- Remove qtype[0]=='T' check that prevented heartbeat from working
with A, AAAA, and CNAME query types
- Fix heartbeat->API transition: when heartbeat indicates pending tasks,
continue to API request instead of returning early
- Add hasPendingTasks check before sending heartbeat to avoid redundant
heartbeats when tasks are already known to be pending
Previously, agents using non-TXT query types (A, AAAA, CNAME) would
skip heartbeat and go directly to API requests, causing a loop where
the server indicated pending tasks but the agent never fetched them.
- Add wrapProxyData() and wrapProxyDataWithError() helpers in pl_main.go
to eliminate repetitive TaskData struct construction
- Refactor TunnelMessage* functions
- Refactor TerminalMessage* functions
- Add formatBurstStatus() helper in pl_utils.go for burst config formatting
- Replace 3 duplicate burst status format strings with helper calls
Add burst mode configuration to DNS listener with three settings:
- burst_enabled: toggle to enable/disable fast transfer mode
- burst_sleep: sleep duration in ms during burst mode (default: 50)
- burst_jitter: jitter percentage for burst mode (0-90%, default: 0)
When burst mode is disabled, the agent uses normal sleep intervals
even during data transfer, making traffic patterns less detectable.
When enabled with jitter, burst sleep varies randomly within the
configured percentage range (e.g., 50ms with 50% jitter = 25-75ms).
UI: When burst mode checkbox is unchecked, sleep and jitter fields
are grayed out and disabled.
Files modified:
- ax_config.axs: UI controls with connected enable/disable logic
- pl_listener.go: DNSConfig struct with new fields
- pl_agent.go: buildDNSProfileParams passes burst settings
- AgentConfig.h: ProfileDNS struct with burst fields
- AgentConfig.cpp: unpack burst settings from profile
- MainAgent.cpp: use burst settings with jitter calculation
Remove verbose block comment separators (// ===...===) and replace
with simple single-line section headers following standard Go style.
Files updated:
- pl_dns.go: Constants, Types, Constructors, Utility Functions,
DNSListener Lifecycle, Persistence, Request Parsing,
Task Fetching, Operation Handlers, Fragment Management,
Main DNS Handler
- pl_main.go: Teamserver Interface, Module, Plugin Entry Point,
Listener Management
- pl_listener.go: Configuration, Constructors, Utility Functions,
Handler Methods
This reduces visual noise and aligns with Go community conventions.
Add inline helper functions for big-endian and little-endian operations:
- WriteBE32: write 32-bit value in big-endian format
- ReadBE32: read 32-bit value from big-endian bytes
- ReadLE32: read 32-bit value from little-endian bytes
Refactor binary operations throughout ConnectorDNS:
- Simplify BuildAckData from 12 lines to 3 calls
- Simplify frame building in SendData upload loop
- Simplify reqData building for GET requests
- Simplify download chunk parsing (total, offset, nonce)
- Simplify agentId extraction in SetConfig
This reduces ~50 lines of repetitive bit-shift code and improves
readability by making byte order explicit.
Implement reliability mechanism for DNS communication:
- Fragment confirmation from server (PUT ACK responses)
- Track confirmed offsets to avoid duplicate transmission
- Detect missing fragments and request retransmission
- Handle reset signals from server on data loss
- Improved offset mismatch handling during task download
- Stale timeout notification mechanism via heartbeat
- Optimize retry attempts with confirmation tracking
Configure project structure for DNS tunneling support:
- Add modules to Go workspace
- Update configuration files for DNS listener and agent
- Configure .gitignore for build artifacts
- Set up profiles for DNS tunneling
Implement DNS listener plugin for receiving DNS queries from agents:
- UDP and TCP servers for handling DNS queries
- DNS query parsing with encoded data extraction
- Support for HI, PUT, GET, HB operations for communication stages
- Message fragmentation and reassembly for large payloads
- Agent state management (SID-based session management)
- Completed upload caching for deduplication
- Inflight delivery mechanism for reliable task delivery
- Inflight task persistence via JSON files
- Stale entry cleanup by timeouts
- Multiple domain support for single listener
Ralf