13 April 2023

By Adam Rose

During recent research into C2 traffic redirection techniques, we found the process of manually editing serverless cloud function code and configuration files tedious and repetitive. So, we automated the process. The result is AutoFunkt, a Python script that reads a Cobalt Strike Malleable C2 profile and generates the function code for Azure  and Google Cloud Provider serverless function redirectors.

How does it work?

AutoFunkt is a Python script that takes a specified Malleable C2 profile, parses it, and then spits out all the code necessary to deploy serverless redirector functions. When both the Google Cloud Provider (-g --google) and the Azure (-a --azure) switches are provided, it creates a directory structure that looks like this:

It also spits out the gcloud commands to deploy generated GCP functions:

Deploying serverless functions to Azure is more complicated, so we recommend using VS Code's Azure Functions extension to deploy these. We outline this process in our previous post on this subject.

This script relies heavily on the mpp pyMalleableProfileParser library by Brett Fitzpatrick. Many thanks!

Usage

Clone the repository from our Github. cd into it and then run pip3 install requirements.txt.

Usage looks like this:

python3 autofunkt.py -p <path-to-malleable-profile> -t <teamserver url> -a -s <azure project subdomain> -r <azure custom-route-prefix>  -o <output directory name> -g

This command generates two sets of GET and POST HTTP redirector functions for both Azure and Google Cloud. It creates two subdirectories (azure and gcp) inside of a directory named the value of the -o switch. Inside each subdirectory you'll find the code for the respective cloud functions.

If you just want to generate Google Cloud functions, use -g/--google. Same goes for Azure with -a/--azure.

Limitations

There are some limitations to the tool:

• The Malleable Profile cannot contain more than one HTTP variant.
• There can only be one URI for each HTTP method, they can and should be different
• Google Cloud uses the function's name in the URL. Therefore, the value of set uri for these blocks should adhere to python function naming requirements. no hyphens.

Support

Feel free to take out an issue on the GitHub repo.