malleable

package module

v1.1.0 Latest Latest Go to latest Published: Dec 14, 2023 License: MIT Imports: 7 Imported by: 1

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/D00Movenok/goMalleable

Links

Open Source Insights

README ¶

goMalleable

🔎🪲 Malleable C2 profiles parser and assembler library written in golang

Latest supported CobaltStrike version: 4.9.1

WARNING

goMalleable treats you as a consenting adult and assumes you know how to write Malleable C2 Profiles. It's able to detect syntax errors, however there are no runtime checks implemented. It'll gladly generate profiles that don't actually work in production if instructed to do so. Always run the generated profiles through c2lint before using them in production!

Installation

Package can be installed with:

go get github.com/D00Movenok/goMalleable@v1

Usage

Parse

Function Parse parses Malleable profile string to easy-to-read structure. Full example Link.

package main

import (
    "os"
    malleable "github.com/D00Movenok/goMalleable"
)

func main() {
    ...
    data, _ := os.Open("example.profile")
    parsed, _ := malleable.Parse(data)
    ...
}

Full definition of structure can be found here.

Assembly

You may print this structure as string to get Malleable profile file. Full example: Link.

fmt.Println(parsed)

Output:

...

set host_stage "false";
set jitter "33";
set tcp_frame_header "";
set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36";

https-certificate {
    set CN "whatever.com";
    set L "California";
    set O "whatever LLC.";
    set OU "local.org";
    set ST "CA";
    set validity "365";
    set C "US";
}

...

Examples

Link	Description
Link	Example of profile parsing
Link	Example of profile creation

TODO

Use map[Name]Type instead of []Type with Name field

Documentation ¶

Index ¶

type Boolean
- func (b *Boolean) Capture(values []string) error
type CodeSigner
- func (b CodeSigner) String() string
type CommaSeparatedList
- func (l *CommaSeparatedList) Capture(values []string) error
- func (l CommaSeparatedList) String() string
type DNSBeacon
- func (b DNSBeacon) String() string
type Data
- func (s Data) String() string
type Function
- func (f Function) String() string
type HTTPBeacon
- func (b HTTPBeacon) String() string
type HTTPConfig
- func (b HTTPConfig) String() string
type HTTPGet
- func (b HTTPGet) String() string
type HTTPGetClient
- func (b HTTPGetClient) String() string
type HTTPPost
- func (b HTTPPost) String() string
type HTTPPostClient
- func (b HTTPPostClient) String() string
type HTTPSCertificate
- func (b HTTPSCertificate) String() string
type HTTPServer
- func (b HTTPServer) String() string
type HTTPStager
- func (b HTTPStager) String() string
type HTTPStagerClient
- func (b HTTPStagerClient) String() string
type Header
- func (h Header) String() string
type Parameter
- func (p Parameter) String() string
type PostEx
- func (b PostEx) String() string
type ProcessInject
- func (b ProcessInject) String() string
type Profile
- func Parse(data io.Reader) (*Profile, error)
- func (d Profile) String() string
type SpaceSeparatedList
- func (l *SpaceSeparatedList) Capture(values []string) error
- func (l SpaceSeparatedList) String() string
type Stage
- func (b Stage) String() string
type String
- func (s String) String() string
type StringW
- func (s StringW) String() string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Boolean ¶

type Boolean bool

NOTE: created because github.com/alecthomas/participle/v2 parses default bool type as true if something is found.

func (*Boolean) Capture ¶

func (b *Boolean) Capture(values []string) error

type CodeSigner ¶

type CodeSigner struct {
	Keystore        string  `parser:"( \"set\" \"keystore\" @String \";\""`
	Password        string  `parser:"| \"set\" \"password\" @String \";\""`
	Alias           string  `parser:"| \"set\" \"alias\" @String \";\""`
	DigestAlgorithm string  `parser:"| \"set\" \"digest_algorithm\" @String \";\""`
	Timestamp       Boolean `parser:"| \"set\" \"timestamp\" @String \";\""`
	TimestampURL    string  `parser:"| \"set\" \"timestamp_url\" @String \";\" )*"`
}

func (CodeSigner) String ¶

func (b CodeSigner) String() string

type CommaSeparatedList ¶

type CommaSeparatedList []string

NOTE: default comma-separated string list parser and stringer, e.g. curl*,lynx*,wget*.

