CVE-2022-39197 PoC — HelpSystems Cobalt Strike 跨站脚本漏洞

Source

https://github.com/xiao-zhu-zhu/pig_CS4.4

Associated Vulnerability

Title: HelpSystems Cobalt Strike 跨站脚本漏洞 (CVE-2022-39197)
Description:An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

Description

Cobalt Strike 4.4 猪猪版 去暗桩 去流量特征  beacon仿造真实API服务  修补CVE-2022-39197补丁

Readme

# 注：仅供安全研究与学习之用，若将工具做其他用途，由使用者承担全部法律及连带责任，作者及发布者不承担任何法律及连带责任。
# Cobalt Strike 4.4 猪猪版 该版本为预发布内测版本,公开版本即将在五月底发布

1. 去暗桩
2. 更改认证头 COOKIE改为Authentication
3. 更改get请求 与POST请求地址
4. 使用geacon二次开发版 替换beacon,可实现免杀(实测火绒 360). 大概五月底发布 
5. 更改为json相应包和请求包
6. CVE-2022-39197补丁
7. 修改ja3和ja3s特征 


<img width="1181" alt="图片" src="https://user-images.githubusercontent.com/85468097/235074292-9c97b351-9965-42b6-a814-8925fba91275.png">

<img width="1650" alt="图片" src="https://user-images.githubusercontent.com/85468097/235079070-ffd989ec-059f-47bd-bccf-0ad9d9b40032.png">

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →