v0.6 Comandos del sistema de ficheros de Windows

README.md

@@ -4,7 +4,41 @@ Cazalla is a basic Windows implant written in C, designed to interface with the
 
 This project was developed based on the article [How to build your own Mythic agent in C](https://red-team-sncf.github.io/how-to-create-your-own-mythic-agent-in-c.html) and serves as an initial version of an implant with room for future improvements.
 
-Cazalla is developed by the OFSTeam at Kaseya. Currently, it only supports the `exit` and `shell` commands, but additional functionality is planned for future updates.
+Cazalla is developed by the OFSTeam at Kaseya. 
+
+## Supported Commands
+
+Commands are organized by category for better clarity and extensibility.
+
+### 📁 File System Commands
+| Command | Description              | Status  |
+|---------|--------------------------|---------|
+| `cd`    | Change working directory | ✅      |
+| `ls`    | List directory contents  | ✅      |
+| `pwd`   | Print working directory  | ✅      |
+| `cp`    | Copy an existing file    | ✅      |
+| `mkdir` | Create a new directory   | ✅      |
+| `rm`    | Delete file/directory    | ✅      |
+
+### 🖥️ Console Commands
+| Command | Description                         | Status |
+|---------|-------------------------------------|--------|
+| `shell`| Execute arbitrary shell command      | ✅     |
+
+### 🔄 Execution Control
+| Command | Description       | Status |
+|---------|-------------------|--------|
+| `exit` | Exit the implant   | ✅     |
+| `sleep`| Modify sleep time  | ✅     |
+
+### 🧠 System Inspection
+| Command | Description           | Status |
+|---------|-----------------------|--------|
+| `ps`    | List running processes| ✅     |
+
+> 🔧 To add a new command, see the [Creating New Commands](#creating-new-commands) section below.
+
+---
 
 ## Install Cazalla
 
@@ -14,10 +48,6 @@ Once Mythic is installed and running, use the following command to install Cazal
 ./mythic-cli install github <repository-url>
 ```
 
-## Detection
-
-A YARA rule can be provided for detection purposes.
-
 ## Communication Protocol
 
 ### HEADER - Implant to C2
@@ -179,7 +209,79 @@ Expected:
 |---------------|-------------------|-------------|
 | Status Resp1  | 1                 | Int         |
 
+## Creating New Commands
+
+### 📦 Mythic Side (Python)
+
+To add a new command in Mythic, create a `.py` file inside the agent's command folder (e.g., `shell.py`). A basic structure includes:
+
+- TaskArguments class
+- CommandBase class
+
+Example: `shell.py`
+
+```python
+class ShellArguments(TaskArguments):
+    def __init__(self, command_line, **kwargs):
+        ...
+        self.args = [
+            CommandParameter(name="command", type=ParameterType.String, ...)
+        ]
+
+class ShellCommand(CommandBase):
+    cmd = "shell"
+    ...
+    async def create_tasking(self, task: MythicTask):
+        ...
+
+    async def process_response(self, task, response):
+        ...
+
+```
+### 🧠 C2 Side (Python - `commands_from_c2.py`)
+
+Update the commands dictionary with a unique hex code and input type:
+
+```python
+commands = {
+    ...
+    "newcmd": {"hex_code": 0xAB, "input_type": "string"}
+}
+```
+Update `responseTasking` to handle serialization of the new command’s parameters.
+
+### 💻 Implant Side (C)
+
+Update the following files:
+
+`comandos.h`
+```c
+#define NEWCMD_CMD 0xAB
+BOOL ejecutarNuevoCmd(PAnalizador argumentos);
+```
+`comandos.c`
+Add your command logic in `handleGetTasking()`:
+```c
+else if (tarea == NEWCMD_CMD) {
+    ejecutarNuevoCmd(analizadorTarea);
+}
+```
+`nuevo_cmd.c` and `nuevo_cmd.h`
+Create your new command implementation.
+```c
+BOOL ejecutarNuevoCmd(PAnalizador argumentos) {
+    // handle parsing and execution here
+}
+```
+Don’t forget to add the source file to the build and include its header where needed.
+
 ## Future Development
 
-This is an initial version of Cazalla with limited functionality. Currently, it only supports the `exit` and `shell` commands. Future updates will introduce additional commands and improvements to enhance its capabilities.
+Planned improvements:
 
+- Full implementation of pwd
+- Additional file system and process control commands
+- File upload/download
+- Persistence and evasion mechanisms
+
+Made with ☕ by the Kaseya OFSTeam