From c0e55a659d2f39bafb2bc4c5e6dde0e0934f8ea4 Mon Sep 17 00:00:00 2001 From: maxdcb Date: Mon, 19 May 2025 11:10:44 -0400 Subject: [PATCH] Minor --- modules/AssemblyExec/AssemblyExec.hpp | 4 + modules/Cat/Cat.hpp | 5 ++ modules/ChangeDirectory/ChangeDirectory.hpp | 4 + modules/Chisel/Chisel.hpp | 4 + modules/CoffLoader/CoffLoader.hpp | 4 + modules/Download/Download.hpp | 4 + modules/Evasion/Evasion.hpp | 4 + modules/Inject/Inject.hpp | 4 + .../KerberosUseTicket/KerberosUseTicket.hpp | 4 + modules/KeyLogger/KeyLogger.hpp | 5 +- modules/ListDirectory/ListDirectory.hpp | 4 + modules/ListProcesses/ListProcesses.hpp | 4 + modules/MakeToken/MakeToken.hpp | 4 + modules/ModuleCmd/CommonCommand.hpp | 90 +------------------ modules/ModuleCmd/ModuleCmd.hpp | 10 +++ modules/ModuleTemplate/ModuleTemplate.hpp | 4 + modules/Powershell/Powershell.hpp | 4 + .../PrintWorkingDirectory.hpp | 4 + modules/PsExec/PsExec.hpp | 4 + modules/Rev2self/Rev2self.hpp | 4 + modules/Run/Run.hpp | 4 + modules/ScreenShot/ScreenShot.hpp | 4 + modules/Script/Script.hpp | 4 + modules/SpawnAs/SpawnAs.cpp | 1 + modules/SpawnAs/SpawnAs.hpp | 4 + modules/StealToken/StealToken.hpp | 4 + modules/Tree/Tree.hpp | 4 + modules/Upload/Upload.hpp | 4 + modules/WmiExec/WmiExec.hpp | 4 + 29 files changed, 117 insertions(+), 90 deletions(-) diff --git a/modules/AssemblyExec/AssemblyExec.hpp b/modules/AssemblyExec/AssemblyExec.hpp index 3892d9a..59fb213 100644 --- a/modules/AssemblyExec/AssemblyExec.hpp +++ b/modules/AssemblyExec/AssemblyExec.hpp @@ -19,6 +19,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int initConfig(const nlohmann::json &config); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } int setProcessToSpawn(const std::string& processToSpawn) { diff --git a/modules/Cat/Cat.hpp b/modules/Cat/Cat.hpp index fa28e3b..c458e51 100644 --- a/modules/Cat/Cat.hpp +++ b/modules/Cat/Cat.hpp @@ -15,6 +15,11 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } + private: diff --git a/modules/ChangeDirectory/ChangeDirectory.hpp b/modules/ChangeDirectory/ChangeDirectory.hpp index 4de59fe..1939d82 100644 --- a/modules/ChangeDirectory/ChangeDirectory.hpp +++ b/modules/ChangeDirectory/ChangeDirectory.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string changeDirectory(const std::string& path); diff --git a/modules/Chisel/Chisel.hpp b/modules/Chisel/Chisel.hpp index a409d16..fc80336 100644 --- a/modules/Chisel/Chisel.hpp +++ b/modules/Chisel/Chisel.hpp @@ -15,6 +15,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); int followUp(const C2Message &c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::vector> m_instances; diff --git a/modules/CoffLoader/CoffLoader.hpp b/modules/CoffLoader/CoffLoader.hpp index 9fba2d6..aa06116 100644 --- a/modules/CoffLoader/CoffLoader.hpp +++ b/modules/CoffLoader/CoffLoader.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string coffLoader(std::string& payload, std::string& functionName, std::string& argsCompressed); diff --git a/modules/Download/Download.hpp b/modules/Download/Download.hpp index 64bf0d5..ba10de7 100644 --- a/modules/Download/Download.hpp +++ b/modules/Download/Download.hpp @@ -17,6 +17,10 @@ public: int process(C2Message& c2Message, C2Message& c2RetMessage); int followUp(const C2Message &c2RetMessage); int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string m_outputfile; diff --git a/modules/Evasion/Evasion.hpp b/modules/Evasion/Evasion.hpp index fdab438..c7a3a06 100644 --- a/modules/Evasion/Evasion.hpp +++ b/modules/Evasion/Evasion.