Modify included C2 profile from GET-only to GET/POST
Opened this issue · 1 comments
Awesome work by the team and thanks for sharing. I was able to get full functionality with my beacons after slight modification to the included C2 profile.
I'd like to recommend modifying your included profile to use GET and POST verbs to avoid incredibly slow beacons. The GET-only C2 ability within Cobalt Strike is a nice feature and can add an additional layer of stealth, but it's not extremely practical if you plan to use Beacon in an interactive manner. From my observations with BurpSuite, it would take over 30 minutes to obtain a full response from a Beacon command resulting in just 50kb of data. Upon issuing commands like "screenshot", "download", or "socks" beacons sometimes appear to "hang" with the GET only C2 profile until they slowly return all their data in 128 byte chunks.
Otherwise, I'd recommend simply adding a note in the README and/or original blog post explaining the difference operators might experience vs a typical GET/POST C2 profile to prevent any head scratching. A GET-only profile could still be practical on a mid-tier to long-haul Team Server with little operator interaction.
If I'm missing something obvious here, please let me know!
Would be glad if the info got added to readme.
Also would like to see some sample usage on the project...
Thanks @andrewchiles