> For the complete documentation index, see [llms.txt](https://wbglil.gitbook.io/cobalt-strike/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-yuan-li-jie-shao/payload-sheng-cheng.md).

# Payload生成分析

## 分阶段payload

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFYffkKXK4u5W6W-5gD%2F-MFYgUjmOnqxdGSOdpZm%2Fimage.png?alt=media\&token=3aca358f-d3d5-4129-bc3a-98adb6445625)

aggressor\dialogs\WindowsExecutableDialog.class

![生成stager shellcode](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFYffkKXK4u5W6W-5gD%2F-MFYgMWscRzAARkQEjRt%2Fimage.png?alt=media\&token=b196ef1a-222a-495e-8f49-5b8d84857b29)

shellcode具体的生成和混淆过程可以自己跟一下getPayloadStrager这个方法(后边有一个混淆的算法)

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFYffkKXK4u5W6W-5gD%2F-MFYgz6gVgcex0DneLx_%2Fimage.png?alt=media\&token=ee997512-1669-4462-b281-263f64c218cd)

把生成好的stager shellcode根据生成类型嵌入到不同的PE文件中然后保存到文件

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFYffkKXK4u5W6W-5gD%2F-MFYmKay37W3eSaCheao%2Fimage.png?alt=media\&token=47dc34c5-5b78-4b69-a307-32116e7bd0ad)

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFYffkKXK4u5W6W-5gD%2F-MFZ8vUPRBxQjvARs_-1%2Fimage.png?alt=media\&token=95d51bee-d540-4e6c-8779-665a56134daa)

读取PE资源添加shellcode(这里还有一个试用版遗留问题)然后修正PE校验码最后保存到文件

这里就是被替换的地方

![大小一共是1024个字节对于一个stager是绰绰有余](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZGNpauqxLAaHyk-y2%2F-MFZGmB_47ZgTvq9Tz-h%2Fimage.png?alt=media\&token=c56943e0-8b5a-4efd-91ff-294ade73b70f)

修补前后对比

![PE校验码](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZMLl9iAOtsoYTEA54%2F-MFZOIAP8PdPoJo60N8n%2Fimage.png?alt=media\&token=33177540-fc86-4a20-a58d-28775812b2f4)

![shellcode填充](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZMLl9iAOtsoYTEA54%2F-MFZO4ZfYHaS5XpgcP_p%2Fimage.png?alt=media\&token=180053e3-5638-42b1-be91-7240c61278fa)

其他分阶段payload生成过程大同小异没啥区别包括

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZLH-qMi0Zzv09Izmz%2F-MFZLr7Qy_O7N_BJ6RHy%2Fimage.png?alt=media\&token=856d414c-5195-407b-97d1-6813acf89cd8)

Payload Generator生成的都是stager shellcode，基本也是这个过程只不过没有嵌入到PE中

## 无阶段Payload生成过程

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZOkCTzH4rvCMyuKQs%2F-MFZzmsplxxGP50sUHzN%2Fimage.png?alt=media\&token=86f81ea1-64b9-4fd3-8a99-cb7ea61089aa)

无阶段payload生成过程基本上也没太大区别

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZOkCTzH4rvCMyuKQs%2F-MFZQh2Qkbt9kAlUhhWL%2Fimage.png?alt=media\&token=41cd250e-b5d5-4a03-858d-558c14d0fadb)

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZOkCTzH4rvCMyuKQs%2F-MFZSmzWiPuE0BZg9qEe%2Fimage.png?alt=media\&token=e526c876-1f99-4fb5-8d98-f02f2daf4a2f)

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZOkCTzH4rvCMyuKQs%2F-MFZUr6VdUh1-g5dN3XV%2Fimage.png?alt=media\&token=bab6c59f-5117-450d-a47a-fbafff0471e8)

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MFZOkCTzH4rvCMyuKQs%2F-MFZWdiaZM3h3f6Q5EME%2Fimage.png?alt=media\&token=5e487e3f-771a-441a-b9a4-4261a4154cb6)

![](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MF_22S5S849Ni9FbHUa%2F-MF_24bumZo6n07ntJmT%2Fimage.png?alt=media\&token=5f7f07d8-0ee2-48f4-b99f-d77f581f0944)

大致流程就是读取Beacon.dll，解密完成进行修补然后使用相同的方法将其嵌入到PE中。

![对比修补前后右为原始Beacon.dll，左为修补后](https://3226329500-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MDZyrMxFR2BnFjV82cS%2F-MF_-OeWMBxzsWJYbzYi%2F-MF_01WKS_H4Q8s8FFlx%2Fimage.png?alt=media\&token=83c6804d-f2ec-4656-8411-80af8b4eb057)

比对修补前后时，导出格式请选择RAW格式。整体来说Beacon修补了三个地方**PE头**，**Malleable C2通信规则**，**Malleable C2后渗透规则**

4.x与3.x不同的是多了一个资源解密，在3.x时所有资源都是放在resources文件夹内，在4.x后Cobalt Strike将加密的资源都放在了sleeve文件夹内，还有一些不同的是，无阶段payload生成增加了powershell和raw两种格式。至于具体怎么修补通信规则和后渗透规则的自己读一下相关代码吧