beacon agent extender upgrade

AdaptixServer/extenders/beacon_agent/ax_config.axs

@@ -275,7 +275,6 @@ function RegisterCommands(listenerType)
         let commands_dns = ax.create_commands_group("beacon", [cmd_cat, cmd_cd, cmd_cp, cmd_disks, cmd_download, cmd_execute, cmd_exfil, cmd_getuid,
             cmd_job, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd, cmd_sleep,
             cmd_socks, cmd_terminate, cmd_unlink, cmd_upload, cmd_shell, cmd_powershell, cmd_interact, cmd_burst] );
-
         return { commands_windows: commands_dns }
     }
     else if(listenerType == "BeaconHTTP") {
@@ -324,7 +323,6 @@ function GenerateUI(listenerType)
     let labelDnsResolvers = form.create_label("DNS Resolvers:");
     let textDnsResolvers = form.create_textline("");
     textDnsResolvers.setPlaceholder("8.8.8.8,1.1.1.1,9.9.9.9");
-
     if(listenerType != "BeaconDNS") {
         labelDnsResolvers.setVisible(false);
         textDnsResolvers.setVisible(false);
@@ -351,27 +349,27 @@ function GenerateUI(listenerType)
     let spacer2 = form.create_vspacer();
 
     let layout = form.create_gridlayout();
-    layout.addWidget(spacer1, 0, 0, 1, 3);
-    layout.addWidget(labelArch, 1, 0, 1, 1);
-    layout.addWidget(comboArch, 1, 1, 1, 2);
-    layout.addWidget(labelFormat, 2, 0, 1, 1);
-    layout.addWidget(comboFormat, 2, 1, 1, 2);
-    layout.addWidget(labelSleep, 3, 0, 1, 1);
-    layout.addWidget(textSleep, 3, 1, 1, 1);
-    layout.addWidget(spinJitter, 3, 2, 1, 1);
-    layout.addWidget(labelDnsResolvers, 4, 0, 1, 1);
-    layout.addWidget(textDnsResolvers, 4, 1, 1, 2);
-    layout.addWidget(checkKilldate, 5, 0, 1, 1);
-    layout.addWidget(dateKill, 5, 1, 1, 1);
-    layout.addWidget(timeKill, 5, 2, 1, 1);
-    layout.addWidget(checkWorkingTime, 6, 0, 1, 1);
-    layout.addWidget(timeStart, 6, 1, 1, 1);
-    layout.addWidget(timeFinish, 6, 2, 1, 1);
-    layout.addWidget(labelSvcName, 7, 0, 1, 1);
-    layout.addWidget(textSvcName, 7, 1, 1, 2);
-    layout.addWidget(checkSideloading, 8, 0, 1, 1);
+    layout.addWidget(spacer1,             0, 0, 1, 3);
+    layout.addWidget(labelArch,           1, 0, 1, 1);
+    layout.addWidget(comboArch,           1, 1, 1, 2);
+    layout.addWidget(labelFormat,         2, 0, 1, 1);
+    layout.addWidget(comboFormat,         2, 1, 1, 2);
+    layout.addWidget(labelSleep,          3, 0, 1, 1);
+    layout.addWidget(textSleep,           3, 1, 1, 1);
+    layout.addWidget(spinJitter,          3, 2, 1, 1);
+    layout.addWidget(labelDnsResolvers,   4, 0, 1, 1);
+    layout.addWidget(textDnsResolvers,    4, 1, 1, 2);
+    layout.addWidget(checkKilldate,       5, 0, 1, 1);
+    layout.addWidget(dateKill,            5, 1, 1, 1);
+    layout.addWidget(timeKill,            5, 2, 1, 1);
+    layout.addWidget(checkWorkingTime,    6, 0, 1, 1);
+    layout.addWidget(timeStart,           6, 1, 1, 1);
+    layout.addWidget(timeFinish,          6, 2, 1, 1);
+    layout.addWidget(labelSvcName,        7, 0, 1, 1);
+    layout.addWidget(textSvcName,         7, 1, 1, 2);
+    layout.addWidget(checkSideloading,    8, 0, 1, 1);
     layout.addWidget(sideloadingSelector, 8, 1, 1, 2);
-    layout.addWidget(spacer2, 9, 0, 1, 3);
+    layout.addWidget(spacer2,             9, 0, 1, 3);
 
     form.connect(comboFormat, "currentTextChanged", function(text) {
         if(text == "Service Exe") {

AdaptixServer/extenders/beacon_agent/config.json

@@ -5,5 +5,5 @@
 
   "agent_name": "beacon",
   "agent_watermark": "be4c0149",
-  "listeners": [ "BeaconHTTP",  "BeaconTCP",  "BeaconSMB", "BeaconDoH", "BeaconDNS"]
+  "listeners": [ "BeaconHTTP",  "BeaconTCP",  "BeaconSMB", "BeaconDNS"]
 }

AdaptixServer/extenders/beacon_agent/pl_utils.go

@@ -1,13 +1,19 @@
 package main
 
 import (
+	"bytes"
+	"compress/zlib"
 	"crypto/rc4"
 	"errors"
 	"fmt"
+	"io"
+	"math/rand"
 	"net"
 	"regexp"
 	"strconv"
 	"strings"
+
+	adaptix "github.com/Adaptix-Framework/axc2"
 )
 
 const (
@@ -94,6 +100,41 @@ const (
 	BOF_ERROR_ALLOC     = 0x105
 )
 
+// DNS Constants
+const (
+	dnsDefaultLabelSize = 48
+	dnsMaxLabelSize     = 63
+	dnsFrameHeaderSize  = 5 // flags:1 + origLen:4
+	dnsCompressFlag     = 0x1
+)
+
+func CreateTaskCommandSaveMemory(ts Teamserver, agentId string, buffer []byte) int {
+	chunkSize := 0x100000 // 1Mb
+	memoryId := int(rand.Uint32())
+
+	bufferSize := len(buffer)
+
+	taskData := adaptix.TaskData{
+		Type:    TYPE_TASK,
+		AgentId: agentId,
+		Sync:    false,
+	}
+
+	for start := 0; start < bufferSize; start += chunkSize {
+		fin := start + chunkSize
+		if fin > bufferSize {
+			fin = bufferSize
+		}
+
+		array := []interface{}{COMMAND_SAVEMEMORY, memoryId, bufferSize, fin - start, buffer[start:fin]}
+		taskData.Data, _ = PackArray(array)
+		taskData.TaskId = fmt.Sprintf("%08x", rand.Uint32())
+
+		ts.TsTaskCreate(agentId, "", "", taskData)
+	}
+	return memoryId
+}
+
 func GetOsVersion(majorVersion uint8, minorVersion uint8, buildNumber uint, isServer bool, systemArch string) (int, string) {
 	var (
 		desc string
@@ -236,3 +277,111 @@ func formatBurstStatus(enabled int, sleepMs int, jitterPct int) string {
 	}
 	return fmt.Sprintf("on (sleep=%dms, jitter=%d%%)", sleepMs, jitterPct)
 }
+
+func buildDNSProfileParams(generateConfig GenerateConfig, listenerMap map[string]any,
+	listenerWM string, agentWatermark int64, killDate int, workingTime int) ([]interface{}, error) {
+
+	domain, _ := listenerMap["domain"].(string)
+
+	resolvers := generateConfig.DnsResolvers
+	if resolvers == "" {
+		resolvers, _ = listenerMap["resolvers"].(string)
+	}
+	qtype, _ := listenerMap["qtype"].(string)
+
+	pktSizeF, _ := listenerMap["pkt_size"].(float64)
+	ttlF, _ := listenerMap["ttl"].(float64)
+	labelSizeF, _ := listenerMap["label_size"].(float64)
+
+	pktSize := int(pktSizeF)
+	ttl := int(ttlF)
+	labelSize := int(labelSizeF)
+	if labelSize <= 0 || labelSize > dnsMaxLabelSize {
+		labelSize = dnsDefaultLabelSize
+	}
+
+	seconds, err := parseDurationToSeconds(generateConfig.Sleep)
+	if err != nil {
+		return nil, err
+	}
+
+	lWatermark, _ := strconv.ParseInt(listenerWM, 16, 64)
+
+	burstEnabledF, _ := listenerMap["burst_enabled"].(bool)
+	burstSleepF, _ := listenerMap["burst_sleep"].(float64)
+	burstJitterF, _ := listenerMap["burst_jitter"].(float64)
+
+	burstEnabled := 0
+	if burstEnabledF {
+		burstEnabled = 1
+	}
+	burstSleep := int(burstSleepF)
+	if burstSleep <= 0 {
+		burstSleep = 50
+	}
+	burstJitter := int(burstJitterF)
+	if burstJitter < 0 || burstJitter > 90 {
+		burstJitter = 0
+	}
+
+	params := []interface{}{
+		int(agentWatermark),
+		// ProfileDNS
+		domain,
+		resolvers,
+		qtype,
+		pktSize,
+		labelSize,
+		ttl,
+		burstEnabled,
+		burstSleep,
+		burstJitter,
+		// Common tail
+		int(lWatermark),
+		killDate,
+		workingTime,
+		seconds,
+		generateConfig.Jitter,
+	}
+
+	return params, nil
+}
+
+func appendDNSObjectFiles(files string, objectDir string, ext string) string {
+	files += objectDir + "/DnsCodec" + ext + " "
+	files += objectDir + "/miniz" + ext + " "
+	return files
+}
+
+func decompressZlibData(data []byte) ([]byte, bool) {
+	if len(data) < dnsFrameHeaderSize {
+		return data, false
+	}
+	flags := data[0]
+	origLen := int(data[1]) | int(data[2])<<8 | int(data[3])<<16 | int(data[4])<<24
+
+	if origLen <= 0 {
+		return data, false
+	}
+
+	payload := data[dnsFrameHeaderSize:]
+	if (flags & dnsCompressFlag) != 0 {
+		r, err := zlib.NewReader(bytes.NewReader(payload))
+		if err != nil {
+			return data, false
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, r)
+		_ = r.Close()
+		if err == nil && buf.Len() == origLen {
+			return buf.Bytes(), true
+		}
+		return data, false
+	}
+
+	if len(payload) == origLen {
+		return payload, true
+	}
+
+	return data, false
+}