scottctaylor12 commented 2 years ago

There were lots of small changes that needed to happen to make poseidon work with Windows. Here's the summary:

Major Changes:

Dockerfile downloads gcc-mingw-w64 to enable cross compiling within the Linux docker container to windows exe RUN apt update; apt-get -y install gcc-mingw-w64

agent_functions/builder.py now includes a Windows build command the uses the typical go build method rather than xgo. (I couldn't get xgo to work for windows...)

elif target_os == "windows":
            command += "mkdir /build;"
            command += (
                "GOOS=windows GOARCH=amd64 CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc go build -ldflags=\"{}\" -tags {} -o /build/poseidon-windows-amd64".format(
                    ldflags,
                    profile,
                )
            )

pkg/utils/functions_windows.go Used golang.org/x/sys/windows to call RtlGetVersion() win32 API for getOS() function. This is required for the checkin process to collect necessary information.

Minor changes:

For the most part, I had to go in various command packages and add a _windows.go file with the //+build windows header and include a return error of "Not Implemented/Compatible". These cases are found in:

drives_windows.go
dyld_inject_windows.go
execute_memory_windows.go
jxa_windows.go
keylog/keystate/keystate_windows.go
keys_windows.go
libinject_windows.go
list_entitlements_windows.go
listtasks_windows.go
persist_loginitem_windows.go
ps_windows.go
ls_windows.go
screencapture_windows.go
xpc_windows.go

Some commands build, but do not work for windows. For these situations, I went into the agent_function/.py file and disabled them for windows by adding:

attributes = CommandAttributes(
    supported_os=[SupportedOS.MacOS, SupportedOS.Linux]
)

This change can be found in:

setenv.py
unsetenv.py
shell.py
ps.py

Notable Testing Success:

Windows default executable builds successfully and works with all profiles: websocket, http, and poseidon_tcp
Windows egress agent can successfully perform the link_tcp and unlink_tcp command for P2P comms (to windows and linux poseidon_tcp agents)

scottctaylor12 commented 2 years ago

Also, socks proxying worked while testing from a windows agent :fire:

scottctaylor12 commented 2 years ago

@its-a-feature PR is up-to-date with latest MythicAgents:dev branch changes and ready for review!

I noticed one thing about your upstream change. The way you handle the compiler flags might cause a bug within the poseidon container. The compiler flags are set using export to environment variables which is fine. However, those environment variables will still be set when the next payload is being built.

Problem scenario: darwin payload exports CC=o64-clang; and CXX=o64-clang++ when being built. When the Linux payload gets built, those environment variables might still be set and mess up the build.

https://github.com/MythicAgents/poseidon/blob/f5e9c0a74d0bc528495a47c91f362ddf01cb48d1/Payload_Type/poseidon/mythic/agent_functions/builder.py#L97-L100

Solution: Instead of exporting the compiler flags, add them before the garble/go command like: CC=mingw go build ..... rather than export CC=mingw; go build ...

its-a-feature commented 2 years ago

How's this effort going? Is it to the point where you want me to review it or are you still looking to add major command functionality?