README
¶
ColdFire II
Golang malware development framework
Table of Contents
- Table of Contents
- Introduction
- Installation
- Types of functions included
- Requirements
- Disclaimer
- License
Introduction
ColdFire II provides various methods useful for malware and security infra development in Golang.
Most functions are compatible with both Linux and Windows operating systems.
Installation
go get github.com/redcode-labs/Coldfire
Docs
Coming soon
Types of functions included (for maldev)
- Logging
- Auxiliary
- Reconnaissance
- Evasion
- Administration
- Sandbox detection
- Disruptive
- Low-level
Types of functions included (for infra)
- Network manipulations
- Cryptography
- IO with specialized readers
- Tunneling
- Target processing
Requirements
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
"github.com/robfig/cron"
"github.com/anvie/port-scanner"
"github.com/matishsiao/goInfo"
"github.com/fatih/color"
"github.com/minio/minio/pkg/disk"
"github.com/dustin/go-humanize"
"github.com/mitchellh/go-ps"
"github.com/GeertJohan/yubigo"
"github.com/go-sql-driver/mysql"
"github.com/ztrue/tracerr"
"github.com/yalue/elf_reader"
Disclaimer
Developers are not responsible for any misuse regarding this tool. Use it only against systems that you are permitted to attack.
License
This software is under MIT license
Documentation
¶
Overview ¶
Package coldfire is a framework that provides functions for malware development that are mostly compatible with Linux and Windows operating systems.
Package coldfire is a framework that provides functions for malware development that are mostly compatible with Linux and Windows operating systems.
Index ¶
- Variables
- func AddPersistentCommand(cmd string) error
- func Alloc(size string)
- func AutoDoc(port ...int)
- func B64D(str string) string
- func B64E(str string) string
- func BannerGrab(target string, port int) (string, error)
- func Bind(port int)
- func BoolCheck(boolean interface{}) bool
- func Caves(file string, min_size int) map[string]map[string]int
- func Check(e error)
- func CheckRootSSH(client ssh.Client) bool
- func ClearLogs() error
- func CloseListener(lst net.Listener)
- func CmdBlind(command string)
- func CmdDir(dirs_cmd map[string]string) ([]string, error)
- func CmdOut(command string) (string, error)
- func CmdOutPlatform(commands map[string]string) (string, error)
- func CmdRun(command string)
- func Contains(s interface{}, elem interface{}) bool
- func ContainsAny(str string, elements []string) bool
- func CopyFile(src, dst string) error
- func CreateWordlist(words []string) []string
- func DecryptBytes(encrypted_message []byte, key []byte) []byte
- func DecryptString(encrypted_message []byte, key []byte) string
- func Disks() ([]string, error)
- func DnsLookup(hostname string) ([]string, error)
- func Download(url string) error
- func EncryptBytes(secret_message []byte, key []byte) []byte
- func EncryptString(message string, key []byte) []byte
- func EqualBytes(b1, b2 byte) bool
- func EraseMbr(device string, partition_table bool) error
- func Exists(file string) bool
- func ExitOnError(e error)
- func ExpandCidr(cidr string) ([]string, error)
- func ExtractIntFromString(s string) []int
- func F(str string, arg ...interface{}) string
- func File2Slice(file string) []string
- func FilePermissions(filename string) (bool, bool)
- func FilesPattern(directory, pattern string) (map[string]string, error)
- func Forkbomb()
- func FullRemove(str string, to_remove string) string
- func GenCpuLoad(cores int, interval string, percentage int)
- func GenerateIV() []byte
- func GenerateKey() []byte
- func GetGatewayIP() string
- func GetGlobalIP() string
- func GetLocalIP() string
- func GetNgrokURL() (string, error)
- func GetUser() (string, error)
- func HarvestDB(ip, username, password string, port int)
- func IOReader(file string) io.ReaderAt
- func IP2Hex(ip string) string
- func Iface() (string, string)
- func IfaceIP(ifname string) string
- func Ifaces() []string
- func Info() map[string]string
- func Int2Str(i int) string
- func Interval2Seconds(interval string) int
