Right. Here I am on the Snap Labs dashboard.
First thing to do is go into the attacker desktop console.
Once I'm logged in, I'm going to
right click on the terminal icon
and select team server SSH.
And this will take us straight into the, Linux VM.
Now you can also do this from the Snap app dashboard as well,
so we can jump straight onto the command line,
here.
It's just my preference to do it this way.
You can do whichever way you prefer.
I'm going to start a Tmux console
or a Tmux session.
And this will ensure that if we lose that SSH connection,
the team server isn't gonna die.
You will also need to do that if going in this way,
because this is just an SSH session in the background.
So let's c d into the cobalt struct directory.
And the script to start the team server is right here.
So we can do sudo
team server.
The first option we want to give it is the IP address of
the server, running the team server.
So that's ten ten five dot fifty.
You can also check the dashboard.
The dashboard shows the IP addresses and the host names of
all of the machines in the lab if you just want a quick reference.
The second parameter is a shared password,
so every operator will connect to the team server
using the same password.
I'm just gonna keep it simple and say password.
And the next argument is it's optional, but we're gonna do
it, for consistency anyway.
So this will be the path to a malleable c two profile.
So if we go to c two profiles and normal,
there are, a bunch to choose from.
It doesn't really matter which one you go for.
I would not use the reference one.
So the reference one
is actually just used as a reference.
It shows you how to use
all of the different,
directives in manual c two.
But any of the other ones are pretty much, pretty good.
I'm just gonna use the web bug profile,
and, we will be making some modifications to the profile.
So if you want to follow along verbatim,
then you can use this one, but it's not really critical.
And with that, we can just hit enter.
This step can take, a little while when you run it for the first
time.
But you'll know when it's finished when it prints out
the, this hash
here.
So now we're good to launch the client.
So that will be this icon down here in the taskbar.
And we want to specify new connection.
So the alias can be anything you want.
Every time you connect to a new team server,
it will save the configuration,
and it will appear in this list here.
So the alias is just a means of recognizing which
connection is which.
So I'm just gonna call this one Ubuntu.
The host, of course, will be the IP address of the, VM.
So that'll be ten ten five fifty.
The port can stay the same.
The username is whatever you want, so you can put your own,
preferred handle in there.
And then the password is the shared password.
So for me, that is just password,
and then hit connect.
And the first time you connect to a team server,
it will print the team server's fingerprint.
And you need to make sure that this hash,
matches this one that the team server gave us.
So this just ensures ensures that nobody
is messing around with the traffic in between your client
and the team server.
So when you're happy with that, just hit
yes.
And we are now
connected.
Since Cobalt Strike, four point seven, there's a new dark mode.
You can control
a bunch of the visual settings of Cobalt Strike by going to
Cobalt Strike and Preferences.
So if you don't like the dark mode,
you can just turn it off here and go back to default.
If you also find that some of these fonts are a little bit
small for you, you can change them in two places.
So the first one here is the GUI font.
So this controls
the font size of things like the menus and these, columns
and the, tabs.
You can also control,
the highlights color.
So if there's an event that happens in one of these tabs
where it's not focused,
here.
The other place you can change it
here.
The other place you can change it is under console,
and this changes the text that happens here inside these
inside the tabs.
So if most of the text is white on black, but if that,
like, hurts your eyes, you can switch that around here.
You can also change the font and the size here and, again,
the different highlighting colours.
If you want Cobalt Strike to forget any of the aliases that
you have saved, you can go into Team Servers and just take them
out here.
And likewise, if you want it to forget any fingerprints that you've
accepted, you can also remove them here as well.
Changing any of these settings and hit and save,
you'll have to close and restart the client for them to take effect.
But then those changes will be persistent through every every
single, client launch.