task

package
v0.2.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 16, 2022 License: GPL-3.0 Imports: 20 Imported by: 1

Documentation

Overview

Package task is a simple collection of Task based functions that cane be tasked to Sessions by the Server.

THis package is separate rom the c2 package to allow for seperation and containerization of Tasks.

Basic internal Tasks are still help in the c2 package.

Index

Constants

View Source 
const (
	MvRefresh uint8 = 0x07
	MvTime    uint8 = 0x08
	MvPwd     uint8 = 0x09
	MvCwd     uint8 = 0x0A
	MvProxy   uint8 = 0x0B
	MvSpawn   uint8 = 0x0C
	MvMigrate uint8 = 0x0D
	MvElevate uint8 = 0x0E
	MvList    uint8 = 0x0F
	MvMounts  uint8 = 0x10
	MvRevSelf uint8 = 0x11
	MvProfile uint8 = 0x12
	MvScript  uint8 = 0xF0 // TODO(dij): setup

	// Built in Task Message ID Values
	TvDownload    uint8 = 0xC0
	TvUpload      uint8 = 0xC1
	TvExecute     uint8 = 0xC2
	TvAssembly    uint8 = 0xC3
	TvZombie      uint8 = 0xC4
	TvDLL         uint8 = 0xC5
	TvCheckDLL    uint8 = 0xC6
	TvReloadDLL   uint8 = 0xC7
	TvPull        uint8 = 0xC8
	TvPullExecute uint8 = 0xC9
	TvRename      uint8 = 0xCA
	TvScreenShot  uint8 = 0xCB
	TvProcDump    uint8 = 0xCC
	TvProcList    uint8 = 0xCD
	TvRegistry    uint8 = 0xCE
	TvSystemIO    uint8 = 0xCF
)

The Mv* Packet ID values are built-in task values that are handled directory before the Mux, as these are critical for operations.

Tv* ID values are standard ID values for Tasks that are handled here.

Variables

View Source 
var Mappings = [0xFF]Tasker{
	TvDownload:    taskDownload,
	TvUpload:      taskUpload,
	TvExecute:     taskProcess,
	TvAssembly:    taskAssembly,
	TvPull:        taskPull,
	TvPullExecute: taskPullExec,
	TvZombie:      taskZombie,
	TvDLL:         taskInject,
	TvCheckDLL:    taskCheck,
	TvReloadDLL:   taskReload,
	TvRename:      taskRename,
	TvScreenShot:  taskScreenShot,
	TvProcDump:    taskProcDump,
	TvProcList:    taskProcList,
	TvRegistry:    taskRegistry,
	TvSystemIO:    taskSystemIo,
}

Mappings is an fixed size array that contains the Tasker mappings for each ID value.

Values that are less than 22 are ignored. Adding a mapping to here will allow it to be executed via the client Scheduler.

Functions

func AssemblyUnmarshal added in v0.2.0 

func AssemblyUnmarshal(x context.Context, r data.Reader) (*cmd.Assembly, bool, error)

AssemblyUnmarshal will read this Assembly's struct data from the supplied reader and returns a Assembly runnable struct along with the wait boolean.

This function returns an error if building or reading fails.

func CheckDLL added in v0.2.0 

func CheckDLL(d string) *com.Packet

CheckDLL is a similar function to ReloadDLL. This function will return 'true' if the contents in memory match the contents of the file on disk. Otherwise it returns false.

Always returns 'ErrNoWindows' on non-Windows devices.

C2 Details: 

ID: TvCheckDLL

Input:
    string // DLL Name
Output:
    bool   // DLL Check result, true if normal.

func Copy added in v0.2.5 

func Copy(src, dst string) *com.Packet

Copy returns a file copy Packet. This can be used to instruct to copy the specified source file to the specified destination path.

The source and destination paths may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvSystemIO

Input:
    uint8  // IO Type
    string // Source
    string // Destination
Output:
    uint8  // IO Type
    string // Expanded Destination Path
    uint64 // Byte Count Written

func Cwd added in v0.1.0 

func Cwd(d string) *com.Packet

Cwd returns a change directory Packet. This can be used to instruct the client to change from it's current working directory to the directory specified.

Empty or invalid directory entires will return an error.

The source path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: MvCwd

Input:
    string // Directory
Output:
    <none>

func DLLUnmarshal added in v0.2.0 

func DLLUnmarshal(_ context.Context, _ data.Reader) (*cmd.DLL, bool, bool, error)

DLLUnmarshal will read this DLL's struct data from the supplied reader and returns a DLL runnable struct along with the wait and delete status booleans.

This function returns an error if building or reading fails or if the device is not running Windows.

func Delete added in v0.2.5 

func Delete(s string, recurse bool) *com.Packet

Delete returns a file delete Packet. This can be used to instruct to delete the specified file if it exists.

Specify 'recurse' to True to delete a non-empty directory and all files in it.

The path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvSystemIO

Input:
    uint8  // IO Type
    string // Path
Output:
    uint8  // IO Type

func Download 

func Download(src string) *com.Packet

Download returns a download Packet. This will instruct the client to read the (client local) filepath provided and return the raw binary data.

The source path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvDownload

Input:
    string // Target
Output:
    string // Expanded Target Path
    bool   // Target is Directory
    int64  // Size
    []byte // Data

func Elevate added in v0.2.0 

func Elevate(f *filter.Filter) *com.Packet

Elevate returns an evelate Packet. This will instruct the client to use the provided Filter to attempt to get a Token handle to an elevated process. If the Filter is nil, then the client will attempt at any elevated process.

C2 Details: 

ID: MvElevate

Input:
    Filter struct { // Filter
        bool        // Filter Status
        uint32      // PID
        bool        // Fallback
        uint8       // Session
        uint8       // Elevated
        []string    // Exclude
        []string    // Include
    }
Output:
    <none>

func Kill added in v0.2.5 

func Kill(p uint32) *com.Packet

Kill returns a process kill Packet. This can be used to instruct to send a SIGKILL signal to the specified process by the specified Process ID.

C2 Details: 

ID: TvSystemIO

Input:
    uint8  // IO Type
    uint32 // PID
Output:
    uint8  // IO Type

func KillName added in v0.2.5 

func KillName(s string) *com.Packet

KillName returns a process kill Packet. This can be used to instruct to send a SIGKILL signal all to the specified processes that have the specified name.

NOTE: This kills all processes that share this name.

C2 Details: 

ID: TvSystemIO

Input:
    uint8  // IO Type
    string // Process Name
Output:
    uint8  // IO Type

func Ls added in v0.1.0 

func Ls(d string) *com.Packet

Ls returns a file list Packet. This can be used to instruct the client to return a string and bool list of the files in the directory specified.

If 'd' is empty, the current working directory "." is used.

The source path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: MvList

Input:
    string          // Directory
Output:
    uint32          // Count
    []File struct { // List of Files
        string      // Name
        int32       // Mode
        uint64      // Size
        int64       // Modtime
    }

func Migrate added in v0.2.0 

func Migrate(f *filter.Filter, s string, c Callable) *com.Packet

Migrate -

func MigrateProfile added in v0.2.0 

func MigrateProfile(f *filter.Filter, s string, b []byte, c Callable) *com.Packet

MigrateProfile -

func MigrateProfileEx added in v0.2.0 

func MigrateProfileEx(f *filter.Filter, w bool, s string, b []byte, c Callable) *com.Packet

MigrateProfileEx -

func MigratePull added in v0.2.0 

func MigratePull(f *filter.Filter, s, url string) *com.Packet

MigratePull -

func MigratePullProfile added in v0.2.0 

func MigratePullProfile(f *filter.Filter, s string, b []byte, url string) *com.Packet

MigratePullProfile -

func MigratePullProfileEx added in v0.2.0 

func MigratePullProfileEx(f *filter.Filter, w bool, s string, b []byte, url string) *com.Packet

MigratePullProfileEx -

func Mounts added in v0.2.0 

func Mounts() *com.Packet

Mounts returns a list mounted drives Packet. This can be used to instruct the client to return a string list of all the mount points on the host device.

C2 Details: 

ID: MvMounts

Input:
    <none>
Output:
    []string // Mount Paths List

func Move added in v0.2.5 

func Move(src, dst string) *com.Packet

Move returns a file move Packet. This can be used to instruct to move the specified source file to the specified destination path.

The source and destination paths may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvSystemIO

Input:
    uint8  // IO Type
    string // Source
    string // Destination
Output:
    uint8  // IO Type
    string // Expanded Destination Path
    uint64 // Byte Count Written

func ProcessDump added in v0.2.2 

func ProcessDump(f *filter.Filter) *com.Packet

ProcessDump will instruct the client to attempt to read and download then memory of the filter target. The returned data is a binary blob of the memory if successful.

