Initial poc working with test server.

docs/Sandcat-Details.md

@@ -63,6 +63,7 @@ When running the Sandcat agent binary, there are optional parameters you can use
 
 Additionally, the sandcat agent can tunnel its communications to the C2 using the following options (for more details, see the [C2 tunneling documentation](../../C2-Tunneling.md)
 
+
 ## Extensions
 In order to keep the agent code lightweight, the default Sandcat agent binary ships with limited basic functionality.
 Users can dynamically compile additional features, referred to as "gocat extensions".
@@ -121,6 +122,23 @@ Additional functionality can be found in the following agent extensions:
 **Other Extensions**
 - `shared` extension provides the C sharing functionality for Sandcat. This can be used to compile Sandcat as a DLL rather than a `.exe` for Windows targets.
 
+### Building sandcat locally for development
+Build sandcat without extensions:
+```cd ./gocat; go build```
+Build sandcat with extensions:
+```cd ./gocat; cp ../gocat-extensions/<extension-type>/<your-extension>.go ./<extension-type>/; go build```
+
+### Building a new extension
+#### Contacts
+1. For testing your contact will need to be in the core code base to get compiled in.
+    - Create a copy of `api.go` in the `sandcat/gocat/contact/` folder.
+    - Name your copy something descriptive of your contact. `Eg. websocket_rev_contact`
+2. Add any static configuration to the vars section. ie. If you have a specific endpoint that won't change often.
+3. Add any dynamic variables that may change during the course of execution or at run time like upstream address to the struct for your contact.
+4. Update the init names for your contact struct. Eg. API -> Websocket
+5. Update the standard functions `GetBeaconBytes`, `GetPayloadBytes`, `C2RequirementsMet`, `SetUpstreamDestAddr`, `SendExecutionResults`, `GetName`, and `UploadFileBytes` to be implementations of your contacts struct and to perform the functions how you want.
+
+
 ## Customizing Default Options & Execution Without CLI Options
 
 It is possible to customize the default values of these options when pulling Sandcat from the CALDERA server.  

gocat-extensions/contact/websocket_rev_contact.go

@@ -0,0 +1,145 @@
+package contact
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/gorilla/websocket"
+
+	"github.com/mitre/gocat/output"
+)
+
+var (
+	websocket_url   = "/ws_interactive"
+	websocket_proto = "ws"
+	ws_userAgent    = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
+)
+
+//API communicates through HTTP
+type Websocket struct {
+	name             string
+	client           *http.Client
+	upstreamDestAddr string
+	ws_client        *websocket.Conn
+}
+
+func init() {
+	CommunicationChannels["Websocket"] = &Websocket{name: "Websocket"}
+}
+
+func (f *Websocket) SupportsContinuous() bool {
+	return false
+}
+
+//GetInstructions sends a beacon and returns response.
+func (a *Websocket) GetBeaconBytes(profile map[string]interface{}) []byte {
+	output.VerbosePrint("[*] Getting commands")
+	data, err := json.Marshal(profile)
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("[-] Cannot request beacon. Error with profile marshal: %s", err.Error()))
+		return nil
+	} else {
+		// address := fmt.Sprintf("%s%s", a.upstreamDestAddr, apiBeacon)
+		return a.request(data)
+	}
+}
+
+// Return the file bytes for the requested payload.
+func (a *Websocket) GetPayloadBytes(profile map[string]interface{}, payload string) ([]byte, string) {
+	// Not implemented due to interactive nature.
+	return nil, ""
+}
+
+//C2RequirementsMet determines if sandcat can use the selected comm channel
+func (a *Websocket) C2RequirementsMet(profile map[string]interface{}, c2Config map[string]string) (bool, map[string]string) {
+	upstreamurl, err := url.Parse(a.upstreamDestAddr)
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("Invalid URL: %v", err))
+		return false, nil
+	}
+	a.SetUpstreamDestAddr(fmt.Sprintf("%s://%s/%s", websocket_proto, upstreamurl.Host, websocket_url))
+	// a.SetUpstreamDestAddr("ws://localhost:7012/ws_interactive")
+
+	output.VerbosePrint(fmt.Sprintf("Interactive endpoint=%s", a.upstreamDestAddr))
+
+	// Gorilla handles the HTTP upgrade to websocket so we don't need that client anymore.
+	// Using a unique name ws_client to avoid name confliction with api.go
+	c, _, err := websocket.DefaultDialer.Dial(a.upstreamDestAddr, nil)
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("dial: %v", err))
+		return false, nil
+	}
+	a.ws_client = c
+	return true, nil
+}
+
+func (a *Websocket) SetUpstreamDestAddr(upstreamDestAddr string) {
+	upstreamDestAddr = "ws://localhost:7013/ws_interactive"
+	a.upstreamDestAddr = upstreamDestAddr
+}
+
+// SendExecutionResults will send the execution results to the upstream destination.
+func (a *Websocket) SendExecutionResults(profile map[string]interface{}, result map[string]interface{}) {
+	output.VerbosePrint("[*] Sending results")
+	_ = fmt.Sprintf("%s%s", a.upstreamDestAddr, apiBeacon)
+	profileCopy := make(map[string]interface{})
+	for k, v := range profile {
+		profileCopy[k] = v
+	}
+	results := make([]map[string]interface{}, 1)
+	results[0] = result
+	profileCopy["results"] = results
+	data, err := json.Marshal(profileCopy)
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("[-] Cannot send results. Error with profile marshal: %s", err.Error()))
+	} else {
+		a.request(data)
+	}
+}
+
+func (a *Websocket) GetName() string {
+	return a.name
+}
+
+func (a *Websocket) UploadFileBytes(profile map[string]interface{}, uploadName string, data []byte) error {
+	// Not implemented due to interactive nature.
+	return nil
+}
+
+func (a *Websocket) request(data []byte) []byte {
+	output.VerbosePrint(string(data))
+	encodedData := []byte(base64.StdEncoding.EncodeToString(data))
+	output.VerbosePrint("[*] Making request")
+
+	err := a.ws_client.WriteMessage(websocket.TextMessage, encodedData)
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("[-] Cannot send websocket message: %s", err.Error()))
+		return nil
+	}
+	_, message, err := a.ws_client.ReadMessage()
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("[-] Cannot recieve websocket message: %s", err.Error()))
+		return nil
+	}
+
+	decodedData, err := base64.StdEncoding.DecodeString(string(message))
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("[-] Cannot decode websocket message: %s", err.Error()))
+		return nil
+	}
+	output.VerbosePrint(fmt.Sprintf("[*] Decoded message:\n %s", decodedData))
+	var jsonData interface{}
+	err = json.Unmarshal(decodedData, &jsonData)
+	if err != nil {
+		output.VerbosePrint(fmt.Sprintf("[-] Cannot unmarshal json data: %s", err.Error()))
+		return nil
+	}
+	// if val, ok := jsonData["sleep"]; ok {
+	// 	jsonData["sleep"] = float64(0)
+	// }
+
+	return decodedData
+}

gocat/go.mod

@@ -19,6 +19,7 @@ require (
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/golang/protobuf v1.4.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/gorilla/websocket v1.5.0
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	golang.org/x/mod v0.4.2 // indirect
 	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect

gocat/go.sum

@@ -106,6 +106,8 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grandcat/zeroconf v1.0.0 h1:uHhahLBKqwWBV6WZUDAT71044vwOTL+McW0mBJvo6kE=
 github.com/grandcat/zeroconf v1.0.0/go.mod h1:lTKmG1zh86XyCoUeIHSA4FJMBwCJiQmGfcP2PdzytEs=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=