[Backup] How Did I Take Over CobaltStrike Servers

Hi folks, today I would like to share how I take over some Cobalt Strike TeamServers
with Quake and Password Spray Attack. From the perspective of a threat hunter, it is
good to track C2 servers on the Internet. From the perspective of a hacker, it is good to
compromise a host, but it is better to compromise a C2 team server and then take over
all compromised hosts connected to the team server : D

Recon
Before exploitation, we need to recon. Here I use Quake(https://quake.360.net) to
find a list of Cobalt Strike with weak credentials. Quake is something which is similar
to Shodan. The query sentence should be response:“\x00\x00\xca\xfe” AND port:
“50050”
What does it mean? Quake will try some very simple passwords to connect to Cobalt
Strike Team Server. If the authentication is successful, Cobalt Strike Team Server will
return “\x00\x00\xca\xfe” in response. According to search results, there are 417
records, 191 unique IPs currently. Of course, if you do not specify the default port, you
could get more results. To get complete and detailed information, a subscription of
Quake is recommended.

After getting these results, then export IP of these Team Servers as a file. So, let’s use
Password Spray Attack against these Team Servers!

Exploitation

Just a disclaimer, it is unethical and even illegal to actually take over those Team Servers. The article is just a proof of concept, it does not encourage anyone to pwn those servers, even they may belong to unethical hackers.
Because Cobalt Strike Team Server has rate limit, it is not wise to brute force a single
Team Server with a big password list. Instead, we can use spray a single simple
password to a list of Team Servers.
I download and modify a script from https://github.com/ryanohoro/csbruter to
enable it to launch Password Spray Attack.

Oh, among these 158 Team Servers, 24 of them use the same simple password! Just
select one and try to log in!

Oh no! The version of your client should match target Team Server’s! Actually most of
these Team Servers’ version are 4.0 lol.

Try another one, cool, there are a lot of bots controlled by the Team Server! By this way we
are able to successfully find and take over some Cobalt Strike Team Servers!

Tips
The list I used is absolutely not an exhaustive list of Team Server with a weak
password. If you want to find more Team Servers with a weak password, here are some
tips
1: Remove the specified port and modify the script.
2: If a Team Server does not show up in previous search results, it does not mean the
Team Server has a strong password, since Quake will only try some simplest
passwords like 123123, 123456, password, etc.
3: Just try different fingerprinting methods to get a large list of Cobalt Strike Team
Servers, and then spray a single simple password to them. If you are lucky, you will
take over many Team Servers from the list : P
Thanks for reading! Happy hacking!