C2 Details: 

ID: TvProcDump

Input:
    Filter struct { // Filter
        bool        // Filter Status
        uint32      // PID
        bool        // Fallback
        uint8       // Session
        uint8       // Elevated
        []string    // Exclude
        []string    // Include
    }
Output:
    []byte // Data

func ProcessList added in v0.2.2 

func ProcessList() *com.Packet

ProcessList returns a list processes Packet. This can be used to instruct the client to return a list of the current running host's processes.

C2 Details: 

ID: TvProcList

Input:
    <none>
Output:
    uint32              // Count
    []cmd.ProcessInfo { // List of Running Processes
        uint32          // Process ID
        uint32          // Parent Process ID
        string          // Process Image Name
    }

func ProcessName added in v0.2.2 

func ProcessName(s string) *com.Packet

ProcessName returns a process name change Packet. This can be used to instruct the client to change from it's current in-memory name to the specified string.

C2 Details: 

ID: TvRename

Input:
    string // New Process Name
Output:
    <none>

func ProcessUnmarshal added in v0.2.0 

func ProcessUnmarshal(x context.Context, r data.Reader) (*cmd.Process, bool, error)

ProcessUnmarshal will read this Processes's struct data from the supplied reader and returns a Process runnable struct along with the wait boolean.

This function returns an error if building or reading fails.

func Proxy added in v0.2.4 

func Proxy(name, addr string, p []byte) *com.Packet

Proxy returns an add Proxy Packet. This can be used to instruct the client to attempt to add the specified Proxy with the name, bind address and Profile bytes.

Returns an error if Proxy support is disabled, a listen/setup error occurs or the name already is in use.

C2 Details: 

ID: MvProxy

Input:
    string // Proxy Name (may be empty)
    bool   // Always set to false for this task.
    string // Proxy Bind Address
    []byte // Proxy Profile
Output:
    <none>

func ProxyRemove added in v0.2.4 

func ProxyRemove(name string) *com.Packet

ProxyRemove returns a remove Proxy Packet. This can be used to instruct the client to attempt to remove the Proxy setup by the name, or the single Proxy instance (if multi-proxy mode is disabled).

Returns an NotFound error if the Proxy is not registered or Proxy support is disabled

C2 Details: 

ID: MvProxy

Input:
    string // Proxy Name (may be empty)
    bool   // Always set to true for this task.
Output:
    <none>

func Pull added in v0.1.0 

func Pull(url, path string) *com.Packet

Pull returns a pull Packet. This will instruct the client to download the resource from the provided URL and write the data to the supplied local filesystem path.

The path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvPull

Input:
    string // URL
    string // Target Path
Output:
    string // Expanded Destination Path
    uint64 // Byte Count Written

func PullExecute added in v0.2.0 

func PullExecute(url string, w bool, f *filter.Filter) *com.Packet

PullExecute returns a pull and execute Packet. This will instruct the client to download the resource from the provided URL and execute the downloaded data.

The download data may be saved in a temporary location depending on what the resulting data type is or file extension. (see 'man.ParseDownloadHeader')

This function allows for specifying a Filter struct to specify the target parent process and the boolean flag can be set to true/false to specify if the task should wait for the process to exit.

Returns the same output as the 'Run*' tasks.

C2 Details: 

ID: TvPullExecute

Input:
    string          // URL
    bool            // Wait
    Filter struct { // Filter
        bool        // Filter Status
        uint32      // PID
        bool        // Fallback
        uint8       // Session
        uint8       // Elevated
        []string    // Exclude
        []string    // Include
    }
Output:
    uint32          // PID
    int32           // Exit Code

func Pwd added in v0.1.0 

func Pwd() *com.Packet

Pwd returns a print current directory Packet. This can be used to instruct the client to return a string value that contains the current working directory.

C2 Details: 

ID: MvPwd

Input:
    <none>
Output:
    string // Working Dir

func Refresh added in v0.2.0 

func Refresh() *com.Packet

Refresh returns a refresh Packet. This will instruct the client to re-update it's internal Device storage and return the new result. This can be used to detect new network interfaces added/removed and changes to hostname/user status.

This is NOT needed after a Migration, as this happens automatically.

