Functions — github.com/Z3ratu1/geacon

hub / github.com/Z3ratu1/geacon_plus / functions

Functions187 in github.com/Z3ratu1/geacon_plus

⨍ Functions 187◇ Types & classes 4

↓ 80 callersFunctionSprintf

seems no need to implement sprintf?

util/log.go:31

↓ 32 callersFunctionPushResult

(callBack int, b []byte)

packet/packet.go:366

↓ 18 callersFunctionPrintf

(format string, a ...any)

util/log.go:14

↓ 18 callersFunctionparseAnArg

(buf *bytes.Buffer)

command/misc.go:69

↓ 15 callersFunctionErrorMessage

(err string)

packet/packet.go:396

↓ 14 callersFunctionPrintln

(a ...any)

util/log.go:20

↓ 12 callersFunctionBytesCombine

(pBytes ...[]byte)

util/util.go:12

↓ 11 callersFunctionReadInt

(buf *bytes.Buffer)

packet/packet.go:74

↓ 8 callersFunctionReadShort

(buf *bytes.Buffer)

packet/packet.go:80

↓ 7 callersFunctionSleep

()

util/util.go:125

↓ 6 callersFunctionWriteInt

(nInt int)

packet/packet.go:68

↓ 5 callersFunctiondnsQueryA

(host string)

packet/dns.go:75

↓ 4 callersFunctionEncryptField

ALL USE BYTE!!! encrypt should not trigger error, this function does not modify input data encode/decode deployment can be found at c2profile.Program

util/util.go:46

↓ 4 callersFunctionExecAsm

(b []byte, isDllX64 bool, ignoreToken bool)

command/unixImpl.go:58

↓ 4 callersFunctionSpawnAndInjectDll

(dll []byte, isDllX64 bool, ignoreToken bool)

command/job.go:167

↓ 4 callersFunctioncreateProcessNative

if there is a token, use it to create new process

command/exec_windows.go:292

↓ 4 callersFunctionupdateCurrentHandle

however, some cmd like shinject and dllinject will simply inject process, but doesn't send job handler. so I should close handle in InjectDll, above c

command/job.go:61

↓ 3 callersFunctionCheckIn

(metadata []byte)

packet/dns.go:120

↓ 3 callersFunctionExec

(b []byte)

command/exec_unix.go:13

↓ 3 callersFunctionGetUsername

()

sysinfo/sysinfo_darwin.go:79

↓ 3 callersFunctioncloseToken

always close handle, no matter it is invalid or not

command/token.go:49

↓ 3 callersFunctioncreateRemoteThread

(processHandle windows.Handle, offset uint32, shellcode []byte, args []byte)

command/job.go:304

↓ 3 callersFunctioninjectSelf

(shellcode []byte, offset uint32, args []byte)

command/job.go:120

↓ 3 callersFunctionloopRead

this func read from pipe and send result back to server

command/exec_windows.go:198

↓ 3 callersFunctionparseCommandMove

can also be used on Copy

command/misc.go:106

↓ 3 callersFunctionparseCommandShell

(b []byte)

command/misc.go:129

↓ 3 callersFunctionparseExecAsm

(b []byte)

command/misc.go:155

↓ 2 callersFunctionDNSPost

DNSPost post result to server

packet/dns.go:214

↓ 2 callersFunctionDecryptField

DecryptField decode data with reversed decryptTypes

util/util.go:81

↓ 2 callersFunctionDeleteSelf

()

command/misc.go:200

↓ 2 callersFunctionDnsGet

fetch command

packet/dns.go:127

↓ 2 callersFunctionDnsGetA

DnsGetA fetch command with DNS A query

packet/dns.go:162

↓ 2 callersFunctionDnsGetAAAA

fetch command with DNS AAAA query

packet/dns.go:204

↓ 2 callersFunctionDnsGetTXT

DnsGetTXT fetch command with DNS TXT query

packet/dns.go:173

↓ 2 callersFunctionGeaconID

()

sysinfo/meta.go:22

↓ 2 callersFunctionGetCodePageANSI

()

sysinfo/sysinfo_darwin.go:64

↓ 2 callersFunctionGetCodePageOEM

()

sysinfo/sysinfo_darwin.go:72

↓ 2 callersFunctionGetComputerName

()

sysinfo/meta.go:59

↓ 2 callersFunctionGetMagicHead

()

sysinfo/meta.go:115

↓ 2 callersFunctionGetMetaDataFlag

()

sysinfo/meta.go:71

↓ 2 callersFunctionGetPID

()

sysinfo/meta.go:53

↓ 2 callersFunctionGetProcessArch

simply assume 64bit mac only run 64bit app

sysinfo/sysinfo_darwin.go:51

↓ 2 callersFunctionGetProcessName

()

sysinfo/meta.go:34

↓ 2 callersFunctionHttpGet

HttpGet need to handler c2profile here, data is raw rsa encrypted meta info

packet/http.go:86

↓ 2 callersFunctionInjectDll

implement of beacon.Job

command/job.go:67

↓ 2 callersFunctionIsOSX64

()

sysinfo/sysinfo_linux.go:76

↓ 2 callersFunctionIsProcessX64

()

sysinfo/sysinfo_darwin.go:43

↓ 2 callersFunctionNetbiosDecode

(data []byte, key byte)

