws NoSuchAlgorithmException, IOException, IllegalBlockSizeException, InvalidKeyException, NoSuchPaddingException, BadPaddingException {
        RSAKeyPairGenerator PairGenerator = new RSAKeyPairGenerator();
        byte[] data = { -54, -2, -64, -45, 0, 43, 1, -55, -61, 127, 0, 0, 34, -112, 127, 16, 27, -27, -66, 82, -58, 37, 92, 51, 85, -114, -118, 28, -74, 103, -53, 6 };
        byte[] rsaByte = PairGenerator.encryptPri(data, PairGenerator.getPrivateKey());
        PairGenerator.byte2File("RSA/cobaltstrike.auth", rsaByte);
        PairGenerator.byte2File("RSA/authkey.private", PairGenerator.getPrivateKey().getEncoded());
        PairGenerator.byte2File("RSA/authkey.pub", PairGenerator.getPublicKey().getEncoded());
        byte[] var1 = CommonUtils.readAll(CommonUtils.class.getClassLoader().getResourceAsStream("resources/authkey.pub"));
        byte[] var2 = CommonUtils.MD5(var1);
        CommonUtils.toHex(var2);
        System.out.println(CommonUtils.toHex(var2)); //此处打印md5值
    }
}