Configure Listeners

Introduction

Cobalt Strike has two listeners: egress listeners and peer-to-peer listeners. Egress listeners are for external connections outside of the network. Facilitation occurs either through HTTP or DNS. Peer-to-Peer (P2) listeners to do not communicate with the team server directory like egress listeners, instead, they combine multiple Beacons together in parent/child relationships. The reasons for this is simple: it reduces the number of hosts talking to the team server (which reduces traffic volume and likelihood of getting burned). It also allows machines who cant talk outside the network to communicate through this type of proxy system. P2P listeners can use SMB or TCP. The traffic from the P2P is sent to the parent who transmits it to the team server.

Egress Listeners

Egress listeners are for external connections outside of the network (HTTP or DNS).

HTTP Listener

Communication occurs over HTTP GET & POST requests.

To add a new listener: Click headphones -> Add -> Input details & Save

DNS Listener

DNS listeners allows Beacons to send messages over several lookup types A, AAAA, TXT. To use DNS listeners, we must configure our DNS records. For example:

Name	Type	Data
@	A	<DNS Resolver>
ns1	A	<DNS Resolver>
img	NS	ns1.copperwired.com.

Creating listener

We now have two listeners:

P2P Listeners

Peer (P2) listeners to do not communicate with the team server directory like egress listeners, instead, they combine multiple Beacons together in parent/child relationships.

• This reduces the number of hosts talking to the team server (which reduces traffic volume and likelihood of getting burned).

• It also allows machines who cant talk outside the network to communicate through this type of proxy system. P2P listeners can use SMB or TCP. The traffic from the P2P is sent to the parent who transmits it to the team server.

SMB Listener

For SMB listeners, the default named pipe is not going to work. We can list named pipes on the host with the following command. We'll change the last couple numbers to something recognizable.

PS> ls \\.\.pipe\

TCP Listener

Your typical TCP listener. Nothing special.

We now have all our listeners!

Pivot Listener

Setting up a listener for pivoting is different than default listeners. Pivot listeners can only be created through a beacon.

To create a pivot listener right-click on the Beacon and go Pivoting -> Listener -> "Open Listener".

Confirming the port is listening and notice the process ID. It's the same as our Beacon PID.

beacon> run netstat -anop tcp

Active Connections

  Proto  Local Address          Foreign Address        State           PID

  TCP    0.0.0.0:4444           0.0.0.0:0              LISTENING       2280

You can run spawn in the beacon promt selected a pivot listener. Optionally, you can create one. The Beacon commandselevate, and jump can also be used for pivoting.

Unfortunately, with Defender enabled, we get burned. We'll have to put some work into our Payload to go undetected.