Beacon TTL

beacon/Beacon.cpp

@@ -320,6 +320,7 @@ bool Beacon::taskResultsToCmd(std::string& output)
 	bundleC2Message->set_arch(m_arch);
 	bundleC2Message->set_privilege(m_privilege);
 	bundleC2Message->set_os(m_os);
+	bundleC2Message->set_lastProofOfLife("0");
 
 	while(!m_taskResult.empty())
 	{
@@ -348,6 +349,7 @@ bool Beacon::taskResultsToCmd(std::string& output)
 			bundleC2Message->set_arch(ptr->getArch());
 			bundleC2Message->set_privilege(ptr->getPrivilege());
 			bundleC2Message->set_os(ptr->getOs());
+			bundleC2Message->set_lastProofOfLife(ptr->getLastProofOfLife());
 
 			C2Message c2Message = ptr->getTaskResult();
 			while(!c2Message.instruction().empty())

listener/Listener.cpp

@@ -123,7 +123,7 @@ bool Listener::isSessionExist(std::string& beaconHash)
 }
 
 
-bool Listener::updateSessionPoofOfLife(std::string& beaconHash)
+bool Listener::updateSessionPoofOfLife(std::string& beaconHash, std::string& lastProofOfLife)
 {
 	std::lock_guard<std::mutex> lock(m_mutex);
 
@@ -133,7 +133,7 @@ bool Listener::updateSessionPoofOfLife(std::string& beaconHash)
 		if (beaconHash == (*it)->getBeaconHash())
 		{
 			sessionExist=true;
-			(*it)->updatePoofOfLife();
+			(*it)->updatePoofOfLife(lastProofOfLife);
 		}
 	}
 	return sessionExist;
@@ -323,7 +323,8 @@ bool Listener::handleMessages(const std::string& input, std::string& output)
 			}
 			else
 			{
-				updateSessionPoofOfLife(beaconHash);
+				std::string lastProofOfLife = bundleC2Message->lastProofOfLife();
+				updateSessionPoofOfLife(beaconHash, lastProofOfLife);
 			}
 
 			// For each message in this session

listener/Listener.hpp

@@ -34,7 +34,7 @@ public:
 	std::shared_ptr<Session> getSessionPtr(int idxSession);
 	std::shared_ptr<Session> getSessionPtr(std::string& beaconHash);
 	bool isSessionExist(std::string& beaconHash);
-	bool updateSessionPoofOfLife(std::string& beaconHash);
+	bool updateSessionPoofOfLife(std::string& beaconHash, std::string& lastProofOfLife);
 	bool markSessionKilled(std::string& beaconhash);
 
 	// Session Listener

listener/Session.hpp

@@ -61,7 +61,9 @@ public:
 		m_os=os;
 		m_killed=false;
 
-		m_lastProofOfLife = std::chrono::system_clock::now();
+		auto current_time = std::chrono::system_clock::now();
+		auto duration_in_seconds = std::chrono::duration<double>(current_time.time_since_epoch());
+		m_lastProofOfLifeSec = duration_in_seconds.count();
 	}
 
 	std::string getListenerHash()
@@ -99,9 +101,14 @@ public:
 		return m_os;
 	}
 
-	void updatePoofOfLife()
+	void updatePoofOfLife(std::string& lastProofOfLife)
 	{
-		m_lastProofOfLife = std::chrono::system_clock::now();
+		double lastProofOfLifeSec = std::stod(lastProofOfLife);
+
+		auto current_time = std::chrono::system_clock::now();
+		auto duration_in_seconds = std::chrono::duration<double>(current_time.time_since_epoch());
+
+		m_lastProofOfLifeSec = duration_in_seconds.count()-lastProofOfLifeSec;
 	}
 
 	bool isSessionKilled()
@@ -121,10 +128,10 @@ public:
 
 	std::string getLastProofOfLife()
 	{
-		auto now = std::chrono::system_clock::now();
-		std::chrono::duration<double> elapsedSeconds = now-m_lastProofOfLife;
+		auto current_time = std::chrono::system_clock::now();
+		auto duration_in_seconds = std::chrono::duration<double>(current_time.time_since_epoch());
 
-		std::string output = std::to_string(elapsedSeconds.count());
+		std::string output = std::to_string(duration_in_seconds.count()-m_lastProofOfLifeSec);
 		if(m_killed)
 			output="-1";
 
@@ -215,7 +222,7 @@ private:
 	std::queue<C2Message> m_messageToSend;
     std::queue<C2Message> m_messageSent;
 
-	std::chrono::time_point<std::chrono::system_clock> m_lastProofOfLife;
+	double m_lastProofOfLifeSec;
 
 	std::string m_listenerHash;
 	std::string m_beaconHash;

modules/AssemblyExec/AssemblyExec.cpp

@@ -51,7 +51,7 @@ std::string AssemblyExec::getInfo()
 {
 	std::string info;
 	info += "assemblyExec:\n";
-	info += "Execute shellcode in a process (notepade.exe), wait for the end of execution or a timeout (120 sec). Retrieve the output.\n";
+	info += "Execute shellcode in a process (notepad.exe), wait for the end of execution or a timeout (120 sec). Retrieve the output.\n";
 	info += "Use -r to use a shellcode file.\n";
 	info += "If -e or -d are given, use donut to create the shellcode.\n";
 	info += "exemple:\n";

modules/ModuleCmd/ModuleCmd.hpp

@@ -202,6 +202,7 @@ public:
 		m_arch = bundleC2MessageJson["arch"].get<std::string>();
 		m_privilege = bundleC2MessageJson["privilege"].get<std::string>();
 		m_os = bundleC2MessageJson["os"].get<std::string>();
+		m_lastProofOfLife = bundleC2MessageJson["lastProofOfLife"].get<std::string>();
 		auto sessions = bundleC2MessageJson["sessions"];
 		
 		for (json::iterator it = sessions.begin(); it != sessions.end(); ++it)
@@ -235,6 +236,7 @@ public:
 			{ "arch", m_arch },
 			{ "privilege", m_privilege },
 			{ "os", m_os},
+			{ "lastProofOfLife", m_lastProofOfLife},
 			{ "sessions", sessions},
 		};
 		*output = bundleC2MessageJson.dump();
@@ -294,6 +296,10 @@ public:
 	{
 		return m_os;
 	}
+	const std::string&  lastProofOfLife() const
+	{
+		return m_lastProofOfLife;
+	}
 
 	void set_beaconhash(const std::string& beaconHash)
 	{
@@ -323,6 +329,10 @@ public:
 	{
 		m_os = os;
 	}
+	void set_lastProofOfLife(const std::string& lastProofOfLife)
+	{
+		m_lastProofOfLife = lastProofOfLife;
+	}
 
 private:
 	std::vector<C2Message*> m_c2Messages;
@@ -334,6 +344,7 @@ private:
 	std::string m_arch;
 	std::string m_privilege;
 	std::string m_os;
+	std::string m_lastProofOfLife;
 };