Jakob Friedl
|
0bf717992e
|
Implemented setting for verbose mode that prints debug messages in the windows where the agent is executed. Setting "verbose" to false disables all console output of the agent program.
|
2025-10-20 22:08:06 +02:00 |
|
Jakob Friedl
|
382e31c439
|
Added comments.
|
2025-10-19 20:55:27 +02:00 |
|
Jakob Friedl
|
2e18decb6d
|
Implemented 'steal-token' command.
|
2025-10-19 20:06:40 +02:00 |
|
Jakob Friedl
|
a4f37b5ceb
|
Implemented most token functionality using Native APIs instead of Windows APIs.
|
2025-10-19 18:05:20 +02:00 |
|
Jakob Friedl
|
35bb4d8869
|
Implemented 'disable-privilege' command.
|
2025-10-18 13:05:01 +02:00 |
|
Jakob Friedl
|
ba1f1943fc
|
Implemented 'enable-privilege' command.
|
2025-10-18 12:41:55 +02:00 |
|
Jakob Friedl
|
b3e82fc3a8
|
Reworked token functions.
|
2025-10-17 18:35:40 +02:00 |
|
Jakob Friedl
|
76930c9302
|
Implemented 'token-info' command that returns statistics, group memberships and privileges of the current access token.
|
2025-10-17 17:22:31 +02:00 |
|
Jakob Friedl
|
4a1a70da4d
|
Impersonated user is displayed in the client UI and persisted in the team server database.
|
2025-10-17 13:01:12 +02:00 |
|
Jakob Friedl
|
0fc8ff3caa
|
Standardized console spacing between commands.
|
2025-10-17 09:42:08 +02:00 |
|
Jakob Friedl
|
dea10ba7d5
|
Started work on token module and implemented 'make-token' command to impersonate a user from username and password.
|
2025-10-16 19:29:49 +02:00 |
|
Jakob Friedl
|
756ee09eeb
|
Fixed team server breaking when trying to write large task result data to log files.
|
2025-10-13 10:12:34 +02:00 |
|
Jakob Friedl
|
392aaec972
|
Timestamp formatting broke text selection, so the int64 unix timestamp is formatted to a string before being added to the console component. This solved most of the highlighting issues I encountered.
|
2025-10-12 15:00:42 +02:00 |
|
Jakob Friedl
|
f2d2833306
|
Implemented callback host system to support HTTP redirectors
|
2025-10-11 17:10:18 +02:00 |
|
Jakob Friedl
|
bcf845288c
|
Implemented widgets for showing loot: Downloads & Screenshots. Textures are read from a byte sequence and displayed in the UI. Currently tested using hard-coded values.
|
2025-10-07 21:16:17 +02:00 |
|
Jakob Friedl
|
b39a0e70e2
|
Updated directory structure.
|
2025-10-03 12:44:28 +02:00 |
|
Jakob Friedl
|
ae09e4e7e3
|
Implemented basic Tab-autocompletion for agent console.
|
2025-10-03 09:59:50 +02:00 |
|
Jakob Friedl
|
ab48bc5795
|
Added build log to client UI.
|
2025-10-02 12:10:46 +02:00 |
|
Jakob Friedl
|
5c0beb36ff
|
Added remote address and modules to agent structure. Help command now only shows commands for which the agent has been configured.
|
2025-10-02 10:25:37 +02:00 |
|
Jakob Friedl
|
0937840b77
|
Removed unused code.
|
2025-10-01 15:27:06 +02:00 |
|
Jakob Friedl
|
039c857027
|
Moved task parsing logic to the client to be able to support dotnet/bof commands when operating from a different machine than the team server. Disabled sequence tracking due to issues.
|
2025-09-30 10:04:29 +02:00 |
|
Jakob Friedl
|
47799ee5f5
|
Implemented generating agent payloads from the ImGui client.
|
2025-09-27 15:18:45 +02:00 |
|
Jakob Friedl
|
166cadcb56
|
Fixed bug caused by '\0' in username that broke formatting.
|
2025-09-25 20:22:56 +02:00 |
|
Jakob Friedl
|
8baf65a96d
|
Improved dual list selection widget.
|
2025-09-24 19:26:17 +02:00 |
|
Jakob Friedl
|
42cc58b30b
|
Replaced prologue implementation with mummy for listener management, since it seems more suitable for future use (websockets, etc.).
