154 lines
2.8 KiB
Protocol Buffer
154 lines
2.8 KiB
Protocol Buffer
syntax = "proto3";
|
|
package apb;
|
|
option go_package = "github.com/Yenn503/NecropolisC2/protobuf/apb";
|
|
|
|
import "cpb/common.proto";
|
|
|
|
// Envelope wraps all messages sent between operator and implant
|
|
message Envelope {
|
|
int64 ID = 1;
|
|
uint32 Type = 2;
|
|
bytes Data = 3;
|
|
bytes Signature = 4;
|
|
bytes SenderKey = 5;
|
|
bytes Token = 6;
|
|
}
|
|
|
|
// Register - First message implant sends after connecting
|
|
message Register {
|
|
string Name = 1;
|
|
string Hostname = 2;
|
|
string UUID = 3;
|
|
string Username = 4;
|
|
string UID = 5;
|
|
string GID = 6;
|
|
string OS = 7;
|
|
string Arch = 8;
|
|
int32 PID = 9;
|
|
string Filename = 10;
|
|
string Version = 11;
|
|
int64 PeerID = 12;
|
|
string ActiveC2 = 13;
|
|
int64 ReconnectInterval = 14;
|
|
string Locale = 15;
|
|
bytes BoxPubKey = 16;
|
|
}
|
|
|
|
// Z1 - Used for async beacon mode
|
|
message Z1 {
|
|
string ID = 1;
|
|
int64 Interval = 2;
|
|
int64 Jitter = 3;
|
|
Register Register = 4;
|
|
int64 NextCheckin = 5;
|
|
}
|
|
|
|
// Z4 removed — alternate kill request, never used
|
|
// Z5/Z6 removed — interactive shell via proto, not used (shell uses direct streams)
|
|
// Z7/Z8 removed — stream tunnel abstraction, not used
|
|
// Z9/Z10 removed — SOCKS via TunnelID, not used (SOCKS uses direct streams)
|
|
// Z11 removed — IPFS exfiltration, not used
|
|
|
|
// Z12 - List processes
|
|
message Z12 {
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z13 {
|
|
repeated cpb.Process Processes = 1;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z14 - Run a command
|
|
message Z14 {
|
|
string Path = 1;
|
|
repeated string Args = 2;
|
|
bool Output = 3;
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z15 {
|
|
uint32 Status = 1;
|
|
bytes Stdout = 2;
|
|
bytes Stderr = 3;
|
|
uint32 Pid = 4;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z16 - List directory
|
|
message Z16 {
|
|
string Path = 1;
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z18 {
|
|
string Name = 1;
|
|
bool IsDir = 2;
|
|
int64 Size = 3;
|
|
int64 ModTime = 4;
|
|
string Mode = 5;
|
|
string Link = 6;
|
|
}
|
|
|
|
message Z17 {
|
|
string Path = 1;
|
|
bool Exists = 2;
|
|
repeated Z18 Files = 3;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z19 - Change directory
|
|
message Z19 {
|
|
string Path = 1;
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z20 {
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z21 {
|
|
string Path = 1;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z22 - Z23 file from implant
|
|
message Z22 {
|
|
string Path = 1;
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z23 {
|
|
string Path = 1;
|
|
bool Exists = 2;
|
|
bytes Data = 3;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z24 - Z25 file to implant
|
|
message Z24 {
|
|
string Path = 1;
|
|
bytes Data = 2;
|
|
bool Overwrite = 3;
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z25 {
|
|
string Path = 1;
|
|
int32 BytesWritten = 2;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z2 - Capture screen
|
|
message Z2 {
|
|
cpb.Request Request = 9;
|
|
}
|
|
|
|
message Z3 {
|
|
bytes Data = 1;
|
|
cpb.Response Response = 9;
|
|
}
|
|
|
|
// Z5-Z11 removed — dead spec from original fork. Shell/portfwd/SOCKS use direct libp2p
|
|
// streams instead of protobuf tunnels. IPFS was never wired. Regenerate with protoc.
|