| 110 | } |
| 111 | |
| 112 | func options() *FlagOptions { |
| 113 | sleeptime := flag.String("Sleep", "", "Initial beacon sleep time") |
| 114 | stage := flag.String("Stage", "false", "Disable host staging (Default: False)") |
| 115 | jitter := flag.String("Jitter", "", "Jitter percentage for beacon call home") |
| 116 | useragent := flag.String("Useragent", "", `UserAgent string for the beacon to use (Leave blank to randomly select one): |
| 117 | [*] Win10Chrome |
| 118 | [*] Win10Edge |
| 119 | [*] Win10IE |
| 120 | [*] Win10 |
| 121 | [*] Win6.3 |
| 122 | [*] Linux |
| 123 | [*] Mac`) |
| 124 | uri := flag.String("Uri", "", "The number URIs a profile for beacons to choose from") |
| 125 | customuri := flag.String("Customuri", "", "The base URI for custom HTTP GET/POST profile - Cannot be used with CustomuriGET or CustomuriPOST") |
| 126 | customuriGET := flag.String("CustomuriGET", "", "The base URI for custom HTTP GET profile - Must be used with CustomuriPOST") |
| 127 | customuriPOST := flag.String("CustomuriPOST", "", "The base URI for custom HTTP POST profile - Must be used with CustomuriGET") |
| 128 | beacon_PE := flag.String("PE_Clone", "", `PE file beacon will mimic (Use the number): |
| 129 | [1] ActivationManager.dll |
| 130 | [2] audioeng.dll |
| 131 | [3] AzureSettingSyncProvider.dll |
| 132 | [4] BingMaps.dll |
| 133 | [5] DIAGCPL.dll |
| 134 | [6] EDGEHTML.dll |
| 135 | [7] FILEMGMT.dll |
| 136 | [8] FIREWALLCONTROLPANEL.dll |
| 137 | [9] GPSVC.dll |
| 138 | [10] gpupvdev.dll |
| 139 | [11] libcrypto.dll |
| 140 | [12] srvcli.dll |
| 141 | [13] srvsvc.dll |
| 142 | [14] Windows.Storage.Search.dll |
| 143 | [15] Windows.System.Diagnostics.dll |
| 144 | [16] Windows.System.Launcher.dll |
| 145 | [17] Windows.System.SystemManagement.dll |
| 146 | [18] Windows.UI.BioFeedback.dll |
| 147 | [19] Windows.UI.BlockedShutdown.dll |
| 148 | [20] Windows.UI.Core.TextInput.DLL |
| 149 | [21] winsqlite3.dll |
| 150 | [22] WMNetMgr.DLL |
| 151 | [23] wwanapi.dll |
| 152 | [24] WWANSVC.DLL |
| 153 | [25] wow64win.dll |
| 154 | [26] wow64.dll |
| 155 | [27] ctiuser.dll (Carbon Black's DLL) |
| 156 | [28] InProcessClient.dll (SentinelOne's DLL) |
| 157 | [29] umppc.dll (CrowdStrike's DLL) |
| 158 | [30] CyMemDef64.dll (Cylance's DLL)`) |
| 159 | processinject_min_alloc := flag.String("Allocation", "", "Minimum amount of memory to request for injected content (must be higher than 4096)") |
| 160 | Post_EX_Process_Name := flag.String("PostEX_Name", "", `File Post-Ex activities will spawn and inject into (Use the number): |
| 161 | [1] WerFault.exe |
| 162 | [2] WWAHost.exe |
| 163 | [3] choice.exe |
| 164 | [4] bootcfg.exe |
| 165 | [5] dtdump.exe |
| 166 | [6] expand.exe |
| 167 | [7] fsutil.exe |
| 168 | [8] gpupdate.exe |
| 169 | [9] gpresult.exe |