c2structs

package
v1.7.0-rc2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 14, 2026 License: BSD-3-Clause Imports: 13 Imported by: 0

Documentation

Index

Constants

View Source
const (
	C2_PARAMETER_TYPE_STRING            C2ParameterType = "String"
	C2_PARAMETER_TYPE_BOOLEAN                           = "Boolean"
	C2_PARAMETER_TYPE_CHOOSE_ONE                        = "ChooseOne"
	C2_PARAMETER_TYPE_CHOOSE_ONE_CUSTOM                 = "ChooseOneCustom"
	C2_PARAMETER_TYPE_CHOOSE_MULTIPLE                   = "ChooseMultiple"
	C2_PARAMETER_TYPE_ARRAY                             = "Array"
	C2_PARAMETER_TYPE_DATE                              = "Date"
	C2_PARAMETER_TYPE_DICTIONARY                        = "Dictionary"
	C2_PARAMETER_TYPE_NUMBER                            = "Number"
	C2_PARAMETER_TYPE_FILE                              = "File"
	C2_PARAMETER_TYPE_FILE_MULTIPLE                     = "FileMultiple"
	C2_PARAMETER_TYPE_JSON_STRING                       = "JSONString"
)
View Source
const (
	HideConditionOperandEQ                 HideConditionOperand = "eq"
	HideConditionOperandNotEQ                                   = "neq"
	HideConditionOperandIN                                      = "in"
	HideConditionOperandNotIN                                   = "nin"
	HideConditionOperandLessThan                                = "lt"
	HideConditionOperandGreaterThan                             = "gt"
	HideConditionOperandLessThanOrEqual                         = "lte"
	HideConditionOperandGreaterThanOrEqual                      = "gte"
	HideConditionOperationStartsWith                            = "sw"
	HideConditionOperationEndsWith                              = "ew"
	HideConditionOperationContains                              = "co"
	HideConditionOperationNotContains                           = "nco"
)

Variables

View Source
var (
	AllC2Data containerC2Data
)

Functions

This section is empty.

Types

type BuildParameterHideCondition

type BuildParameterHideCondition struct {
	Name    string               `json:"name"`
	Operand HideConditionOperand `json:"operand"`
	Value   string               `json:"value"`
	Choices []string             `json:"choices"`
}

type C2ConfigCheckMessage

type C2ConfigCheckMessage struct {
	C2Parameters
}

type C2ConfigCheckMessageResponse

type C2ConfigCheckMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	RestartInternalServer bool   `json:"restart_internal_server"`
}

type C2GetDebugOutputMessage

type C2GetDebugOutputMessage struct {
	Name string `json:"c2_profile_name"`
}

type C2GetDebugOutputMessageResponse

type C2GetDebugOutputMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	InternalServerRunning bool   `json:"server_running"`
	RestartInternalServer bool   `json:"restart_internal_server"`
}

type C2GetIOCMessage added in v1.1.0

type C2GetIOCMessage struct {
	C2Parameters
}

C2GetIOCMessage given the following C2 configuration, determine the IOCs that a defender should look for

type C2GetIOCMessageResponse added in v1.1.0

type C2GetIOCMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	IOCs                  []IOC  `json:"iocs"`
	RestartInternalServer bool   `json:"restart_internal_server"`
}

C2GetIOCMessageResponse the resulting set of IOCs that a defender should look out for based on the C2GetIOCMessage configuration

type C2GetRedirectorRuleMessage

type C2GetRedirectorRuleMessage struct {
	C2Parameters
}

type C2GetRedirectorRuleMessageResponse

type C2GetRedirectorRuleMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	RestartInternalServer bool   `json:"restart_internal_server"`
}

type C2HostFileMessage added in v1.1.0

type C2HostFileMessage struct {
	AgentFileID   string `json:"agent_file_id"`
	HostURL       string `json:"host_url"`
	Remove        bool   `json:"remove"`
	DownloadToken string `json:"download_token,omitempty"`
	Filename      string `json:"filename,omitempty"`
}

