Implemented profile embedding via patching a placeholder in the agent executable. Agent correctly deserializes and parses the profile and listener configuration.
This commit is contained in:
@@ -34,6 +34,7 @@ Commands:
|
||||
info Display details for a specific agent.
|
||||
kill Terminate the connection of an active listener and remove it from the interface.
|
||||
interact Interact with an active agent.
|
||||
build Generate a new agent to connect to an active listener.
|
||||
|
||||
Options:
|
||||
-h, --help""")
|
||||
@@ -124,65 +125,3 @@ proc agentInteract*(cq: Conquest, name: string) =
|
||||
|
||||
cq.interactAgent = nil
|
||||
|
||||
# Agent generation
|
||||
proc agentBuild*(cq: Conquest, listener, sleep, payload: string) =
|
||||
|
||||
# Verify that listener exists
|
||||
if not cq.dbListenerExists(listener.toUpperAscii):
|
||||
cq.writeLine(fgRed, styleBright, fmt"[-] Listener {listener.toUpperAscii} does not exist.")
|
||||
return
|
||||
|
||||
let listener = cq.listeners[listener.toUpperAscii]
|
||||
|
||||
# Create/overwrite nim.cfg file to set agent configuration
|
||||
let AgentCtxFile = fmt"../src/agent/nim.cfg"
|
||||
|
||||
# Parse IP Address and store as compile-time integer to hide hardcoded-strings in binary from `strings` command
|
||||
let (first, second, third, fourth) = parseOctets(listener.address)
|
||||
|
||||
# Covert the servers's public X25519 key to as base64 string
|
||||
let publicKey = encode(cq.keyPair.publicKey)
|
||||
let profileString = encode(cq.profile.toTomlString())
|
||||
|
||||
# The following shows the format of the agent configuration file that defines compile-time variables
|
||||
let config = fmt"""
|
||||
# Agent configuration
|
||||
-d:ListenerUuid="{listener.listenerId}"
|
||||
-d:Octet1="{first}"
|
||||
-d:Octet2="{second}"
|
||||
-d:Octet3="{third}"
|
||||
-d:Octet4="{fourth}"
|
||||
-d:ListenerPort={listener.port}
|
||||
-d:SleepDelay={sleep}
|
||||
-d:ServerPublicKey="{publicKey}"
|
||||
-d:ProfileString="{profileString}"
|
||||
""".replace(" ", "")
|
||||
writeFile(AgentCtxFile, config)
|
||||
|
||||
cq.writeLine(fgBlack, styleBright, "[*] ", resetStyle, "Configuration file created.")
|
||||
|
||||
# Build agent by executing the ./build.sh script on the system.
|
||||
let agentBuildScript = fmt"../src/agent/build.sh"
|
||||
|
||||
cq.writeLine(fgBlack, styleBright, "[*] ", resetStyle, "Building agent...")
|
||||
|
||||
try:
|
||||
# Using the startProcess function from the 'osproc' module, it is possible to retrieve the output as it is received, line-by-line instead of all at once
|
||||
let process = startProcess(agentBuildScript, options={poUsePath, poStdErrToStdOut})
|
||||
let outputStream = process.outputStream
|
||||
|
||||
var line: string
|
||||
while outputStream.readLine(line):
|
||||
cq.writeLine(line)
|
||||
|
||||
let exitCode = process.waitForExit()
|
||||
|
||||
# Check if the build succeeded or not
|
||||
if exitCode == 0:
|
||||
cq.writeLine(fgGreen, "[+] ", resetStyle, "Agent payload generated successfully.")
|
||||
else:
|
||||
cq.writeLine(fgRed, styleBright, "[-] ", resetStyle, "Build script exited with code ", $exitCode)
|
||||
|
||||
except CatchableError as err:
|
||||
cq.writeLine(fgRed, styleBright, "[-] ", resetStyle, "An error occurred: ", err.msg)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user