diff --git a/LICENSE b/LICENSE deleted file mode 100644 index eb0c002..0000000 --- a/LICENSE +++ /dev/null @@ -1,21 +0,0 @@ -MIT License - -Copyright (c) 2021 Tylous - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. diff --git a/Loader/Loader.go b/Loader/Loader.go index f195abd..2b68540 100644 --- a/Loader/Loader.go +++ b/Loader/Loader.go @@ -1,14 +1,15 @@ package Loader import ( - "SourcePoint/Struct" - "SourcePoint/Utils" "bytes" "fmt" "log" "strconv" "strings" "text/template" + + "github.com/Tylous/SourcePoint/Struct" + "github.com/Tylous/SourcePoint/Utils" ) type FlagOptions struct { @@ -64,7 +65,7 @@ type Beacon_SSL struct { var num_Profile int var Post bool -func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, ansible, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string) { +func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, ansible, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool) { Beacon_Com := &Beacon_Com{} Beacon_Stage_p1 := &Beacon_Stage_p1{} Beacon_Stage_p2 := &Beacon_Stage_p2{} @@ -79,7 +80,7 @@ func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, beacon fmt.Println("[*] Preparing Varibles...") HostStageMessage, Beacon_Com.Variables = GenerateComunication(stage, sleeptime, jitter, useragent, datajitter) Beacon_PostEX.Variables = GeneratePostProcessName(Post_EX_Process_Name, Keylogger) - Beacon_GETPOST.Variables = GenerateHTTPVaribles(Host, metadata, uri, customuri, CDN, CDN_Value, Profile) + Beacon_GETPOST.Variables = GenerateHTTPVaribles(Host, metadata, uri, customuri, CDN, CDN_Value, Profile, Forwarder) Beacon_Stage_p2.Variables = GeneratePE(beacon_PE) Process_Inject.Variables = GenerateProcessInject(processinject_min_alloc, injector) Beacon_GETPOST_Profile.Variables, Beacon_SSL.Variables = GenerateProfile(Profile, CDN, CDN_Value, cert_password, custom_cert, ProfilePath, Host) @@ -195,11 +196,16 @@ func GeneratePostProcessName(Post_EX_Process_Name, Keylogger string) map[string] return Beacon_PostEX.Variables } -func GenerateHTTPVaribles(Host, metadata, uri, customuri, CDN, CDN_Value, Profile string) map[string]string { +func GenerateHTTPVaribles(Host, metadata, uri, customuri, CDN, CDN_Value, Profile string, Forwarder bool) map[string]string { Beacon_GETPOST := &Beacon_GETPOST{} Beacon_GETPOST.Variables = make(map[string]string) Beacon_GETPOST.Variables["Host"] = Host - num_Profile, _ = strconv.Atoi(Profile) + if Profile == "" { + num_Profile, _ = strconv.Atoi(Utils.GenerateNumer(1, 5)) + } else { + num_Profile, _ = strconv.Atoi(Profile) + } + fmt.Println(num_Profile) if metadata == "base64" { Beacon_GETPOST.Variables["metadata_mode"] = metadata } else if metadata == "base64url" { @@ -243,6 +249,12 @@ func GenerateHTTPVaribles(Host, metadata, uri, customuri, CDN, CDN_Value, Profil Beacon_GETPOST.Variables["maxage"] = Utils.GenerateNumer(172800, 31536001) Beacon_GETPOST.Variables["Age"] = Utils.GenerateNumer(1222, 2500) + if Forwarder == true { + Beacon_GETPOST.Variables["forward"] = "true" + } else { + Beacon_GETPOST.Variables["forward"] = "false" + } + return Beacon_GETPOST.Variables } @@ -296,10 +308,10 @@ func GenerateProfile(Profile, CDN, CDN_Value, cert_password, custom_cert, Profil Beacon_GETPOST_Profile.Variables = make(map[string]string) Beacon_SSL.Variables = make(map[string]string) if Profile == "" { - num_Profile, _ = strconv.Atoi(Utils.GenerateNumer(0, 4)) + fmt.Println(num_Profile) CNAME := "\rhttps-certificate {\rset CN \"" + hostname + "\"; #Common Name" - Beacon_SSL.Variables["Cert"] = CNAME + Struct.Cert[num_Profile] - Beacon_GETPOST_Profile.Variables["Profile"] = Struct.HTTP_GET_POST_list[num_Profile] + Beacon_SSL.Variables["Cert"] = CNAME + Struct.Cert[num_Profile-1] + Beacon_GETPOST_Profile.Variables["Profile"] = Struct.HTTP_GET_POST_list[num_Profile-1] } if Profile != "" { num_Profile, _ = strconv.Atoi(Profile) diff --git a/Sample.yaml b/Sample.yaml index a17e02d..86225d3 100644 --- a/Sample.yaml +++ b/Sample.yaml @@ -20,3 +20,4 @@ Customuri: CDN: CDN_Value: ProfilePath: +Forwarder: False \ No newline at end of file diff --git a/SourcePoint b/SourcePoint new file mode 100755 index 0000000..9f83948 Binary files /dev/null and b/SourcePoint differ diff --git a/SourcePoint.go b/SourcePoint.go index ee1b0ed..bd771cd 100644 --- a/SourcePoint.go +++ b/SourcePoint.go @@ -1,12 +1,13 @@ package main import ( - Loader "SourcePoint/Loader" "flag" "fmt" "io/ioutil" "log" + Loader "github.com/Tylous/SourcePoint/Loader" + "gopkg.in/yaml.v2" ) @@ -33,6 +34,7 @@ type FlagOptions struct { CDN_Value string Datajitter string Keylogger string + Forwarder bool Yaml string } @@ -59,6 +61,7 @@ type conf struct { Useragent string `yaml:"Useragent"` Datajitter string `yaml:"Datajitter"` Keylogger string `yaml:"Keylogger"` + Forwarder bool `yaml:"Forwarder"` } func (c *conf) getConf(yamlfile string) *conf { @@ -163,9 +166,10 @@ func options() *FlagOptions { cert_password := flag.String("Password", "", "SSL certificate password") CDN_Value := flag.String("CDN-Value", "", "CDN cookie value (typically used for AzureEdge profiles)") CDN := flag.String("CDN", "", "CDN cookie name (typically used for AzureEdge profiles)") + Forwarder := flag.Bool("Forwarder", false, "Enabled the X-forwarded-For header (Good for when your C2 is behind a redirector)") Yaml := flag.String("Yaml", "", "Path to the Yaml config file") flag.Parse() - return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger} + return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder} } @@ -206,6 +210,7 @@ func main() { opt.injector = c.Injector opt.Datajitter = c.Datajitter opt.Keylogger = c.Keylogger + opt.Forwarder = c.Forwarder } if opt.outFile == "" { log.Fatal("Error: Please provide a file name to save the profile into") @@ -214,6 +219,6 @@ func main() { log.Fatal("Error: Please provide the hostname, IP or enable ansible mode") } - Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.ansible, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger) + Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.ansible, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder) } diff --git a/Struct/Struct.go b/Struct/Struct.go index d5253f4..6e4104c 100644 --- a/Struct/Struct.go +++ b/Struct/Struct.go @@ -389,6 +389,12 @@ var Useragent_list = []string{ var HTTP_GET_POST_list = []string{ ` +http-config { + + #set "true" if teamserver is behind redirector + set trust_x_forwarded_for "{{.Variables.forward}}"; +} + http-get { {{.Variables.HTTP_GET_URI}} @@ -464,9 +470,8 @@ http-stager { http-config { -#set "true" if teamserver is behind redirector -set trust_x_forwarded_for "false"; - + #set "true" if teamserver is behind redirector + set trust_x_forwarded_for "{{.Variables.forward}}"; } http-get { @@ -645,16 +650,16 @@ header "X-Via" "haproxy-www-suhx"; } `, ` http-config { -set headers "Server, Content-Type, Brightspot-Id, Cache-Control, X-Content-Type-Options, X-Powered-By, Vary, Connection"; -header "Content-Type" "text/html;charset=UTF-8"; -header "Connection" "close"; -header "Brightspot-Id" "00000459-72af-a783-feef2189"; -header "Cache-Control" "max-age={{.Variables.maxage}}"; -header "Server" "Apache-Coyote/1.1"; -header "X-Content-Type-Options" "nosniff"; -header "X-Powered-By" "Brightspot"; -header "Vary" "Accept-Encoding"; - set trust_x_forwarded_for "false"; + set headers "Server, Content-Type, Brightspot-Id, Cache-Control, X-Content-Type-Options, X-Powered-By, Vary, Connection"; + header "Content-Type" "text/html;charset=UTF-8"; + header "Connection" "close"; + header "Brightspot-Id" "00000459-72af-a783-feef2189"; + header "Cache-Control" "max-age={{.Variables.maxage}}"; + header "Server" "Apache-Coyote/1.1"; + header "X-Content-Type-Options" "nosniff"; + header "X-Powered-By" "Brightspot"; + header "Vary" "Accept-Encoding"; + set trust_x_forwarded_for "{{.Variables.forward}}"; } @@ -796,6 +801,11 @@ http-get { {{.Variables.HTTP_GET_URI}} +http-config { + + #set "true" if teamserver is behind redirector + set trust_x_forwarded_for "{{.Variables.forward}}"; +} client { header "Host" "{{.Variables.Host}}"; @@ -918,6 +928,12 @@ server { } `, ` +http-config { + + #set "true" if teamserver is behind redirector + set trust_x_forwarded_for "{{.Variables.forward}}"; +} + http-get { {{.Variables.HTTP_GET_URI}} @@ -983,10 +999,16 @@ server { } } }`, ` +http-config { + + #set "true" if teamserver is behind redirector + set trust_x_forwarded_for "{{.Variables.forward}}"; +} http-get { {{.Variables.HTTP_GET_URI}} + client { header "Host" "{{.Variables.Host}}"; {{.Variables.CDN}} @@ -1044,6 +1066,12 @@ server { } } `, ` + +http-config { + + #set "true" if teamserver is behind redirector + set trust_x_forwarded_for "{{.Variables.forward}}"; +} http-get { {{.Variables.HTTP_GET_URI}} @@ -1226,12 +1254,9 @@ func Beacon_Stage_Struct_p3() string { strrep "ReflectiveLoader" ""; strrep "This program cannot be run in DOS mode" ""; strrep "NtQueueApcThread" ""; - strrep "IsWow64Process" ""; strrep "HTTP/1.1 200 OK" ""; strrep "Stack memory was corrupted" ""; - strrep "kernel32" ""; strrep "beacon.dll" ""; - strrep "KERNEL32.dll" ""; strrep "ADVAPI32.dll" ""; strrep "WININET.dll" ""; strrep "WS2_32.dll" ""; @@ -1327,12 +1352,9 @@ func Beacon_Stage_Struct_p3() string { strrep "This program cannot be run in DOS mode" ""; strrep "beacon.x64.dll" ""; strrep "NtQueueApcThread" ""; - strrep "IsWow64Process" ""; strrep "HTTP/1.1 200 OK" ""; strrep "Stack memory was corrupted" ""; - strrep "kernel32" ""; strrep "beacon.dll" ""; - strrep "KERNEL32.dll" ""; strrep "ADVAPI32.dll" ""; strrep "WININET.dll" ""; strrep "WS2_32.dll" ""; diff --git a/go.mod b/go.mod index de5efe2..a573b22 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module SourcePoint +module github.com/Tylous/SourcePoint go 1.15