C2 Details: 

ID: MvRefresh

Input:
    <none>
Output:
    Machine // Updated device details

func RegDelete added in v0.2.3 

func RegDelete(key, value string, force bool) *com.Packet

RegDelete returns a delete key/value Packet. This can be used to instruct the client to delete a key or value at the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    string // Value Name
    bool   // Delete Recursively or Delete non-empty Keys
Output:
    uint8  // Operation

func RegDeleteKey added in v0.2.3 

func RegDeleteKey(key string, force bool) *com.Packet

RegDeleteKey returns a delete key Packet. This can be used to instruct the client to delete a key at the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    bool   // Delete Recursively or Delete non-empty Keys
Output:
    uint8  // Operation

func RegGet added in v0.2.3 

func RegGet(key, value string) *com.Packet

RegGet returns a get key/value Packet. This can be used to instruct the client to return a entry details for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8          // Operation
    string         // Key Path
    string         // Value Name
Output:
    uint8          // Operation
    Entry struct { // Entry
        string     // Name
        uint32     // Type
        []byte     // Data
    }

func RegLs added in v0.2.3 

func RegLs(s string) *com.Packet

RegLs returns a list registry keys/values Packet. This can be used to instruct the client to return a list of Registry entries for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8            // Operation
    string           // Key Path
Output:
    uint8            // Operation
    uint32           // Count
    []Entry struct { // List of Entries
        string       // Name
        uint32       // Type
        []byte       // Data
    }

func RegMakeKey added in v0.2.3 

func RegMakeKey(key string) *com.Packet

RegMakeKey returns a make registry key Packet. This can be used to instruct the client to make a key at specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
Output:
    uint8  // Operation

func RegSet added in v0.2.3 

func RegSet(key, value string, t uint32, b []byte) *com.Packet

RegSet returns a set content key/value Packet. This can be used to instruct the client to set the raw value content to the supplied raw bytes for the specified registry path along with the type.

C2 Details: 

ID: TvRegistry

Input:
    uint8   // Operation
    string  // Key Path
    string  // Value Name
    uint32  // Type
    []byte  // Content
Output:
    uint8  // Operation

func RegSetBytes added in v0.2.3 

func RegSetBytes(key, value string, b []byte) *com.Packet

RegSetBytes returns a set as a BINARY (bytes) key/value Packet. This can be used to instruct the client to set the value content to the supplied bytes for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    string // Value Name
    []byte // Content
Output:
    uint8  // Operation

func RegSetDword added in v0.2.3 

func RegSetDword(key, value string, v uint32) *com.Packet

RegSetDword returns a set as a DWORD (uint32) key/value Packet. This can be used to instruct the client to set the value content to the supplied DWORD for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    string // Value Name
    uint32 // Content
Output:
    uint8  // Operation

func RegSetExpandString added in v0.2.3 

func RegSetExpandString(key, value, v string) *com.Packet

RegSetExpandString returns a set as expand string key/value Packet. This can be used to instruct the client to set the value content to the supplied string for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    string // Value Name
    string // Content
Output:
    uint8  // Operation

func RegSetQword added in v0.2.3 

func RegSetQword(key, value string, v uint64) *com.Packet

RegSetQword returns a set as QWORD (uint64) key/value Packet. This can be used to instruct the client to set the value content to the supplied QWORD for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    string // Value Name
    uint64 // Content
Output:
    uint8  // Operation

func RegSetString added in v0.2.3 

func RegSetString(key, value, v string) *com.Packet

RegSetString returns a set as string key/value Packet. This can be used to instruct the client to set the value content to the supplied string for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8  // Operation
    string // Key Path
    string // Value Name
    string // Content
Output:
    uint8  // Operation

func RegSetStringList added in v0.2.3 

func RegSetStringList(key, value string, v []string) *com.Packet

RegSetStringList returns a set as multi string key/value Packet. This can be used to instruct the client to set the value content to the supplied strings for the specified registry path.

C2 Details: 

ID: TvRegistry

Input:
    uint8    // Operation
    string   // Key Path
    string   // Value Name
    []string // Content
Output:
    uint8  // Operation

func RegisterEngine 

func RegisterEngine(i uint8, s Engine) error

RegisterEngine is a function that can be used to register a Scripting engine into the XMT client tasking runtime.

Script engines can increase the footprint of the compiled binary, so engines must be registed manually.

See the 'cmd/script' package for scripting engines.

C2 Details: 

ID: <Supplied>

Input:
    string (script)
Output:
    string (output)

func ReloadDLL added in v0.2.0 

func ReloadDLL(d string) *com.Packet

ReloadDLL is a function shamelessly stolen from the sliver project. This function will read a DLL file from on-disk and rewrite over it's current in-memory contents to erase any hooks placed on function calls.

Re-mastered and refactored to be less memory hungry and easier to read :P

Orig src here: 

https://github.com/BishopFox/sliver/blob/f94f0fc938ca3871390c5adfa71bf4edc288022d/implant/sliver/evasion/evasion_windows.go#L116

Always returns 'ErrNoWindows' on non-Windows devices.

C2 Details: 

ID: TvReloadDLL

Input:
    string // DLL Name
Output:
    <none>

func RevToSelf added in v0.2.0 

func RevToSelf() *com.Packet

RevToSelf returns a Rev2Self Packet. This can be used to instruct Windows based devices to drop any previous elevated Tokens they may posess and return to their "normal" Token.

This task result does not return any data, only errors if it fails.

C2 Details: 

ID: MvRevSelf

Input:
    <none>
Output:
    <none>

func ScreenShot added in v0.2.2 

func ScreenShot() *com.Packet

ScreenShot returns a screenshot Packet. This will instruct the client to attempt to get a screenshot of all the current active desktops on the host. If successful, the returned data is a binary blob of the resulting image, encoded in the PNG image format.

C2 Details: 

ID: TVScreenShot

Input:
    <none>
Output:
    []byte // Data

func Spawn added in v0.2.0 

func Spawn(f *filter.Filter, s string, c Callable) *com.Packet

Spawn -

func SpawnProfile added in v0.2.0 

func SpawnProfile(f *filter.Filter, s string, b []byte, c Callable) *com.Packet

SpawnProfile -

func SpawnPull added in v0.2.0 

func SpawnPull(f *filter.Filter, s, url string) *com.Packet

SpawnPull -

func SpawnPullProfile added in v0.2.0 

func SpawnPullProfile(f *filter.Filter, s string, b []byte, url string) *com.Packet

SpawnPullProfile -

func Touch added in v0.2.5 

func Touch(s string) *com.Packet

Touch returns a file touch Packet. This can be used to instruct to create the specified file if it does not exist.

The path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvSystemIO

Input:
    uint8  // IO Type
    string // Path
Output:
    uint8  // IO Type

func Upload 

func Upload(dst string, b []byte) *com.Packet

Upload returns a upload Packet. This will instruct the client to write the provided byte array to the filepath provided. The client will return the number of bytes written and the resulting expanded file path.

The destination path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvUpload

Input:
    string // Destination
    []byte // File Data
Output:
    string // Expanded Destination Path
    uint64 // Byte Count Written

func UploadFile added in v0.1.0 

func UploadFile(dst, src string) (*com.Packet, error)

UploadFile returns a upload Packet. This will instruct the client to write the provided (server local) file content to the filepath provided. The client will return the number of bytes written and the resulting expanded file path.

The destination path may contain environment variables that will be resolved during runtime.

The source path may contain environment variables that will be resolved on server execution.

C2 Details: 

ID: TvUpload

Input:
    string // Destination
    []byte // File Data
Output:
    string // Expanded Destination Path
    uint64 // Byte Count Written

func UploadReader added in v0.1.0 

func UploadReader(dst string, r io.Reader) (*com.Packet, error)

UploadReader returns a upload Packet. This will instruct the client to write the provided reader content to the filepath provided. The client will return the number of bytes written and the resulting file path.

The destination path may contain environment variables that will be resolved during runtime.

C2 Details: 

ID: TvUpload

Input:
    string // Destination
    []byte // File Data
Output:
    string // Expanded Destination Path
    uint64 // Byte Count Written

func WebResource added in v0.2.0 

func WebResource(x context.Context, w data.Writer, z bool, u string) (cmd.Runnable, string, error)

WebResource will attempt to download the URL target at 'u' and parse the data into a Runnable interface.

The passed Writer will be passed as Stdout/Stderr to certain processes if the 'z' flag is true.

The returned string is the full expanded path if a temporary file is created. It's the callers responsibility to delete this file when not needed.

This function uses the 'man.ParseDownloadHeader' function to assist with determining the executable type.

func ZombieUnmarshal added in v0.2.0 

func ZombieUnmarshal(_ context.Context, _ data.Reader) (*cmd.Zombie, bool, bool, error)

ZombieUnmarshal will read this Zombies's struct data from the supplied reader and returns a Zombie runnable struct along with the wait and delete status booleans.