type C2HostFileMessageResponse added in v1.1.0

type C2HostFileMessageResponse struct {
	Success     bool   `json:"success"`
	Error       string `json:"error"`
	AgentFileID string `json:"agent_file_id"`
	HostURL     string `json:"host_url"`
}

type C2HostFilesMessage

type C2HostFilesMessage struct {
	Name  string              `json:"c2_profile_name"`
	Files []C2HostFileMessage `json:"files"`
}

type C2HostFilesMessageResponse

type C2HostFilesMessageResponse struct {
	Success               bool                        `json:"success"`
	Error                 string                      `json:"error"`
	Results               []C2HostFileMessageResponse `json:"results,omitempty"`
	RestartInternalServer bool                        `json:"restart_internal_server,omitempty"`
}

type C2OPSECMessage

type C2OPSECMessage struct {
	C2Parameters
}

type C2OPSECMessageResponse

type C2OPSECMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	RestartInternalServer bool   `json:"restart_internal_server"`
}

type C2Parameter

type C2Parameter struct {
	Name                 string                               `json:"name"`
	DisplayName          string                               `json:"display_name"`
	Description          string                               `json:"description"`
	Required             bool                                 `json:"required"`
	VerifierRegex        string                               `json:"verifier_regex"`
	DefaultValue         interface{}                          `json:"default_value"`
	ParameterType        C2ParameterType                      `json:"parameter_type"`
	FormatString         string                               `json:"format_string"`
	Randomize            bool                                 `json:"randomize"`
	IsCryptoType         bool                                 `json:"crypto_type"`
	Choices              []string                             `json:"choices"`
	ChoicesDisplayNames  map[string]string                    `json:"choices_display_names"`
	DictionaryChoices    []C2ParameterDictionary              `json:"dictionary_choices"`
	JsonStringSchema     map[string]interface{}               `json:"json_string_schema"`
	GroupName            string                               `json:"group_name"`
	HideConditions       []BuildParameterHideCondition        `json:"hide_conditions"`
	UiPosition           int                                  `json:"ui_position"`
	DynamicQueryFunction C2RPCC2ParameterDynamicQueryFunction `json:"dynamic_query_function"`
}

type C2ParameterDictionary

type C2ParameterDictionary struct {
	Name         string `json:"name"`
	DefaultValue string `json:"default_value"`
	DefaultShow  bool   `json:"default_show"`
}

type C2ParameterType

type C2ParameterType = string

C2_SYNC STRUCTS

type C2Parameters added in v1.1.0

type C2Parameters struct {
	Name        string                 `json:"c2_profile_name"`
	Parameters  map[string]interface{} `json:"parameters"`
	PayloadUUID string                 `json:"payload_uuid,omitempty"`
}

func (*C2Parameters) GetArg added in v1.1.0

func (arg *C2Parameters) GetArg(name string) (interface{}, error)

func (*C2Parameters) GetArgNames added in v1.1.0

func (arg *C2Parameters) GetArgNames() []string

func (*C2Parameters) GetArrayArg added in v1.1.0

func (arg *C2Parameters) GetArrayArg(name string) ([]string, error)

func (*C2Parameters) GetBooleanArg added in v1.1.0

func (arg *C2Parameters) GetBooleanArg(name string) (bool, error)

func (*C2Parameters) GetChooseMultipleArg added in v1.1.0

func (arg *C2Parameters) GetChooseMultipleArg(name string) ([]string, error)

func (*C2Parameters) GetChooseOneArg added in v1.1.0

func (arg *C2Parameters) GetChooseOneArg(name string) (string, error)

func (*C2Parameters) GetChooseOneCustomArg added in v1.4.0

func (arg *C2Parameters) GetChooseOneCustomArg(name string) (string, error)

func (*C2Parameters) GetCryptoArg added in v1.1.0

func (arg *C2Parameters) GetCryptoArg(name string) (CryptoArg, error)

func (*C2Parameters) GetDateArg added in v1.1.0

func (arg *C2Parameters) GetDateArg(name string) (string, error)

