Jakob Friedl
|
47799ee5f5
|
Implemented generating agent payloads from the ImGui client.
|
2025-09-27 15:18:45 +02:00 |
|
Jakob Friedl
|
933a72f920
|
Improved module selection in payload generation modal with tooltips from the module manager.
|
2025-09-27 12:36:59 +02:00 |
|
Jakob Friedl
|
a8154bb7d6
|
Fixed team server crashing when no UI client is connected.
|
2025-09-26 15:30:14 +02:00 |
|
Jakob Friedl
|
14771a4b50
|
Started porting over functionality to the ImGui client via websocket communication.
|
2025-09-25 19:22:17 +02:00 |
|
Jakob Friedl
|
f0dbcdfc58
|
Improved agent generation modal.
|
2025-09-25 10:41:41 +02:00 |
|
Jakob Friedl
|
8baf65a96d
|
Improved dual list selection widget.
|
2025-09-24 19:26:17 +02:00 |
|
Jakob Friedl
|
b6c81755a0
|
Implemented dual list selection widgets for choosing modules.
|
2025-09-24 16:30:29 +02:00 |
|
Jakob Friedl
|
d4bdf56224
|
Added more websocket commands and started agent generation modal window.
|
2025-09-23 15:51:57 +02:00 |
|
Jakob Friedl
|
d3b37aa4a1
|
Started work on websocket communication: Parsing/Serialization of WebSocket packets.
|
2025-09-22 21:53:13 +02:00 |
|
Jakob Friedl
|
42cc58b30b
|
Replaced prologue implementation with mummy for listener management, since it seems more suitable for future use (websockets, etc.).
|
2025-09-19 18:31:45 +02:00 |
|
Jakob Friedl
|
6b41efe1ed
|
Added simple eventlog.
|
2025-09-19 11:43:14 +02:00 |
|
Jakob Friedl
|
3173122878
|
Implemented dynamic sleepmask configuration command.
|
2025-09-19 10:11:20 +02:00 |
|
Jakob Friedl
|
669a436946
|
Added console filter.
|
2025-09-18 12:35:26 +02:00 |
|
Jakob Friedl
|
5d09efd823
|
Reworked module system. Modules can now be individually set to be included in the agent. For example, it is possible to compile an agent only capable of executing BOFs and nothing else.
|
2025-09-17 15:55:13 +02:00 |
|
Jakob Friedl
|
5f1a9979be
|
Added console history handling with arrow keys.
|
2025-09-16 22:21:11 +02:00 |
|
Jakob Friedl
|
ee397c4fb5
|
Implemented console input field.
|
2025-09-16 20:17:48 +02:00 |
|
Jakob Friedl
|
94f2f8121c
|
Implemented 'dotnet' command for execute-assembly functionality. Patched AMSI using HWBP
|
2025-09-13 11:47:19 +02:00 |
|
Jakob Friedl
|
e64e31a7bc
|
Integrated sleep obfuscation settings into agent generation.
|
2025-09-04 13:44:50 +02:00 |
|
Jakob Friedl
|
5ebe5d3598
|
Implemented the Foliage sleep obfuscation technique.
|
2025-09-03 23:21:45 +02:00 |
|
Jakob Friedl
|
d0545ffd16
|
Implemented 'screenshot' command.
|
2025-09-03 19:38:22 +02:00 |
|
Jakob Friedl
|
b19f8e1236
|
Implemented Zilean sleep obfuscation technique as an alternative to Ekko.
|
2025-09-02 21:41:04 +02:00 |
|
Jakob Friedl
|
ae083896b6
|
Implemented simple download command.
|
2025-09-01 19:45:39 +02:00 |
|
Jakob Friedl
|
8292a5b1ff
|
Implemented handling of different argument types (int, wstring, short) for BOF files using specific prefixes.
|
2025-08-30 14:05:09 +02:00 |
|
Jakob Friedl
|
4ceb756cfd
|
Added 'bof' module for executing object files and fixed handling of optional arguments.
|
2025-08-29 15:58:26 +02:00 |
|
Jakob Friedl
|
a18ad3c2cb
|
Removed Ekko WinAPI implementation to clear up file.
|
2025-08-27 18:24:44 +02:00 |
|
Jakob Friedl
|
00866b30cd
|
Implemented basic sleep obfuscation via the Ekko technique using WinAPI. Improvement needed!