This function returns an error if building or reading fails or if the device is not running Windows.

Types

type Assembly added in v0.1.0 

type Assembly struct {
	Filter  *filter.Filter
	Data    []byte
	Timeout time.Duration
	Wait    bool
}

Assembly is a Tasklet that is similar to the 'cmd.Assembly' struct.

This struct is used to Task a Client with running shellcode on devices. It has many of the functionallies matching the 'cmd.Assembly' struct.

This can be directly used in the Session 'Tasklet' function instead of directly creating a Task.

The 'SetParent' function will attempt to set the target that runs the shellcode. If none are specified, the shellcode will be injected into the client process.

C2 Details: 

ID: TvAssembly

Input:
    Assembly struct {
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Assembly Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func AssemblyFile added in v0.2.0 

func AssemblyFile(s string) (*Assembly, error)

AssemblyFile will create a Tasklet that will instruct the client to run shellcode from a file source on the local (server - the one calling this function) machine.

This will attempt to read the file and will return an error if it fails.

C2 Details: 

ID: TvAssembly

Input:
    Assembly struct {
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Assembly Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func AssemblyReader added in v0.2.0 

func AssemblyReader(r io.Reader) (*Assembly, error)

AssemblyReader will create a Tasklet that will instruct the client to run shellcode from the contents of the supplied Reader.

This will attempt to read from the Reader and will return an error if it fails.

C2 Details: 

ID: TvAssembly

Input:
    Assembly struct {
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Assembly Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func (Assembly) MarshalStream added in v0.1.0 

func (a Assembly) MarshalStream(w data.Writer) error

MarshalStream writes the data for this Code thread to the supplied Writer.

func (Assembly) Packet added in v0.2.0 

func (a Assembly) Packet() (*com.Packet, error)

Packet will take the configured Assembly options and will return a Packet and any errors that may occur during building.

This allows the Assembly struct to fulfil the 'Tasklet' interface.

C2 Details: 

ID: TvAssembly

Input:
    Assembly struct {
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Assembly Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func (*Assembly) UnmarshalStream added in v0.1.0 

func (a *Assembly) UnmarshalStream(r data.Reader) error

UnmarshalStream reads the data for this Code thread from the supplied Reader.

type Callable added in v0.2.0 

type Callable interface {
	MarshalStream(data.Writer) error
	// contains filtered or unexported methods
}

Callable is an internal interface used to specify a wide range of Runnabale types that can be Marshaled into a Packet.

Currently the DLL, Zombie, Assembly and Process instances are supported.

type DLL added in v0.2.0 

type DLL struct {
	Filter *filter.Filter

	Path    string
	Data    []byte
	Wait    bool
	Timeout time.Duration
}

DLL is a Tasklet that is similar to the 'cmd.DLL' struct. This is used to Task a Client with loading a DLL.

The Path parameter is the path (on the client) where the DLL is located. This may be omitted and Data can be filled instead with the raw binary data to send and load a remote DLL instead. (THIS WILL MAKE A WRITE TO DISK!)

To prevent writes to disk, use the 'cmd.DLLToASM' function on the server (or any non 'implant' tagged build) to build a shellcode DLL+loader using SRDi and launch as Assembly instead.

This can be directly used in the Session 'Tasklet' function instead of directly creating a Task.

The Filter attribute will attempt to set the target that runs the Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: TvDLL

Input:
    DLL struct {
        string          // Path
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Raw DLL Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func DLLFile added in v0.2.0 

func DLLFile(s string) (*DLL, error)

DLLFile will create a Tasklet that will instruct the client to local a DLL from the specified local (server - the one calling this function) file source. (THIS WILL MAKE A WRITE TO DISK!)

To prevent writes to disk, use the 'cmd.DLLToASM' function on the server (or any non 'implant' tagged build) to build a shellcode DLL+loader using SRDi and launch as Assembly instead.

The Filter attribute will attempt to set the target that runs the Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: WvInjectDLL

Input:
    DLL struct {
        string          // Path
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Raw DLL Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func DLLReader added in v0.2.0 

func DLLReader(r io.Reader) (*DLL, error)

DLLReader will create a Tasklet that will instruct the client to local a DLL from the specified reader source. (THIS WILL MAKE A WRITE TO DISK!)