func (*C2Parameters) GetDictionaryArg added in v1.1.0

func (arg *C2Parameters) GetDictionaryArg(name string) (map[string]string, error)

func (*C2Parameters) GetFileArg added in v1.1.0

func (arg *C2Parameters) GetFileArg(name string) (string, error)

func (*C2Parameters) GetFileMultipleArg added in v1.4.0

func (arg *C2Parameters) GetFileMultipleArg(name string) ([]string, error)

func (*C2Parameters) GetNumberArg added in v1.1.0

func (arg *C2Parameters) GetNumberArg(name string) (float64, error)

func (*C2Parameters) GetStringArg added in v1.1.0

func (arg *C2Parameters) GetStringArg(name string) (string, error)

func (*C2Parameters) GetTypedArrayArg added in v1.3.13

func (arg *C2Parameters) GetTypedArrayArg(name string) ([][]string, error)

type C2Profile

type C2Profile struct {
	Name                       string                                                                                                     `json:"name"`
	Description                string                                                                                                     `json:"description"`
	Author                     string                                                                                                     `json:"author"`
	IsP2p                      bool                                                                                                       `json:"is_p2p"`
	IsServerRouted             bool                                                                                                       `json:"is_server_routed"`
	ServerBinaryPath           string                                                                                                     `json:"-"`
	ServerFolderPath           string                                                                                                     `json:"-"`
	SemVer                     string                                                                                                     `json:"semver"`
	AgentIcon                  *[]byte                                                                                                    `json:"agent_icon"`
	DarkModeAgentIcon          *[]byte                                                                                                    `json:"dark_mode_agent_icon"`
	ConfigCheckFunction        func(context.Context, C2ConfigCheckMessage) C2ConfigCheckMessageResponse                                   `json:"-"`
	GetRedirectorRulesFunction func(context.Context, C2GetRedirectorRuleMessage) C2GetRedirectorRuleMessageResponse                       `json:"-"`
	OPSECCheckFunction         func(context.Context, C2OPSECMessage) C2OPSECMessageResponse                                               `json:"-"`
	GetIOCFunction             func(context.Context, C2GetIOCMessage) C2GetIOCMessageResponse                                             `json:"-"`
	SampleMessageFunction      func(context.Context, C2SampleMessageMessage) C2SampleMessageResponse                                      `json:"-"`
	HostFileFunction           func(context.Context, C2HostFilesMessage) C2HostFilesMessageResponse                                       `json:"-"`
	CustomRPCFunctions         map[string]func(context.Context, C2RPCOtherServiceRPCMessage) C2RPCOtherServiceRPCMessageResponse          `json:"-"`
	OnContainerStartFunction   func(context.Context, sharedStructs.ContainerOnStartMessage) sharedStructs.ContainerOnStartMessageResponse `json:"-"`
}

type C2RPCC2ParameterDynamicQueryFunction

func (C2RPCC2ParameterDynamicQueryFunction) MarshalJSON

func (f C2RPCC2ParameterDynamicQueryFunction) MarshalJSON() ([]byte, error)

type C2RPCDynamicQueryC2ParameterFunctionMessage

type C2RPCDynamicQueryC2ParameterFunctionMessage struct {
	// ParameterName - the specific parameter for the query function called
	ParameterName string `json:"parameter_name" binding:"required"`
	// C2Profile - the name of the c2 profile for the query function called
	C2Profile string `json:"c2_profile" binding:"required"`
	// Secrets - User supplied secrets
	Secrets map[string]interface{} `json:"secrets"`
	// OtherParameters - other user supplied parameters
	OtherParameters map[string]interface{} `json:"other_parameters"`
}

type C2RPCDynamicQueryC2ParameterFunctionMessageResponse

type C2RPCDynamicQueryC2ParameterFunctionMessageResponse struct {
	// Success - indicating if the query function succeeded or not
	Success bool `json:"success"`
	// Error - if there was an error, return that message here for the user
	Error string `json:"error"`
	// Choices - the resulting choices for the user based on the dynamic query function
	Choices []string `json:"choices"`
	// ComplexChoices - the ability to specify a value and display value for more complex usability
	// this is the required format for options provided for a parameter of type JSONString
	ComplexChoices []ComplexChoice `json:"complex_choices"`
}