|
2025-08-27 00:27:50 +02:00 |
|
Jakob Friedl
|
8791faec3f
|
Implemented compile-time string obfuscation via XOR for the agent.
|
2025-08-26 15:11:43 +02:00 |
|
Jakob Friedl
|
dd7433588f
|
Refactored random byte generation functions.
|
2025-08-25 20:08:23 +02:00 |
|
Jakob Friedl
|
fbb08afe31
|
Implemented wrapper functions for logging and console output (info, error, success, ...)
|
2025-08-21 17:02:50 +02:00 |
|
Jakob Friedl
|
f69adc53a2
|
Implemented initial version of logging system. Log formatting and content needs to be reworked.
|
2025-08-20 12:55:09 +02:00 |
|
Jakob Friedl
|
b023fca124
|
Implemented encryption for embedded profile.
|
2025-08-19 20:03:34 +02:00 |
|
Jakob Friedl
|
72fcb0d610
|
Refactor profile de/serialization, removing unnecessary overhead caused by TLV format.
|
2025-08-19 14:34:58 +02:00 |
|
Jakob Friedl
|
84e8730b1e
|
Implemented profile embedding via patching a placeholder in the agent executable. Agent correctly deserializes and parses the profile and listener configuration.
|
2025-08-18 22:05:23 +02:00 |
|
Jakob Friedl
|
739faf781e
|
Added more randomization. The profile now supports setting keys to an array of strings, from which a random one is chosen each time (useful for e.g. Host header, etc.)
|
2025-08-17 16:27:48 +02:00 |
|
Jakob Friedl
|
22c15dd82c
|
Added randomization to profile strings by replacing '#' with random alphanumerical chars.
|
2025-08-15 16:18:15 +02:00 |
|
Jakob Friedl
|
c7980d219d
|
Added profile system to agent communication. Randomized URL endpoints/request methods and dynamic data transformation based on C2 profile. Profile is defined as compile-time string for now.
|
2025-08-15 15:42:57 +02:00 |
|
Jakob Friedl
|
5a73c0f2f4
|
Improved working with profiles by adding helper retrieval functions.
|
2025-08-14 19:33:32 +02:00 |
|
Jakob Friedl
|
714360ef24
|
Updated profile system, including dynamic parsing of hidden heartbeats and setting of response headers.
|
2025-08-14 15:53:58 +02:00 |
|
Jakob Friedl
|
e403ac1c07
|
Refactored utility functions to make them more readable and removed separate register endpoint.
|
2025-08-14 12:25:06 +02:00 |
|
Jakob Friedl
|
415cd7ebf8
|
Started implementing profile system.
|
2025-08-13 19:32:51 +02:00 |
|
Jakob Friedl
|
b7622dd72f
|
Updated C2 communication to hide heartbeat data in JWT token.
|
2025-08-13 13:38:39 +02:00 |
|
Jakob Friedl
|
0e205d34d3
|
Updated sequence number to uint32
|
2025-08-06 14:28:54 +02:00 |
|
Jakob Friedl
|
dfcafa9c24
|
Implemented basic "ps" and "env" commands.
|
2025-08-01 13:16:12 +02:00 |
|
Jakob Friedl
|
0d54b3e64b
|
Cleaned up parts of the serialization by removing redundant code.
|
2025-07-28 21:29:47 +02:00 |
|
Jakob Friedl
|
882579b3cb
|
Implemented sequence tracking.
|
2025-07-26 18:20:54 +02:00 |
|
Jakob Friedl
|
7bf135750c
|
Rework module system. Now modules/commands are defined in a single file each, with both the function executed by teh agent and the definition for server-side argument parsing.
|
2025-07-25 16:41:29 +02:00 |
|
Jakob Friedl
|
dcf6285a2a
|
Updated key management to create a new private key file if no existing one is found.
|
2025-07-24 22:34:12 +02:00 |
|
Jakob Friedl
|
3e9178ec34
|
Reworked key exchange, now using direct C imports from monocypher instead of nimble modules/libraries.
|
2025-07-24 17:26:48 +02:00 |
|
Jakob Friedl
|
b6c720ccca
|
Implemented ECDH key exchange using ed25519 to share a symmetric AES key without transmitting it over the network.
|
2025-07-24 15:31:46 +02:00 |
|
Jakob Friedl
|
cf4e4a7017
|
Updated database to store session key (still unencrypted)
|
2025-07-23 15:25:19 +02:00 |
|