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: diff --git a/modules/Inject/Inject.hpp b/modules/Inject/Inject.hpp index c0feada..466eb6d 100644 --- a/modules/Inject/Inject.hpp +++ b/modules/Inject/Inject.hpp @@ -18,6 +18,10 @@ public: int initConfig(const nlohmann::json &config); int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string m_processToSpawn; diff --git a/modules/KerberosUseTicket/KerberosUseTicket.hpp b/modules/KerberosUseTicket/KerberosUseTicket.hpp index 820fc69..a4f3eb5 100644 --- a/modules/KerberosUseTicket/KerberosUseTicket.hpp +++ b/modules/KerberosUseTicket/KerberosUseTicket.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string importTicket(const std::string& ticket); diff --git a/modules/KeyLogger/KeyLogger.hpp b/modules/KeyLogger/KeyLogger.hpp index 2365fa5..ed16ffb 100644 --- a/modules/KeyLogger/KeyLogger.hpp +++ b/modules/KeyLogger/KeyLogger.hpp @@ -16,9 +16,12 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg); - int recurringExec(C2Message& c2RetMessage); int followUp(const C2Message &c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } bool getIsThreadLaunched() { diff --git a/modules/ListDirectory/ListDirectory.hpp b/modules/ListDirectory/ListDirectory.hpp index 4880a6c..8632a4d 100644 --- a/modules/ListDirectory/ListDirectory.hpp +++ b/modules/ListDirectory/ListDirectory.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string listDirectory(const std::string& path); diff --git a/modules/ListProcesses/ListProcesses.hpp b/modules/ListProcesses/ListProcesses.hpp index 516be3e..ae80a37 100644 --- a/modules/ListProcesses/ListProcesses.hpp +++ b/modules/ListProcesses/ListProcesses.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string listProcesses(); diff --git a/modules/MakeToken/MakeToken.hpp b/modules/MakeToken/MakeToken.hpp index 2f0f74a..254a6be 100644 --- a/modules/MakeToken/MakeToken.hpp +++ b/modules/MakeToken/MakeToken.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string makeToken(const std::string& username, const std::string& domain, const std::string& password); diff --git a/modules/ModuleCmd/CommonCommand.hpp b/modules/ModuleCmd/CommonCommand.hpp index 1d54f7a..0dd6719 100644 --- a/modules/ModuleCmd/CommonCommand.hpp +++ b/modules/ModuleCmd/CommonCommand.hpp @@ -33,8 +33,6 @@ const std::string ListenerPollCmd = "LISP"; const std::string LoadC2ModuleCmd = "LM"; const std::string UnloadC2ModuleCmd = "ULM"; const std::string Socks5Cmd = "SO5"; -// const std::string GetInfoCmd = "GI"; -// const std::string PatchMemoryCmd = "PM"; const std::string InitCmd = "IN"; const std::string RunCmd = "RU"; const std::string EndCmd = "EN"; @@ -55,9 +53,6 @@ const std::string EndInstruction = "end"; const std::string ListenerInstruction = "listener"; const std::string LoadModuleInstruction = "loadModule"; const std::string UnloadModuleInstruction = "unloadModule"; -const std::string SocksInstruction = "socks"; -const std::string GetInfoInstruction = "getInfo"; -const std::string PatchMemoryInstruction = "patchMemory"; const std::string StartInstruction = "start"; const std::string StopInstruction = "stop"; @@ -68,14 +63,11 @@ class CommonCommands public: CommonCommands() { - m_commonCommands.push_back(SleepInstruction); m_commonCommands.push_back(EndInstruction); m_commonCommands.push_back(ListenerInstruction); m_commonCommands.push_back(LoadModuleInstruction); m_commonCommands.push_back(UnloadModuleInstruction); - m_commonCommands.push_back(SocksInstruction); - // m_commonCommands.push_back(GetInfoInstruction); - // m_commonCommands.push_back(PatchMemoryInstruction); + m_commonCommands.push_back(SleepInstruction); } int getNumberOfCommand() @@ -105,13 +97,6 @@ class CommonCommands return LoadModuleInstruction; else if(cmd==UnloadC2ModuleCmd) return UnloadModuleInstruction; - else if(cmd==Socks5Cmd) - return SocksInstruction; - // else if(cmd==GetInfoCmd) - // return GetInfoInstruction; - // else if(cmd==PatchMemoryCmd) - // return PatchMemoryInstruction; - return ""; } @@ -157,26 +142,6 @@ class CommonCommands output += "exemple:\n"; output += " - unloadModule assemblyExec \n"; } - // else if(cmd==Socks5Cmd) - // { - // output = "socks: \n"; - // output += "Start a socks5 server on the TeamServer and tunnel the traffic to the Beacon.