protocol

package
v0.0.0-...-f1edcfc Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 19, 2023 License: GPL-3.0 Imports: 10 Imported by: 4

Documentation

Index

Constants

View Source 
const (
	SuccessDNSResponse = "1.1.1.1"
	FailureDNSResponse = "1.1.1.2"
)

Response codes sent as DNS answers.

View Source 
const (
	FileProtocol = iota
	CmdProtocol
	UploadProtocol
	CobaltStrikeProtocol
)

Protocols understood

View Source 
const (
	PollTypeUndefined = iota
	PollTypeCheckin
	PollTypeUpload
)

PollTypes to expect from agents.

View Source 
const (
	StreamStart = 0xbe
	StreamData  = 0xef
	StreamEnd   = 0xca
)

Request stream status

View Source 
const MaxLabelSize = 63

MaxLabelSize is the maximum size a DNS hostname label may be.

Variables

View Source 
var (
	NoCmdTxtResponse  = "v=B2B3FE1C"
	ErrorTxtResponse  = "v=D31CFAA4"
	CmdTxtResponse    = "v=A9F466E8"
	UploadTxtResponse = "v=H34FERKL"
)

TXT record default responses

Functions

func ARequestify 

func ARequestify(data []byte, protocol int) (requests []string)

ARequestify generates hostnames for DNS lookups via A records. This is typically for data streams coming from the client to the server.

A full conversation with the server will involve multiple DNS lookups. Requestifying assumes that the client will be sending data to the server. Each request normally requires the server to respond with a specific IP address indicating success, failure or other scenarios. Checking these is up to the caller to verify, but something to keep in mind.

Generically speaking, hostnames for lookups will have multiple labels. ie: 

	Structure:
		ident.type.seq.crc32.proto.datalen.data.data.data

	ident: 		the identifier for this specific stream
	type:		stream status indicator. ie: start, sending, stop
	seq:		a sequence number to track request count
	crc32:		checksum value
	proto:		the protocol this transaction is for. eg: file transfer/cmd
	datalen:	how much data does this packet have
	data:		the labels containing data. max of 3 but can have only one too

	Size: 4 + 2 + 16 + 8 + 2 + 2 + 60 + 60 + 60 for a maximum size of 214
 Sample:
		0000.00.0000000000000000.00000000.00.00.60.60.60

Note: Where the label lenths may be something like 60, a byte takes two of those, meaning that each data label is only 30 bytes for a total of 90 bytes per request, excluding ident, seq and crc32.

func TXTRequestify 

func TXTRequestify(data []byte, protocol int) (requests []string)

TXTRequestify creates TXT record responses for data transfer. This is typically for data streams to an agent.

Unlike A record responses that have markers to indicate stream status, TXT record chunks are just a list of payloads in order to be appended together on the agent side. A TXT record response has the following format. 

	Structure:
		ident.seq.crc32.proto.datalen.data

	ident: 		the identifier for this specific stream
	seq:		a sequence number to track request count
	crc32:		checksum value
	proto:		the protocol this transaction is for. eg: file transfer/cmd
	datalen:	how much data does this packet have
	data:		the labels containing data. max of 3 but can have only one too

	Size: 4 + 16 + 8 + 2 + 2 + 200 (max) for a maximum size of 233
 Sample:
		0000.0000000000000000.00000000.00.00.00000000000000...

Types

type Agent 

type Agent struct {
	Identifier   string
	FirstCheckin time.Time
	LastCheckin  time.Time
}

Agent represents an agent connected to this C2

type Command 

type Command struct {
	Exec       string `json:"exec"`
	Data       []byte `json:"data"`
	ExecTime   int64  `json:"exectime"`
	Identifier string `json:"identifier"`
}

Command represents a command to be send over DNS.

func (*Command) GetOutgoing 

func (c *Command) GetOutgoing() string

GetOutgoing returns the hostnames to lookup as part of a file transfer operation.

func (*Command) GetRequests 

func (c *Command) GetRequests() ([]string, string)

GetRequests returns the hostnames to lookup as part of a command output operation.

func (*Command) Prepare 

func (c *Command) Prepare(cmd string)

Prepare configures the File struct with relevant data.

type File 

type File struct {
	Size        int64   `json:"size"`
	Shasum      string  `json:"shasum"`
	Name        string  `json:"name"`
	Destination string  `json:"destination"`
	Data        *[]byte `json:"data"`
	Identifier  string  `json:"identifier"`
}

File represents a file to be send over DNS.

func (*File) GetARequests 

func (fc *File) GetARequests() ([]string, string)

GetARequests returns the hostnames to lookup as part of a file transfer operation via A records.

func (*File) GetTXTRequests 

func (fc *File) GetTXTRequests() []string

GetTXTRequests returns the TXT record contents to return as part of a file transfer operation via TXT records

func (*File) Prepare 

func (fc *File) Prepare(data *[]byte, fileInfo os.FileInfo)

Prepare configures the File struct with relevant data.

type FileTransport 

type FileTransport struct {
	Data   []byte
	Size   int64
	Shasum string
}

FileTransport defines properties, as well as the data for a file.

type IncomingDNSBuffer 

type IncomingDNSBuffer struct {
	Identifier string
	Data       []byte
	Seq        int
	Started    bool
	Finished   bool
	Protocol   int
}

IncomingDNSBuffer represents a pending incoming DNS conversation

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.