warhorse/cobaltstrike-ag

By warhorse

•Updated almost 6 years ago

A Cobaltstrike Aggressor Script container, built for Warhorse

Image

602

Overview Tags

warhorse/cobaltstrike-ag repository overview

⁠warhorse/cobaltstrike-ag⁠

Cobaltstrike⁠ - Software for Adversary Simulations and Red Team Operations.

⁠WARNING

This image is for server side AGGRESSOR scripts. You will need a running Cobaltstrike server to use this image.

You need a valid Cobaltstrike key to use this image. The Cobaltstrike software is downloaded when this image is started. If you need a license please go to Cobaltstrike⁠

⁠Usage

Here are some example snippets to help you get started creating a container.

⁠docker

docker create \
  --name=coblatstrike-ag \
  -e TZ=Europe/London \
  -e COBALTSTRIKE_KEY=cs_key \
  -e COBALTSTRIKE_PASS=cs_password \
  -e COBALTSTRIKE_HOSTNAME=cobaltstrike.mydomain.com \
  -e AG_SCRIPT_NAME=script.cna \
  -v <path to data>:/opt/cobaltstrike \
  --restart unless-stopped \
  warhorse/cobaltstrike-ag

⁠docker-compose

Compatible with docker-compose v2 schemas. Server and AG server example.

---
version: "2"
services:
  cobaltstrike:
    image: warhorse/cobaltstrike
    container_name: cobaltstrike
    environment:
      - TZ=Europe/London
      - COBALTSTRIKE_KEY=cs_key
      - COBALTSTRIKE_PASS=cs_password
      - COBALTSTRIKE_EXP=2020-12-20
      - COBALTSTRIKE_PROFILE=malleable.profile
    volumes:
      - <path to data>:/opt/cobaltstrike
    ports:
      - 50050:50050
      - 443:443
      - 80:80
    restart: unless-stopped
  cobaltstrike-ag:
    image: warhorse/cobaltstrike-ag
    container_name: cobaltstrike-ag
    environment:
      - TZ=Europe/London
      - COBALTSTRIKE_KEY=cs_key
      - COBALTSTRIKE_PASS=cs_password
      - COBALTSTRIKE_HOSTNAME=cobaltstrike.mydomain.com
      - AG_SCRIPT_NAME=script.cna
    volumes:
      - <path to data>:/opt/cobaltstrike
    restart: unless-stopped

⁠Parameters

Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate <external>:<internal> respectively. For example, -p 8080:80 would expose port 80 from inside the container to be accessible from the host's IP on port 8080 outside the container.

Parameter	Function
`-e TZ=Europe/London`	Specify a timezone to use EG Europe/London
`-e COBALTSTRIKE_KEY=cs_key`	Specify a valid Cobaltstrike key
`-e COBALTSTRIKE_PASS=cs_password`	Specify a Cobaltstrike password
`-e COBALTSTRIKE_HOSTNAME=cobaltstrike.mydomain.com`	Specify a cobaltstrike hostname
`-e AG_SCRIPT_NAME=script.cna`	Specify a cobaltstrike AGGRESSOR script name
`-v /opt/cobaltstrike`	Cobaltstrike data folder

⁠Application Setup

This setup is completely server side and as such there is no interface.

⁠Support Info

Shell access whilst the container is running: docker exec -it cobaltstrike-ag /bin/bash
To monitor the logs of the container in realtime: docker logs -f cobaltstrike-ag

⁠Building locally

If you want to make local modifications to these images for development purposes or just to customize the logic:

git clone https://github.com/warhorse/docker-cobaltstrike-ag.git
cd docker-cobaltstrike-ag
docker build \
  --no-cache \
  --pull \
  -t warhorse/cobaltstrike-ag:latest .

⁠Versions

10.31.19: - First Push

Tag summary

Recent tags

Content type

Image

Digest

Size

430.3 MB

Last updated

almost 6 years ago

docker pull warhorse/cobaltstrike-ag