Network Security

Published on September 7th, 2012 | by NJ Ouchn


Announcement: Covert VPN – drops you into your target’s network

Here is an exclusive Announcement from the impressive coder machine Raphael Mudge. Great news, ToolsWatch will cover the international release of CobaltStrike very soon. Stay tuned :)

Covert VPN is a VPN pivoting technology recently added to Cobalt Strike (the commercial Armitage). Once deployed, you have a layer 2 tunnel into your target’s network. This allows you to sniff packets, use external tools, host rogue services, and inject spoofed packets.

How to Deploy

To activate Covert VPN, right-click a compromised host, go to Meterpreter -> Pivoting -> Deploy VPN. Select the remote interface you would like Covert VPN to bind to. If no local interface is present, press Add to create one.

Deploy VPN Pivoting
Deploy Covert VPN

Check Clone host MAC address to make your local interface have the same MAC address as the remote interface. It’s safest to leave this option checked.

Select Inject VPN client into memory to deploy Covert VPN directly into memory. If this box is not checked, Cobalt Strike will upload and execute the Covert VPN client for you. The inject into memory option does not work reliably on Windows Vista, Windows 7, or 64-bit Windows XP.

Press Deploy to start the Covert VPN client on the target. Covert VPN requires SYSTEM access to deploy.

Once a Covert VPN interface is active, you may use it like any physical interface on your system. Use ifconfig to configure its IP address. If your target network has a DHCP server, you may request an IP address from it using your operating systems built-in tools.

Manage Interfaces

To manage your Covert VPN interfaces, go to Cobalt Strike -> Interfaces. Here, Cobalt Strike will show the Covert VPN interfaces, how they’re configured, and how many bytes were transmitted and received through each interface.

Highlight an interface and press Remove to destroy the interface and close the remote Covert VPN client. Covert VPN will remove its temporary files on reboot and it automatically undoes any system changes right away.

Press Add to configure a new Covert VPN interface.

Configure an Interface

Covert VPN interfaces consist of a network tap and a channel to communicate ethernet frames through. To configure the interface, choose an Interface name (this is what you will manipulate through ifconfig later) and a MAC address.

VPN Pivoting Setup
VPN Interface Setup

You must also configure the Covert VPN communication channel for your interface. Covert VPN may communicate ethernet frames over a UDP connection, TCP connection, or using the HTTP protocol. Cobalt Strike will setup and manage a server to receive a connection from the Covert VPN client based on the Local Port and Channel you select.

The Covert VPN HTTP channel makes use of the Cobalt Strike web server. You may host other Cobalt Strike web applications and multiple Covert VPN HTTP channels on the same port.

For best performance, use the UDP channel. The UDP channel has the least amount of overhead compared to the TCP and HTTP channels. Use the HTTP channel if you need to get past a restrictive firewall.

Covert VPN in Action



Covert VPN is in the latest version of Cobalt Strike. A 21-day trial is available as well. Try it out and send your feedbacks to Raphael Mudge.


Tags: , , ,

About the Author

"Passion is needed for any great work, and for the revolution, passion and audacity are required in big doses"

Back to Top ↑