|
2025-09-19 18:31:45 +02:00 |
|
Jakob Friedl
|
5d09efd823
|
Reworked module system. Modules can now be individually set to be included in the agent. For example, it is possible to compile an agent only capable of executing BOFs and nothing else.
|
2025-09-17 15:55:13 +02:00 |
|
Jakob Friedl
|
c6bbef8520
|
Implemented compression of the network packet bodies.
|
2025-09-13 15:18:46 +02:00 |
|
Jakob Friedl
|
b7b9114258
|
Fixed issue that caused assembly execution to fail when used more than once in a session.
|
2025-09-13 14:14:21 +02:00 |
|
Jakob Friedl
|
94f2f8121c
|
Implemented 'dotnet' command for execute-assembly functionality. Patched AMSI using HWBP
|
2025-09-13 11:47:19 +02:00 |
|
Jakob Friedl
|
9b94a06ce9
|
Implemented basic .NET assembly execution using winim/clr.
|
2025-09-12 15:06:28 +02:00 |
|
Jakob Friedl
|
e64e31a7bc
|
Integrated sleep obfuscation settings into agent generation.
|
2025-09-04 13:44:50 +02:00 |
|
Jakob Friedl
|
e297bb2d76
|
Split sleep obfuscation into separate functions to increase readability and changed to manual API resolution.
|
2025-09-04 12:02:50 +02:00 |
|
Jakob Friedl
|
5ebe5d3598
|
Implemented the Foliage sleep obfuscation technique.
|
2025-09-03 23:21:45 +02:00 |
|
Jakob Friedl
|
d0545ffd16
|
Implemented 'screenshot' command.
|
2025-09-03 19:38:22 +02:00 |
|
Jakob Friedl
|
653dfac4b4
|
Improved sleep obfuscation cleanup.
|
2025-09-03 08:46:38 +02:00 |
|
Jakob Friedl
|
b19f8e1236
|
Implemented Zilean sleep obfuscation technique as an alternative to Ekko.
|
2025-09-02 21:41:04 +02:00 |
|
Jakob Friedl
|
ae083896b6
|
Implemented simple download command.
|
2025-09-01 19:45:39 +02:00 |
|
Jakob Friedl
|
8292a5b1ff
|
Implemented handling of different argument types (int, wstring, short) for BOF files using specific prefixes.
|
2025-08-30 14:05:09 +02:00 |
|
Jakob Friedl
|
4ceb756cfd
|
Added 'bof' module for executing object files and fixed handling of optional arguments.
|
2025-08-29 15:58:26 +02:00 |
|
Jakob Friedl
|
352b8fd8d1
|
Reworked beacon.nim with definitions from trustedSec's COFFLoader.
|
2025-08-29 13:40:00 +02:00 |
|
Jakob Friedl
|
957f96f1ca
|
Implemented COFF loader.
|
2025-08-28 19:00:34 +02:00 |
|
Jakob Friedl
|
e1ea085a0d
|
Decided against implementing additional heap obfuscation for Ekko, due to no sensitive data being allocated in heap memory.
|
2025-08-28 12:47:37 +02:00 |
|
Jakob Friedl
|
f81933e479
|
Extended ekko implementation with stack spoofing.
|
2025-08-27 20:11:22 +02:00 |
|
Jakob Friedl
|
a18ad3c2cb
|
Removed Ekko WinAPI implementation to clear up file.
|
2025-08-27 18:24:44 +02:00 |
|
Jakob Friedl
|
d3e0d5e6de
|
Implemented Ekki according to MalDev module with both Native API and WinAPI; fixing race condition for both implementations.
|
2025-08-27 11:37:07 +02:00 |
|
Jakob Friedl
|
00866b30cd
|
Implemented basic sleep obfuscation via the Ekko technique using WinAPI. Improvement needed!
|
2025-08-27 00:27:50 +02:00 |
|
Jakob Friedl
|
8791faec3f
|
Implemented compile-time string obfuscation via XOR for the agent.
|
2025-08-26 15:11:43 +02:00 |
|
Jakob Friedl
|
dd7433588f
|
Refactored random byte generation functions.
|
2025-08-25 20:08:23 +02:00 |
|
Jakob Friedl
|
5922a5b850
|
Created nimble package and installation instructions.
|
2025-08-22 10:48:00 +02:00 |
|
Jakob Friedl
|
4a38f76331
|
Moved some compiler flags to nim.cfg
|
2025-08-19 21:00:52 +02:00 |
|