Necropolis v1 release

2026-07-07 04:37:29 +01:00
commit cf9c51a3df
69 changed files with 15056 additions and 0 deletions
@@ -0,0 +1,153 @@
+syntax = "proto3";
+package apb;
+option go_package = "github.com/Yenn503/NecropolisC2/protobuf/apb";
+
+import "cpb/common.proto";
+
+// Envelope wraps all messages sent between operator and implant
+message Envelope {
+  int64 ID = 1;
+  uint32 Type = 2;
+  bytes Data = 3;
+  bytes Signature = 4;
+  bytes SenderKey = 5;
+  bytes Token = 6;
+}
+
+// Register - First message implant sends after connecting
+message Register {
+  string Name = 1;
+  string Hostname = 2;
+  string UUID = 3;
+  string Username = 4;
+  string UID = 5;
+  string GID = 6;
+  string OS = 7;
+  string Arch = 8;
+  int32 PID = 9;
+  string Filename = 10;
+  string Version = 11;
+  int64 PeerID = 12;
+  string ActiveC2 = 13;
+  int64 ReconnectInterval = 14;
+  string Locale = 15;
+  bytes BoxPubKey = 16;
+}
+
+// Z1 - Used for async beacon mode
+message Z1 {
+  string ID = 1;
+  int64 Interval = 2;
+  int64 Jitter = 3;
+  Register Register = 4;
+  int64 NextCheckin = 5;
+}
+
+// Z4 removed — alternate kill request, never used
+// Z5/Z6 removed — interactive shell via proto, not used (shell uses direct streams)
+// Z7/Z8 removed — stream tunnel abstraction, not used
+// Z9/Z10 removed — SOCKS via TunnelID, not used (SOCKS uses direct streams)
+// Z11 removed — IPFS exfiltration, not used
+
+// Z12 - List processes
+message Z12 {
+  cpb.Request Request = 9;
+}
+
+message Z13 {
+  repeated cpb.Process Processes = 1;
+  cpb.Response Response = 9;
+}
+
+// Z14 - Run a command
+message Z14 {
+  string Path = 1;
+  repeated string Args = 2;
+  bool Output = 3;
+  cpb.Request Request = 9;
+}
+
+message Z15 {
+  uint32 Status = 1;
+  bytes Stdout = 2;
+  bytes Stderr = 3;
+  uint32 Pid = 4;
+  cpb.Response Response = 9;
+}
+
+// Z16 - List directory
+message Z16 {
+  string Path = 1;
+  cpb.Request Request = 9;
+}
+
+message Z18 {
+  string Name = 1;
+  bool IsDir = 2;
+  int64 Size = 3;
+  int64 ModTime = 4;
+  string Mode = 5;
+  string Link = 6;
+}
+
+message Z17 {
+  string Path = 1;
+  bool Exists = 2;
+  repeated Z18 Files = 3;
+  cpb.Response Response = 9;
+}
+
+// Z19 - Change directory
+message Z19 {
+  string Path = 1;
+  cpb.Request Request = 9;
+}
+
+message Z20 {
+  cpb.Request Request = 9;
+}
+
+message Z21 {
+  string Path = 1;
+  cpb.Response Response = 9;
+}
+
+// Z22 - Z23 file from implant
+message Z22 {
+  string Path = 1;
+  cpb.Request Request = 9;
+}
+
+message Z23 {
+  string Path = 1;
+  bool Exists = 2;
+  bytes Data = 3;
+  cpb.Response Response = 9;
+}
+
+// Z24 - Z25 file to implant
+message Z24 {
+  string Path = 1;
+  bytes Data = 2;
+  bool Overwrite = 3;
+  cpb.Request Request = 9;
+}
+
+message Z25 {
+  string Path = 1;
+  int32 BytesWritten = 2;
+  cpb.Response Response = 9;
+}
+
+// Z2 - Capture screen
+message Z2 {
+  cpb.Request Request = 9;
+}
+
+message Z3 {
+  bytes Data = 1;
+  cpb.Response Response = 9;
+}
+
+// Z5-Z11 removed — dead spec from original fork. Shell/portfwd/SOCKS use direct libp2p
+// streams instead of protobuf tunnels. IPFS was never wired. Regenerate with protoc.