diff --git a/ManagedServices/alphv_blackcat/Resources/assets/launch-json-setup1.png b/ManagedServices/alphv_blackcat/Resources/assets/launch-json-setup1.png new file mode 100644 index 00000000..3e109e01 Binary files /dev/null and b/ManagedServices/alphv_blackcat/Resources/assets/launch-json-setup1.png differ diff --git a/ManagedServices/alphv_blackcat/Resources/assets/launch-json-setup2.png b/ManagedServices/alphv_blackcat/Resources/assets/launch-json-setup2.png new file mode 100644 index 00000000..675f8264 Binary files /dev/null and b/ManagedServices/alphv_blackcat/Resources/assets/launch-json-setup2.png differ diff --git a/ManagedServices/alphv_blackcat/Resources/control_server/DebuggingGuide.md b/ManagedServices/alphv_blackcat/Resources/control_server/DebuggingGuide.md index e4d3095e..86d61f95 100644 --- a/ManagedServices/alphv_blackcat/Resources/control_server/DebuggingGuide.md +++ b/ManagedServices/alphv_blackcat/Resources/control_server/DebuggingGuide.md @@ -1,6 +1,6 @@ # Golang Debugging Guide -This guide is a quick overview on how to install and get started with the Golang debugger on VS Code. +This guide is a quick overview on how to install and get started with the Golang debugger on VS Code. See the [official documentation](https://code.visualstudio.com/docs/languages/go) for additional tips. ## Step 1 @@ -10,7 +10,7 @@ You will first need to install the Go extension if you have not already. Click o You will need to create a `launch.json` config file. Click on the Debug icon on the left pane of VS Code. You should see the following: -![Screenshot 2023-06-27 at 2 42 18 PM](https://github.com/attackevals/evalsC2server/assets/78662790/25b67171-a9b3-4fc4-ac77-27765025d8e5) +![Visual Studio Code Debugging Setup 1](../assets/launch-json-setup1.png) Click on the `create a launch.json file` link to generate the file. If your Debug panel does not give you this option, you can just create the file manually. Create a new directory entitled `.vscode` and new file `launch.json` within it. @@ -18,7 +18,7 @@ Click on the `create a launch.json file` link to generate the file. If your Debu Configure your `launch.json` file to reflect the following: -Screenshot 2023-11-17 at 1 13 57 PM +![Visual Studio Code Debugging Setup 2](../assets/launch-json-setup2.png) Make sure to update the `"program"` and `"args"` fields to correctly reflect your filepaths to `main.go` and your handler config file. diff --git a/ManagedServices/menupass/Resources/assets/launch-json-setup1.png b/ManagedServices/menupass/Resources/assets/launch-json-setup1.png new file mode 100644 index 00000000..3e109e01 Binary files /dev/null and b/ManagedServices/menupass/Resources/assets/launch-json-setup1.png differ diff --git a/ManagedServices/menupass/Resources/assets/launch-json-setup2.png b/ManagedServices/menupass/Resources/assets/launch-json-setup2.png new file mode 100644 index 00000000..675f8264 Binary files /dev/null and b/ManagedServices/menupass/Resources/assets/launch-json-setup2.png differ diff --git a/ManagedServices/menupass/Resources/assets/sodamaster-c2-diagram.png b/ManagedServices/menupass/Resources/assets/sodamaster-c2-diagram.png new file mode 100644 index 00000000..04dbbfb6 Binary files /dev/null and b/ManagedServices/menupass/Resources/assets/sodamaster-c2-diagram.png differ diff --git a/ManagedServices/menupass/Resources/control_server/DebuggingGuide.md b/ManagedServices/menupass/Resources/control_server/DebuggingGuide.md index e4d3095e..86d61f95 100644 --- a/ManagedServices/menupass/Resources/control_server/DebuggingGuide.md +++ b/ManagedServices/menupass/Resources/control_server/DebuggingGuide.md @@ -1,6 +1,6 @@ # Golang Debugging Guide -This guide is a quick overview on how to install and get started with the Golang debugger on VS Code. +This guide is a quick overview on how to install and get started with the Golang debugger on VS Code. See the [official documentation](https://code.visualstudio.com/docs/languages/go) for additional tips. ## Step 1 @@ -10,7 +10,7 @@ You will first need to install the Go extension if you have not already. Click o You will need to create a `launch.json` config file. Click on the Debug icon on the left pane of VS Code. You should see the following: -![Screenshot 2023-06-27 at 2 42 18 PM](https://github.com/attackevals/evalsC2server/assets/78662790/25b67171-a9b3-4fc4-ac77-27765025d8e5) +![Visual Studio Code Debugging Setup 1](../assets/launch-json-setup1.png) Click on the `create a launch.json file` link to generate the file. If your Debug panel does not give you this option, you can just create the file manually. Create a new directory entitled `.vscode` and new file `launch.json` within it. @@ -18,7 +18,7 @@ Click on the `create a launch.json file` link to