Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"profiles info" subcommand and saving poll timeout in profile #1299

Merged
merged 1 commit into from
Jun 15, 2023

Conversation

RafBishopFox
Copy link
Collaborator

This PR adds a subcommand called info to the profiles command. The purpose is to give nitty gritty detail about a profile that is not shown in the normal profile view. It was useful for debugging some profile-related issues, so I figured it would not hurt to clean up the code a bit and submit it as a PR.

While I was working on this, I noticed that the poll-timeout setting was not saved in profiles and was defaulting to 0. I added poll-timeout to the information stored with a profile, and the setting appears to keep now.

Here is what profiles info looks like:

profiles info basicprofile 

[*] Implant Basics
+-------------------+------------+
| OS / Architecture | Linux 386  |
| Implant Type      | Session    |
| Implant Format    | Executable |
+-------------------+------------+

[*] Obfuscation
+---------------------------+----------+
| Evasion is                | disabled |
| Debugging is              | disabled |
| Obfuscation of symbols is | enabled  |
| Shikata Ga Nai (SGN) is   | disabled |
+---------------------------+----------+

[*] Timeouts and Intervals
+---------------------------+-------------+
| Reconnect Interval        | 60 seconds  |
| Maximum Connection Errors | 1000        |
| Poll Timeout              | 360 seconds |
+---------------------------+-------------+

[*] Command and Control
+---------------------+----------------------------------------------------------+
| Endpoints           | [1] http://evildomain.com:8080                           |
|                     | [2] https://backupdomain.com?proxy=http://proxy.com:1234 |
| Connection Strategy | Sequential                                               |
+---------------------+----------------------------------------------------------+

[*] Execution is not subject to any restrictions
[*] Traffic encoders are not enabled

Here is a beacon with execution restrictions:

profiles info beacon-with-restrictions 

[*] Implant Basics
+-------------------+---------------+
| OS / Architecture | Windows AMD64 |
| Implant Type      | Beacon        |
| Implant Format    | Shellcode     |
+-------------------+---------------+

[*] Obfuscation
+---------------------------+----------+
| Evasion is                | disabled |
| Debugging is              | disabled |
| Obfuscation of symbols is | enabled  |
| Shikata Ga Nai (SGN) is   | enabled  |
+---------------------------+----------+

[*] Timeouts and Intervals
+---------------------------+-------------+
| Beacon Interval           | 60 seconds  |
| Beacon Jitter             | 30 seconds  |
| Reconnect Interval        | 60 seconds  |
| Maximum Connection Errors | 1000        |
| Poll Timeout              | 360 seconds |
+---------------------------+-------------+

[*] Command and Control
+---------------------+-----------------------------------+
| Endpoints           | [1] https://www.myevildomain.com  |
|                     | [2] https://myotherevildomain.com |
| Connection Strategy | Sequential                        |
+---------------------+-----------------------------------+

[*] Execution is subject to the following restrictions
+-----------------------------------------------------------------+----------------+
| Device must be domain joined                                    | Yes            |
| Execution will only occur before the following date/time        | No restriction |
| Files that must be present                                      | file.ext       |
| Device has the hostname                                         | No restriction |
| Device uses the locale                                          | No restriction |
| The implant must be running under the context of specified user | User           |
+-----------------------------------------------------------------+----------------+

[*] Traffic encoders are not enabled

@RafBishopFox RafBishopFox requested a review from a team as a code owner June 15, 2023 14:01
@moloch-- moloch-- merged commit 853537d into master Jun 15, 2023
@RafBishopFox RafBishopFox deleted the profile-info branch June 15, 2023 14:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants