v1.2.1

[yunzheng]

This v1.2.1 release mainly brings support for dumping beacons protected with guardrails. It can automatically deduce the environmental key and decrypt the protected beacon config. Example:

$ beacon-dump -v 124552cf674b362e0c916ab79b9e7a56.bin
2025-03-25 15:17:14,318 INFO root: Processing: '124552cf674b362e0c916ab79b9e7a56.bin'
2025-03-25 15:17:14,869 INFO dissect.cobaltstrike.guardrails: Found guardrail config at offset: 320138 in <_io.BufferedReader name='124552cf674b362e0c916ab79b9e7a56.bin'>
2025-03-25 15:17:14,893 INFO dissect.cobaltstrike.guardrails: Found guardrail payload xorkey: b'desktop-r4vgq8o'
...
--------------------------------------------------
pe_export_stamp = 1720799264, 0x66915020, Fri Jul 12 17:47:44 2024 - Cobalt Strike 4.10 (Jul 16, 2024)
pe_compile_stamp = 1720799264, 0x66915020, Fri Jul 12 17:47:44 2024
max_setting_enum = 78 - BeaconSetting.SETTING_BEACON_GATE
beacon_version = Cobalt Strike 4.10 (Jul 16, 2024)
guardrail payload xor key = b'desktop-r4vgq8o'
guardrail options = [<GuardOption.GUARD_COMPUTER: 6>, <GuardOption.GUARD_PAYLOAD_CHECKSUM: 9>]

Also, some small quality of life changes were made to beacon-dump:

• You can now specify more than one beacon file to dump, useful for shell globbing, e.g.: beacon-dump -v beacons/*.bin
• It will now try all single byte XOR keys by default, this deprecates the --all flag and introduces --default-xor-keys-only.

Furthermore, the beacon version identification support is now up to Cobalt Strike v4.10.1 and the identification table can now also be found in the documentation for reference.

What's Changed

• Fix BeaconSetting names with unknown values by @yunzheng in Fix BeaconSetting names with unknown values #64
• Speed up beacon file reading from zip files in tests by @yunzheng in Speed up beacon file reading from zip files in tests #65
• Add version detection for Cobalt Strike 4.9 and 4.10 by @yunzheng in Add version detection for Cobalt Strike 4.9 and 4.10 #66
• Output bof_reuse_memory and bof_allocator in c2profile by @yunzheng in Output bof_reuse_memory and bof_allocator in c2profile #67
• Add support for SETTING_DATA_STORE_SIZE and SETTING_BEACON_GATE options by @yunzheng in Add support for SETTING_DATA_STORE_SIZE and SETTING_BEACON_GATE options #68
• Update pip install docs with quoting when installing extras by @yunzheng in Update pip install docs with quoting when installing extras #69
• More pip install quotations in the docs by @yunzheng in More pip install quotations in the docs #70
• Add support for SETTING_HTTP_DATA_REQUIRED beacon setting by @yunzheng in Add support for SETTING_HTTP_DATA_REQUIRED beacon setting #71
• Add support for beacon guardrails by @yunzheng in Add support for beacon guardrails #73
• Fix failing readthedocs builds by @yunzheng in Fix failing readthedocs builds #74
• Add guardrails definitions to the docs by @yunzheng in Add guardrails definitions to the docs #75
• Add Cobalt Strike 4.10.1 version detection by @yunzheng in Add Cobalt Strike 4.10.1 version detection #76
• Add beacon version table to documentation by @yunzheng in Add beacon version table to documentation #77

Full Changelog: v1.2.0...v1.2.1

---

This discussion was created from the release v1.2.1.