To prevent writes to disk, use the 'cmd.DLLToASM' function on the server (or any non 'implant' tagged build) to build a shellcode DLL+loader using SRDi and launch as Assembly instead.

The Filter attribute will attempt to set the target that runs the Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: WvInjectDLL

Input:
    DLL struct {
        string          // Path
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Raw DLL Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func (DLL) MarshalStream added in v0.2.0 

func (d DLL) MarshalStream(w data.Writer) error

MarshalStream writes the data for this DLL task to the supplied Writer.

func (DLL) Packet added in v0.2.0 

func (d DLL) Packet() (*com.Packet, error)

Packet will take the configured DLL options and will return a Packet and any errors that may occur during building.

This allows the DLL struct to fulfil the 'Tasklet' interface.

C2 Details: 

ID: TvDLL

Input:
    DLL struct {
        string          // Path
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Raw DLL Data
    }
Output:
    uint64              // Handle
    uint32              // PID
    int32               // Exit Code

func (*DLL) UnmarshalStream added in v0.2.0 

func (d *DLL) UnmarshalStream(r data.Reader) error

UnmarshalStream reads the data for this DLL task from the supplied Reader.

type Engine 

type Engine interface {
	Invoke(context.Context, map[string]interface{}, string) (string, error)
}

Engine is an interface that allows for extending XMT with non-compiled code for easy deployability and flexibility.

Each Script interface contains a single function that will take a Context, an environment block and the script code string.

The result of this function will be the output of the script and any errors that may occur.

By default, the 'ID', 'OS', 'PID' 'PPID', 'OSVER' and 'HOSTNAME' variables are built-in to assist with code runtime.

type Process 

type Process struct {
	Filter *filter.Filter
	Dir    string

	Env, Args []string
	Stdin     []byte

	Timeout    time.Duration
	Flags      uint32
	Wait, Hide bool
}

Process is a Tasklet that is similar to the 'cmd.Process' struct. This is used to Task a Client with running a specified command.

This can be directly used in the Session 'Tasklet' function instead of directly creating a Task.

The Filter attribute will attempt to set the target that runs the Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: TvExecute

Input:
    Process struct {
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func Run 

func Run(c string) Process

Run will create a Tasklet that will instruct the client to run a command. This command will parsed using the 'cmd.Split' function.

The Filter attribute will attempt to set the target that runs the Process. If none are specified, the Process will be ran under the client process.

The response to this task will return the PID, ExitCode and Stdout/Stderr data.

C2 Details: 

ID: TvExecute

Input:
    Process struct {
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func Shell added in v0.2.0 

func Shell(c string) Process

Shell will create a Task that will instruct the client to run a shell command. The command will be passed as an argument to the default shell found on the device.

The Filter attribute will attempt to set the target that runs the Process. If none are specified, the Process will be ran under the client process.

The response to this task will return the PID, ExitCode and Stdout/Stderr data.

C2 Details: 

ID: TvExecute

Input:
    Process struct {
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func (Process) MarshalStream 

func (p Process) MarshalStream(w data.Writer) error

MarshalStream writes the data for this Process to the supplied Writer.

func (Process) Packet added in v0.2.0 

func (p Process) Packet() (*com.Packet, error)

Packet will take the configured Process options and will return a Packet and any errors that may occur during building.

This allows Process to fulfil the 'Tasklet' interface.

C2 Details: 

ID: TvAssembly

Input:
    Process struct {
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func (*Process) SetStdin 

func (p *Process) SetStdin(r io.Reader) error

SetStdin wil attempt to read all the data from the supplied reader to fill the Stdin byte array for this Process struct.

This function will return an error if any errors occurs during reading.

func (*Process) UnmarshalStream 

func (p *Process) UnmarshalStream(r data.Reader) error

UnmarshalStream reads the data for this Process from the supplied Reader.

type Tasker 

type Tasker func(context.Context, data.Reader, data.Writer) error

Tasker is an function alias that will be tasked with executing a Job and will return an error or write the results to the supplied Writer. Associated data can be read from the supplied Reader.

This function is NOT responsible with writing any error codes, the parent caller will handle that.

type Tasklet added in v0.2.0 

type Tasklet interface {
	Packet() (*com.Packet, error)
}

Tasklet is an interface that allows for Sessions to be directly tasked without creating the underlying Packet.

The 'Packet' function should return a Packet that has the Task data or any errors that may have occurred during Packet generation.

