transform

Documentation

Overview

Package transform is a simple container package for c2 Transform types.

Index

• Constants
• Variables
• type B64
  • func B64Shift(n int) B64
  • func (b B64) Read(p []byte, w io.Writer) error
  • func (b B64) Write(p []byte, w io.Writer) error
• type DNSClient
  • func (d *DNSClient) Read(b []byte, w io.Writer) error
  • func (d *DNSClient) Write(b []byte, w io.Writer) error

Constants

const Base64 = B64(0)

Base64 is a transform that auto converts the data to and from Base64 encoding. This instance does not include any shifting.

Variables

var (
	// DNS is the standard DNS Transform struct. This struct uses the default DNS addresses contained
	// in 'DefaultDNSNames' to spoof DNS packets. Custom options may be used by creating a new DNS struct or
	// updating the 'Domains' property.
	DNS = new(DNSClient)

	// DefaultDomains is in array of DNS names to be used if the 'Domains' property of a DNS struct is empty.
	DefaultDomains = []string{
		"duckduckgo.com",
		"google.com",
		"microsoft.com",
		"amazon.com",
		"cnn.com",
		"youtube.com",
		"twitch.tv",
		"reddit.com",
		"facebook.com",
		"slack.com",
	}

	// ErrInvalidLength is an error raised by the Read and Write functions
	// if the byte array supplied is smaller than the required byte size to
	// Transform into a DNS packet.
	ErrInvalidLength = xerr.New("length of byte array is invalid")
)

Types

type B64

type B64 byte

B64 is the underlying type for the Base64 Transform. This Transform encodes data into a Base64 string before the final write to the output.

func B64Shift

func B64Shift(n int) B64

B64Shift returns a Base64 Transform that also shifts the bytes by the specified amount before writes and after reads. This is useful for evading detection by avoiding commonly flagged Base64 values.

func (B64) Read

func (b B64) Read(p []byte, w io.Writer) error

Read satisfies the Transform interface requirements.

func (B64) Write

func (b B64) Write(p []byte, w io.Writer) error

Write satisfies the Transform interface requirements.

type DNSClient

type DNSClient struct {
	Domains []string
	// contains filtered or unexported fields
}

DNSClient is a Transform struct that attempts to mask C2 traffic in the form of DNS request packets.

func (*DNSClient) Read

func (d *DNSClient) Read(b []byte, w io.Writer) error

Read satisfies the Transform interface requirements.

func (*DNSClient) Write

func (d *DNSClient) Write(b []byte, w io.Writer) error

Write satisfies the Transform interface requirements.

TODO(dij): Write a checksum function to calculate the valid DNS checksum of the packet

(structure is OK, but wireshark shows no checksum code).