def

README

#define

Defined constants and variables which act like constants, similar to C-style #defines.

Documentation

Overview

Package def - Defined constants

Index

• Constants
• Variables
• type EDEnqueue
• type EDGoodbye
• type EDLMCurlGen
• type EDLMExfil
• type EDLMFileRequest
• type EDLMNewImplant
• type EDLMOpConnected
• type EDLMOutputRequest
• type EDLMTaskQueued
• type EDLMTaskRequest
• type EDName
• type EDSeen
• type ISeen

Constants

const (
	AcceptWait        = time.Second / 4     /* Wait between failed accepts. */
	C2URLParam        = "c2"                /* cURLGen query C2 URL parameter. */
	DirPerms          = 0770                /* Default directory permissions. */
	FilePerms         = 0660                /* Default file permissions. */
	HTTPIOTimeout     = 30 * time.Second    /* HTTP read/write timeout. */
	LogsPrompt        = "(plonk)> "         /* opshell prompt for log-watching. */
	MaxExfilOpenTries = 100                 /* Maximum number of exfil filenames to try. */
	MaxOutput         = 1 * 1024 * 1024     /* Output stops at 1MB. */
	NSeen             = 10                  /* Max number of seen IDs. */
	NamelessName      = "an IDless implant" /* Name we give to ID "" */
	NReplayLogs       = 10                  /* Number of logs to show with ,logs. */
	OpNameWait        = 10 * time.Second    /* Wait for operator's name. */
	StateWriteDelay   = "5s"
)

Other nonconfigurables

const (
	ENGoodbye  = "goodbye"  /* Server's closing. */
	ENName     = "name"     /* Operator name. */
	ENEnqueue  = "enqueue"  /* Enqueue(d) task. */
	ENListSeen = "listseen" /* List seen implants. */
)

Event names

const (
	LMCaughtSignal   = "Caught signal, exiting"
	LMCurlGen        = "Implant generation"
	LMExfil          = "Exfil"
	LMFileRequest    = "Static file requested"
	LMImplantServing = "Implant service started"
	LMNewImplant     = "New implant"
	LMOpConnected    = "Operator connected"
	LMOpDisconnected = "Operator disconnected"
	LMOpListening    = "Operator listener started"
	LMOpNameChange   = "Operator name change"
	LMOutputRequest  = "Output"
	LMSentSeenList   = "Sent implant list"
	LMServerReady    = "Server ready"
	LMTaskQueued     = "Task queued"
	LMTaskRequest    = "Task request"

	/* Errors */
	LMDefaultFileFailed    = "Opening default file failed"
	LMHTTPError            = "HTTP error"
	LMHTTPErrorFailed      = "HTTP error logger failed"
	LMOpInitialNameError   = "Error getting initial operator name"
	LMServerDied           = "Server died"
	LMStateWriteFailed     = "State write failed"
	LMTemporaryAcceptError = "Temporary accept error"
	LMUnexpectedMessage    = "Unexpected message"
)

Log messages

const (
	LKAddress     = "address"
	LKConnNumber  = "cnum"
	LKDirname     = "dirname"
	LKErrorType   = "error_type"
	LKFilename    = "filename"
	LKHTTPAddr    = "http_addr"
	LKHTTPSAddr   = "https_addr"
	LKHash        = "hash"
	LKHost        = "host"
	LKID          = "id"
	LKLocation    = "location"
	LKMessage     = "message"
	LKMessageType = "message_type"
	LKMethod      = "method"
	LKOpName      = "opname"
	LKOpOldName   = "oldname"
	LKOutput      = "output"
	LKParameters  = "parameters"
	LKQLen        = "qlen"
	LKRemoteAddr  = "remote_address"
	LKReqPath     = "requested_path"
	LKSNI         = "sni"
	LKSignal      = "signal"
	LKSize        = "size"
	LKStatusCode  = "status_code"
	LKTask        = "task"
	LKURL         = "url"
)

Log keys

Variables

var (
	DefaultFile    = "index.html" /* Default file served by HTTP. */
	ExfilDir       = "exfil"
	LogFile        = "log.json"
	OpSock         = "op.sock" /* Operator comms Unix socket. */
	StateFile      = "state.json"
	StaticFilesDir = "files"
	TemplateFile   = "implant.tmpl"
	DirEnvVar      = "PLONK_DIRECTORY"
)

Files and directories, within working directory

var (
	CurlGenPath = "/c" /* Implant generator. */
	ExfilPath   = "/p"
	FilePath    = "/f"
	OutputPath  = "/o"
	TaskPath    = "/t"
)

Request URL paths.

var (
	StateWriteDelayD time.Duration
)

Other configurables

Types

type EDEnqueue

type EDEnqueue struct {
	ID    string
	Task  string
	Error string
}

EDEnqueue is a queued task.

type EDGoodbye

type EDGoodbye struct {
	Message string
}

EDGoodbye indicates the server is shutting down.

type EDLMCurlGen

type EDLMCurlGen struct {
	Parameters struct {
		RandN string
		URL   string
	}
	RemoteAddr string `json:"remote_address"`
}

EDLMCurlGen tells us when someone's generated implant code.

type EDLMExfil

type EDLMExfil struct {
	Filename      string
	Size          int
	RequestedPath string `json:"requested_path"`
	RemoteAddr    string `json:"remote_address"`
	Error         string
}

EDLMExfil tells us when we've got exfil.

type EDLMFileRequest

type EDLMFileRequest struct {
	StatusCode int    `json:"status_code"`
	RemoteAddr string `json:"remote_address"`
	Filename   string
	Size       int
}

EDLMFileRequest tells us when someone's asked for a file.

type EDLMNewImplant

type EDLMNewImplant struct {
	ID string
}

EDLMNewImplant informs about a newly-seen implant.

type EDLMOpConnected

type EDLMOpConnected struct {
	OpName string
	CNum   int
}

EDLMOpConnected is a log message indicating a new operator has connected. It also works for disconnections.

type EDLMOutputRequest

type EDLMOutputRequest struct {
	ID     string
	Output string /* Empty means none sent. */
	Error  string
}

EDLMOutputRequest is a log message sent after a request to send output.

type EDLMTaskQueued

type EDLMTaskQueued struct {
	ID     string
	Task   string
	OpName string
	QLen   int
}

EDLMTaskQueued is a log message indicating a queued task.

type EDLMTaskRequest

type EDLMTaskRequest struct {
	ID    string
	Task  string /* Empty means none sent. */
	QLen  int
	Error string
}

EDLMTaskRequest is a log message sent after a request for tasking.

type EDName

type EDName string

EDName sets the per-connection Operator name.

type EDSeen

type EDSeen [NSeen]ISeen

EDSeen contains the last-seen implants.

type ISeen

type ISeen struct {
	ID   string    /* Implant ID. */
	From string    /* Remote address. */
	When time.Time /* When last seen. */
}

ISeen is the last time an Implant was seen.