This function should be able to be called multiple times.

type Zombie added in v0.2.0 

type Zombie struct {
	Filter *filter.Filter

	Dir       string
	Data      []byte
	Env, Args []string

	Stdin   []byte
	Timeout time.Duration
	Flags   uint32

	Wait, Hide bool
}

Zombie is a Tasklet that is similar to the 'cmd.Zombie' struct. This is used to Task a Client with running a specified zombie command.

This can be directly used in the Session 'Tasklet' function instead of directly creating a Task.

The Filter attribute will attempt to set the target that runs the Zombie Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: WvZombie

Input:
    Zombie struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func ZombieAsm added in v0.2.0 

func ZombieAsm(b []byte, args ...string) *Zombie

ZombieAsm will create a Zombie Tasklet that can be used to run the supplied Assembly in a Zombie process that uses the specified command line arguments.

The Filter attribute will attempt to set the target that runs the zombie Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: WvZombie

Input:
    Zombie struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func ZombieAsmFile added in v0.2.0 

func ZombieAsmFile(s string, args ...string) (*Zombie, error)

ZombieAsmFile will create a Zombie Tasklet that can be used to run the supplied Assembly from the specified local (server) file source in a Zombie process that uses the specified command line arguments.

The Filter attribute will attempt to set the target that runs the zombie Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: WvZombie

Input:
    Zombie struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func ZombieAsmReader added in v0.2.0 

func ZombieAsmReader(r io.Reader, args ...string) (*Zombie, error)

ZombieAsmReader will create a Zombie Tasklet that can be used to run the supplied Assembly from the specified reader source in a Zombie process that uses the specified command line arguments.

The Filter attribute will attempt to set the target that runs the zombie Process. If none are specified, the Process will be ran under the client process.

C2 Details: 

ID: WvZombie

Input:
    Zombie struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func ZombieDLLFile added in v0.2.0 

func ZombieDLLFile(s string, args ...string) (*Zombie, error)

ZombieDLLFile will create a Zombie Tasklet that can be used to run the supplied DLL from the specified local (server) file source in a Zombie process that uses the specified command line arguments.

The Filter attribute will attempt to set the target that runs the zombie Process. If none are specified, the Process will be ran under the client process.

NOTE: This converts the DLL to Assembly.

C2 Details: 

ID: WvZombie

Input:
    Zombie struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func ZombieDLLReader added in v0.2.0 

func ZombieDLLReader(r io.Reader, args ...string) (*Zombie, error)

ZombieDLLReader will create a Zombie Tasklet that can be used to run the supplied DLL from the specified reader source in a Zombie process that uses the specified command line arguments.

The Filter attribute will attempt to set the target that runs the zombie Process. If none are specified, the Process will be ran under the client process.

NOTE: This converts the DLL to Assembly.

C2 Details: 

ID: WvZombie

Input:
    Zombie struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func (Zombie) MarshalStream added in v0.2.0 

func (z Zombie) MarshalStream(w data.Writer) error

MarshalStream writes the data for this Zombie to the supplied Writer.

func (Zombie) Packet added in v0.2.0 

func (z Zombie) Packet() (*com.Packet, error)

Packet will take the configured Zombie options and will return a Packet and any errors that may occur during building.

This allows Zombie to fulfil the 'Tasklet' interface.

C2 Details: 

ID: WvZombie

Input:
    Process struct {
        []byte          // Data
        []string        // Args
        string          // Dir
        []string        // Environment
        uint32          // Flags
        bool            // Wait
        int64           // Timeout
        bool            // Filter Status
        Filter struct { // Filter
            bool        // Filter Status
            uint32      // PID
            bool        // Fallback
            uint8       // Session
            uint8       // Elevated
            []string    // Exclude
            []string    // Include
        }
        []byte          // Stdin Data
    }
Output:
    uint32              // PID
    int32               // Exit Code
    []byte              // Output (Stdout and Stderr)

func (*Zombie) SetStdin added in v0.2.0 

func (z *Zombie) SetStdin(r io.Reader) error

SetStdin wil attempt to read all the data from the supplied reader to fill the Stdin byte array for this Process struct.

This function will return an error if any errors occurs during reading.

func (*Zombie) UnmarshalStream added in v0.2.0 

func (z *Zombie) UnmarshalStream(r data.Reader) error

UnmarshalStream reads the data for this Zombie from the supplied Reader.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.