Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Install CLI tool in the PATH #25

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Install CLI tool in the PATH #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
66cc9ec
Add entry-point to setup.py to make it easily installable
nbareil Dec 19, 2023
fbd8c84
Update the CLI name
nbareil Dec 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Python parser for CobaltStrike Beacon's configuration

## Description
Use `parse_beacon_config.py` for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode (default true).
Use `parse_beacon_config` for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode (default true).
Many stageless beacons are PEs where the beacon code itself is stored in the `.data` section and xored with 4-byte key.
The script tries to find the xor key and data heuristically, decrypt the data and parse the configuration from it.

Expand All @@ -12,7 +12,7 @@ The repo now also includes a small commuincation module (comm.py) that can help

## Usage
```
usage: parse_beacon_config.py [-h] [--json] [--quiet] [--version VERSION] beacon
usage: parse_beacon_config [-h] [--json] [--quiet] [--version VERSION] beacon

Parses CobaltStrike Beacon's configuration from PE, memory dump or URL.

Expand All @@ -28,4 +28,4 @@ optional arguments:

## Extra
To use the communication poc copy it to the main folder and run it from there.
For installing the M2Crypto library (a requirement for the poc) on Windows, it's easiest with installers found online, and not through pip.
For installing the M2Crypto library (a requirement for the poc) on Windows, it's easiest with installers found online, and not through pip.
5 changes: 4 additions & 1 deletion parse_beacon_config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,7 +528,7 @@ def parse_encrypted_config(self, version=None, quiet=False, as_json=False):
return self.parse_config(version=version, quiet=quiet, as_json=as_json)


if __name__ == '__main__':
def main():
parser = argparse.ArgumentParser(description="Parses CobaltStrike Beacon's configuration from PE, memory dump or URL.")
parser.add_argument("beacon", help="This can be a file path or a url (if started with http/s)")
parser.add_argument("--json", help="Print as json", action="store_true", default=False)
Expand Down Expand Up @@ -559,3 +559,6 @@ def parse_encrypted_config(self, version=None, quiet=False, as_json=False):

print("[-] Failed to find any beacon configuration")
exit(1)

if __name__ == '__main__':
main()
5 changes: 5 additions & 0 deletions setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@
long_description=long_description,
url="https://github.com/Sentinel-One/CobaltStrikeParser",
py_modules=["parse_beacon_config", "beacon_utils"],
entry_points = {
'console_scripts': [
'parse_beacon_config = parse_beacon_config:main',
],
},
install_requires=["urllib3",
"requests",
"netstruct==1.1.2",
Expand Down
Loading