ansible-role-cobalt-strike

An Ansible role for installing Cobalt Strike.

Pre-requisites

In order to execute the Molecule tests for this Ansible role in GitHub Actions, a build user must exist in AWS. The accompanying Terraform code will create the user with the appropriate name and permissions. This only needs to be run once per project, per AWS account. This user can also be used to run the Molecule tests on your local machine.

Before the build user can be created, the following profile must exist in your AWS credentials file:

• cool-terraform-backend

The easiest way to set up that profile is to use our aws-profile-sync utility. Follow the usage instructions in that repository before continuing with the next steps. Note that you will need to know where your team stores their remote profile data in order to use aws-profile-sync.

To create the build user, follow these instructions:

cd terraform
terraform init --upgrade=true
terraform apply

Once the user is created you will need to update the repository's secrets with the new encrypted environment variables. This should be done using the terraform-to-secrets tool available in the development guide. Instructions for how to use this tool can be found in the "Terraform IAM Credentials to GitHub Secrets" section. of the Project Setup README.

If you have appropriate permissions for the repository you can view existing secrets on the appropriate page in the repository's settings.

Requirements

Requires that a Java implementation be installed.

Role Variables

• bucket-name - The name of the AWS S3 bucket where the Cobalt Strike tarball and license files are stored. Defaults to cisa-cool-third-party-production.
• tarball_object_name - The name of the AWS S3 object that is the Cobalt Strike tarball. Defaults to cobaltstrike.tgz.
• license_object_name - The name of the AWS S3 object that is the Cobalt Strike license. Defaults to cobaltstrike.license.

Dependencies

None.

Example Playbook

Here's how to use it in a playbook:

- hosts: teamservers
  become: yes
  become_method: sudo
  roles:
    - cobalt_strike

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.

Author Information

Shane Frasier - [email protected]