Documentation
¶
Index ¶
- Constants
- Variables
- type BuildParameterHideCondition
- type C2ConfigCheckMessage
- type C2ConfigCheckMessageResponse
- type C2GetDebugOutputMessage
- type C2GetDebugOutputMessageResponse
- type C2GetIOCMessage
- type C2GetIOCMessageResponse
- type C2GetRedirectorRuleMessage
- type C2GetRedirectorRuleMessageResponse
- type C2HostFileMessage
- type C2HostFileMessageResponse
- type C2HostFilesMessage
- type C2HostFilesMessageResponse
- type C2OPSECMessage
- type C2OPSECMessageResponse
- type C2Parameter
- type C2ParameterDictionary
- type C2ParameterType
- type C2Parameters
- func (arg *C2Parameters) GetArg(name string) (interface{}, error)
- func (arg *C2Parameters) GetArgNames() []string
- func (arg *C2Parameters) GetArrayArg(name string) ([]string, error)
- func (arg *C2Parameters) GetBooleanArg(name string) (bool, error)
- func (arg *C2Parameters) GetChooseMultipleArg(name string) ([]string, error)
- func (arg *C2Parameters) GetChooseOneArg(name string) (string, error)
- func (arg *C2Parameters) GetChooseOneCustomArg(name string) (string, error)
- func (arg *C2Parameters) GetCryptoArg(name string) (CryptoArg, error)
- func (arg *C2Parameters) GetDateArg(name string) (string, error)
- func (arg *C2Parameters) GetDictionaryArg(name string) (map[string]string, error)
- func (arg *C2Parameters) GetFileArg(name string) (string, error)
- func (arg *C2Parameters) GetFileMultipleArg(name string) ([]string, error)
- func (arg *C2Parameters) GetNumberArg(name string) (float64, error)
- func (arg *C2Parameters) GetStringArg(name string) (string, error)
- func (arg *C2Parameters) GetTypedArrayArg(name string) ([][]string, error)
- type C2Profile
- type C2RPCC2ParameterDynamicQueryFunction
- type C2RPCDynamicQueryC2ParameterFunctionMessage
- type C2RPCDynamicQueryC2ParameterFunctionMessageResponse
- type C2RPCOtherServiceRPCMessage
- type C2RPCOtherServiceRPCMessageResponse
- type C2RPCReSyncMessage
- type C2RPCReSyncMessageResponse
- type C2RPCStartServerMessage
- type C2RPCStartServerMessageResponse
- type C2RPCStopServerMessage
- type C2RPCStopServerMessageResponse
- type C2SampleMessageMessage
- type C2SampleMessageResponse
- type C2SyncMessage
- type C2SyncMessageResponse
- type C2_GET_REDIRECTOR_RULE_STATUS
- type C2_HOST_FILE_STATUS
- type ComplexChoice
- type CryptoArg
- type HideConditionOperand
- type IOC
- type SimplifiedC2ParameterDictionary
Constants ¶
const ( C2_PARAMETER_TYPE_STRING C2ParameterType = "String" C2_PARAMETER_TYPE_BOOLEAN = "Boolean" C2_PARAMETER_TYPE_CHOOSE_ONE = "ChooseOne" C2_PARAMETER_TYPE_CHOOSE_ONE_CUSTOM = "ChooseOneCustom" C2_PARAMETER_TYPE_CHOOSE_MULTIPLE = "ChooseMultiple" C2_PARAMETER_TYPE_ARRAY = "Array" C2_PARAMETER_TYPE_DATE = "Date" C2_PARAMETER_TYPE_DICTIONARY = "Dictionary" C2_PARAMETER_TYPE_NUMBER = "Number" C2_PARAMETER_TYPE_FILE = "File" C2_PARAMETER_TYPE_FILE_MULTIPLE = "FileMultiple" C2_PARAMETER_TYPE_JSON_STRING = "JSONString" )
const ( HideConditionOperandEQ HideConditionOperand = "eq" HideConditionOperandNotEQ = "neq" HideConditionOperandIN = "in" HideConditionOperandNotIN = "nin" HideConditionOperandLessThan = "lt" HideConditionOperandGreaterThan = "gt" HideConditionOperandLessThanOrEqual = "lte" HideConditionOperandGreaterThanOrEqual = "gte" HideConditionOperationStartsWith = "sw" HideConditionOperationEndsWith = "ew" HideConditionOperationContains = "co" HideConditionOperationNotContains = "nco" )
Variables ¶
var (
AllC2Data containerC2Data
)
Functions ¶
This section is empty.
