# PyBeacon | A Collection Of Scripts For Dealing With Cobalt Strike Beacons In Python

**URL:** <https://onehack.st/t/pybeacon-a-collection-of-scripts-for-dealing-with-cobalt-strike-beacons-in-python/174393>\
**Category:** Tools & Scripts\
**Tags:** programming, privacy, data-recovery\
**Created:** [March 5, 2021, 10:03am UTC](https://onehack.st/t/pybeacon-a-collection-of-scripts-for-dealing-with-cobalt-strike-beacons-in-python/174393 "2021-03-05T10:03:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [March 5, 2021, 10:03am UTC](https://onehack.st/t/pybeacon-a-collection-of-scripts-for-dealing-with-cobalt-strike-beacons-in-python/174393/1 "2021-03-05T10:03:51Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/1/91c35b4d733b3e0a12872d5c033a67238f362b5d.jpeg)

# PyBeacon

PyBeacon is a collection of scripts for dealing with Cobalt Strike’s encrypted traffic.

It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings

# Scripts included

There is a small library which includes encryption/decoding methods, however some example scripts are included.

- stager-decode.py - this tool will simply decode a beacon DLL from a stager URL (you can use it to extract the public key).
- register.py - this tool deals with RSA encrypted metadata and can register a new (fake) beacon on a target Teamserver.
- tasktool.py - this tool deals with AES encrypted taskings to/from the teamserver. Use it to send callbacks to the teamserver, or for decoding taskings from a Teamserver to the beacon.
- ~~cs-3-5-rce.py - This is an implementation of the exploit used to exploit CS \< 3.5-hf1, which was used in the wild to hack Cobalt Strike servers. It works by registering a beacon with a directory traversal in the IP address field. It then subsequently registers a download callback which causes the “download” to be uploaded anywhere on the target file system. The ITW exploit used a cronjob to achieve RCE.~~

# TODO

- Add more task types to the task decoding logic
- Add decoding for beacon taskings. At the moment some “generic” logic is used, but it’s not really helpful

## GitHub:

> **[GitHub - nccgroup/pybeacon: A collection of scripts for dealing with Cobalt...](https://github.com/nccgroup/pybeacon)**
>
> A collection of scripts for dealing with Cobalt Strike beacons in Python