\n"; - // output += "The tunneling is done using the communication protocol of the beacon.\n"; - // output += "Only one socks5 server can be opened at a time.\n"; - // output += "exemple:\n"; - // output += " - socks start 1080 \n"; - // output += " - socks stop \n"; - // } - // else if(cmd==GetInfoCmd) - // { - // output = "getInfo: \n"; - // output += "TODO\n"; - // } - // else if(cmd==PatchMemoryCmd) - // { - // output = "patchMemory: \n"; - // output += "TODO\n"; - // } return output; } @@ -363,59 +328,6 @@ class CommonCommands return -1; } } - // - // Socks5 - // - // else if(instruction==SocksInstruction) - // { - // if(splitedCmd.size()>=2) - // { - // if(splitedCmd[1]==StartInstruction) - // { - // if(splitedCmd.size()>=3) - // { - // int port=-1; - // try - // { - // port = std::atoi(splitedCmd[2].c_str()); - // } - // catch (const std::invalid_argument& ia) - // { - // std::cerr << "Invalid argument: " << ia.what() << '\n'; - // return -1; - // } - - // c2Message.set_instruction(Socks5Cmd); - // c2Message.set_cmd(StartCmd); - // c2Message.set_data(splitedCmd[2].data(), splitedCmd[2].size()); - // } - // else - // { - // std::string errorMsg = "socks start: not enough arguments"; - // c2Message.set_returnvalue(errorMsg); - // return -1; - // } - // } - // else if(splitedCmd[1]==StopInstruction) - // { - // c2Message.set_instruction(Socks5Cmd); - // c2Message.set_cmd(StopSocksCmd); - // } - // else - // { - // std::string errorMsg = getHelp(Socks5Cmd); - // c2Message.set_returnvalue(errorMsg); - // return -1; - // } - - // } - // else - // { - // std::string errorMsg = getHelp(instruction); - // c2Message.set_returnvalue(errorMsg); - // return -1; - // } - // } return 0; } diff --git a/modules/ModuleCmd/ModuleCmd.hpp b/modules/ModuleCmd/ModuleCmd.hpp index e4cfc6f..7176b09 100644 --- a/modules/ModuleCmd/ModuleCmd.hpp +++ b/modules/ModuleCmd/ModuleCmd.hpp @@ -11,6 +11,15 @@ #include +enum OSCompatibility { + OS_NONE = 0, + OS_LINUX = 1 << 0, // 0001 + OS_MAC = 1 << 1, // 0010 + OS_WINDOWS = 1 << 2, // 0100 + OS_ALL = OS_LINUX | OS_MAC | OS_WINDOWS +}; + + // // ModuleCmd // @@ -68,6 +77,7 @@ public: virtual int followUp(const C2Message &c2RetMessage) {return 0;}; virtual int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg) {return 0;}; virtual int recurringExec (C2Message& c2RetMessage) {return 0;}; + virtual int osCompatibility () {return OS_NONE;}; protected: std::string m_name; diff --git a/modules/ModuleTemplate/ModuleTemplate.hpp b/modules/ModuleTemplate/ModuleTemplate.hpp index ffba887..56ff5d8 100644 --- a/modules/ModuleTemplate/ModuleTemplate.hpp +++ b/modules/ModuleTemplate/ModuleTemplate.hpp @@ -16,6 +16,10 @@ public: int process(C2Message& c2Message, C2Message& c2RetMessage); int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg); int followUp(const C2Message &c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: diff --git a/modules/Powershell/Powershell.hpp b/modules/Powershell/Powershell.hpp index 6293467..9bc00c4 100644 --- a/modules/Powershell/Powershell.hpp +++ b/modules/Powershell/Powershell.hpp @@ -30,6 +30,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string execPowershell(const std::string& cmd); diff --git a/modules/PrintWorkingDirectory/PrintWorkingDirectory.hpp b/modules/PrintWorkingDirectory/PrintWorkingDirectory.hpp index f223c78..a25396b 100644 --- a/modules/PrintWorkingDirectory/PrintWorkingDirectory.hpp +++ b/modules/PrintWorkingDirectory/PrintWorkingDirectory.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string printWorkingDirectory(); diff --git a/modules/PsExec/PsExec.hpp b/modules/PsExec/PsExec.hpp index bf6c1f2..17297e6 100644 --- a/modules/PsExec/PsExec.hpp +++ b/modules/PsExec/PsExec.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: diff --git a/modules/Rev2self/Rev2self.hpp b/modules/Rev2self/Rev2self.hpp index 3e39723..423c570 100644 --- a/modules/Rev2self/Rev2self.hpp +++ b/modules/Rev2self/Rev2self.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string rev2self(); diff --git a/modules/Run/Run.hpp b/modules/Run/Run.hpp index 1f6e280..3b69a17 100644 --- a/modules/Run/Run.hpp +++ b/modules/Run/Run.hpp @@ -18,6 +18,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string execBash(const std::string& cmd); diff --git a/modules/ScreenShot/ScreenShot.hpp b/modules/ScreenShot/ScreenShot.hpp index f6e1f33..ab14867 100644 --- a/modules/ScreenShot/ScreenShot.hpp +++ b/modules/ScreenShot/ScreenShot.hpp @@ -17,6 +17,10 @@ public: int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg); int recurringExec(C2Message& c2RetMessage); int followUp(const C2Message &c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: diff --git a/modules/Script/Script.hpp b/modules/Script/Script.hpp index 1196a0d..46164d3 100644 --- a/modules/Script/Script.hpp +++ b/modules/Script/Script.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX; + } private: diff --git a/modules/SpawnAs/SpawnAs.cpp b/modules/SpawnAs/SpawnAs.cpp index 6d8219c..91112b9 100644 --- a/modules/SpawnAs/SpawnAs.cpp +++ b/modules/SpawnAs/SpawnAs.cpp @@ -122,6 +122,7 @@ int SpawnAs::init(std::vector &splitedCmd, C2Message &c2Message) } +//TODO look at https://github.com/antonioCoco/RunasCs/blob/master/RunasCs.cs int SpawnAs::process(C2Message &c2Message, C2Message &c2RetMessage) { std::string cmd = c2Message.cmd(); diff --git a/modules/SpawnAs/SpawnAs.hpp b/modules/SpawnAs/SpawnAs.hpp index c2a233e..b88b9e0 100644 --- a/modules/SpawnAs/SpawnAs.hpp +++ b/modules/SpawnAs/SpawnAs.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: diff --git a/modules/StealToken/StealToken.hpp b/modules/StealToken/StealToken.hpp index 885d84c..f019983 100644 --- a/modules/StealToken/StealToken.hpp +++ b/modules/StealToken/StealToken.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: std::string stealToken(int pid); diff --git a/modules/Tree/Tree.hpp b/modules/Tree/Tree.hpp index 6431368..ecd7ab3 100644 --- a/modules/Tree/Tree.hpp +++ b/modules/Tree/Tree.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: std::string iterProcess(const std::string& path, int depth); diff --git a/modules/Upload/Upload.hpp b/modules/Upload/Upload.hpp index 845cbfc..e51538b 100644 --- a/modules/Upload/Upload.hpp +++ b/modules/Upload/Upload.hpp @@ -15,6 +15,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg); + int osCompatibility() + { + return OS_LINUX | OS_WINDOWS; + } private: diff --git a/modules/WmiExec/WmiExec.hpp b/modules/WmiExec/WmiExec.hpp index bbab934..219a346 100644 --- a/modules/WmiExec/WmiExec.hpp +++ b/modules/WmiExec/WmiExec.hpp @@ -14,6 +14,10 @@ public: int init(std::vector& splitedCmd, C2Message& c2Message); int process(C2Message& c2Message, C2Message& c2RetMessage); + int osCompatibility() + { + return OS_WINDOWS; + } private: