From 474a9abd1e7385993fc8b2b406f865574c1b6b4e Mon Sep 17 00:00:00 2001 From: its-a-feature Date: Wed, 13 Nov 2024 08:34:14 -0600 Subject: [PATCH] updating socks to support username/password for start/stop --- Payload_Type/poseidon/go.mod | 4 +- Payload_Type/poseidon/go.sum | 8 +- .../poseidon/poseidon/agent_code/go.mod | 17 ++-- .../poseidon/poseidon/agent_code/go.sum | 17 ++++ .../poseidon/poseidon/agentfunctions/socks.go | 93 ++++++++++--------- 5 files changed, 80 insertions(+), 59 deletions(-) diff --git a/Payload_Type/poseidon/go.mod b/Payload_Type/poseidon/go.mod index faa89cc..6a41836 100644 --- a/Payload_Type/poseidon/go.mod +++ b/Payload_Type/poseidon/go.mod @@ -7,7 +7,7 @@ toolchain go1.22.2 //replace github.com/MythicMeta/MythicContainer => ../../../../MythicMeta/MythicContainer require ( - github.com/MythicMeta/MythicContainer v1.4.6 + github.com/MythicMeta/MythicContainer v1.4.7 github.com/google/uuid v1.6.0 github.com/mitchellh/mapstructure v1.5.0 github.com/pelletier/go-toml v1.9.5 @@ -35,7 +35,7 @@ require ( golang.org/x/net v0.30.0 // indirect golang.org/x/sys v0.26.0 // indirect golang.org/x/text v0.19.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect google.golang.org/grpc v1.67.1 // indirect google.golang.org/protobuf v1.35.1 // indirect gopkg.in/ini.v1 v1.67.0 // indirect diff --git a/Payload_Type/poseidon/go.sum b/Payload_Type/poseidon/go.sum index a37fdd6..e0340d6 100644 --- a/Payload_Type/poseidon/go.sum +++ b/Payload_Type/poseidon/go.sum @@ -1,5 +1,5 @@ -github.com/MythicMeta/MythicContainer v1.4.6 h1:d+fD/WuhpWAl+MbaXB/c+OUxxT26AWUjtpCwCAo/42o= -github.com/MythicMeta/MythicContainer v1.4.6/go.mod h1:f9nIBe8teDUW+NP/jYw9Otor1RZHXpC/4cxMv88+KQE= +github.com/MythicMeta/MythicContainer v1.4.7 h1:Aelo4g18UPr6Po0CnGF3wujyoCUpoqkiVllrCPWUAb0= +github.com/MythicMeta/MythicContainer v1.4.7/go.mod h1:BnUYftqQ9KsGxBd6RlyRcAHBrqV1CUcrRCjktWwc2Do= github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= @@ -76,8 +76,8 @@ golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo= golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM= golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:QCqS/PdaHTSWGvupk2F/ehwHtGc0/GYkT+3GAcR1CCc= -google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 h1:zciRKQ4kBpFgpfC5QQCVtnnNAcLIqweL7plyZRQHVpI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI= google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E= google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA= google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA= diff --git a/Payload_Type/poseidon/poseidon/agent_code/go.mod b/Payload_Type/poseidon/poseidon/agent_code/go.mod index 6c04693..16336ba 100644 --- a/Payload_Type/poseidon/poseidon/agent_code/go.mod +++ b/Payload_Type/poseidon/poseidon/agent_code/go.mod @@ -1,26 +1,27 @@ module github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code -go 1.21 +go 1.22.0 toolchain go1.22.2 require ( - github.com/creack/pty v1.1.21 + github.com/creack/pty v1.1.24 github.com/djherbis/atime v1.1.0 github.com/google/uuid v1.6.0 github.com/gorilla/websocket v1.5.3 - github.com/kbinani/screenshot v0.0.0-20230812210009-b87d31814237 + github.com/kbinani/screenshot v0.0.0-20240820160931-a8a2c5d0e191 github.com/tmc/scp v0.0.0-20170824174625-f7b48647feef github.com/xorrior/keyctl v1.0.1-0.20210425144957-8746c535bf58 - golang.org/x/crypto v0.25.0 - golang.org/x/exp v0.0.0-20240707233637-46b078467d37 - golang.org/x/sync v0.7.0 - golang.org/x/sys v0.22.0 + golang.org/x/crypto v0.29.0 + golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f + golang.org/x/sync v0.9.0 + golang.org/x/sys v0.27.0 howett.net/plist v1.0.1 ) require ( - github.com/gen2brain/shm v0.1.0 // indirect + github.com/gen2brain/shm v0.1.1 // indirect + github.com/godbus/dbus/v5 v5.1.0 // indirect github.com/jezek/xgb v1.1.1 // indirect github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect diff --git a/Payload_Type/poseidon/poseidon/agent_code/go.sum b/Payload_Type/poseidon/poseidon/agent_code/go.sum index 538db5f..3ac671c 100644 --- a/Payload_Type/poseidon/poseidon/agent_code/go.sum +++ b/Payload_Type/poseidon/poseidon/agent_code/go.sum @@ -1,9 +1,15 @@ github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0= github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= +github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= +github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= github.com/djherbis/atime v1.1.0 h1:rgwVbP/5by8BvvjBNrbh64Qz33idKT3pSnMSJsxhi0g= github.com/djherbis/atime v1.1.0/go.mod h1:28OF6Y8s3NQWwacXc5eZTsEsiMzp7LF8MbXE+XJPdBE= github.com/gen2brain/shm v0.1.0 h1:MwPeg+zJQXN0RM9o+HqaSFypNoNEcNpeoGp0BTSx2YY= github.com/gen2brain/shm v0.1.0/go.mod h1:UgIcVtvmOu+aCJpqJX7GOtiN7X2ct+TKLg4RTxwPIUA= +github.com/gen2brain/shm v0.1.1 h1:1cTVA5qcsUFixnDHl14TmRoxgfWEEZlTezpUj1vm5uQ= +github.com/gen2brain/shm v0.1.1/go.mod h1:UgIcVtvmOu+aCJpqJX7GOtiN7X2ct+TKLg4RTxwPIUA= +github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= +github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= @@ -15,6 +21,8 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNU github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8= github.com/kbinani/screenshot