Governments, vigilantes, and criminal hackers have a new way to disrupt botnets running the widely used attack software Cobalt Strike, courtesy of research published on Wednesday.
Cobalt Strike is a legitimate security tool used by penetration testers to emulate malicious activity in a network. Over the past few years, malicious hackers—working on behalf of a nation-state or in search of profit—have increasingly embraced the software. For both defender and attacker, Cobalt Strike provides a soup-to-nuts collection of software packages that allow infected computers and attacker servers to interact in highly customizable ways.
The main components of the security tool are the Cobalt Strike client—also known as a Beacon—and the Cobalt Strike team server, which sends commands to infected computers and receives the data they exfiltrate. An attacker starts by spinning up a machine running Team Server that has been configured to use specific “malleability” customizations, such as how often the client is to report to the server or specific data to periodically send.
Then the attacker installs the client on a targeted machine after exploiting a vulnerability, tricking the user or gaining access by other means. From then on, the client will use those customizations to maintain persistent contact with the machine running the Team Server.
The link connecting the client to the server is called the web server thread, which handles communication between the two machines. Chief among the communications are “tasks” servers send to instruct clients to run a command, get a process list, or do other things. The client then responds with a “reply.”
Feeling the squeeze
Researchers at security firm SentinelOne recently found a critical bug in the Team Server that makes it easy to knock the server offline. The bug works by sending a server fake replies that “squeeze every bit of available memory from the C2’s web server thread,” SentinelOne researcher Gal Kristal wrote in a post.
Kristal went on to write:
This would allow an attacker to cause memory exhaustion in the Cobalt Strike server (the “Teamserver”) making the server unresponsive until it’s restarted. This means that live Beacons cannot communicate to their C2 until the operators restart the server.
Restarting, however, won’t be enough to defend against this vulnerability as it is possible to repeatedly target the server until it is patched or the Beacon’s configuration is changed.
Either of these will make the existing live Beacons obsolete as they’ll be unable to communicate with the server until they’re updated with the new configuration. Therefore, this vulnerability has the potential to severely interfere with ongoing operations.
All that’s needed to perform the attack is to know some of the server configurations. These settings are sometimes embedded in malware samples available from services such as VirusTotal. The configurations are also obtainable by anyone with physical access to an infected client.
Black hats, beware
To make the process easier, Sentinel One published a parser that captures configurations obtained from malware samples, memory dumps, and sometimes the URLs that clients use to connect to servers. Once in possession of the settings, an attacker can use a communication module included with the parser to masquerade as a Cobalt Strike client that belongs to the server.
In all, the tool has:
- Parsing of a Beacon’s embedded Malleable profile instructions
- Parsing of a Beacon’s configuration directly from an active C2 (like the popular nmap script)
- Basic code for communicating with a C2 as a fake Beacon
The fake client can then send the server replies, even when the server sent no corresponding task first. A bug, tracked as CVE-2021-36798, in the Team Server software prevents it from rejecting replies that contain malformed data. An example is the data accompanying a screenshot the client uploads to the server.
“By manipulating the screenshot’s size we can make the server allocate an arbitrary size of memory, the size of which is totally controllable by us,” Kristal wrote. “By combining all the knowledge of Beacon communication flow with our configuration parser, we have all we need to fake a Beacon.”
While it’s true that exploits can be used against white hat and black hat hackers alike, the latter category is likely to be most threatened by the vulnerability. That’s because most professional security defenders pay for licenses to use Cobalt Strike, while many malicious hackers, by contrast, obtain pirated versions of the software.
A patch made available by Cobalt Strike creator HelpSystems will take time before it’s leaked to people pirating the software. It’s available to license holders now.
Listing image by Getty Images