SourcePoint v3.2 releases: polymorphic C2 profile generator for Cobalt Strike C2s

by do son · Published August 12, 2021 · Updated December 6, 2023

SourcePoint

SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written in Go. SourcePoint allows unique C2 profiles to be generated on the fly that helps reduce our Indicators of Compromise (“IoCs”) and allows the operator to spin up complex profiles with minimal effort. This was done by extensively reviewing Articles as well as Patch Notes to identify key functions and modifiable features. SourcePoint was designed with the intent of addressing the issue of how to make our C2 activity harder to detect, focusing on moving away from malicious IoCs to suspicious ones. The goal here is that it is harder to detect our C2 if our IoCs are not malicious in nature and require additional research to discover the suspicious nature. SourcePoint contains numerous different configurable options to choose from to modify your profile (in most cases if left blank SourcePoint will randomly choose them for you). The generated profiles modify all aspects of your C2. The goal of this project is to not only aid in circumventing detection-based controls but also help blend C2 traffic and activity into the environment, making said activity hard to detect.

Important

SourcePoint primarily automates the build process of a profile. It’s very important to know all the features modified in these profiles. Knowing these features can really help increase your success.

Options

While there are a lot of settings and features described in the help function of SourcePoint, there are numerous important features baked into each profile that are important to be familiar with. These features are:

Global Options

This part of your profile modifies how the beacon operators. Some of the features used to modify the behaviour are:

Host Stage – Allows the team server to host staged shellcode for HTTP, HTTPS, DNS. If this is enabled, anyone sending a GET request with a specific value such has /9ZXq can pull the shellcode as well
Sleep – The length of time that a beacon calls back home
Jitter – Appends a percentage to the beacon call home time
Useragent – The useragent string used when communicating HTTP and HTTPS traffic. Using the appropriate useragent string can help blend into the environment
Data Jitter – Adds a random-length string to all GET and POST requests to ensure incoming requests are not the same length
SMB Frame Header – Adds a header value to the SMB beacon messages
Pipename – Sets the name of the SMB pipe the beacons is going to use for communication
Pipename Stager – Sets the name of the SMB stager for the beacons
TCP Frame Header – Adds a header value to the TCP beacon messages
SSH Banner – The SSH banner used
SSH Pipename – The name used for the SSH banner

Stage

This part of your profile controls how beacon is loaded into memory and edit the content of the beacon DLL. Some of the features used to modify the behaviour are:

Obfuscate – Obfuscates the import table of the reflective DLL
Stomppe – Asks the payload to stomp MZ, PE and, e_lfanen values after loading
Clean up – Tells the beacon to free up memory assoicated with the refelctive DLL that initalized it
UseRWX – Ensures shellcode does not use Read, Write Execute permissions
Smart Inject – Uses embedded function pointer hints to bootstrap the beacon agent without walking kernel32 EAT
Sleep Mask – TCP and SMB beacons will obfuscate themselves at rest while they wait for the connection to be established
PE Header – Changes the characteristics of your beacon Reflective DLL to look like something else in memory
Transformation – Transform beacon’s Reflective DLL stage by removing or adding strings to the .rdata section

Process-Inject

This part of your profile controls how the beacon shapes injected content and controls process injection behavior. Some of the features used to modify the behaviour are:

Allocator – Determines how the beacon’s Reflective loader allocates memory
Minimum Allocation – Minimum amount of memory to request for injected content
Userwx – Ensures shellcode does not use Read, Write Execute permissions (The alternative is RW)
Startrwx – Use Read, Write Execute as initial permissions for injected content (The alternative is RW)
Transformer – Adds a block of padding content injected by the beacon
Execute – This section determines how to execute the injected code

Post-Exec

This part of your profile controls how the beacon handles post-exploitation modules and commands. Some of the features used to modify the behaviour are:

Spawnto – Determines the default temporary process beacon will spawn for its post-exploitation command and options
Obfuscate – Obfuscates the import table of the reflective DLL
Smart Inject – Pass key function pointers from beacon to its child jobs
AMSI disable – Disable AMSI for powerpick, execute-assembly, and psinject (Certain EDRs can detect this best avoid using these tools)
Keylogger – Determines how the keystroker logging API use to capture keystrokes

Profiles

Currently, SourcePoint provides you with 6 baked in options for HTTP/HTTPS traffic profiles, based on existing profiles. Of these 6, 4 of them are influenced by and based on:

Microsoft Window’s Update Communication
Slack’s Message Communication
Gotomeeting’s Active Meeting Communication
Microsoft Outlook’s Email Communication

2 of the profile options (5 and 6) are designed specifically for:

Cloudfront.net
AzureEdge.net

The last option (7) is designed to input a custom profile. This option is designed to allow an operator to utilize a completely custom traffic profile. There are many cases where a completely unique traffic profile will yield high success rather than one of these. This also allows operators to still utilize SourcePoint’s malleability features with their go-to or favorite traffic profile. As this allows for unique profiles it’s important to ensure you tweak and adjust the profile for SourcePoint to work. At a minimum:

Replace – header “Host” “acme.com”; with header “Host” “{{.Variables.Host}}”;
Replace – /pathtolegitpage/ under the GET field with {{.Variables.HTTP_GET_URI}}
Replace – /pathtolegitpage/ under the POST field with {{.Variables.HTTP_POST_URI}}

To do so, use the following options -CustomURI and -ProfilePath along with -Profile 7. While developing a profile, it’s highly recommended to use the native ./c2lint to verify everything is working.