Jakob Friedl
|
7f89487fb7
|
Implemented agent kill date.
|
2025-10-28 21:01:10 +01:00 |
|
Jakob Friedl
|
c718e3647a
|
Agent now re-registers to the team-server when it is still alive after it was removed via the client.
|
2025-10-27 16:20:38 +01:00 |
|
Jakob Friedl
|
0e9cffb1c4
|
Improved 'exit' command and implemented self-delete functionality.
|
2025-10-24 12:26:44 +02:00 |
|
Jakob Friedl
|
7326cc10b6
|
Removed POST header check interfering with C2 profile.
|
2025-10-23 17:45:13 +02:00 |
|
Jakob Friedl
|
c6875e5eb2
|
Implemented jitter.
|
2025-10-23 11:14:26 +02:00 |
|
Jakob Friedl
|
0bf717992e
|
Implemented setting for verbose mode that prints debug messages in the windows where the agent is executed. Setting "verbose" to false disables all console output of the agent program.
|
2025-10-20 22:08:06 +02:00 |
|
Jakob Friedl
|
a4f37b5ceb
|
Implemented most token functionality using Native APIs instead of Windows APIs.
|
2025-10-19 18:05:20 +02:00 |
|
Jakob Friedl
|
ba1f1943fc
|
Implemented 'enable-privilege' command.
|
2025-10-18 12:41:55 +02:00 |
|
Jakob Friedl
|
4a1a70da4d
|
Impersonated user is displayed in the client UI and persisted in the team server database.
|
2025-10-17 13:01:12 +02:00 |
|
Jakob Friedl
|
0fc8ff3caa
|
Standardized console spacing between commands.
|
2025-10-17 09:42:08 +02:00 |
|
Jakob Friedl
|
dea10ba7d5
|
Started work on token module and implemented 'make-token' command to impersonate a user from username and password.
|
2025-10-16 19:29:49 +02:00 |
|
Jakob Friedl
|
756ee09eeb
|
Fixed team server breaking when trying to write large task result data to log files.
|
2025-10-13 10:12:34 +02:00 |
|
Jakob Friedl
|
392aaec972
|
Timestamp formatting broke text selection, so the int64 unix timestamp is formatted to a string before being added to the console component. This solved most of the highlighting issues I encountered.
|
2025-10-12 15:00:42 +02:00 |
|
Jakob Friedl
|
f2d2833306
|
Implemented callback host system to support HTTP redirectors
|
2025-10-11 17:10:18 +02:00 |
|
Jakob Friedl
|
bcf845288c
|
Implemented widgets for showing loot: Downloads & Screenshots. Textures are read from a byte sequence and displayed in the UI. Currently tested using hard-coded values.
|
2025-10-07 21:16:17 +02:00 |
|
Jakob Friedl
|
b39a0e70e2
|
Updated directory structure.
|
2025-10-03 12:44:28 +02:00 |
|
Jakob Friedl
|
ae09e4e7e3
|
Implemented basic Tab-autocompletion for agent console.
|
2025-10-03 09:59:50 +02:00 |
|
Jakob Friedl
|
ab48bc5795
|
Added build log to client UI.
|
2025-10-02 12:10:46 +02:00 |
|
Jakob Friedl
|
5c0beb36ff
|
Added remote address and modules to agent structure. Help command now only shows commands for which the agent has been configured.
|
2025-10-02 10:25:37 +02:00 |
|
Jakob Friedl
|
0937840b77
|
Removed unused code.
|
2025-10-01 15:27:06 +02:00 |
|
Jakob Friedl
|
039c857027
|
Moved task parsing logic to the client to be able to support dotnet/bof commands when operating from a different machine than the team server. Disabled sequence tracking due to issues.
|
2025-09-30 10:04:29 +02:00 |
|
Jakob Friedl
|
47799ee5f5
|
Implemented generating agent payloads from the ImGui client.
|
2025-09-27 15:18:45 +02:00 |
|
Jakob Friedl
|
8baf65a96d
|
Improved dual list selection widget.
|
2025-09-24 19:26:17 +02:00 |
|
Jakob Friedl
|
42cc58b30b
|
Replaced prologue implementation with mummy for listener management, since it seems more suitable for future use (websockets, etc.).