- func Introspect(strct interface{}) (map[string]interface{}, []string)
- func IpIncrement(ip net.IP)
- func Is64Bit(fname string) bool
- func IsELF(fname string) bool
- func IsEXE(fname string) bool
- func IsFileExec(file string) bool
- func IsIterable(v interface{}) bool
- func IsRoot() bool
- func KillProcByPID(pid int) error
- func ListDB(db *sql.DB, tables bool) []string
- func MakeZip(zip_file string, files []string) error
- func Md5Hash(str string) string
- func Networks() ([]string, error)
- func P()
- func Ping(target string) bool
- func PkillAv() error
- func PkillName(name string) error
- func PkillPid(pid int) error
- func Port2Hex(port int) string
- func PortFree(port int) int
- func PortReuse(network string, address string, conn syscall.RawConn) error
- func Portscan(target string, timeout, threads int) (pr []int)
- func PortscanSingle(target string, port int) bool
- func PortscanSingleTimeout(target string, port, timeout, threads int) bool
- func PrintError(msg string)
- func PrintGood(msg string)
- func PrintInfo(msg string)
- func PrintWarning(msg string)
- func Processes() (map[int]string, error)
- func RandomBool() bool
- func RandomFloatSlice(min, max float64, n int) []float64
- func RandomInt(min int, max int) int
- func RandomIntSlice(length int) []int
- func RandomSelectInt(list []int) int
- func RandomSelectStr(list []string) string
- func RandomSelectStrNested(list [][]string) []string
- func RandomString(n int) string
- func RandomStringCharset(strlen int, chars string) string
- func RdnsLookup(ip string) ([]string, error)
- func ReadFile(filename string) (string, error)
- func RegexMatch(regex_type, str string) bool
- func Remove()
- func RemoveDuplicatesInt(slice []int) []int
- func RemoveDuplicatesStr(slice []string) []string
- func RemoveFromSlice(slice []string, element string) []string
- func RemoveInactive(targets []string)
- func RemoveInt(slice []int, s int) []int
- func RemoveNewlines(s string) string
- func RemoveNth(slic interface{}, idx int) interface{}
- func RemoveStr(slice []string, s string) []string
- func Reverse(host string, port int)
- func Revert(s string) string
- func RevertSlice(s interface{})
- func Rot13(str string) string
- func RunShellcode(sc []byte, bg bool)
- func SandboxAll() bool
- func SandboxAlln(num int) bool
- func SandboxCpu(cores int) bool
- func SandboxFilepath() bool
- func SandboxMac() bool
- func SandboxProc() bool
- func SandboxProcnum(proc_num int) bool
- func SandboxRam(ram_mb int) bool
- func SandboxSleep() bool
- func SandboxTmp(entries int) bool
- func SandboxUtc() bool
- func SendDataTCP(host string, port int, data string) error
- func SendDataUDP(host string, port int, data string) error
- func Serializer(gobpath string, obj interface{})
- func Sha1Hash(str string) string
- func Sha256Hash(str string) string
- func ShuffleSlice(s []string) []string
- func ShuffleSliceInt(s []int) []int
- func Shutdown() error
- func Size2Bytes(size string) int
- func SliceTransform(s []interface{}, f func(interface{}) interface{})
- func SplitChunks(s string, chunk int) []string
- func SplitJoin(s, splittBy, joinBy string) string
- func SplitMultiSep(s string, seps []string) []string
- func StartNgrokHTTP(port int) error
- func StartNgrokTCP(port int) error
- func Str2Int(string_integer string) int
- func Str2Words(s string) []string
- func TimeNTP() time.Time
- func TraverseCurrentDir() ([]string, error)
- func TraverseDir(dir string) ([]string, error)
- func UnixToTime(time_num int64) string
- func Url2Lines(url string) []string
- func Users() ([]string, error)
- func VerifyELFMagic(fname string) bool
- func Wait(interval string)
- func WifiDisconnect() error
- func Wipe() error
- func WriteFile(filename, data string) error
- func Yubi(id, token, otp string) bool
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func AddPersistentCommand ¶
AddPersistentCommand creates a task that runs a given command on startup.
func AutoDoc ¶
func AutoDoc(port ...int)
Launches live documentation of the library on port 8080 or arbitrary
func BannerGrab ¶
BannerGrab returns a service banner string from a given port.
func Check ¶
func Check(e error)
Basic error handilng and reporting Similar to exitOnError() but more verbose and does not exit
func CheckRootSSH ¶
Checks if an SSH client connection has a root context
func CloseListener ¶
Gracefully closes an instance of net.Listener
func CmdDir ¶
CmdDir executes commands which are mapped to a string indicating the directory where the command is executed.
func CmdOutPlatform ¶
CmdOutPlatform executes a given set of commands based on the OS of the machine.
func CmdRun ¶
func CmdRun(command string)
CmdRun executes a command and writes output as well as error to STDOUT.
func Contains ¶
func Contains(s interface{}, elem interface{}) bool
Contains is used to check if an element exists in an array type agnostically.
func ContainsAny ¶
Checks if a string exists within a list of strings.
func CreateWordlist ¶
CreateWordList generates possible variations of each word in the wordlist.
func DecryptBytes ¶
func DecryptString ¶
func EncryptBytes ¶
func EncryptString ¶
func EqualBytes ¶
func EraseMbr ¶
EraseMbr zeroes out the Master Boot Record. This is linux only, so should live in `coldfier_linux.go`
func ExitOnError ¶
func ExitOnError(e error)
ExitOnError prints a given error and then stops execution of the process.
func ExpandCidr ¶
ExpandCidr returns a list of Ip addresses within a given CIDR.
func ExtractIntFromString ¶
ExtractIntFromString extracts a list of possible integers from a given string.
func File2Slice ¶
File2Slice reads a textfile and returns all lines as an array.
func FilePermissions ¶
FilePermissions checks if a given file has read and write permissions.
func FilesPattern ¶
FilesPattern is used to return data mapped to files where their filenames match a given pattern.
func FullRemove ¶
FullRemove removes all instances of a string from another string.
func GenCpuLoad ¶
GenCpuLoad gives the Cpu work to do by spawning goroutines.
func GenerateIV ¶
func GenerateIV() []byte
func GenerateKey ¶
func GenerateKey() []byte
func GetGatewayIP ¶
func GetGatewayIP() string
GetGatewayIP returns the Ip address of the gateway in the network where the machine resides.
func GetGlobalIP ¶
func GetGlobalIP() string
GetGlobalIp is used to return the global Ip address of the machine.
func GetLocalIP ¶
func GetLocalIP() string
GetLocalIp is used to get the local Ip address of the machine.
func GetNgrokURL ¶
GetNgrokURL returns the URL of the Ngrok tunnel exposing the machine.
func Info ¶
Info is used to return basic system information. Note that if information can not be resolved in a specific field it returns "N/A"
func Interval2Seconds ¶
Interval2Seconds converts a human friendly string indicating time into a proper integer.
func Introspect ¶
Returns names of fields and their values in struct + names of fields with unitialized/empty values -1 value is treated as unitialized int field - you can change "val == -1" according to your needs
func IsIterable ¶
func IsIterable(v interface{}) bool
Checks if a generic is iterable and non-emptty
func IsRoot ¶
func IsRoot() bool
IsRoot checks if the current user is the administrator of the machine.
func PkillAv ¶
func PkillAv() error
PkillAv kills Anti-Virus processes that may run within the machine.
func PortscanSingle ¶
PortscanSingle checks if a specific port is open in a given target.
func PortscanSingleTimeout ¶
PortscanSingleTimeout checks if a specific port is open in a given target. Connection timeout as well as no. of threads can be adjusted
func PrintError ¶
func PrintError(msg string)
PrintError is used to print output indicating failure.
func PrintInfo ¶
func PrintInfo(msg string)
PrintInfo is used to print output containing information.
func PrintWarning ¶
func PrintWarning(msg string)
PrintWarning is used to print output indicating potential failure.
func RandomFloatSlice ¶
func RandomIntSlice ¶
Creates and populates a slice with random numeric values up to 1000
func RandomSelectInt ¶
RandomSelectInt returns an integer that was randomly selected from a list of integers.
func RandomSelectStr ¶
RandomSelectStr returns a string that was randomly selected from a list of strings.
