Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adapt to new Cobalt Strike download names, executables, and install locations #87

Merged
merged 4 commits into from
Aug 14, 2024
Merged

Adapt to new Cobalt Strike download names, executables, and install locations #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
30d9725
Account for new names for Cobalt Strike archives
jsf9k Aug 14, 2024
2b3dd93
Adapt to new location of Cobalt Strike auth file
jsf9k Aug 14, 2024
7eca9f8
Adapt to new location of Cobalt Strike teamserver executable
jsf9k Aug 14, 2024
0c08b1e
Upgrade minimum version to match what is currently being installed
jsf9k Aug 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions molecule/default/tests/test_default.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
from strip_ansi import strip_ansi
import testinfra.utils.ansible_runner

min_expected_version = semver.VersionInfo.parse("4.8.0")
min_expected_version = semver.VersionInfo.parse("4.10.0")
expected_licensed_value = "Licensed"

testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
Expand All @@ -22,7 +22,7 @@
"f",
[
"/opt/cobaltstrike",
"/opt/cobaltstrike/cobaltstrike.auth",
"/opt/cobaltstrike/client/cobaltstrike.auth.client",
"/opt/cobaltstrike/update",
],
)
Expand All @@ -39,7 +39,7 @@ def test_files2(host, f):

def test_version_and_license(host):
"""Verify that Cobalt Strike is licensed and is an expected version."""
cmd = host.run("cd /opt/cobaltstrike && ./teamserver")
cmd = host.run("cd /opt/cobaltstrike/server && ./teamserver")
regex = (
r"^\[\*\] Team Server Version: (?P<version>(\d+)(\.\d+){1,2}) (?P<licensed>.*)$"
)
Expand Down
12 changes: 6 additions & 6 deletions tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Check if Cobalt Strike is already installed in the expected place
- name: Check if Cobalt Strike is already installed and licensed
ansible.builtin.stat:
path: /opt/cobaltstrike/cobaltstrike.auth
path: /opt/cobaltstrike/client/cobaltstrike.auth.client
register: cobaltstrike_auth

- name: Install and license Cobalt Strike
Expand Down Expand Up @@ -35,23 +35,23 @@

- name: Set CobaltStrike token fact
ansible.builtin.set_fact:
cobaltstrike_token_content: "{{ cobaltstrike_token.content | regex_search('href=\"/downloads/(.+)/cobaltstrike-dist.zip\"', '\\1') | first }}"
cobaltstrike_token_content: "{{ cobaltstrike_token.content | regex_search('href=\"/downloads/(.+)/cobaltstrike-dist-windows.zip\"', '\\1') | first }}"

- name: Extract the download token and download the Cobalt Strike tarball
ansible.builtin.get_url:
dest: /tmp
mode: "0644"
url: "https://download.cobaltstrike.com/downloads/{{ cobaltstrike_token_content }}/cobaltstrike-dist.tgz"
url: "https://download.cobaltstrike.com/downloads/{{ cobaltstrike_token_content }}/cobaltstrike-dist-linux.tgz"

- name: Extract the Cobalt Strike tarball
ansible.builtin.unarchive:
dest: /opt
remote_src: true
src: /tmp/cobaltstrike-dist.tgz
src: /tmp/cobaltstrike-dist-linux.tgz

- name: Delete remote copy of Cobalt Strike tarball
ansible.builtin.file:
path: /tmp/cobaltstrike-dist.tgz
path: /tmp/cobaltstrike-dist-linux.tgz
state: absent

#
Expand Down Expand Up @@ -128,7 +128,7 @@
}
args:
chdir: /opt/cobaltstrike
creates: /opt/cobaltstrike/cobaltstrike.auth
creates: /opt/cobaltstrike/client/cobaltstrike.auth.client
executable: /usr/bin/expect
failed_when: expect.rc != 0
# The CS license key is sensitive
Expand Down
Loading