util/util.go:34

↓ 2 callersFunctionNetbiosEncode

(data []byte, key byte)

util/util.go:23

↓ 2 callersFunctionPaddingWithA

(rawData []byte)

util/aes.go:26

↓ 2 callersFunctionPullCommand

()

packet/packet.go:349

↓ 2 callersFunctionRandomAESKey

()

util/rand.go:11

↓ 2 callersFunctionRandomInt

(min, max int)

util/rand.go:7

↓ 2 callersFunctionRunAsync

(cmd *exec.Cmd)

command/unixImpl.go:91

↓ 2 callersFunctionTimeCheck

(current time.Time)

command/misc.go:186

↓ 2 callersFunctionUpload

(b []byte, start bool)

command/fileSystem.go:21

↓ 2 callersFunctionWritePacketLen

(b []byte)

packet/packet.go:63

↓ 2 callersFunctionXOR

(text []byte, key []byte)

util/util.go:16

↓ 2 callersFunctionarrayToString

(x [65]int8)

sysinfo/sysinfo_linux.go:13

↓ 2 callersFunctioncallUserAPC

copy from GolangBypassAV EarlyBird

command/job.go:276

↓ 2 callersFunctiongetPrivs

(privs []string)

command/token.go:60

↓ 2 callersFunctiongetUname

()

sysinfo/sysinfo_linux.go:25

↓ 2 callersFunctionmakeTokenNative

(domain []byte, username []byte, password []byte)

command/token.go:162

↓ 2 callersFunctionparseTimeStomp

(b []byte)

command/misc.go:117

↓ 2 callersFunctionrandomID

()

packet/dns.go:38

↓ 2 callersFunctionspawnTempProcess

(procInfo *windows.ProcessInformation, startupInfo *windows.StartupInfo, isX64 bool, ignoreToken bool)

command/job.go:240

↓ 1 callersFunctionAesCBCDecrypt

(encryptData []byte, key []byte)

util/aes.go:47

↓ 1 callersFunctionAesCBCEncrypt

(rawData []byte, key []byte)

util/aes.go:35

↓ 1 callersFunctionCancel

(b []byte)

command/fileSystem.go:241

↓ 1 callersFunctionChangeCurrentDir

(path []byte)

command/fileSystem.go:49

↓ 1 callersFunctionChangeSleep

(b []byte)

command/misc.go:166

↓ 1 callersFunctionCopyFile

(b []byte)

command/fileSystem.go:307

↓ 1 callersFunctionDecryptPacket

(b []byte)

packet/packet.go:86

↓ 1 callersFunctionDeleteSelfImpl

()

command/unixImpl.go:73

↓ 1 callersFunctionDownload

(b []byte)

command/fileSystem.go:177

↓ 1 callersFunctionEncryptedMetaInfo

EncryptedMetaInfo return raw rsa encrypted data

packet/packet.go:164

↓ 1 callersFunctionFileBrowse

(b []byte)

command/fileSystem.go:68

↓ 1 callersFunctionFirstBlood

()

packet/packet.go:329

↓ 1 callersFunctionGetCurrentDirectory

()

command/fileSystem.go:58

↓ 1 callersFunctionGetLocalIP

()

sysinfo/meta.go:86

↓ 1 callersFunctionGetLocalIPInt

()

sysinfo/meta.go:99

↓ 1 callersFunctionGetNetworkInformation

(b []byte)

command/network.go:11

↓ 1 callersFunctionGetOSVersion

()

sysinfo/sysinfo_darwin.go:12

↓ 1 callersFunctionGetOSVersion41Plus

()

sysinfo/sysinfo_darwin.go:18

↓ 1 callersFunctionGetPrivsByte

(b []byte)

command/unixImpl.go:42

↓ 1 callersFunctionGetProcessSessionId

just return 0

sysinfo/sysinfo_darwin.go:60

↓ 1 callersFunctionHandlerJobAsync

(b []byte)

command/job.go:352

↓ 1 callersFunctionHmacHash

(encrytedBytes []byte)

util/aes.go:66

↓ 1 callersFunctionHttpPost

HttpPost seems post response is no need to deal with need to handler c2profile here

packet/http.go:45

↓ 1 callersFunctionIPXor

(ip net.IP, mask net.IP)

packet/dns.go:44

↓ 1 callersFunctionIsHighPriv

()

sysinfo/sysinfo_darwin.go:24

↓ 1 callersFunctionIsHighPriv

()

sysinfo/sysinfo_linux.go:67

↓ 1 callersFunctionIsOSX64

()

sysinfo/sysinfo_darwin.go:33

↓ 1 callersFunctionIsProcessX64

seems use go arch to judge is a good idea

sysinfo/sysinfo_linux.go:85

↓ 1 callersFunctionKillJob

(b []byte)

command/job.go:404

↓ 1 callersFunctionKillProcess

(b []byte)

command/proc.go:46

↓ 1 callersFunctionListDrives

(b []byte)

command/fileSystem.go:360

↓ 1 callersFunctionListJobs

()

command/job.go:395

↓ 1 callersFunctionListProcess

(pendingRequest []byte)

command/proc.go:13

↓ 1 callersFunctionMakeDir

(dir string)

command/fileSystem.go:351

next →1–100 of 187, ranked by callers