func (*CommaSeparatedList) Capture ¶

func (l *CommaSeparatedList) Capture(values []string) error

func (CommaSeparatedList) String ¶

func (l CommaSeparatedList) String() string

type DNSBeacon ¶

type DNSBeacon struct {
	Name string `parser:"@String? \"{\""`

	DNSIdle          string `parser:"( \"set\" \"dns_idle\" @String \";\""`
	DNSMaxTXT        int    `parser:"| \"set\" \"dns_max_txt\" @String \";\""`
	DNSSleep         int    `parser:"| \"set\" \"dns_sleep\" @String \";\""`
	DNSTTL           int    `parser:"| \"set\" \"dns_ttl\" @String \";\""`
	MaxDNS           int    `parser:"| \"set\" \"maxdns\" @String \";\""`
	DNSStagerPrepend string `parser:"| \"set\" \"dns_stager_prepend\" @String \";\""`
	DNSStagerSubhost string `parser:"| \"set\" \"dns_stager_subhost\" @String \";\""`
	Beacon           string `parser:"| \"set\" \"beacon\" @String \";\""`
	GetA             string `parser:"| \"set\" \"get_A\" @String \";\""`
	GetAAAA          string `parser:"| \"set\" \"get_AAAA\" @String \";\""`
	GetTXT           string `parser:"| \"set\" \"get_TXT\" @String \";\""`
	PutMetadata      string `parser:"| \"set\" \"put_metadata\" @String \";\""`
	PutOutput        string `parser:"| \"set\" \"put_output\" @String \";\""`
	NSResponse       string `parser:"| \"set\" \"ns_response\" @String \";\")* \"}\""`
}

func (DNSBeacon) String ¶

func (b DNSBeacon) String() string

type Data ¶

type Data string

NOTE: parser and stringer for "data" function.

func (Data) String ¶

func (s Data) String() string

type Function ¶

type Function struct {
	Func string   `parser:"@Ident"`
	Args []string `parser:"@String* \";\""`
}

NOTE: parser and stringer for function sequences, e.g. http-get output, transforms in post-ex, etc.

func (Function) String ¶

func (f Function) String() string

type HTTPBeacon ¶ added in v1.1.0

type HTTPBeacon struct {
	Name string `parser:"@String? \"{\""`

	Library string `parser:"( \"set\" \"library\" @String \";\")* \"}\""`
}

func (HTTPBeacon) String ¶ added in v1.1.0

func (b HTTPBeacon) String() string

type HTTPConfig ¶

type HTTPConfig struct {
	HeadersOrder       CommaSeparatedList `parser:"( \"set\" \"headers\" @String \";\""`
	Headers            []Header           `parser:"| \"header\" @@ \";\""`
	TrustXForwardedFor Boolean            `parser:"| \"set\" \"trust_x_forwarded_for\" @String \";\""`
	BlockUserAgents    CommaSeparatedList `parser:"| \"set\" \"block_useragents\" @String \";\""`
	AllowUserAgents    CommaSeparatedList `parser:"| \"set\" \"allow_useragents\" @String \";\")*"`
}

func (HTTPConfig) String ¶

func (b HTTPConfig) String() string

type HTTPGet ¶

type HTTPGet struct {
	Name string `parser:"@String? \"{\""`

	Verb   string             `parser:"( \"set\" \"verb\" @String \";\""`
	URI    SpaceSeparatedList `parser:"| \"set\" \"uri\" @String \";\""`
	Client HTTPGetClient      `parser:"| \"client\" \"{\" @@ \"}\""`
	Server HTTPServer         `parser:"| \"server\" \"{\" @@ \"}\" )* \"}\""`
}

func (HTTPGet) String ¶

func (b HTTPGet) String() string

type HTTPGetClient ¶

type HTTPGetClient struct {
	Headers    []Header    `parser:"( \"header\" @@ \";\""`
	Parameters []Parameter `parser:"| \"parameter\" @@ \";\""`
	Metadata   []Function  `parser:"| \"metadata\" \"{\" @@* \"}\" )*"`
}

func (HTTPGetClient) String ¶

func (b HTTPGetClient) String() string

type HTTPPost ¶

type HTTPPost struct {
	Name string `parser:"@String? \"{\""`

	Verb   string             `parser:"( \"set\" \"verb\" @String \";\""`
	URI    SpaceSeparatedList `parser:"| \"set\" \"uri\" @String \";\""`
	Client HTTPPostClient     `parser:"| \"client\" \"{\" @@ \"}\""`
	Server HTTPServer         `parser:"| \"server\" \"{\" @@ \"}\" )* \"}\""`
}

func (HTTPPost) String ¶

func (b HTTPPost) String() string

type HTTPPostClient ¶

type HTTPPostClient struct {
	Headers    []Header    `parser:"( \"header\" @@ \";\""`
	Parameters []Parameter `parser:"| \"parameter\" @@ \";\""`
	Output     []Function  `parser:"| \"output\" \"{\" @@* \"}\""`
	ID         []Function  `parser:"| \"id\" \"{\" @@* \"}\" )*"`
}

func (HTTPPostClient) String ¶

func (b HTTPPostClient) String() string

type HTTPSCertificate ¶

type HTTPSCertificate struct {
	Name string `parser:"@String? \"{\""`

	Keystore string `parser:"( \"set\" \"keystore\" @String \";\""`
	Password string `parser:"| \"set\" \"password\" @String \";\""`

	C        string `parser:"| \"set\" \"C\" @String \";\""`
	CN       string `parser:"| \"set\" \"CN\" @String \";\""`
	L        string `parser:"| \"set\" \"L\" @String \";\""`
	O        string `parser:"| \"set\" \"O\" @String \";\""`
	OU       string `parser:"| \"set\" \"OU\" @String \";\""`
	ST       string `parser:"| \"set\" \"ST\" @String \";\""`
	Validity int    `parser:"| \"set\" \"validity\" @String \";\")* \"}\""`
}

func (HTTPSCertificate) String ¶

func (b HTTPSCertificate) String() string

type HTTPServer ¶

type HTTPServer struct {
	Headers []Header   `parser:"( \"header\" @@ \";\""`
	Output  []Function `parser:"| \"output\" \"{\" @@* \"}\" )*"`
}

func (HTTPServer) String ¶

func (b HTTPServer) String() string

type HTTPStager ¶

type HTTPStager struct {
	Name string `parser:"@String? \"{\""`

	URIx86 SpaceSeparatedList `parser:"( \"set\" \"uri_x86\" @String \";\""`
	URIx64 SpaceSeparatedList `parser:"| \"set\" \"uri_x64\" @String \";\""`
	Client HTTPStagerClient   `parser:"| \"client\" \"{\" @@ \"}\""`
	Server HTTPServer         `parser:"| \"server\" \"{\" @@ \"}\" )* \"}\""`
}

func (HTTPStager) String ¶

func (b HTTPStager) String() string

type HTTPStagerClient ¶

type HTTPStagerClient struct {
	Headers    []Header    `parser:"( \"header\" @@ \";\""`
	Parameters []Parameter `parser:"| \"parameter\" @@ \";\" )*"`
}

func (HTTPStagerClient) String ¶

func (b HTTPStagerClient) String() string

type Header ¶

type Header struct {
	Name  string `parser:"@String"`
	Value string `parser:"@String"`
}

NOTE: key-value type with "header" prefix, used for headers parsing and (mostly) stringer, e.g. header "Accept-Encoding" "gzip, deflate";.

func (h Header) String() string

type Parameter ¶

type Parameter struct {
	Name  string `parser:"@String"`
	Value string `parser:"@String"`
}

NOTE: key-value type with "parameter" prefix, used for parameters parsing and (mostly) stringer, e.g. parameter "param_name" "param_value";.

func (Parameter) String ¶

func (p Parameter) String() string

type PostEx ¶

type PostEx struct {
	SpawnToX86  string  `parser:"( \"set\" \"spawnto_x86\" @String \";\""`
	SpawnToX64  string  `parser:"| \"set\" \"spawnto_x64\" @String \";\""`
	Obfuscate   Boolean `parser:"| \"set\" \"obfuscate\" @String \";\""`
	SmartInject Boolean `parser:"| \"set\" \"smartinject\" @String \";\""`
	AmsiDisable Boolean `parser:"| \"set\" \"amsi_disable\" @String \";\""`
	Cleanup     Boolean `parser:"| \"set\" \"cleanup\" @String \";\""`
	ThreadHint  string  `parser:"| \"set\" \"thread_hint\" @String \";\""`
	PipeName    string  `parser:"| \"set\" \"pipename\" @String \";\""`
	Keylogger   string  `parser:"| \"set\" \"keylogger\" @String \";\""`

	TransformX86 []Function `parser:"| \"transform-x86\" \"{\" @@* \"}\""`
	TransformX64 []Function `parser:"| \"transform-x64\" \"{\" @@* \"}\" )*"`
}

func (PostEx) String ¶

func (b PostEx) String() string

type ProcessInject ¶

type ProcessInject struct {
	Allocator      string  `parser:"( \"set\" \"allocator\" @String \";\""`
	BOFAllocator   string  `parser:"| \"set\" \"bof_allocator\" @String \";\""`
	BOFReuseMemory Boolean `parser:"| \"set\" \"bof_reuse_memory\" @String \";\""`
	MinAlloc       int     `parser:"| \"set\" \"min_alloc\" @String \";\""`
	UseRWX         Boolean `parser:"| \"set\" \"userwx\" @String \";\""`
	StartRWX       Boolean `parser:"| \"set\" \"startrwx\" @String \";\""`

	TransformX86 []Function `parser:"| \"transform-x86\" \"{\" @@* \"}\""`
	TransformX64 []Function `parser:"| \"transform-x64\" \"{\" @@* \"}\""`

	Execute []Function `parser:"| \"execute\" \"{\" @@* \"}\" )*"`
}

func (ProcessInject) String ¶

func (b ProcessInject) String() string

type Profile ¶

type Profile struct {
	SampleName           string             `parser:"( \"set\" \"sample_name\" @String \";\""`
	SleepTime            int                `parser:"| \"set\" \"sleeptime\" @String \";\""`
	Jitter               int                `parser:"| \"set\" \"jitter\" @String \";\""`
	UserAgent            string             `parser:"| \"set\" \"useragent\" @String \";\""`
	DataJitter           int                `parser:"| \"set\" \"data_jitter\" @String \";\""`
	HostStage            Boolean            `parser:"| \"set\" \"host_stage\" @String \";\""`
	Pipename             string             `parser:"| \"set\" \"pipename\" @String \";\""`
	PipenameStager       string             `parser:"| \"set\" \"pipename_stager\" @String \";\""`
	SMBFrameHeader       string             `parser:"| \"set\" \"smb_frame_header\" @String \";\""`
	TCPPort              int                `parser:"| \"set\" \"tcp_port\" @String \";\""`
	TCPFrameHeader       string             `parser:"| \"set\" \"tcp_frame_header\" @String \";\""`
	SSHBanner            string             `parser:"| \"set\" \"ssh_banner\" @String \";\""`
	SSHPipename          string             `parser:"| \"set\" \"ssh_pipename\" @String \";\""`
	StealTokenAccessMask int                `parser:"| \"set\" \"steal_token_access_mask\" @String \";\""`
	TasksMaxSize         int                `parser:"| \"set\" \"tasks_max_size\" @String \";\""`
	TasksProxyMaxSize    int                `parser:"| \"set\" \"tasks_proxy_max_size\" @String \";\""`
	TasksDNSProxyMaxSize int                `parser:"| \"set\" \"tasks_dns_proxy_max_size\" @String \";\""`
	HeadersRemove        CommaSeparatedList `parser:"| \"set\" \"headers_remove\" @String \";\""`

	DNSBeacon        []DNSBeacon        `parser:"| \"dns-beacon\" @@"`
	HTTPBeacon       []HTTPBeacon       `parser:"| \"http-beacon\" @@"`
	HTTPSCertificate []HTTPSCertificate `parser:"| \"https-certificate\" @@"`
	CodeSigner       CodeSigner         `parser:"| \"code-signer\" \"{\" @@ \"}\""`
	HTTPConfig       HTTPConfig         `parser:"| \"http-config\" \"{\" @@ \"}\""`
	HTTPGet          []HTTPGet          `parser:"| \"http-get\" @@"`
	HTTPPost         []HTTPPost         `parser:"| \"http-post\" @@"`
	HTTPStager       []HTTPStager       `parser:"| \"http-stager\" @@"`
	Stage            Stage              `parser:"| \"stage\" \"{\" @@ \"}\""`
	ProcessInject    ProcessInject      `parser:"| \"process-inject\" \"{\" @@ \"}\""`
	PostEx           PostEx             `parser:"| \"post-ex\" \"{\" @@ \"}\" )*"`
}

func Parse ¶

func Parse(data io.Reader) (*Profile, error)

Parse Cobalt-Strike MalleableC2 profile.

func (Profile) String ¶

func (d Profile) String() string

type SpaceSeparatedList ¶ added in v1.1.0

type SpaceSeparatedList []string

NOTE: default space-separated string list parser and stringer, e.g. /jquery-3.3.1.min.js /jquery-1.3.3.7.min.js /someotherurl.