Types ¶
type BuildParameterHideCondition ¶
type BuildParameterHideCondition struct {
Name string `json:"name"`
Operand HideConditionOperand `json:"operand"`
Value string `json:"value"`
Choices []string `json:"choices"`
}
type C2ConfigCheckMessage ¶
type C2ConfigCheckMessage struct {
C2Parameters
}
type C2GetDebugOutputMessage ¶
type C2GetDebugOutputMessage struct {
Name string `json:"c2_profile_name"`
}
type C2GetIOCMessage ¶ added in v1.1.0
type C2GetIOCMessage struct {
C2Parameters
}
C2GetIOCMessage given the following C2 configuration, determine the IOCs that a defender should look for
type C2GetIOCMessageResponse ¶ added in v1.1.0
type C2GetIOCMessageResponse struct {
Success bool `json:"success"`
Error string `json:"error"`
IOCs []IOC `json:"iocs"`
RestartInternalServer bool `json:"restart_internal_server"`
}
C2GetIOCMessageResponse the resulting set of IOCs that a defender should look out for based on the C2GetIOCMessage configuration
type C2GetRedirectorRuleMessage ¶
type C2GetRedirectorRuleMessage struct {
C2Parameters
}
type C2HostFileMessage ¶ added in v1.1.0
type C2HostFileMessageResponse ¶ added in v1.1.0
type C2HostFilesMessage ¶
type C2HostFilesMessage struct {
Name string `json:"c2_profile_name"`
Files []C2HostFileMessage `json:"files"`
}
type C2HostFilesMessageResponse ¶
type C2HostFilesMessageResponse struct {
Success bool `json:"success"`
Error string `json:"error"`
Results []C2HostFileMessageResponse `json:"results,omitempty"`
RestartInternalServer bool `json:"restart_internal_server,omitempty"`
}
type C2OPSECMessage ¶
type C2OPSECMessage struct {
C2Parameters
}
type C2OPSECMessageResponse ¶
type C2Parameter ¶
type C2Parameter struct {
Name string `json:"name"`
DisplayName string `json:"display_name"`
Description string `json:"description"`
Required bool `json:"required"`
VerifierRegex string `json:"verifier_regex"`
DefaultValue interface{} `json:"default_value"`
ParameterType C2ParameterType `json:"parameter_type"`
FormatString string `json:"format_string"`
Randomize bool `json:"randomize"`
IsCryptoType bool `json:"crypto_type"`
Choices []string `json:"choices"`
ChoicesDisplayNames map[string]string `json:"choices_display_names"`
DictionaryChoices []C2ParameterDictionary `json:"dictionary_choices"`
JsonStringSchema map[string]interface{} `json:"json_string_schema"`
GroupName string `json:"group_name"`
HideConditions []BuildParameterHideCondition `json:"hide_conditions"`
UiPosition int `json:"ui_position"`
DynamicQueryFunction C2RPCC2ParameterDynamicQueryFunction `json:"dynamic_query_function"`
}
type C2ParameterDictionary ¶
type C2Parameters ¶ added in v1.1.0
type C2Parameters struct {
Name string `json:"c2_profile_name"`
Parameters map[string]interface{} `json:"parameters"`
PayloadUUID string `json:"payload_uuid,omitempty"`
}
func (*C2Parameters) GetArg ¶ added in v1.1.0
func (arg *C2Parameters) GetArg(name string) (interface{}, error)
func (*C2Parameters) GetArgNames ¶ added in v1.1.0
func (arg *C2Parameters) GetArgNames() []string
func (*C2Parameters) GetArrayArg ¶ added in v1.1.0
func (arg *C2Parameters) GetArrayArg(name string) ([]string, error)
func (*C2Parameters) GetBooleanArg ¶ added in v1.1.0
func (arg *C2Parameters) GetBooleanArg(name string) (bool, error)
func (*C2Parameters) GetChooseMultipleArg ¶ added in v1.1.0
func (arg *C2Parameters) GetChooseMultipleArg(name string) ([]string, error)
func (*C2Parameters) GetChooseOneArg ¶ added in v1.1.0
func (arg *C2Parameters) GetChooseOneArg(name string) (string, error)
func (*C2Parameters) GetChooseOneCustomArg ¶ added in v1.4.0
func (arg *C2Parameters) GetChooseOneCustomArg(name string) (string, error)
func (*C2Parameters) GetCryptoArg ¶ added in v1.1.0
func (arg *C2Parameters) GetCryptoArg(name string) (CryptoArg, error)
func (*C2Parameters) GetDateArg ¶ added in v1.1.0
func (arg *C2Parameters) GetDateArg(name string) (string, error)
func (*C2Parameters) GetDictionaryArg ¶ added in v1.1.0
func (arg *C2Parameters) GetDictionaryArg(name string) (map[string]string, error)
func (*C2Parameters) GetFileArg ¶ added in v1.1.0
func (arg *C2Parameters) GetFileArg(name string) (string, error)
func (*C2Parameters) GetFileMultipleArg ¶ added in v1.4.0
func (arg *C2Parameters) GetFileMultipleArg(name string) ([]string, error)
func (*C2Parameters) GetNumberArg ¶ added in v1.1.0
func (arg *C2Parameters) GetNumberArg(name string) (float64, error)
func (*C2Parameters) GetStringArg ¶ added in v1.1.0
func (arg *C2Parameters) GetStringArg(name string) (string, error)
func (*C2Parameters) GetTypedArrayArg ¶ added in v1.3.13
func (arg *C2Parameters) GetTypedArrayArg(name string) ([][]string, error)