func RandomSelectStrNested ¶
RandomSelectStrNested returns a string array that was randomly selected from a nested list of strings
func RandomString ¶
RandomString randomly generates an alphabetic string of a given length.
func RandomStringCharset ¶
RandomStringCharset returns a string of a given length from provided charset
func RdnsLookup ¶
RdnsLookup returns the list of hostnames associated with the given Ip address.
func RegexMatch ¶
Checks if a string contains valuable information through regex.
func RemoveDuplicatesInt ¶
RemoveDuplicatesInt returns an array of integers that are unique to each other.
func RemoveDuplicatesStr ¶
RemoveDuplicatesStr returns an array of strings that are unique to each other.
func RemoveFromSlice ¶
RemoveFromSlice removes a string from a list of strings if it exists.
func RemoveInactive ¶
func RemoveInactive(targets []string)
Removes hosts from slice that did not respond to a ping request
func RemoveNewlines ¶
RemoveNewLines removes possible newlines from a string.
func RemoveNth ¶
func RemoveNth(slic interface{}, idx int) interface{}
Removes Nth index from generic slice if idx != 0; removes last element otherwise
func RunShellcode ¶
Injects a bytearray into current process and executes it
func SandboxAll ¶
func SandboxAll() bool
SandboxAll is used to check if an environment is virtualized by testing all sandbox checks.
func SandboxAlln ¶
SandboxAlln checks if an environment is virtualized by testing all sandbox checks and checking if the number of successful checks is equal or greater to a given integer.
func SandboxCpu ¶
SandboxCpu is used to check if the environment's cores are less than a given integer.
func SandboxFilepath ¶
func SandboxFilepath() bool
SandboxFilePath checks if the process is being run inside a virtualized environment.
func SandboxMac ¶
func SandboxMac() bool
SandboxMac is used to check if the environment's MAC address matches standard MAC adddresses of virtualized environments.
func SandboxProc ¶
func SandboxProc() bool
SandboxProc checks if there are processes that indicate a virtualized environment.
func SandboxProcnum ¶
SandboxProcnum is used to check if the environment has processes less than a given integer.
func SandboxRam ¶
SandboxRam is used to check if the environment's RAM is less than a given size.
func SandboxSleep ¶
func SandboxSleep() bool
SandboxSleep is used to check if the virtualized environment is speeding up the sleeping process.
func SandboxTmp ¶
SandboxTmp is used to check if the environment's temporary directory has less files than a given integer.
func SandboxUtc ¶
func SandboxUtc() bool
SandboxUtc is used to check if the environment is in a properly set Utc timezone.
func SendDataTCP ¶
SendDataTCP sends data to a given host:port using the TCP protocol.
func SendDataUDP ¶
SendDataUDP sends data to a given host:port using the UDP protocol.
func Serializer ¶
func Serializer(gobpath string, obj interface{})
Unified serializer/deserializer for structs - logic is based on whether a .gob file already exists
func Sha256Hash ¶
func ShuffleSlice ¶
ShuffleSlice randomly shuffles a list of strings.
func ShuffleSliceInt ¶
ShuffleSliceInt randomly shuffles a list of integers.
func Size2Bytes ¶
Size2Bytes converts a human friendly string indicating size into a proper integer.
func SliceTransform ¶
func SliceTransform(s []interface{}, f func(interface{}) interface{})
Applies a function to each element of a generic slice.
func SplitChunks ¶
Split string to a slice with chunks of desired length
func SplitMultiSep ¶
Split a string by multiple sepaators to a single slice
func StartNgrokHTTP ¶
StartNgrokHTTP exposes a web server on a given port.
func StartNgrokTCP ¶
StartNgrokTCP exposes a TCP server on a given port.
func TraverseCurrentDir ¶
TraverseCurrentDir lists all files that exist within the current directory.
func TraverseDir ¶
TraverseDir lists all files that exist within a given directory.
func UnixToTime ¶
func VerifyELFMagic ¶
func Wait ¶
func Wait(interval string)
Wait uses a human friendly string that indicates how long a system should wait.
func WifiDisconnect ¶
func WifiDisconnect() error
WifiDisconnect is used to disconnect the machine from a wireless network.
Types ¶
This section is empty.
Source Files