Und3rf10w / external_c2_framework

Python api for usage with cobalt strike's External C2 specification
224 stars 95 forks source link

Create imgur transport using LSB encoding #11

Closed Und3rf10w closed 6 years ago

Und3rf10w commented 6 years ago

Create a new transport and encoder that utilizes imgur for c2, with images that use Least significant bit stenography

Logic could be something similar to this:

                  Sending data
            +------------------------+
            |                        |
            |  Get data from server  |
            |                        |                                                                              +-------------------+
            +---------+--------------+                                              +---------------------+         |                   |
                      |                                                             |                     |         | Transport uploads |
                      |                                                             | Return list of      |         | list of images to |
                      |                                                             | images to transport +-------->+ new Imgur album   |
                      |                                                             |                     |         |                   |          +-----------+
                      |                                                             +----------+----------+         +-------------------+          |           |
                      v                        +---------------------------+                   ^                                                   | Add image +<-------------------+
            +---------+--------------+         |                           |                   |                                                   | to list   |                    |
            |                        |         |                           |                   |                                                   |           |                    |
            | Send data to transport +-------->+ Transport sends raw data  |                   |                                                   +----+------+                    |
            |                        |         |   to encoder for encoding |                   |                                                        |              +------------+-----------------------+
            |                        |         |                           |         +---------+-------------+        +------------------------+        V              |                                    |
            +------------------------+         |                           |         |                       |        |                        |   +-----------+       | Change upperleftmost               |
                                               +------------+--------------+         | Loop through chunks,  |        | Start a counter,       |   |           |       | pixel to:                          |
                                                            |                        | Creating an image for +--------+ Ends when hits:        |   | increment |       | ($VERSION, $COUNTER, $TOTAL_PAGES) |
                                                            |                        | each chunk            |        | (number_of_chunks - 1) +<--+ counter   |       |                                    |
                                                            |                        |                       |        |                        |   |           |       +--------------+---------------------+
                                                            |                        +---------+-------------+        +---------+--------------+   +-----------+                      ^
                                                            |                                  ^                                |                                                     |
                                                            v                                  |                                |                                                     |
                                                +-----------+--------------+        +----------+------------------+             v                 +-------------------+     +---------+---------+
                                                |                          |        |                             |     +-------+-------------+   |                   |     |                   |
                                                | Encoder base64s the data +------->+ Encoder splits data         |     |                     |   | Loop through # of |     | Change Blue value |
                                                |                          |        | into 1079 byte sized chunks |     | Create a new image  +-->+ horizontal pixels +---->+ to chr(byte)      |
                                                +--------------------------+        |                             |     |                     |   | Ignoring first.   |     |                   |
                                                                                    +-----------------------------+     +---------------------+   |                   |     +-------------------+
                                                                                                                                                  +-------------------+

   Retrieving Data
+------------------+
|                  |
| Check Imgur user |
| for new album    |
|                  |
+-------+----------+
        |
        |
        v                  +------------------------+                                     +-------------------+         +-----------------------+
 +------+--------+         |                        |                                     |                   |         |                       |
 |               |         | Download all photos in |                                     | Increment counter |         | Move image to correct |
 | See new album +-------->+ album as a list        |                                     |                   +<--------+ location in new list  |
 |               |         |                        |                                     +--------+----------+         |                       |
 +---------------+         +----------+-------------+                                              |                    +-----------+-----------+
                                      |                                                            |                                ^
                                      |                                                            v                                |
                                      v                                               +------------+---------------+    +-----------+------------+
                          +-----------+-------------+      +--------------------+     |                            |    |                        |
                          |                         |      |                    |     | Start a counter, ends when |    | Read topleftmost       |
                          | Send list of downloaded |      | Reorder the photos +-----+ hits (number_of_photos)    +--->+ pixel of current image |
                          | photos to encoder for   +----->+ in a loop          |     |                            |    |                        |
                          | decoding                |      |                    |     +----------------------------+    +------------------------+
                          |                         |      +-------+------------+
                          +-------------------------+              |
                                                                   |
+----------------+                                                 |
|                |       +---------------------+                   |
| Return the raw |       |                     |                   |
| data to the    |       | Return the raw data |                   |
| application    +<------+ to transport        |                   |
|                |       |                     |                   |
+----------------+       +------------+--------+                   |
                                      ^                            v
                                      |                    +-------+-----------+         +----------------------------+
                                      |                    |                   |         |                            |       +-----------------+
                               +------+------------+       | Loop through new, |         | Start a counter, ends when |       |                 |
                               |                   |       | ordered list of   +---------+ hits (number_of_photos)    +<------+ Increment image |
                               | unbase64 the list +<------+ images            |         |                            |       | counter         |
                               |                   |       |                   |         +-------------+--------------+       |                 |
                               +-------------------+       +-------------------+                       |                      +---------+-------+
                                                                                                       |                                ^
                                                                                                       v                                |
                                                                                           +-----------+------------+          +--------+----------+     +-------------------+
                                                                                           |                        |          |                   |     |                   |
                                                                                           | Start a counter,       |          | Loop through # of |     | append            |
                                                                                           | Ends when hits:        +----------+ horizontal pixels +-----+ ord(pix[x][x][2]) |
                                                                                           | (number_of_chunks - 1) |          | Ignoring first.   |     | to byte list      |
                                                                                           |                        |          |                   |     |                   |
                                                                                           +------------------------+          +------------------++     +---------+---------+
                                                                                                                                                  ^                |
                                                                                                                                                  |                v
                                                                                                                                                  |    +-----------+-------------+
                                                                                                                                                  |    |                         |
                                                                                                                                                  +----+ Increment pixel counter |
                                                                                                                                                       |                         |
                                                                                                                                                       +-------------------------+
Und3rf10w commented 6 years ago

Created new branch: imgurC2 to track development of this feature

Und3rf10w commented 6 years ago

Commit 29ab652 adds the LSB encoder in encoder_lsbjpg.py

Und3rf10w commented 6 years ago

Still need to add logic to order the list of images when decoding:

Und3rf10w commented 6 years ago

Also, current header logic only supports up to 255 images

Und3rf10w commented 6 years ago

Commit 20e8eae adds logic to encoder.decode() that orders the images before decoding

Und3rf10w commented 6 years ago

Moving tracking of development for this to #12

Und3rf10w commented 6 years ago

Fixed by #12