type C2Profile ¶
type C2Profile struct {
Name string `json:"name"`
Description string `json:"description"`
Author string `json:"author"`
IsP2p bool `json:"is_p2p"`
IsServerRouted bool `json:"is_server_routed"`
ServerBinaryPath string `json:"-"`
ServerFolderPath string `json:"-"`
SemVer string `json:"semver"`
AgentIcon *[]byte `json:"agent_icon"`
DarkModeAgentIcon *[]byte `json:"dark_mode_agent_icon"`
ConfigCheckFunction func(context.Context, C2ConfigCheckMessage) C2ConfigCheckMessageResponse `json:"-"`
GetRedirectorRulesFunction func(context.Context, C2GetRedirectorRuleMessage) C2GetRedirectorRuleMessageResponse `json:"-"`
OPSECCheckFunction func(context.Context, C2OPSECMessage) C2OPSECMessageResponse `json:"-"`
GetIOCFunction func(context.Context, C2GetIOCMessage) C2GetIOCMessageResponse `json:"-"`
SampleMessageFunction func(context.Context, C2SampleMessageMessage) C2SampleMessageResponse `json:"-"`
HostFileFunction func(context.Context, C2HostFilesMessage) C2HostFilesMessageResponse `json:"-"`
CustomRPCFunctions map[string]func(context.Context, C2RPCOtherServiceRPCMessage) C2RPCOtherServiceRPCMessageResponse `json:"-"`
OnContainerStartFunction func(context.Context, sharedStructs.ContainerOnStartMessage) sharedStructs.ContainerOnStartMessageResponse `json:"-"`
}
type C2RPCC2ParameterDynamicQueryFunction ¶
type C2RPCC2ParameterDynamicQueryFunction func(context.Context, C2RPCDynamicQueryC2ParameterFunctionMessage) C2RPCDynamicQueryC2ParameterFunctionMessageResponse
func (C2RPCC2ParameterDynamicQueryFunction) MarshalJSON ¶
func (f C2RPCC2ParameterDynamicQueryFunction) MarshalJSON() ([]byte, error)
type C2RPCDynamicQueryC2ParameterFunctionMessage ¶
type C2RPCDynamicQueryC2ParameterFunctionMessage struct {
// ParameterName - the specific parameter for the query function called
ParameterName string `json:"parameter_name" binding:"required"`
// C2Profile - the name of the c2 profile for the query function called
C2Profile string `json:"c2_profile" binding:"required"`
// Secrets - User supplied secrets
Secrets map[string]interface{} `json:"secrets"`
// OtherParameters - other user supplied parameters
OtherParameters map[string]interface{} `json:"other_parameters"`
}
type C2RPCDynamicQueryC2ParameterFunctionMessageResponse ¶
type C2RPCDynamicQueryC2ParameterFunctionMessageResponse struct {
// Success - indicating if the query function succeeded or not
Success bool `json:"success"`
// Error - if there was an error, return that message here for the user
Error string `json:"error"`
// Choices - the resulting choices for the user based on the dynamic query function
Choices []string `json:"choices"`
// ComplexChoices - the ability to specify a value and display value for more complex usability
// this is the required format for options provided for a parameter of type JSONString
ComplexChoices []ComplexChoice `json:"complex_choices"`
}
type C2RPCReSyncMessage ¶
type C2RPCReSyncMessage struct {
Name string `json:"c2_profile_name"`
}
type C2RPCStartServerMessage ¶
type C2RPCStartServerMessage struct {
Name string `json:"c2_profile_name"`
}
type C2RPCStopServerMessage ¶
type C2RPCStopServerMessage struct {
Name string `json:"c2_profile_name"`
}
type C2SampleMessageMessage ¶ added in v1.1.0
type C2SampleMessageMessage struct {
C2Parameters
}
C2SampleMessageMessage - Generate sample C2 Traffic based on this configuration so that the operator and developer can more easily troubleshoot
type C2SampleMessageResponse ¶ added in v1.1.0
type C2SampleMessageResponse struct {
Success bool `json:"success"`
Error string `json:"error"`
Message string `json:"message"`
RestartInternalServer bool `json:"restart_internal_server"`
}
C2SampleMessageResponse - Provide a string representation of the C2 Traffic that the corresponding C2SampleMessageMessage configuration would generate
type C2SyncMessage ¶
type C2SyncMessage struct {
Profile C2Profile `json:"c2_profile"`
Parameters []C2Parameter `json:"parameters"`
ContainerVersion string `json:"container_version"`
}
type C2SyncMessageResponse ¶
type C2_GET_REDIRECTOR_RULE_STATUS ¶
type C2_GET_REDIRECTOR_RULE_STATUS = string
type C2_HOST_FILE_STATUS ¶ added in v1.1.0
type C2_HOST_FILE_STATUS = string
type ComplexChoice ¶
type HideConditionOperand ¶
type HideConditionOperand string
type IOC ¶ added in v1.1.0
type IOC struct {
Type string `json:"type" mapstructure:"type"`
IOC string `json:"ioc" mapstructure:"ioc"`
}
IOC identify the type of ioc with Type and the actual IOC value An example could be a Type of URL with the actual IOC value being the configured callback URL with URI parameters