Package: pyMalleableProfileParser
pyMalleableProfileParserParses Cobalt Strike malleable C2 profiles.Installation :gear:pip3installpyMalleableProfileParserUpgrading to the latest versionpip3install--upgradepyMalleableProfileParserUsageMalleableProfile classfrommppimportMalleableProfilemp=MalleableProfile(profile='/path/to/profile')mp.profileGet attributes easilyOptionsHere is an example of getting the global optionjitter:>>mp.jitterOption(option="jitter",value="0")>>mp.jitter.option'jitter'>>mp.jitter.value'0'You can also access options in any block:>>mp.http_get.uriOption(option="uri",value="/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books")StatementsYou can get statements in any block or sub-block:>>mp.http_get.client.HostStatement(statement=header,key="Host",value="www.amazon.com")>>mp=MalleableProfile('bing_maps.profile')>>mp.stage.transform_x86.ReflectiveLoaderStatement(statement=strrep,string="ReflectiveLoader",replace="")BlocksLike statements, you can access any block or sub-block:>>mp.http_getBlock(name=http-get,data=[Option(option="uri",value="/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books"),Block(name=client,data=[Statement(statement=header,key="Accept",value="*/*"),Statement(statement=header,key="Host",value="www.amazon.com"),Block(name=metadata,data=[Statement(statement=base64,value=""),Statement(statement=prepend,value="session-token="),Statement(statement=prepend,value="skin=noskin;"),Statement(statement=append,value="csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996"),Statement(statement=header,key="Cookie",value="")])]),Block(name=server,data=[Statement(statement=header,key="Server",value="Server"),Statement(statement=header,key="x-amz-id-1",value="THKUYEZKCKPGY5T42PZT"),Statement(statement=header,key="x-amz-id-2",value="a21yZ2xrNDNtdGRsa212bGV3YW85amZuZW9ydG5rZmRuZ2tmZGl4aHRvNDVpbgo="),Statement(statement=header,key="X-Frame-Options",value="SAMEORIGIN"),Statement(statement=header,key="Content-Encoding",value="gzip"),Block(name=output,data=[Statement(statement=print,value="")])])])>>mp.http_get.server.outputBlock(name=output,data=[Statement(statement=print,value="")])Validate a ProfileBy default,validate()will validate Malleable Profiles for 4.0+. You can also specify a specific version. Note: a
warning will be displayed when setting dns options globally but will fail the validation if you specify version4.3.Example>>>frommpp.profileimportMalleableProfile>>>mp=MalleableProfile('bing_maps.profile')>>>mp.validate()startingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:dns_idlestartingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:maxdnsstartingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:dns_sleepstartingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:dns_stager_prependstartingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:dns_stager_subhoststartingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:dns_max_txtstartingwithv4.3,dnsoptionshavebeenmovedinto'dns-beacon'block:dns_ttlTrue>>>mp.validate(version=4.3)[(Option(option="dns_idle",value="8.8.8.8"),'INVALID_OPTION'),(Option(option="maxdns",value="245"),'INVALID_OPTION'),(Option(option="dns_sleep",value="0"),'INVALID_OPTION'),(Option(option="dns_stager_prepend",value=""),'INVALID_OPTION'),(Option(option="dns_stager_subhost",value=""),'INVALID_OPTION'),(Option(option="dns_max_txt",value="252"),'INVALID_OPTION'),(Option(option="dns_ttl",value="1"),'INVALID_OPTION')]>>>Profile Structure (Dict)Example: amazon.profile{'sleeptime':Option(option="sleeptime",value="5000"),'jitter':Option(option="jitter",value="0"),'maxdns':Option(option="maxdns",value="255"),'useragent':Option(option="useragent",value="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"),'http-get':Block(name=http-get,data=[Option(option="uri",value="/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books"),Block(name=client,data=[Statement(statement=header,key="Accept",value="*/*"),Statement(statement=header,key="Host",value="www.amazon.com"),Block(name=metadata,data=[Statement(statement=base64,value=""),Statement(statement=prepend,value="session-token="),Statement(statement=prepend,value="skin=noskin;"),Statement(statement=append,value="csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996"),Statement(statement=header,key="Cookie",value="")])]),Block(name=server,data=[Statement(statement=header,key="Server",value="Server"),Statement(statement=header,key="x-amz-id-1",value="THKUYEZKCKPGY5T42PZT"),Statement(statement=header,key="x-amz-id-2",value="a21yZ2xrNDNtdGRsa212bGV3YW85amZuZW9ydG5rZmRuZ2tmZGl4aHRvNDVpbgo="),Statement(statement=header,key="X-Frame-Options",value="SAMEORIGIN"),Statement(statement=header,key="Content-Encoding",value="gzip"),Block(name=output,data=[Statement(statement=print,value="")])])]),'http-post':Block(name=http-post,data=[Option(option="uri",value="/N4215/adj/amzn.us.sr.aps"),Block(name=client,data=[Statement(statement=header,key="Accept",value="*/*"),Statement(statement=header,key="Content-Type",value="text/xml"),Statement(statement=header,key="X-Requested-With",value="XMLHttpRequest"),Statement(statement=header,key="Host",value="www.amazon.com"),Statement(statement=parameter,key="sz",value="160x600"),Statement(statement=parameter,key="oe",value="oe=ISO-8859-1;"),Block(name=id,data=[Statement(statement=parameter,key="sn",value="")]),Statement(statement=parameter,key="s",value="3717"),Statement(statement=parameter,key="dc_ref",value="http%3A%2F%2Fwww.amazon.com"),Block(name=output,data=[Statement(statement=base64,value=""),Statement(statement=print,value="")])]),Block(name=server,data=[Statement(statement=header,key="Server",value="Server"),Statement(statement=header,key="x-amz-id-1",value="THK9YEZJCKPGY5T42OZT"),Statement(statement=header,key="x-amz-id-2",value="a21JZ1xrNDNtdGRsa219bGV3YW85amZuZW9zdG5rZmRuZ2tmZGl4aHRvNDVpbgo="),Statement(statement=header,key="X-Frame-Options",value="SAMEORIGIN"),Statement(statement=header,key="x-ua-compatible",value="IE=edge"),Block(name=output,data=[Statement(statement=print,value="")])])])}Help :construction_worker:Join us in discussionsI use GitHub Discussions to talk about all sorts of topics related to this repo.Open an issueFirst, check out theexisting issues. If you spot
something new, open an issue. We'll use the issue to have a conversation about the problem you want to fix, and I'll
try to get to it as soon as I can.