239 Commits

Author SHA1 Message Date
Jakob Friedl
d4bdf56224 Added more websocket commands and started agent generation modal window. 2025-09-23 15:51:57 +02:00
Jakob Friedl
d3b37aa4a1 Started work on websocket communication: Parsing/Serialization of WebSocket packets. 2025-09-22 21:53:13 +02:00
Jakob Friedl
42cc58b30b Replaced prologue implementation with mummy for listener management, since it seems more suitable for future use (websockets, etc.). 2025-09-19 18:31:45 +02:00
Jakob Friedl
6b41efe1ed Added simple eventlog. 2025-09-19 11:43:14 +02:00
Jakob Friedl
3173122878 Implemented dynamic sleepmask configuration command. 2025-09-19 10:11:20 +02:00
Jakob Friedl
971bb6c8df Added listener table view and modal for starting listeners. 2025-09-18 17:50:58 +02:00
Jakob Friedl
669a436946 Added console filter. 2025-09-18 12:35:26 +02:00
Jakob Friedl
5d09efd823 Reworked module system. Modules can now be individually set to be included in the agent. For example, it is possible to compile an agent only capable of executing BOFs and nothing else. 2025-09-17 15:55:13 +02:00
Jakob Friedl
5f1a9979be Added console history handling with arrow keys. 2025-09-16 22:21:11 +02:00
Jakob Friedl
ee397c4fb5 Implemented console input field. 2025-09-16 20:17:48 +02:00
Jakob Friedl
ce417db941 Implemented console items window using ImGuiTextSelect after it was implemented into imguin. 2025-09-14 22:55:44 +02:00
Jakob Friedl
c6bbef8520 Implemented compression of the network packet bodies. 2025-09-13 15:18:46 +02:00
Jakob Friedl
b7b9114258 Fixed issue that caused assembly execution to fail when used more than once in a session. 2025-09-13 14:14:21 +02:00
Jakob Friedl
94f2f8121c Implemented 'dotnet' command for execute-assembly functionality. Patched AMSI using HWBP 2025-09-13 11:47:19 +02:00
Jakob Friedl
9b94a06ce9 Implemented basic .NET assembly execution using winim/clr. 2025-09-12 15:06:28 +02:00
Jakob Friedl
f0010694eb Added notes and some minor changes to console view. Auto-scroll to bottom is not supported with the current approach, revisit this later. 2025-09-12 10:15:13 +02:00
Jakob Friedl
e15f4842ec Added comments. 2025-09-11 19:11:11 +02:00
Jakob Friedl
1a6977d52d Implemented vertically and horizontally scrollable console-output window for agent interaction windows. 2025-09-11 18:18:13 +02:00
Jakob Friedl
c2b388fbf2 Implemented default docking layout. Console windows are automatically docked to the bottom panel of the application. 2025-09-11 12:03:02 +02:00
Jakob Friedl
8968c797ac Implemented right-click context menu on session table to create console windows for interacting with the agent. 2025-09-10 18:25:15 +02:00
Jakob Friedl
5f131ae916 Implemented multi-select functionality and basic context-menu for session table. 2025-09-09 22:55:43 +02:00
Jakob Friedl
2320b705d3 Experimented with ImGUI tables for session view. 2025-09-07 17:18:50 +02:00
Jakob Friedl
87059ced4c Created template files for core views. 2025-09-06 14:12:51 +02:00
Jakob Friedl
d834e4f713 Created initial UI component template. 2025-09-05 19:39:24 +02:00
Jakob Friedl
e7ab8b5fac Created base template for ImGUI application. 2025-09-05 10:49:27 +02:00
Jakob Friedl
cb02d79b6e Fixed help flag output. 2025-09-04 15:29:54 +02:00
Jakob Friedl
e64e31a7bc Integrated sleep obfuscation settings into agent generation. 2025-09-04 13:44:50 +02:00
Jakob Friedl
e297bb2d76 Split sleep obfuscation into separate functions to increase readability and changed to manual API resolution. 2025-09-04 12:02:50 +02:00
Jakob Friedl
5ebe5d3598 Implemented the Foliage sleep obfuscation technique. 2025-09-03 23:21:45 +02:00
Jakob Friedl
d0545ffd16 Implemented 'screenshot' command. 2025-09-03 19:38:22 +02:00
Jakob Friedl
653dfac4b4 Improved sleep obfuscation cleanup. 2025-09-03 08:46:38 +02:00
Jakob Friedl
b19f8e1236 Implemented Zilean sleep obfuscation technique as an alternative to Ekko. 2025-09-02 21:41:04 +02:00
Jakob Friedl
f7d97908d1 Added initial client UI structure. 2025-09-02 12:48:46 +02:00
Jakob Friedl
4ae9add3af Implemented simple upload command. 2025-09-01 20:27:00 +02:00
Jakob Friedl
ae083896b6 Implemented simple download command. 2025-09-01 19:45:39 +02:00
Jakob Friedl
8292a5b1ff Implemented handling of different argument types (int, wstring, short) for BOF files using specific prefixes. 2025-08-30 14:05:09 +02:00
Jakob Friedl
4ceb756cfd Added 'bof' module for executing object files and fixed handling of optional arguments. 2025-08-29 15:58:26 +02:00
Jakob Friedl
352b8fd8d1 Reworked beacon.nim with definitions from trustedSec's COFFLoader. 2025-08-29 13:40:00 +02:00
Jakob Friedl
957f96f1ca Implemented COFF loader. 2025-08-28 19:00:34 +02:00
Jakob Friedl
e1ea085a0d Decided against implementing additional heap obfuscation for Ekko, due to no sensitive data being allocated in heap memory. 2025-08-28 12:47:37 +02:00
Jakob Friedl
f81933e479 Extended ekko implementation with stack spoofing. 2025-08-27 20:11:22 +02:00
Jakob Friedl
a18ad3c2cb Removed Ekko WinAPI implementation to clear up file. 2025-08-27 18:24:44 +02:00
Jakob Friedl
d3e0d5e6de Implemented Ekki according to MalDev module with both Native API and WinAPI; fixing race condition for both implementations. 2025-08-27 11:37:07 +02:00
Jakob Friedl
00866b30cd Implemented basic sleep obfuscation via the Ekko technique using WinAPI. Improvement needed! 2025-08-27 00:27:50 +02:00
Jakob Friedl
8791faec3f Implemented compile-time string obfuscation via XOR for the agent. 2025-08-26 15:11:43 +02:00
Jakob Friedl
dd7433588f Refactored random byte generation functions. 2025-08-25 20:08:23 +02:00
Jakob Friedl
84f889451c Update LICENSE 2025-08-22 11:05:49 +02:00
Jakob Friedl
2d58b76998 Update LICENSE 2025-08-22 11:04:11 +02:00
Jakob Friedl
4f0cde381b Update LICENSE 2025-08-22 10:55:54 +02:00
Jakob Friedl
5922a5b850 Created nimble package and installation instructions. 2025-08-22 10:48:00 +02:00