Skip to content

Commit 5e303d2

Browse files
its-a-featureits-a-feature
committed
updating for httpx's updates
1 parent 15d6ccf commit 5e303d2

File tree

6 files changed

+114
-51
lines changed

6 files changed

+114
-51
lines changed

‎Payload_Type/poseidon/go.mod

+11-11
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
module MyContainer
22

3-
go 1.22.0
3+
go 1.22.7
44

5-
toolchain go1.22.2
5+
toolchain go1.23.3
66

77
//replace github.com/MythicMeta/MythicContainer => ../../../../MythicMeta/MythicContainer
88

99
require (
10-
github.com/MythicMeta/MythicContainer v1.4.7
10+
github.com/MythicMeta/MythicContainer v1.4.9
1111
github.com/google/uuid v1.6.0
1212
github.com/mitchellh/mapstructure v1.5.0
1313
github.com/pelletier/go-toml v1.9.5
14-
golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c
14+
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f
1515
)
1616

1717
require (
18-
github.com/fsnotify/fsnotify v1.7.0 // indirect
18+
github.com/fsnotify/fsnotify v1.8.0 // indirect
1919
github.com/hashicorp/hcl v1.0.0 // indirect
2020
github.com/magiconair/properties v1.8.7 // indirect
2121
github.com/mattn/go-colorable v0.1.13 // indirect
@@ -32,12 +32,12 @@ require (
3232
github.com/spf13/viper v1.19.0 // indirect
3333
github.com/subosito/gotenv v1.6.0 // indirect
3434
go.uber.org/multierr v1.11.0 // indirect
35-
golang.org/x/net v0.30.0 // indirect
36-
golang.org/x/sys v0.26.0 // indirect
37-
golang.org/x/text v0.19.0 // indirect
38-
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
39-
google.golang.org/grpc v1.67.1 // indirect
40-
google.golang.org/protobuf v1.35.1 // indirect
35+
golang.org/x/net v0.31.0 // indirect
36+
golang.org/x/sys v0.27.0 // indirect
37+
golang.org/x/text v0.20.0 // indirect
38+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697 // indirect
39+
google.golang.org/grpc v1.68.0 // indirect
40+
google.golang.org/protobuf v1.35.2 // indirect
4141
gopkg.in/ini.v1 v1.67.0 // indirect
4242
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
4343
gopkg.in/yaml.v3 v3.0.1 // indirect

‎Payload_Type/poseidon/go.sum

+19-18
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
1-
github.com/MythicMeta/MythicContainer v1.4.7 h1:Aelo4g18UPr6Po0CnGF3wujyoCUpoqkiVllrCPWUAb0=
2-
github.com/MythicMeta/MythicContainer v1.4.7/go.mod h1:BnUYftqQ9KsGxBd6RlyRcAHBrqV1CUcrRCjktWwc2Do=
1+
github.com/MythicMeta/MythicContainer v1.4.9/go.mod h1:BnUYftqQ9KsGxBd6RlyRcAHBrqV1CUcrRCjktWwc2Do=
32
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
43
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
54
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
65
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
76
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
87
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
9-
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
10-
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
8+
github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
9+
github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
1110
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
11+
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
12+
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
1213
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
1314
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
1415
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -65,23 +66,23 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
6566
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
6667
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
6768
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
68-
golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c h1:7dEasQXItcW1xKJ2+gg5VOiBnqWrJc+rq0DPKyvvdbY=
69-
golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c/go.mod h1:NQtJDoLvd6faHhE7m4T/1IY708gDefGGjR/iUW8yQQ8=
70-
golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
71-
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
69+
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
70+
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
71+
golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
72+
golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
7273
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
7374
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
7475
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
75-
golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
76-
golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
77-
golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
78-
golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
79-
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 h1:zciRKQ4kBpFgpfC5QQCVtnnNAcLIqweL7plyZRQHVpI=
80-
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
81-
google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
82-
google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
83-
google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
84-
google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
76+
golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
77+
golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
78+
golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
79+
golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
80+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697 h1:LWZqQOEjDyONlF1H6afSWpAL/znlREo2tHfLoe+8LMA=
81+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
82+
google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
83+
google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
84+
google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
85+
google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
8586
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
8687
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
8788
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

‎Payload_Type/poseidon/poseidon/agent_code/CHANGELOG.MD

+6
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
55
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
66

7+
## 2.1.12 - 2024-11-26
8+
9+
### Changed
10+
11+
- Updated httpx implementation to match latest v0.0.0.15 release of httpx
12+
713
## 2.1.11 - 2024-11-15
814