v0.0.0-20230812210009-b87d31814237 h1:YOp8St+CM/AQ9Vp4XYm4272E77MptJDHkwypQHIRl9Q= github.com/kbinani/screenshot v0.0.0-20230812210009-b87d31814237/go.mod h1:e7qQlOY68wOz4b82D7n+DdaptZAi+SHW0+yKiWZzEYE= +github.com/kbinani/screenshot v0.0.0-20240820160931-a8a2c5d0e191 h1:5UHVWNX1qrIbNw7OpKbxe5bHkhHRk3xRKztMjERuCsU= +github.com/kbinani/screenshot v0.0.0-20240820160931-a8a2c5d0e191/go.mod h1:Pmpz2BLf55auQZ67u3rvyI2vAQvNetkK/4zYUmpauZQ= github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc= github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk= github.com/tmc/scp v0.0.0-20170824174625-f7b48647feef h1:7D6Nm4D6f0ci9yttWaKjM1TMAXrH5Su72dojqYGntFY= @@ -25,18 +33,27 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30= golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M= +golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ= +golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg= golang.org/x/exp v0.0.0-20240707233637-46b078467d37 h1:uLDX+AfeFCct3a2C7uIWBKMJIR3CJMhcgfrUAqjRK6w= golang.org/x/exp v0.0.0-20240707233637-46b078467d37/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= +golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo= +golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ= +golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI= golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s= +golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk= golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4= +golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg= diff --git a/Payload_Type/poseidon/poseidon/agentfunctions/socks.go b/Payload_Type/poseidon/poseidon/agentfunctions/socks.go index 22a2fbc..2ded1a1 100644 --- a/Payload_Type/poseidon/poseidon/agentfunctions/socks.go +++ b/Payload_Type/poseidon/poseidon/agentfunctions/socks.go @@ -92,60 +92,63 @@ func init() { response.Error = err.Error() return response } - if action, err := taskData.Args.GetStringArg("action"); err != nil { + action, err := taskData.Args.GetStringArg("action") + if err != nil { response.Success = false response.Error = err.Error() return response - } else if port, err := taskData.Args.GetNumberArg("port"); err != nil { + } + port, err := taskData.Args.GetNumberArg("port") + if err != nil { response.Success = false response.Error = err.Error() return response - } else { - displayString := fmt.Sprintf("%s on port %.0f", action, port) - response.DisplayParams = &displayString - if action == "start" { - if socksResponse, err := mythicrpc.SendMythicRPCProxyStart(mythicrpc.MythicRPCProxyStartMessage{ - PortType: rabbitmq.CALLBACK_PORT_TYPE_SOCKS, - LocalPort: int(port), - TaskID: taskData.Task.ID, - Username: username, - Password: password, - }); err != nil { - logging.LogError(err, "Failed to start socks") - response.Error = err.Error() - response.Success = false - return response - } else if !socksResponse.Success { - response.Error = socksResponse.Error - response.Success = false - return response - } else { - return response - } - } else if action == "stop" { - if socksResponse, err := mythicrpc.SendMythicRPCProxyStop(mythicrpc.MythicRPCProxyStopMessage{ - PortType: rabbitmq.CALLBACK_PORT_TYPE_SOCKS, - Port: int(port), - TaskID: taskData.Task.ID, - }); err != nil { - logging.LogError(err, "Failed to stop socks") - response.Error = err.Error() - response.Success = false - return response - } else if !socksResponse.Success { - response.Error = socksResponse.Error - response.Success = false - return response - } else { - return response - } + } + displayString := fmt.Sprintf("%s on port %.0f", action, port) + response.DisplayParams = &displayString + if action == "start" { + if socksResponse, err := mythicrpc.SendMythicRPCProxyStart(mythicrpc.MythicRPCProxyStartMessage{ + PortType: rabbitmq.CALLBACK_PORT_TYPE_SOCKS, + LocalPort: int(port), + TaskID: taskData.Task.ID, + Username: username, + Password: password, + }); err != nil { + logging.LogError(err, "Failed to start socks") + response.Error = err.Error() + response.Success = false + return response + } else if !socksResponse.Success { + response.Error = socksResponse.Error + response.Success = false + return response } else { - response.Success = true - output := "reset all connections and flush data" - response.DisplayParams = &output return response } - + } else if action == "stop" { + if socksResponse, err := mythicrpc.SendMythicRPCProxyStop(mythicrpc.MythicRPCProxyStopMessage{ + PortType: rabbitmq.CALLBACK_PORT_TYPE_SOCKS, + Port: int(port), + TaskID: taskData.Task.ID, + Username: username, + Password: password, + }); err != nil { + logging.LogError(err, "Failed to stop socks") + response.Error = err.Error() + response.Success = false + return response + } else if !socksResponse.Success { + response.Error = socksResponse.Error + response.Success = false + return response + } else { + return response + } + } else { + response.Success = true + output := "reset all connections and flush data" + response.DisplayParams = &output + return response } }, TaskFunctionParseArgDictionary: func(args *agentstructs.PTTaskMessageArgsData, input map[string]interface{}) error {