Summary
There is a remote code execution vulnerability in the Cobalt Strike team server.
A hot fix that breaks this particular exploit chain is available.
Customers may use the built-in update program to download an update with this hotfix. The latest trial download has this hotfix as well.
Strategic Cyber LLC is working on a comprehensive update for this issue. This comprehensive update will be available as soon as possible.
Update 29 Sept 2016: A second hot fix is available. The original hot fix was scoped to the reported attack chain. This second hot fix provides broader protection against the reported attack chain and potential variants. Cobalt Strike users are urged to update to the second hot fix until the comprehensive update is available.
Update 3 Oct 2016: Cobalt Strike 3.5.1 is now available. This release restores functionality degraded by the Hot Fixes for this vulnerability, improves on Hot Fix 2’s measures, and hardens the Cobalt Strike team server against this vulnerability and potential variants. This is the comprehensive update to address this vulnerability and its variants.
What happened?
Strategic Cyber LLC received a report with suspicious indicators of active exploitation from a third-party. Strategic Cyber LLC investigated the indicators and determined that the likelihood of a remote code execution vulnerability is high.
The Vulnerability
The vulnerability is a directory traversal attack allowed by improper sanitization of parameters in the file download feature of the Beacon and SSH session payloads.
One may connect to a Cobalt Strike listener, download the payload stage, use the information in the stage to fake a session, and craft a message to force Cobalt Strike to write a file to an arbitrary location.
Potential Indicators of Compromise
These are the indicators that may indicate an exploitation attempt:
1. a GET to /aaaa was one of the reported indicators. While this is a valid URI to grab a payload stage–Cobalt Strike randomizes this URI when it downloads a payload stage.
2. The activity report showed downloads of .config, /etc/crontab, and /etc/cron.d/.hourly.
3. The reporter states that the attacker cleared logs from the server, cleared the downloaded files, and cleared the Cobalt Strike data model and log files.
Steps to Mitigate
Trial users: download the trial for Cobalt Strike 3.5.1.
Customers: run the built-in update program to update to Cobalt Strike 3.5.1.
If you have Beacons that are already deployed with Cobalt Strike 3.5, 3.5-hf1 or 3.5-hf2, you may update to this release without affecting them. The fix is entirely in the controller.
To verify that you have the hot fix, go to Help -> System Information. Cobalt Strike will report its version as 20161003. Help -> About will state 3.5.1.
What’s affected?
All versions of Cobalt Strike 3.5 and below (without the hotfix) are affected.
It’s likely this issue also exists in the deprecated Cobalt Strike 2.x and below as well.
What’s next?
Strategic Cyber LLC will issue a comprehensive fix for this issue as soon as possible. As more information is available, Strategic Cyber LLC will post it to two places:
1. Updates to this blog post.
2. Emails will also go out to the Cobalt Strike Technical Notes mailing list.
POC
Raphael Mudge, Strategic Cyber LLC
[email protected]
Changelog
3 October 2016, 9:05am EST – Announce Cobalt Strike 3.5.1
29 September 2016, 5:45pm EST – Announce Hot Fix 2
28 September 2016, 7:05pm EST – Initial Announcement