type C2RPCOtherServiceRPCMessage

type C2RPCOtherServiceRPCMessage struct {
	ServiceName                 string                 `json:"service_name"` //required
	ServiceRPCFunction          string                 `json:"service_function"`
	ServiceRPCFunctionArguments map[string]interface{} `json:"service_arguments"`
}

type C2RPCOtherServiceRPCMessageResponse

type C2RPCOtherServiceRPCMessageResponse struct {
	Success               bool                   `json:"success"`
	Error                 string                 `json:"error"`
	Result                map[string]interface{} `json:"result"`
	RestartInternalServer bool                   `json:"restart_internal_server"`
}

type C2RPCReSyncMessage

type C2RPCReSyncMessage struct {
	Name string `json:"c2_profile_name"`
}

type C2RPCReSyncMessageResponse

type C2RPCReSyncMessageResponse struct {
	Success bool   `json:"success"`
	Error   string `json:"error"`
}

type C2RPCStartServerMessage

type C2RPCStartServerMessage struct {
	Name string `json:"c2_profile_name"`
}

type C2RPCStartServerMessageResponse

type C2RPCStartServerMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	InternalServerRunning bool   `json:"server_running"`
}

type C2RPCStopServerMessage

type C2RPCStopServerMessage struct {
	Name string `json:"c2_profile_name"`
}

type C2RPCStopServerMessageResponse

type C2RPCStopServerMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	InternalServerRunning bool   `json:"server_running"`
}

type C2SampleMessageMessage added in v1.1.0

type C2SampleMessageMessage struct {
	C2Parameters
}

C2SampleMessageMessage - Generate sample C2 Traffic based on this configuration so that the operator and developer can more easily troubleshoot

type C2SampleMessageResponse added in v1.1.0

type C2SampleMessageResponse struct {
	Success               bool   `json:"success"`
	Error                 string `json:"error"`
	Message               string `json:"message"`
	RestartInternalServer bool   `json:"restart_internal_server"`
}

C2SampleMessageResponse - Provide a string representation of the C2 Traffic that the corresponding C2SampleMessageMessage configuration would generate

type C2SyncMessage

type C2SyncMessage struct {
	Profile          C2Profile     `json:"c2_profile"`
	Parameters       []C2Parameter `json:"parameters"`
	ContainerVersion string        `json:"container_version"`
}

type C2SyncMessageResponse

type C2SyncMessageResponse struct {
	Success bool   `json:"success"`
	Error   string `json:"error"`
}

type C2_GET_REDIRECTOR_RULE_STATUS

type C2_GET_REDIRECTOR_RULE_STATUS = string

type C2_HOST_FILE_STATUS added in v1.1.0

type C2_HOST_FILE_STATUS = string

type ComplexChoice

type ComplexChoice struct {
	DisplayValue string `json:"display_value"`
	Value        string `json:"value"`
}

type CryptoArg added in v1.1.0

type CryptoArg struct {
	Value  string `json:"value" mapstructure:"value"`
	EncKey string `json:"enc_key" mapstructure:"enc_key"`
	DecKey string `json:"dec_key" mapstructure:"dec_key"`
}

type HideConditionOperand

type HideConditionOperand string

type IOC added in v1.1.0

type IOC struct {
	Type string `json:"type" mapstructure:"type"`
	IOC  string `json:"ioc" mapstructure:"ioc"`
}

IOC identify the type of ioc with Type and the actual IOC value An example could be a Type of URL with the actual IOC value being the configured callback URL with URI parameters

type SimplifiedC2ParameterDictionary

type SimplifiedC2ParameterDictionary struct {
	Name  string `json:"name"`
	Value string `json:"value"`
	Key   string `json:"key"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL