I did this about 6 months ago, but this blog post didn’t get posted back then. I’m posting it now.
I made a small Proof-of-Concept: cs-mitm.py is a mitmproxy script that intercepts Cobalt Strike traffic, decrypts it and injects its own commands.
In this video, a malicious beacon is terminated by sending it a sleep command followed by an exit command. I just included the sleep command to show that it’s possible to do this for more than one command.
I selected this malicious beacon for this PoC because it uses one of the leaked private keys, enabling the script to decrypt the metadata and obtain the necessary AES and HMAC keys.
The PoC does not support malleable C2 data transforms, but the code to do this can be taken from my other cs-* tools.
Didier Stevens 
[…] Didier StevensPoC: Cobalt Strike mitm Attack […]
Pingback by Week 22 – 2022 – This Week In 4n6 — Sunday 29 May 2022 @ 4:20
This xlsx-Version of BumbleBee (Abuse.ch a635b98a8c5fa3cac2deda41b9f9c5b04adf161901c8405b71208062104b895d) includes VBA and even a Userform. Why does Excel not recognize it and reject opening the file?
Thank you!
Comment by Anonymous — Monday 30 May 2022 @ 18:38
I can open that file with Excel. What is your exact problem?
Comment by Didier Stevens — Monday 30 May 2022 @ 19:41