mirror of
https://github.com/maxDcb/C2Core
synced 2026-06-08 15:48:01 +00:00
Maxime dcb
108a370807
* CommandSpecs * CommandSpecs * feat(command-specs): add simple module specs * listModule * AssemblyExec * AssemblyExecTests * Minor * Inject * InjectTests * Spec modules * Folder layout * upload & download * Chisel Minidump Powershell & Script * CoffLoader DotnetExec /KerberosUseTicket PsExec PwSh ScreenShot * add artifact_filters * Minor * stabilisation * Fixes * manual test * manual test * manual test * manual test * manual test * manual test * manual test * manual test * ScreenShot png * socks5 hostname * Maj for AI * minor
111 lines
3.1 KiB
JSON
111 lines
3.1 KiB
JSON
{
|
|
"name": "inject",
|
|
"display_name": "inject",
|
|
"kind": "module",
|
|
"description": "Inject prepared shellcode into an existing process or a newly spawned process. Donut inputs are prepared by the TeamServer shellcode service before the task is sent to the beacon.",
|
|
"command_template": "inject --pid {pid} [--raw {raw:q}] [--donut-exe {donut_exe:q}] [--donut-dll {donut_dll:q}] [--method {method:q}] [-- {arguments:raw}]",
|
|
"target": "beacon",
|
|
"requires_session": true,
|
|
"platforms": ["windows"],
|
|
"archs": ["x86", "x64", "arm64"],
|
|
"args": [
|
|
{
|
|
"name": "--pid",
|
|
"type": "flag",
|
|
"required": true,
|
|
"description": "Target process id. Use a negative value to spawn the configured process before injection."
|
|
},
|
|
{
|
|
"name": "--raw",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Use an existing raw shellcode file on the TeamServer.",
|
|
"artifact_filter": {
|
|
"category": "tool",
|
|
"scope": "server",
|
|
"target": "teamserver",
|
|
"platform": "windows",
|
|
"arch": "session.arch",
|
|
"runtime": "any",
|
|
"format": "bin",
|
|
"name_contains": ".bin"
|
|
}
|
|
},
|
|
{
|
|
"name": "--donut-exe",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Generate shellcode from an executable on the TeamServer.",
|
|
"artifact_filters": [
|
|
{
|
|
"category": "tool",
|
|
"scope": "server",
|
|
"target": "teamserver",
|
|
"platform": "windows",
|
|
"arch": "session.arch",
|
|
"runtime": "any",
|
|
"format": "exe",
|
|
"name_contains": ".exe"
|
|
},
|
|
{
|
|
"category": "beacon",
|
|
"scope": "implant",
|
|
"target": "listener",
|
|
"platform": "windows",
|
|
"arch": "session.arch",
|
|
"runtime": "native",
|
|
"format": "exe",
|
|
"name_contains": ".exe"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "--donut-dll",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Generate shellcode from a DLL on the TeamServer.",
|
|
"artifact_filter": {
|
|
"category": "tool",
|
|
"scope": "server",
|
|
"target": "teamserver",
|
|
"platform": "windows",
|
|
"arch": "session.arch",
|
|
"runtime": "any",
|
|
"format": "dll",
|
|
"name_contains": ".dll"
|
|
}
|
|
},
|
|
{
|
|
"name": "source_path",
|
|
"type": "path",
|
|
"required": true,
|
|
"description": "Raw shellcode, executable, or DLL path on the TeamServer."
|
|
},
|
|
{
|
|
"name": "pid",
|
|
"type": "number",
|
|
"required": true,
|
|
"description": "Target process id."
|
|
},
|
|
{
|
|
"name": "--method",
|
|
"type": "flag",
|
|
"required": false,
|
|
"description": "Required for --donut-dll."
|
|
},
|
|
{
|
|
"name": "arguments",
|
|
"type": "text",
|
|
"required": false,
|
|
"description": "Arguments passed to the Donut source after --.",
|
|
"variadic": true
|
|
}
|
|
],
|
|
"examples": [
|
|
"inject --raw shellcode.bin --pid 4321",
|
|
"inject --donut-exe Seatbelt.exe --pid 4321 -- -group=system",
|
|
"inject --donut-dll Tool.dll --pid -1 --method EntryPoint -- arg1 arg2"
|
|
],
|
|
"source": "manifest"
|
|
}
|