func (*SpaceSeparatedList) Capture ¶ added in v1.1.0

func (l *SpaceSeparatedList) Capture(values []string) error

func (SpaceSeparatedList) String ¶ added in v1.1.0

func (l SpaceSeparatedList) String() string

type Stage ¶

type Stage struct {
	Checksum      int     `parser:"( \"set\" \"checksum\" @String \";\""`
	CompileTime   string  `parser:"| \"set\" \"compile_time\" @String \";\""`
	EntryPoint    int     `parser:"| \"set\" \"entry_point\" @String \";\""`
	ImageSizeX86  int     `parser:"| \"set\" \"image_size_x86\" @String \";\""`
	ImageSizeX64  int     `parser:"| \"set\" \"image_size_x64\" @String \";\""`
	Name          string  `parser:"| \"set\" \"name\" @String \";\""`
	RichHeader    string  `parser:"| \"set\" \"rich_header\" @String \";\""`
	UseRWX        Boolean `parser:"| \"set\" \"userwx\" @String \";\""`
	Cleanup       Boolean `parser:"| \"set\" \"cleanup\" @String \";\""`
	SleepMask     Boolean `parser:"| \"set\" \"sleep_mask\" @String \";\""`
	StompPE       Boolean `parser:"| \"set\" \"stomppe\" @String \";\""`
	Obfuscate     Boolean `parser:"| \"set\" \"obfuscate\" @String \";\""`
	Allocator     string  `parser:"| \"set\" \"allocator\" @String \";\""`
	MagicMZX86    string  `parser:"| \"set\" \"magic_mz_x86\" @String \";\""`
	MagicMZX64    string  `parser:"| \"set\" \"magic_mz_x64\" @String \";\""`
	MagicPE       string  `parser:"| \"set\" \"magic_pe\" @String \";\""`
	SmartInject   Boolean `parser:"| \"set\" \"smartinject\" @String \";\""`
	ModuleX86     string  `parser:"| \"set\" \"module_x86\" @String \";\""`
	ModuleX64     string  `parser:"| \"set\" \"module_x64\" @String \";\""`
	SyscallMethod string  `parser:"| \"set\" \"syscall_method\" @String \";\""`

	TransformX86 []Function `parser:"| \"transform-x86\" \"{\" @@* \"}\""`
	TransformX64 []Function `parser:"| \"transform-x64\" \"{\" @@* \"}\""`

	Data      []Data    `parser:"| \"data\" @String \";\""`
	Strings   []String  `parser:"| \"string\" @String \";\""`
	SwtringsW []StringW `parser:"| \"stringw\" @String \";\" )*"`
}

func (Stage) String ¶

func (b Stage) String() string

type String ¶

type String string

NOTE: parser and stringer for "string" function.

func (String) String ¶

func (s String) String() string

type StringW ¶

type StringW string

NOTE: parser and stringer for "stringw" function.

func (StringW) String ¶

func (s StringW) String() string

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

README ¶

goMalleable

Table of Contents

WARNING

Installation

Usage

Parse

Assembly

Examples

TODO

Documentation ¶

Index ¶

Constants ¶

Variables ¶

Functions ¶

Types ¶

type Boolean ¶

func (*Boolean) Capture ¶

type CodeSigner ¶

func (CodeSigner) String ¶

type CommaSeparatedList ¶

func (*CommaSeparatedList) Capture ¶

func (CommaSeparatedList) String ¶

type DNSBeacon ¶

func (DNSBeacon) String ¶

type Data ¶

func (Data) String ¶

type Function ¶

func (Function) String ¶

type HTTPBeacon ¶ added in v1.1.0

func (HTTPBeacon) String ¶ added in v1.1.0

type HTTPConfig ¶

func (HTTPConfig) String ¶

type HTTPGet ¶

func (HTTPGet) String ¶

type HTTPGetClient ¶

func (HTTPGetClient) String ¶

type HTTPPost ¶

func (HTTPPost) String ¶

type HTTPPostClient ¶

func (HTTPPostClient) String ¶

type HTTPSCertificate ¶

func (HTTPSCertificate) String ¶

type HTTPServer ¶

func (HTTPServer) String ¶

type HTTPStager ¶

func (HTTPStager) String ¶

type HTTPStagerClient ¶

func (HTTPStagerClient) String ¶

type Header ¶

func (Header) String ¶

type Parameter ¶

func (Parameter) String ¶

type PostEx ¶

func (PostEx) String ¶

type ProcessInject ¶

func (ProcessInject) String ¶

type Profile ¶

func Parse ¶

func (Profile) String ¶

type SpaceSeparatedList ¶ added in v1.1.0

func (*SpaceSeparatedList) Capture ¶ added in v1.1.0

func (SpaceSeparatedList) String ¶ added in v1.1.0

type Stage ¶

func (Stage) String ¶

type String ¶

func (String) String ¶

type StringW ¶

func (StringW) String ¶

Source Files ¶