teamserver-prop/TeamServer.prop at main · Cobalt-Strike/teamserver-prop · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
#Cobalt Strike Team Server Properties
#July 16, 2024

# ------------------------------------------------
# Validation for screenshot messages from beacons
# ------------------------------------------------
# limits.screenshot_validated=true
# limits.screenshot_data_maxlen=4194304
# limits.screenshot_user_maxlen=1024
# limits.screenshot_title_maxlen=1024

# Stop writing screenshot data when Disk Usage reaches XX%
# Example: Off
#          "limits.screenshot_diskused_percent=0"
# Example: Stop writing screenshot data when Disk Usage reaches 95%
#          "limits.screenshot_diskused_percent=95"
# Default:
# limits.screenshot_diskused_percent=95

# ------------------------------------------------
# Validation for keystroke messages from beacons
# ------------------------------------------------
# limits.keystrokes_validated=true
# limits.keystrokes_data_maxlen=8192
# limits.keystrokes_user_maxlen=1024
# limits.keystrokes_title_maxlen=1024

# Stop writing keystroke data when Disk Usage reaches XX%
# Example: Off
#          "limits.keystrokes_diskused_percent=0"
# Example: Stop writing keystroke data when Disk Usage reaches 95%
#          "limits.keystrokes_diskused_percent=95"
# Default:
# limits.keystrokes_diskused_percent=95

# ------------------------------------------------
# Add a limit to the number of beacons allowed (spam protection)
# Setting the value to 0 (or less) will disable this function.
#   limits.beacons_max - (500) maximum number of beacon allowed
# ------------------------------------------------
# limits.beacons_max=500

# ------------------------------------------------
# Threshold rate for adding new beacons (spam protection)...
# Add a limit to the number of new beacons added within a specified time period.
# When the limit is exceeded, disable accepting new beacons for the disable duration.
# Setting any value to 0 (or less) will disable this function.
#   limits.beacon_rate_period - (30000) milliseconds of the time period
#   limits.beacon_rate_maxperperiod - (50) new beacons allowed during time period
#   limits.beacon_rate_disableduration - (600000) milliseconds to disable when threshold is exceeded
# ------------------------------------------------
# limits.beacon_rate_period=30000
# limits.beacon_rate_maxperperiod=50
# limits.beacon_rate_disableduration=600000

# ------------------------------------------------
# Perform XSS Validation on select new beacon metadata (spam protection)
#   default = true
# ------------------------------------------------
# limits.beacons_xssvalidated=true

# ------------------------------------------------
# Callback timeout limits
#    callback_max_timeout controls the number of milliseconds a request is
#    kept in the pending queue to wait for the initial data response.
#    The default is 86400000 milliseconds (24 hours)
#
#    callback_keep_timeout controls the number of milliseconds a request is
#    kept in the pending queue to wait for subsequent data responses.  If
#    using callbacks in long running jobs/tasks you may need to adjust
#    this setting based on how often data will be received, which needs
#    to account for beacon's sleep time and how often the job/task sends
#    data.
#    The default is 3600000 milliseconds (1 hour)
# ------------------------------------------------
# limits.callback_max_timeout=86400000
# limits.callback_keep_timeout=3600000

# ------------------------------------------------
# The "logfile.*" properties below impact the formatting of
# timestamps in the following log files:
#   - .../logs/[date]/events.log
#   - .../logs/[date]/downloads.log
#   - .../logs/[date]/weblog_[port].log
#   - .../logs/[date]/webkeystrokes.log
#   - .../logs/[date]/phishes/campaign_[id].log
#   - .../logs/[date]/[target-ip]/screenshots.log
#   - .../logs/[date]/[target-ip]/beacon_[bid].log
#   - .../logs/[date]/[target-ip]/keystrokes/keystrokes_[bid].[desktop-id].txt
# ------------------------------------------------
# Override the timestamp formatting pattern used for logfiles.
# The pattern should be compatible with the Java's "java.text.SimpleDateFormat" class.
# See: https://docs.oracle.com/javase/8/docs/api/java/text/SimpleDateFormat.html
# ------------------------------------------------
#   Default:  "MM/dd HH:mm:ss zzz"
#   Examples:
#        logfile.timestamp.pattern=MM/dd/yy HH:mm:ss zzz
#        logfile.timestamp.pattern=yyyy-MM-dd HH:mm:ss zzz
# ------------------------------------------------
# logfile.timestamp.pattern=yyyy-MM-dd HH:mm:ss zzz

# ------------------------------------------------
# Override the timezone used for the log files mentioned above.
# The timezone name should be compatible with the Java's "java.util.TimeZone" class.
# See: https://docs.oracle.com/javase/8/docs/api/java/util/TimeZone.html
# NOTE: An invalid timezone override results in GMT.
# ------------------------------------------------
#   Default:  UTC
#   Special Value: "*default" [uses the value supplied by the team server JRE]
#   Examples:
#             logfile.timezone=*default
#             logfile.timezone=America/Los_Angeles   or PST
#             logfile.timezone=America/Chicago       or CST
#             logfile.timezone=Europe/London
#             logfile.timezone=Pacific/Noumea
# ------------------------------------------------
# logfile.timezone=America/Los_Angeles
# logfile.timezone=*default