|
2025-09-19 18:31:45 +02:00 |
|
Jakob Friedl
|
5d09efd823
|
Reworked module system. Modules can now be individually set to be included in the agent. For example, it is possible to compile an agent only capable of executing BOFs and nothing else.
|
2025-09-17 15:55:13 +02:00 |
|
Jakob Friedl
|
e64e31a7bc
|
Integrated sleep obfuscation settings into agent generation.
|
2025-09-04 13:44:50 +02:00 |
|
Jakob Friedl
|
d0545ffd16
|
Implemented 'screenshot' command.
|
2025-09-03 19:38:22 +02:00 |
|
Jakob Friedl
|
352b8fd8d1
|
Reworked beacon.nim with definitions from trustedSec's COFFLoader.
|
2025-08-29 13:40:00 +02:00 |
|
Jakob Friedl
|
5922a5b850
|
Created nimble package and installation instructions.
|
2025-08-22 10:48:00 +02:00 |
|
Jakob Friedl
|
4a38f76331
|
Moved some compiler flags to nim.cfg
|
2025-08-19 21:00:52 +02:00 |
|
Jakob Friedl
|
8fcb60f57c
|
Implemented replacing agent configuration instead of overwriting the full file.
|
2025-08-19 20:58:47 +02:00 |
|
Jakob Friedl
|
b023fca124
|
Implemented encryption for embedded profile.
|
2025-08-19 20:03:34 +02:00 |
|
Jakob Friedl
|
72fcb0d610
|
Refactor profile de/serialization, removing unnecessary overhead caused by TLV format.
|
2025-08-19 14:34:58 +02:00 |
|
Jakob Friedl
|
84e8730b1e
|
Implemented profile embedding via patching a placeholder in the agent executable. Agent correctly deserializes and parses the profile and listener configuration.
|
2025-08-18 22:05:23 +02:00 |
|
Jakob Friedl
|
023a562be5
|
Implemented server output encoding for task retrieval.
|
2025-08-17 17:01:50 +02:00 |
|
Jakob Friedl
|
739faf781e
|
Added more randomization. The profile now supports setting keys to an array of strings, from which a random one is chosen each time (useful for e.g. Host header, etc.)
|
2025-08-17 16:27:48 +02:00 |
|
Jakob Friedl
|
22c15dd82c
|
Added randomization to profile strings by replacing '#' with random alphanumerical chars.
|
2025-08-15 16:18:15 +02:00 |
|
Jakob Friedl
|
c7980d219d
|
Added profile system to agent communication. Randomized URL endpoints/request methods and dynamic data transformation based on C2 profile. Profile is defined as compile-time string for now.
|
2025-08-15 15:42:57 +02:00 |
|
Jakob Friedl
|
714360ef24
|
Updated profile system, including dynamic parsing of hidden heartbeats and setting of response headers.
|
2025-08-14 15:53:58 +02:00 |
|
Jakob Friedl
|
e403ac1c07
|
Refactored utility functions to make them more readable and removed separate register endpoint.
|
2025-08-14 12:25:06 +02:00 |
|
Jakob Friedl
|
415cd7ebf8
|
Started implementing profile system.
|
2025-08-13 19:32:51 +02:00 |
|
Jakob Friedl
|
b7622dd72f
|
Updated C2 communication to hide heartbeat data in JWT token.
|
2025-08-13 13:38:39 +02:00 |
|
Jakob Friedl
|
0e205d34d3
|
Updated sequence number to uint32
|
2025-08-06 14:28:54 +02:00 |
|
Jakob Friedl
|
0d54b3e64b
|
Cleaned up parts of the serialization by removing redundant code.
|
2025-07-28 21:29:47 +02:00 |
|
Jakob Friedl
|
882579b3cb
|
Implemented sequence tracking.
|
2025-07-26 18:20:54 +02:00 |
|
Jakob Friedl
|
7bf135750c
|
Rework module system. Now modules/commands are defined in a single file each, with both the function executed by teh agent and the definition for server-side argument parsing.
|
2025-07-25 16:41:29 +02:00 |
|