protocol

package

v0.0.0-...-dd779cd Latest Latest Go to latest Published: Feb 7, 2019 License: GPL-3.0 Imports: 10 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/randomwalksp/godoh

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func Requestify(data []byte, protocol int) []string
func Textify(data []byte, protocol int) string
type Agent
type Command
type DNSBuffer
type File
- func (fc *File) GetRequests() ([]string, string)
- func (fc *File) Prepare(data *[]byte, fileInfo os.FileInfo)
type FileTransport

Constants ¶

View Source

const (
	SuccessDNSResponse = "1.1.1.1"
	FailureDNSResponse = "1.1.1.2"
)

Response codes sent as DNS answers.

View Source

const (
	FileProtocol = iota
	CmdProtocol
)

Protocols understood

View Source

const (
	StreamStart = 0xbe
	StreamData  = 0xef
	StreamEnd   = 0xca
)

Request stream status

View Source

const MaxLabelSize = 63

MaxLabelSize is the maximum size a DNS hostname label may be.

Variables ¶

View Source

var (
	NoCmdTxtResponse = []string{
		"v=B2B3FE1C",
	}
	ErrorTxtResponse = []string{
		"v=D31CFAA4",
	}
	CmdTxtResponse = []string{
		"v=A9F466E8",
	}
)

TXT record default responses

Functions ¶

func Requestify ¶

func Requestify(data []byte, protocol int) []string

Requestify generates hostnames for DNS lookups

A full conversation with the server will involve multiple DNS lookups. Requestifying assumes that the client will be sending data to the server. Each request normally requires the server to respond with a specific IP address indicating success, failure or other scenarios. Checking these is up to the caller to verify, but something to keep in mind.

Generically speaking, hostnames for lookups will have multiple labels. ie:

	Structure:
		ident.type.seq.crc32.proto.datalen.data.data.data

	ident: 		the identifier for this specific stream
	type:		stream status indicator. ie: start, sending, stop
	seq:		a sequence number to track request count
	crc32:		checksum value
	proto:		the protocol this transaction is for. eg: file transfer/cmd
	datalen:	how much data does this packet have
	data:		the labels containing data. max of 3 but can have only one too

	Size: 4 + 2 + 16 + 8 + 2 + 2 + 60 + 60 + 60 for a maximum size of 214
 Sample:
		0000.00.0000000000000000.00000000.00.00.60.60.60

Note: Where the label lenths may be something like 60, a byte takes two of those, meaning that each data label is only 30 bytes for a total of 90 bytes per request, excluding ident, seq and crc32.

func Textify ¶

func Textify(data []byte, protocol int) string

Textify creates a TXT record response

Types ¶

type Agent ¶

type Agent struct {
	Identifier   string
	FirstCheckin time.Time
	LastCheckin  time.Time
}

Agent represents an agent connected to this C2

type Command ¶

type Command struct {
	Exec     string
	Data     []byte
	ExecTime time.Time
	// contains filtered or unexported fields
}

Command represents a command to be send over DNS.

func (*Command) GetOutgoing ¶

func (c *Command) GetOutgoing() string

GetOutgoing returns the hostnames to lookup as part of a file transfer operation.

func (*Command) GetRequests ¶

func (c *Command) GetRequests() ([]string, string)

GetRequests returns the hostnames to lookup as part of a command output operation.

func (*Command) Prepare ¶

func (c *Command) Prepare(cmd string)

Prepare configures the File struct with relevant data.

type DNSBuffer ¶

type DNSBuffer struct {
	Identifier string
	Data       []byte
	Seq        int
	Started    bool
	Finished   bool
	Protocol   int
}

DNSBuffer represents a pending DNS conversation

type File ¶

type File struct {
	Size   int64
	Shasum string
	Name   string
	Data   *[]byte
	// contains filtered or unexported fields
}

File represents a file to be send over DNS.

func (*File) GetRequests ¶

func (fc *File) GetRequests() ([]string, string)

GetRequests returns the hostnames to lookup as part of a file transfer operation.

func (*File) Prepare ¶

func (fc *File) Prepare(data *[]byte, fileInfo os.FileInfo)

Prepare configures the File struct with relevant data.

type FileTransport ¶

type FileTransport struct {
	Data   []byte
	Size   int64
	Shasum string
}

FileTransport defines properties, as well as the data for a file.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL