Cobalt Strike TeamServer CloudFlare HTTPS 防溯源部署

🙏感谢 `@mattshi 提供套路

环境准备

两台VPS，推荐一台windows 一台linux 一个匿名的域名，同时注册好cloudflare账号

部署步骤

CloudFlare配置

把域名解析到C2服务器的IP，一个二级域名和两个三级域名，三级域名名字随意。

同时吧SSL模式调到Full

C2服务器部署

先在linux的C2服务器上部署好nginx nginx配置文件参考如下

server {
        listen 443 ssl;
        ssl_certificate /etc/ssl/server.crt;
        ssl_certificate_key     /etc/ssl/server.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        root /var/www/html/;
        index ip.html;
        server_name [域名];
        location / {
            if ( $http_user_agent ~ "^$" ){
                    proxy_pass  http://[二级跳转域名];
            }
        }
}

server{
        listen 443 ssl;
        ssl_certificate /etc/ssl/server.crt;
        ssl_certificate_key     /etc/ssl/server.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        server_name [二级跳转域名];
        root /var/www/html/;
        index ip.html;
        location / {
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass  [TeamServer WebScript IP和端口];
        }
}

server{ 
        listen 443 ssl; 
        ssl_certificate /etc/ssl/server.crt;
        ssl_certificate_key     /etc/ssl/server.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        server_name [域名];
        root /var/www/html/;
        index 1.html;
        location / {
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header    Host    $host;
            proxy_pass  [TeamServer Listener IP和端口];
            proxy_redirect      off;    

        }
}

在 /var/www/html/下面创建个index.html 填入如下内容，伪装成一个没有危害的站点

<html>
<head>
    <script>
        const API_URL = `https://www.cloudflare.com/cdn-cgi/trace`;
        function onDataRecieve() {
            const ipRegex = /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/                           
            const IP = xhttp.responseText.match(ipRegex)[0];
            document.getElementById("demo").innerHTML = IP
        }
        const xhttp = new XMLHttpRequest();
        xhttp.onreadystatechange = onDataRecieve;
        xhttp.open("GET", API_URL, true);
        xhttp.send();
    </script>
</head>
<body>
    <div id="demo"></div>
</body>
</html>