Didier Stevens

Friday 27 May 2022

PoC: Cobalt Strike mitm Attack

Filed under: Encryption,Hacking,Malware — Didier Stevens @ 0:00

I did this about 6 months ago, but this blog post didn’t get posted back then. I’m posting it now.

I made a small Proof-of-Concept: cs-mitm.py is a mitmproxy script that intercepts Cobalt Strike traffic, decrypts it and injects its own commands.

In this video, a malicious beacon is terminated by sending it a sleep command followed by an exit command. I just included the sleep command to show that it’s possible to do this for more than one command.

I selected this malicious beacon for this PoC because it uses one of the leaked private keys, enabling the script to decrypt the metadata and obtain the necessary AES and HMAC keys.

The PoC does not support malleable C2 data transforms, but the code to do this can be taken from my other cs-* tools.


  1. […] Didier StevensPoC: Cobalt Strike mitm Attack […]

    Pingback by Week 22 – 2022 – This Week In 4n6 — Sunday 29 May 2022 @ 4:20

  2. This xlsx-Version of BumbleBee (Abuse.ch a635b98a8c5fa3cac2deda41b9f9c5b04adf161901c8405b71208062104b895d) includes VBA and even a Userform. Why does Excel not recognize it and reject opening the file?

    Thank you!

    Comment by Anonymous — Monday 30 May 2022 @ 18:38

  3. I can open that file with Excel. What is your exact problem?

    Comment by Didier Stevens — Monday 30 May 2022 @ 19:41

RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.