a90bf015fd
feat: encrypt implant-to-operator payloads with NaCl box
...
Add X25519 box keypair (operator.boxkey/operator.boxpub) for end-to-end
encryption of all implant->operator message Data fields via
box.SealAnonymous. Prevents eavesdropping on GossipSub traffic.
- Encrypt env.Data before signing in sendEnvelopeDirect and SignAndSend
- Build local wire envelope in sendEnvelopeDirect (avoids mutating caller's
env on send failure, preventing double-encryption on PubSub fallback)
- Serialize beacon stream writes with beaconWriteMu mutex
- Decrypt in operator handleMessage before dispatching to handlers
- Embed box pubkey in implant during arachne generate
- Generate box keys on first operator run, persist to disk
- Add stub files for development compilation
2026-06-13 03:06:34 +10:00
7784d08e6b
fix: address code review findings
...
- Add SHA256 verification for Go auto-install download
- Add replay protection with time-skew validation
- Upgrade SOCKS password hashing to bcrypt
- Fix SOCKS random exit mode (pick once per listener, not per conn)
- Fix lock contention in implant sendEnvelopeDirect
- Log panics with stack traces instead of silent recover()
- Fix SOCKS5 auth downgrade when client doesn't offer method 2
- Remove TOCTOU race in port checking
- Fix Garble GOPATH parsing (use SplitList)
- Fix DHT bootstrap race (wait for >=5 peers)
- Fix Windows Go detection paths
- Fix Windows Go auto-install (.zip not .tar.gz)
- Fix Windows history persistence (defer save + MkdirAll)
- Add timeouts to all Go download HTTP requests
- Populate UUID field in beacon register
2026-06-10 00:33:00 +08:00
f4fc743ffd
add SOCKS5 proxy: operator-side server, implant-side stream handler, CLI subcommands
...
Operator runs a SOCKS5 server on 127.0.0.1 that forwards traffic to implants
via direct /x/sk/1.0.0 libp2p streams. Supports username/password auth (RFC
1929) with SHA-256 hashed credentials saved to ~/.arachne/socks.json.
CLI: socks start <idx|random> <port>, socks list, socks stop <port>,
socks reset-creds
Implant: handleSocksStream registered for SocksProtocolID
Operator: socksProxies map, socksMu mutex, beacon stream noise suppression
Build fix: prune *Stub.go except antivm_stub.go from embedded source tree.
2026-06-09 05:18:50 +10:00
b26e2f5137
add --antivm flag: pure-Go VMAware-compatible VM detection (65+ techniques, accumulated scoring)
2026-06-06 05:04:18 +08:00
3d8e9d80bc
perf: reduce UPX pack time for implant generation
...
Replace --best --all-methods --lzma with --lzma --compress-exports=0
- Drops brute-force multi-algorithm search (NRV/NRV2b/NRV2d/NRV2e/LZMA)
- LZMA always wins for Go binaries, rest was wasted time
- --compress-exports=0 skips export section (Go binaries have none)
2026-06-06 00:53:10 +08:00
dfa9a20629
fix: relay circuit keepalive, TCP transport, shell escape Ctrl+]
...
- Add 5s stream keepalive loop (MsgTypeCover) to prevent relay idle timeout
- Add TCP transport alongside WebSocket for relay connectivity
- Add Ctrl+] escape from interactive shell
- Fix DHT reconnection when beacon stream dies (check stream nil)
- Add AllowLimitedConn to shell and portfwd NewStream calls
- Log periodic beacon success messages
- Fix ps empty-slice handling on Linux
- Fix process-wait zombie prevention
2026-06-05 23:36:24 +08:00
3f3b8acd24
fix: direct libp2p stream beacon registration
2026-06-05 00:57:59 +08:00
c9fb32fbcd
Obfuscate wire identifiers, fix Windows shell, fix command routing
...
- Renamed protobuf packages: arachnepb→apb, commonpb→cpb, rpcpb→rpb
- Renamed protobuf types to opaque Z-series (BeaconRegister→Z1, etc.)
- Renamed RPC from ArachneRPC→S, methods GetVersion→M0, etc.
- Changed protocol IDs: /arachne/shell/1.0.0 → /x/sh/1.0.0, etc.
