prelude

README

Prelude

The prelude package handles the connection with Prelude's Operator platform.

Documentation

Index

• Constants
• func MakeRequest(a ActiveImplant) *commonpb.Request
• func RunCommand(message string, executor string, payload []byte, ...) (string, int, int)
• type ActiveImplant
• type AgentConfig
  • func (c *AgentConfig) BuildExecutingHash() string
  • func (c *AgentConfig) EndInstruction(instruction Instruction)
  • func (c *AgentConfig) StartInstruction(instruction Instruction) bool
  • func (c *AgentConfig) StartInstructions(instructions []Instruction) (ret []Instruction)
• type Configuration
• type Instruction
• type OperatorBeacon
• type OperatorConfig
• type OperatorImplantBridge
  • func NewImplantBridge(c *net.Conn, a ActiveImplant, rpc rpcpb.SliverRPCClient, ...) *OperatorImplantBridge
  • func (a *OperatorImplantBridge) ReceiveLoop()
• type OperatorImplantMapper
  • func InitImplantMapper(conf *OperatorConfig) *OperatorImplantMapper
  • func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string, func(*clientpb.BeaconTask))) error
  • func (p *OperatorImplantMapper) GetConfig() *OperatorConfig
  • func (p *OperatorImplantMapper) RemoveImplant(imp ActiveImplant) (err error)

Constants

const (
	ErrorExitStatus   = -1
	SuccessExitStatus = 0
)

Functions

func MakeRequest

func MakeRequest(a ActiveImplant) *commonpb.Request

func RunCommand

func RunCommand(message string, executor string, payload []byte, agentSession *OperatorImplantBridge, onFinish func(string, int, int)) (string, int, int)

RunCommand executes a given command

Types

type ActiveImplant

type ActiveImplant interface {
	GetID() string
	GetHostname() string
	GetPID() int32
	GetOS() string
	GetArch() string
	GetFilename() string
	GetReconnectInterval() int64
}

ActiveImplant exposes common methods between Sliver clientpb.Session and clientpb.Beacon that are required by Operator implants

type AgentConfig

type AgentConfig struct {
	Name           string
	AESKey         string
	Range          string
	Contact        string
	Address        string
	Useragent      string
	Sleep          int
	KillSleep      int
	CommandJitter  int
	CommandTimeout int
	Pid            int
	Proxy          string
	Debug          bool
	Executing      map[string]Instruction
}

func (*AgentConfig) BuildExecutingHash

func (c *AgentConfig) BuildExecutingHash() string

func (*AgentConfig) EndInstruction

func (c *AgentConfig) EndInstruction(instruction Instruction)

func (*AgentConfig) StartInstruction

func (c *AgentConfig) StartInstruction(instruction Instruction) bool

func (*AgentConfig) StartInstructions

func (c *AgentConfig) StartInstructions(instructions []Instruction) (ret []Instruction)

type Configuration

type Configuration interface {
	ApplyConfig(ac map[string]interface{})
	BuildBeacon() OperatorBeacon
}

type Instruction

type Instruction struct {
	ID       string `json:"ID"`
	Executor string `json:"Executor"`
	Payload  string `json:"Payload"`
	Request  string `json:"Request"`
	Response string
	Status   int
	Pid      int
}

type OperatorBeacon

type OperatorBeacon struct {
	Name      string
	Target    string
	Hostname  string
	Location  string
	Platform  string
	Executors []string
	Range     string
	Sleep     int
	Pwd       string
	Executing string
	Links     []Instruction
}

type OperatorConfig

type OperatorConfig struct {
	Range       string
	OperatorURL string
	RPC         rpcpb.SliverRPCClient
	AESKey      string
}

type OperatorImplantBridge

type OperatorImplantBridge struct {
	Conn           *net.Conn
	Implant        ActiveImplant
	RPC            rpcpb.SliverRPCClient
	PBeacon        OperatorBeacon
	BeaconCallback func(string, func(*clientpb.BeaconTask))
	Config         AgentConfig
	// contains filtered or unexported fields
}

OperatorImplantBridge maps the Sliver implants (whether it be a beacon or a session) to a Prelude Operator implant with a TCP transport.

func NewImplantBridge

func NewImplantBridge(c *net.Conn, a ActiveImplant, rpc rpcpb.SliverRPCClient, pbeacon OperatorBeacon, conf AgentConfig, callback func(string, func(*clientpb.BeaconTask))) *OperatorImplantBridge

func (*OperatorImplantBridge) ReceiveLoop

func (a *OperatorImplantBridge) ReceiveLoop()

type OperatorImplantMapper

type OperatorImplantMapper struct {
	sync.Mutex
	// contains filtered or unexported fields
}

OperatorImplantMapper maps an OperatorConfig with active Sliver implant sessions/beacons

var ImplantMapper *OperatorImplantMapper

func InitImplantMapper

func InitImplantMapper(conf *OperatorConfig) *OperatorImplantMapper

func (*OperatorImplantMapper) AddImplant

func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string, func(*clientpb.BeaconTask))) error

func (*OperatorImplantMapper) GetConfig

func (p *OperatorImplantMapper) GetConfig() *OperatorConfig

func (*OperatorImplantMapper) RemoveImplant

func (p *OperatorImplantMapper) RemoveImplant(imp ActiveImplant) (err error)