first commit

.github/workflows/package.yml

@@ -0,0 +1,32 @@
+name: Package
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  release:
+    types: [published]
+
+jobs:
+  deploy:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.x'
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install tox
+    - name: Build package via tox
+      run: tox -e build
+    - name: Upload artifacts
+      uses: actions/[email protected]
+      with:
+        name: dist-files
+        path: dist/*  

.github/workflows/tests.yml

@@ -0,0 +1,36 @@
+# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
+# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
+
+name: Tests
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.6", "3.7", "3.8", "3.9", "3.10", "3.11-dev"]
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install tox
+    - name: Lint via tox
+      run: |
+        tox -e lint
+    - name: Test via tox
+      run: |
+        tox -e py3

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+repos:
+  - repo: https://github.com/psf/black
+    rev: 22.1.0
+    hooks:
+    - id: black
+      language_version: python3
+  - repo: https://gitlab.com/pycqa/flake8
+    rev: 4.0.1
+    hooks:
+      - id: flake8

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 NCC Group, Fox-IT
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

MANIFEST.in

@@ -0,0 +1,3 @@
+# Exclude some dirs from the release package
+prune tests/beacons
+prune tests/profiles

README.rst

@@ -0,0 +1,73 @@
+Dissecting Cobalt Strike using Python
+=====================================
+
+**dissect.cobaltstrike** is a Python library for dissecting and parsing Cobalt Strike related data such as beacon payloads and Malleable C2 Profiles.
+
+Installation
+------------
+
+The library is available on PyPI. Use ``pip`` to install it::
+
+    $ pip install dissect.cobaltstrike
+
+**dissect.cobaltstrike** requires Python 3.6 or later.
+
+Documentation
+-------------
+
+The project documentation can be found here: https://dissect-cobaltstrike.readthedocs.io
+
+Basic Usage
+-----------
+
+Load a beacon and access some properties and settings:
+
+.. code-block:: python
+
+    >>> from dissect.cobaltstrike.beacon import BeaconConfig
+    >>> bconfig = BeaconConfig.from_path("beacon.bin")
+    >>> bconfig.version
+    <BeaconVersion 'Cobalt Strike 4.2 (Nov 06, 2020)', tuple=(4, 2), date=2020-11-06>
+    >>> hex(bconfig.watermark)
+    '0x5109bf6d'
+    >>> bconfig.protocol
+    'https'
+    >>> bconfig.settings
+    mappingproxy({'SETTING_PROTOCOL': 8,
+                  'SETTING_PORT': 443,
+                  'SETTING_SLEEPTIME': 5000,
+                  'SETTING_MAXGET': 1048576,
+                  'SETTING_JITTER': 0, ...
+    >>> bconfig.settings["SETTING_C2_REQUEST"]
+    [('_HEADER', b'Connection: close'),
+     ('_HEADER', b'Accept-Language: en-US'),
+     ('BUILD', 'metadata'),
+     ('MASK', True),
+     ('BASE64', True),
+     ('PREPEND', b'wordpress_ed1f617bbd6c004cc09e046f3c1b7148='),
+     ('HEADER', b'Cookie')]
+
+Loading Malleable C2 Profiles and access settings:
+
+.. code-block:: python
+
+    >>> from dissect.cobaltstrike.c2profile import C2Profile
+    >>> profile = C2Profile.from_path("amazon.profile")
+    >>> profile.as_dict()
+    {'sleeptime': ['5000'],
+     'jitter': ['0'],
+     'maxdns': ['255'],
+     'useragent': ['Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'],
+     'http-get.uri': ['/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'],
+     'http-get.client.header': [('Accept', '*/*'), ('Host', 'www.amazon.com')],
+     ...
+    }
+    >>> profile.properties["useragent"]
+    ['Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko']
+    >>> profile.properties["http-get.uri"]
+    ['/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books']
+
+License
+-------
+
+**dissect.cobaltstrike** is developed and distributed under the MIT license.