Set Up and Team Server

1. Starting the Team Server

From a Linux Server, start the team server:

sudo ./teamserver {IP} {password} {maleable profile}

Then from the Attacker machine launch the Cobalt Strike client and enter the connection details.

2. Running as a Service

Running the team server as a service allows it to start automatically when the VM starts up, which obviously saves us having to SSH in each time and start it manually. This can be done with a systemd unit file.

First, create the file in /etc/systemd/system: sudo nano /etc/systemd/system/teamserver.service

Then paste the following content:

[Unit]
Description=Cobalt Strike Team Server
After=network.target
StartLimitIntervalSec=0
 
[Service]
Type=simple
Restart=always
RestartSec=1
User=root
WorkingDirectory=/home/attacker/cobaltstrike
ExecStart=/home/attacker/cobaltstrike/teamserver 10.10.5.50 Passw0rd! c2-profiles/normal/webbug.profile
 
[Install]
WantedBy=multi-user.target

Next, reload the systemd manager and check the status of the service. It will be inactive/dead.

sudo systemctl daemon-reload

sudo systemctl status teamserver.service

sudo systemctl start teamserver.service

sudo systemctl status teamserver.service

The service should be active/running and you will see the typical console output from the team server. Now that we know the service is working, we can tell it to start on boot.

sudo systemctl enable teamserver.service

We will now be able to connect from the Cobalt Strike client as soon as the VMs boot up.