generate the file. If your Debu Configure your `launch.json` file to reflect the following: -Screenshot 2023-11-17 at 1 13 57 PM +![Visual Studio Code Debugging Setup 2](../assets/launch-json-setup2.png) Make sure to update the `"program"` and `"args"` fields to correctly reflect your filepaths to `main.go` and your handler config file. diff --git a/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/README.md b/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/README.md index 83a141dd..a7a6e5a7 100644 --- a/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/README.md +++ b/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/README.md @@ -7,7 +7,7 @@ The SodaMaster TCP Handler functions as the server-side counterpart to the SodaM - process the data returned after the implant completes tasks - accept tasking from `evalsC2client.py` and send the tasks to the implant when requested -![SodaMaster C2 Diagram drawio](https://github.com/attackevals/evalsC2server/assets/78662790/467b8479-c1ed-4ee8-94eb-64c7c62e20a8) +![SodaMaster C2 Diagram](../../../assets/sodamaster-c2-diagram.png) ## Components @@ -172,16 +172,16 @@ See [here](../../DebuggingGuide.md) for a guide on how to set up the Golang debu - The handler is configured to discard any invalid/malicious data to avoid crashing, in the case of bad data the handler will throw an error message. Locate the error message in the source code and set a breakpoint in that function to debug the error. - If the implant data is not formatted correctly (*length of length* or *length* incorrect, etc.), it will most likely error out [here](https://github.com/attackevals/evalsC2server/blob/dce97c97b2c8d41c3e2608e2e29a77179353c98e/handlers/sodamaster/sodamaster_utility.go#L64). If the handler throws an error in this function, follow the steps below to validate the data and ensure the implant is functioning correctly. - There are several layers of b64 encoding and encryption on comms sent between the handler and implant that can potentially cause the data to be malformed- here are some tips to start debugging if the data appears invalid: - - Set a breakpoint in `startListener` ([suggested line](https://github.com/attackevals/evalsC2server/blob/dce97c97b2c8d41c3e2608e2e29a77179353c98e/handlers/sodamaster/sodamaster.go#L193)) + - Set a breakpoint in `startListener` ([suggested line](https://github.com/attackevals/ael/blob/main/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/sodamaster.go#L193)) - Compare the `response` and `encryptedResponse` variables with the plain text data and encrypted data received by the implant, ensure this data matches - - Set a breakpoint in `parseImplantData` ([suggested line](https://github.com/attackevals/evalsC2server/blob/dce97c97b2c8d41c3e2608e2e29a77179353c98e/handlers/sodamaster/sodamaster.go#L560)) + - Set a breakpoint in `parseImplantData` ([suggested line](https://github.com/attackevals/ael/blob/main/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/sodamaster.go#L560)) - Compare the `data` and `encryptedData` variables with the plain text data and encrypted data sent by the implant, ensure this data matches - If the data sent/received by the handler does not match with the implant: - - Ensure that the task string is being formatted correctly [here](https://github.com/attackevals/evalsC2server/blob/dce97c97b2c8d41c3e2608e2e29a77179353c98e/handlers/sodamaster/sodamaster_utility.go#L102) - - Ensure that the data is being encrypted/decrypted correctly [here](https://github.com/attackevals/evalsC2server/blob/main/handlers/sodamaster/sodamaster_crypto.go) + - Ensure that the task string is being formatted correctly [here](https://github.com/attackevals/ael/blob/main/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/sodamaster_utility.go#L102) + - Ensure that the data is being encrypted/decrypted correctly [here](https://github.com/attackevals/ael/blob/main/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/sodamaster_crypto.go) #### Shellcode execution fails -- Set a breakpoint in the `formatShellcodeTask` utility function ([suggested line](https://github.com/attackevals/evalsC2server/blob/dce97c97b2c8d41c3e2608e2e29a77179353c98e/handlers/sodamaster/sodamaster_utility.go#L122)) +- Set a breakpoint in the `formatShellcodeTask` utility function ([suggested line](https://github.com/attackevals/ael/blob/main/ManagedServices/menupass/Resources/control_server/handlers/sodamaster/sodamaster_utility.go#L122)) - Check the `shellcode` variable for valid bytes, it is possible there was an error with generating the shellcode and the bytes are zeroed out - Check the beginning of the task string to make sure the `id`, `len of length`, and `length` variables all match what is received implant side