- Changed pubsub topic prefixes: /arachne/ → /c/, /beacons/ → /b/
- Per-implant task routing (TaskTopic) instead of shared CommandTopic
- Fixed Windows shell: HideWindow, merged stderr, LF→CRLF conversion
- Fixed io.Copy Write contract violation in shell stdin path
- Fixed ListImplants() sorting for stable select ordering
- Added garble -literals -tiny flags, PATH propagation for generate
- Added bootstrap IP fallbacks for bypassing DNS blocking
- Updated all docs to reflect new wire format
2026-06-04 05:04:31 +08:00
187b7b10fd
Fix Windows shell (pipes instead of PTY), deselect on disconnect, print newline after shell exits
2026-06-04 00:37:16 +08:00
a72c062c7b
Fix Windows session issues: cross-platform username, Windows ps via tasklist, handle Pwd/Download/Upload responses
2026-06-04 00:34:16 +08:00
58324ddb6b
Hide disconnected implants from list/select
2026-06-03 23:43:43 +08:00
4131e9536a
Fix --quiet daemonization: use os.StartProcess instead of raw fork to avoid Go runtime corruption
2026-06-03 23:38:31 +08:00
9c5f554c07
Implant disconnect detection: log and mark stale beacons as DISCONNECTED
2026-06-03 23:25:16 +08:00
8b555c290f
Add --quiet flag: daemonize on Linux, hide console on Windows
2026-06-03 23:17:47 +08:00
d727c78cfe
Fix garble: add 'build' subcommand to args, check GOPATH/bin after install
2026-06-03 23:09:12 +08:00
f37dd016bd
Fix findGo ~/.local/go path and pass goBin to ensureGarble
2026-06-03 23:04:18 +08:00
0d5d967854
Fix Go auto-install: graceful fallback when sudo unavailable
...
- Try direct write to /usr/local/go first
- Fall back to sudo
- Fall back to ~/.local/go
- Last resort: /tmp/go
2026-06-03 23:01:14 +08:00
a276a4b6de
Add --obfuscate flag for garble-based implant obfuscation
...
- --obfuscate flag on generate uses garble for symbol stripping, string
obfuscation, and package path hiding
- Auto-installs garble via 'go install mvdan.cc/garble@latest' when missing
- Works cross-platform for all OS/arch targets
2026-06-03 22:54:59 +08:00
98b87a51d6
Unified binary, embedded source, cover traffic, persistent implant keys, regenerate command
...
- Single cmd/arachne entry point replaces server, implant, build-implant
- Implant source embedded in operator binary at build time (self-contained)
- generate command embeds unique keypair per implant build (persistent PeerID)
- cover traffic: random noise messages mask beacon timing
- regenerate command: rotate operator keys with warning
- auto-install Go when missing during generate
- liner-based CLI with command history and per-command --help
2026-06-03 22:45:59 +08:00
67fd5ccbaa
shell: forward terminal size, prefer bash over sh for readline support
2026-06-03 04:52:20 +08:00
8a0cbabce3
rename module to ArachneC2, update remote
2026-06-03 04:46:26 +08:00
7079cae938
port forwarding over direct libp2p stream
2026-06-03 04:29:53 +08:00
99391e3a2a
interactive shell with PTY over direct libp2p stream
2026-06-03 04:27:16 +08:00
bf5357aef4
suppress beacon spam, fix implant name, add build.sh
2026-06-03 04:04:47 +08:00
e820cfd58d
Remove debug logging from DHT bootstrap/advertise/discovery
2026-06-03 02:42:47 +08:00
fa387ba5fd
Store keys in ~/.arachne/, remove non-embedded implant, fix DHT advertise wait, suppress routing table spam
2026-06-03 02:41:01 +08:00
58138a3225
Complete operator CLI, implant handlers, topic naming fix, embedded pubkey build system
...
- Added server/core/operator.go: Operator struct, implant tracking, command dispatch, beacon handler with envelope signature verification
- Added pkg/transport/types.go: Message type constants (MsgTypeRegister through MsgTypeDisconnect)
- Added implant/core/embedded_pubkey.go: Build-time operator key injection stub
- Fixed pkg/transport/node.go: Topic prefix format per protocol spec
- Fixed pkg/transport/messenger.go: Topic naming to /arachne/<operator-peerid>/...
- Added implant/core/agent.go: All command handlers (ps, ping, ls, cd, pwd, execute, download, upload, screenshot, kill)
- Added server/core/cli.go: Interactive console with list/select/ps/ls/cd/pwd/exec/download/upload/help/exit
- Fixed server/core/run.go: Operator key loading + auto-export of operator.pub
2026-06-03 00:55:13 +08:00
b22580c2a8
new stuff
2026-06-03 02:13:31 +10:00
6f7f72f856
Phase 0-1: Operator node, implant agent, beacon/command loop
...
Server (operator):
- server/main.go — entry point, loads key, starts operator
- server/core/operator.go — handles beacons, tracks implants, dispatches commands
- server/core/run.go — signal handling, key generation on first run
Implant (agent):
- implant/main.go — entry point, loads operator pubkey, starts agent
- implant/core/agent.go — key generation, beacon loop, command dispatch
- implant/core/ps.go — cross-platform process listing (Linux /proc)
Transport:
- pkg/transport/messenger.go — signed envelope creation, topic pub/sub
- pkg/transport/node.go — libp2p host, GossipSub, topic join/subscribe/publish
Crypto:
- pkg/cryptography/keys.go — LoadOrGenerateOperatorKey, Ed25519 sign/verify
2026-06-03 00:22:41 +10:00
portbuster1337