From 736a61dce7ad321df1660779d480acecdffe9bcb Mon Sep 17 00:00:00 2001 From: kali Date: Mon, 16 Oct 2023 12:34:52 +0200 Subject: [PATCH] Beacon TTL --- beacon/Beacon.cpp | 2 ++ listener/Listener.cpp | 7 ++++--- listener/Listener.hpp | 2 +- listener/Session.hpp | 21 ++++++++++++++------- modules/AssemblyExec/AssemblyExec.cpp | 2 +- modules/ModuleCmd/ModuleCmd.hpp | 11 +++++++++++ 6 files changed, 33 insertions(+), 12 deletions(-) diff --git a/beacon/Beacon.cpp b/beacon/Beacon.cpp index b465028..5bc344d 100644 --- a/beacon/Beacon.cpp +++ b/beacon/Beacon.cpp @@ -320,6 +320,7 @@ bool Beacon::taskResultsToCmd(std::string& output) bundleC2Message->set_arch(m_arch); bundleC2Message->set_privilege(m_privilege); bundleC2Message->set_os(m_os); + bundleC2Message->set_lastProofOfLife("0"); while(!m_taskResult.empty()) { @@ -348,6 +349,7 @@ bool Beacon::taskResultsToCmd(std::string& output) bundleC2Message->set_arch(ptr->getArch()); bundleC2Message->set_privilege(ptr->getPrivilege()); bundleC2Message->set_os(ptr->getOs()); + bundleC2Message->set_lastProofOfLife(ptr->getLastProofOfLife()); C2Message c2Message = ptr->getTaskResult(); while(!c2Message.instruction().empty()) diff --git a/listener/Listener.cpp b/listener/Listener.cpp index 2080ef6..7dd2885 100644 --- a/listener/Listener.cpp +++ b/listener/Listener.cpp @@ -123,7 +123,7 @@ bool Listener::isSessionExist(std::string& beaconHash) } -bool Listener::updateSessionPoofOfLife(std::string& beaconHash) +bool Listener::updateSessionPoofOfLife(std::string& beaconHash, std::string& lastProofOfLife) { std::lock_guard lock(m_mutex); @@ -133,7 +133,7 @@ bool Listener::updateSessionPoofOfLife(std::string& beaconHash) if (beaconHash == (*it)->getBeaconHash()) { sessionExist=true; - (*it)->updatePoofOfLife(); + (*it)->updatePoofOfLife(lastProofOfLife); } } return sessionExist; @@ -323,7 +323,8 @@ bool Listener::handleMessages(const std::string& input, std::string& output) } else { - updateSessionPoofOfLife(beaconHash); + std::string lastProofOfLife = bundleC2Message->lastProofOfLife(); + updateSessionPoofOfLife(beaconHash, lastProofOfLife); } // For each message in this session diff --git a/listener/Listener.hpp b/listener/Listener.hpp index cf827aa..d0ece79 100644 --- a/listener/Listener.hpp +++ b/listener/Listener.hpp @@ -34,7 +34,7 @@ public: std::shared_ptr getSessionPtr(int idxSession); std::shared_ptr getSessionPtr(std::string& beaconHash); bool isSessionExist(std::string& beaconHash); - bool updateSessionPoofOfLife(std::string& beaconHash); + bool updateSessionPoofOfLife(std::string& beaconHash, std::string& lastProofOfLife); bool markSessionKilled(std::string& beaconhash); // Session Listener diff --git a/listener/Session.hpp b/listener/Session.hpp index b50345d..4179fbb 100644 --- a/listener/Session.hpp +++ b/listener/Session.hpp @@ -61,7 +61,9 @@ public: m_os=os; m_killed=false; - m_lastProofOfLife = std::chrono::system_clock::now(); + auto current_time = std::chrono::system_clock::now(); + auto duration_in_seconds = std::chrono::duration(current_time.time_since_epoch()); + m_lastProofOfLifeSec = duration_in_seconds.count(); } std::string getListenerHash() @@ -99,9 +101,14 @@ public: return m_os; } - void updatePoofOfLife() + void updatePoofOfLife(std::string& lastProofOfLife) { - m_lastProofOfLife = std::chrono::system_clock::now(); + double lastProofOfLifeSec = std::stod(lastProofOfLife); + + auto current_time = std::chrono::system_clock::now(); + auto duration_in_seconds = std::chrono::duration(current_time.time_since_epoch()); + + m_lastProofOfLifeSec = duration_in_seconds.count()-lastProofOfLifeSec; } bool isSessionKilled() @@ -121,10 +128,10 @@ public: std::string getLastProofOfLife() { - auto now = std::chrono::system_clock::now(); - std::chrono::duration elapsedSeconds = now-m_lastProofOfLife; + auto current_time = std::chrono::system_clock::now(); + auto duration_in_seconds = std::chrono::duration(current_time.time_since_epoch()); - std::string output = std::to_string(elapsedSeconds.count()); + std::string output = std::to_string(duration_in_seconds.count()-m_lastProofOfLifeSec); if(m_killed) output="-1"; @@ -215,7 +222,7 @@ private: std::queue m_messageToSend; std::queue m_messageSent; - std::chrono::time_point m_lastProofOfLife; + double m_lastProofOfLifeSec; std::string m_listenerHash; std::string m_beaconHash; diff --git a/modules/AssemblyExec/AssemblyExec.cpp b/modules/AssemblyExec/AssemblyExec.cpp index 274fadd..6356c79 100644 --- a/modules/AssemblyExec/AssemblyExec.cpp +++ b/modules/AssemblyExec/AssemblyExec.cpp @@ -51,7 +51,7 @@ std::string AssemblyExec::getInfo() { std::string info; info += "assemblyExec:\n"; - info += "Execute shellcode in a process (notepade.exe), wait for the end of execution or a timeout (120 sec). Retrieve the output.\n"; + info += "Execute shellcode in a process (notepad.exe), wait for the end of execution or a timeout (120 sec). Retrieve the output.\n"; info += "Use -r to use a shellcode file.\n"; info += "If -e or -d are given, use donut to create the shellcode.\n"; info += "exemple:\n"; diff --git a/modules/ModuleCmd/ModuleCmd.hpp b/modules/ModuleCmd/ModuleCmd.hpp index 175c9c8..326961b 100644 --- a/modules/ModuleCmd/ModuleCmd.hpp +++ b/modules/ModuleCmd/ModuleCmd.hpp @@ -202,6 +202,7 @@ public: m_arch = bundleC2MessageJson["arch"].get(); m_privilege = bundleC2MessageJson["privilege"].get(); m_os = bundleC2MessageJson["os"].get(); + m_lastProofOfLife = bundleC2MessageJson["lastProofOfLife"].get(); auto sessions = bundleC2MessageJson["sessions"]; for (json::iterator it = sessions.begin(); it != sessions.end(); ++it) @@ -235,6 +236,7 @@ public: { "arch", m_arch }, { "privilege", m_privilege }, { "os", m_os}, + { "lastProofOfLife", m_lastProofOfLife}, { "sessions", sessions}, }; *output = bundleC2MessageJson.dump(); @@ -294,6 +296,10 @@ public: { return m_os; } + const std::string& lastProofOfLife() const + { + return m_lastProofOfLife; + } void set_beaconhash(const std::string& beaconHash) { @@ -323,6 +329,10 @@ public: { m_os = os; } + void set_lastProofOfLife(const std::string& lastProofOfLife) + { + m_lastProofOfLife = lastProofOfLife; + } private: std::vector m_c2Messages; @@ -334,6 +344,7 @@ private: std::string m_arch; std::string m_privilege; std::string m_os; + std::string m_lastProofOfLife; };