Implemented dynamic sleepmask configuration command.

This commit is contained in:
Jakob Friedl
2025-09-19 10:11:20 +02:00
parent 971bb6c8df
commit 3173122878
4 changed files with 65 additions and 29 deletions

View File

@@ -2,6 +2,7 @@ import ../common/[types, utils]
# Define function prototype
proc executeSleep(ctx: AgentCtx, task: Task): TaskResult
proc executeSleepmask(ctx: AgentCtx, task: Task): TaskResult
# Module definition
let module* = Module(
@@ -11,12 +12,23 @@ let module* = Module(
Command(
name: protect("sleep"),
commandType: CMD_SLEEP,
description: protect("Update sleep delay configuration."),
description: protect("Update sleep delay settings."),
example: protect("sleep 5"),
arguments: @[
Argument(name: protect("delay"), description: protect("Delay in seconds."), argumentType: INT, isRequired: true)
],
execute: executeSleep
),
Command(
name: protect("sleepmask"),
commandType: CMD_SLEEPMASK,
description: protect("Update sleepmask settings."),
example: protect("sleepmask ekko true"),
arguments: @[
Argument(name: protect("technique"), description: protect("Sleep obfuscation technique (NONE, EKKO, ZILEAN, FOLIAGE). Executing without arguments retrieves current sleepmask settings."), argumentType: STRING, isRequired: false),
Argument(name: protect("spoof"), description: protect("Use stack spoofing to obfuscate the call stack."), argumentType: BOOL, isRequired: false)
],
execute: executeSleepmask
)
]
)
@@ -24,6 +36,7 @@ let module* = Module(
# Implement execution functions
when defined(server):
proc executeSleep(ctx: AgentCtx, task: Task): TaskResult = nil
proc executeSleepmask(ctx: AgentCtx, task: Task): TaskResult = nil
when defined(agent):
@@ -45,3 +58,32 @@ when defined(agent):
except CatchableError as err:
return createTaskResult(task, STATUS_FAILED, RESULT_STRING, string.toBytes(err.msg))
proc executeSleepmask(ctx: AgentCtx, task: Task): TaskResult =
try:
echo fmt" [>] Updating sleepmask settings."
case int(task.argCount):
of 0:
# Retrieve sleepmask settings
let response = fmt"Sleepmask settings: Technique: {$ctx.sleepTechnique}, Delay: {$ctx.sleep}ms, Stack spoofing: {$ctx.spoofStack}" & "\n"
return createTaskResult(task, STATUS_COMPLETED, RESULT_STRING, string.toBytes(response))
of 1:
# Only set the sleepmask technique
let technique = parseEnum[SleepObfuscationTechnique](Bytes.toString(task.args[0].data).toUpperAscii())
ctx.sleepTechnique = technique
else:
# Set sleepmask technique and stack-spoofing configuration
let technique = parseEnum[SleepObfuscationTechnique](Bytes.toString(task.args[0].data).toUpperAscii())
ctx.sleepTechnique = technique
let spoofStack = cast[bool](task.args[1].data[0]) # BOOLEAN values are just 1 byte
ctx.spoofStack = spoofStack
return createTaskResult(task, STATUS_COMPLETED, RESULT_NO_OUTPUT, @[])
except CatchableError as err:
return createTaskResult(task, STATUS_FAILED, RESULT_STRING, string.toBytes(err.msg))