915
### Changed

‎Payload_Type/poseidon/poseidon/agent_code/pkg/profiles/httpx.go

+29-6
Original file line numberDiff line numberDiff line change
@@ -48,18 +48,19 @@ type AgentVariationConfigMessage struct {
4848
Name string `json:"name" toml:"name"`
4949
}
5050
type AgentVariationConfigClient struct {
51-
Headers map[string]string `json:"headers" toml:"headers"`
52-
Parameters map[string]string `json:"parameters" toml:"parameters"`
53-
Message AgentVariationConfigMessage `json:"message" toml:"message"`
54-
Transforms []AgentVariationConfigMessageTransform `json:"transforms" toml:"transforms"`
51+
Headers map[string]string `json:"headers" toml:"headers"`
52+
Parameters map[string]string `json:"parameters" toml:"parameters"`
53+
DomainSpecificHeaders map[string]map[string]string `json:"domain_specific_headers" toml:"domain_specific_headers"`
54+
Message AgentVariationConfigMessage `json:"message" toml:"message"`
55+
Transforms []AgentVariationConfigMessageTransform `json:"transforms" toml:"transforms"`
5556
}
5657
type AgentVariationConfigServer struct {
5758
Headers map[string]string `json:"headers" toml:"headers"`
5859
Transforms []AgentVariationConfigMessageTransform `json:"transforms" toml:"transforms"`
5960
}
6061
type AgentVariationConfig struct {
6162
Verb string `json:"verb" toml:"verb"`
62-
URI string `json:"uri" toml:"uri"`
63+
URIs []string `json:"uris" toml:"uris"`
6364
Client AgentVariationConfigClient `json:"client" toml:"client"`
6465
Server AgentVariationConfigServer `json:"server" toml:"server"`
6566
}
@@ -434,6 +435,8 @@ func (c *C2HTTPx) increaseErrorCount() {
434435
}
435436
} else if c.DomainRotationMethod == "round-robin" {
436437
c.CurrentDomain = (c.CurrentDomain + 1) % len(c.CallbackDomains)
438+
} else if c.DomainRotationMethod == "random" {
439+
c.CurrentDomain = rand.Intn(len(c.CallbackDomains))
437440
} else {
438441
utils.PrintDebug(fmt.Sprintf("unknown domain rotation method: %s\n", c.DomainRotationMethod))
439442
}
@@ -782,7 +785,9 @@ func (c *C2HTTPx) CreateDynamicMessage(content []byte, isGetTaskingRequest bool)
782785
}
783786
}
784787
bodyBuffer = bytes.NewBuffer(bodyBytes)
785-
url := c.CallbackDomains[c.CurrentDomain] + variation.URI
788+
// select a URI from this variation at random
789+
uriIndex := rand.Intn(len(variation.URIs))
790+
url := c.CallbackDomains[c.CurrentDomain] + variation.URIs[uriIndex]
786791
utils.PrintDebug(fmt.Sprintf("method: %s\nURL: %s\n", variation.Verb, url))
787792
req, err := http.NewRequest(variation.Verb, url, bodyBuffer)
788793
if err != nil {
@@ -816,6 +821,24 @@ func (c *C2HTTPx) CreateDynamicMessage(content []byte, isGetTaskingRequest bool)
816821
req.Header.Set(key, variation.Client.Headers[key])
817822
}
818823
}
824+
for domain, _ := range variation.Client.DomainSpecificHeaders {
825+
if domain == c.CallbackDomains[c.CurrentDomain] {
826+
for key, _ := range variation.Client.DomainSpecificHeaders[domain] {
827+
if key == "Host" {
828+
req.Host = variation.Client.DomainSpecificHeaders[domain][key]
829+
} else if key == "User-Agent" {
830+
req.Header.Set(key, variation.Client.DomainSpecificHeaders[domain][key])
831+
tr.ProxyConnectHeader = http.Header{}
832+
tr.ProxyConnectHeader.Add("User-Agent", variation.Client.DomainSpecificHeaders[domain][key])
833+
} else if key == "Content-Length" {
834+
continue
835+
} else {
836+
req.Header.Set(key, variation.Client.DomainSpecificHeaders[domain][key])
837+
}
838+
}
839+
}
840+
841+
}
819842
// adding query parameters is a little weird in go
820843

821844
for key, _ := range variation.Client.Parameters {

‎Payload_Type/poseidon/poseidon/agent_code/test_agent_config_httpx.json

+49-15
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"callback_interval": 2,
44
"killdate": "2024-12-31",
55
"encrypted_exchange_check": true,
6-
"AESPSK": "1EhTUM7jVrdKBOhTLMx+fXT8a77Ge2XOUVNuMuhLSe4=",
6+
"AESPSK": "ye6wt4oUi50HDnoNskj1e5HxIpWQWyJ1BeaSohZtbrk=",
77
"failover_threshold": 2,
88
"callback_domains": [
99
"http://127.0.0.1:82"
@@ -13,58 +13,92 @@
1313
"name": "TEST",
1414
"get": {
1515
"verb": "GET",
16-
"uri": "/my/uri/path",
16+
"uris": [
17+
"/my/uri/path"
18+
],
1719
"client": {
1820
"headers": {
1921
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
2022
},
2123
"parameters": {
2224
"MyKey": "value"
2325
},
26+
"domain_specific_headers": {
27+
"https://example.com:443": {
28+
"User-Agent": "Test"
29+
}
30+
},
2431
"message": {
2532
"location": "cookie",
2633
"name": "sessionID"
2734
},
2835
"transforms": [
2936
{
30-
"action": "base64url"
37+
"action": "base64url",
38+
"value": ""
3139
}
3240
]
3341
},
3442
"server": {
3543
"headers": {
36-
"Server": "Server",
37-
"Cache-Control": "max-age=0, no-cache"
44+
"Cache-Control": "max-age=0, no-cache",
45+
"Server": "Server"
3846
},
3947
"transforms": [
40-
{"action": "xor", "value": "keyHere"},
41-
{"action": "base64url", "value": ""},
42-
{"action": "prepend", "value": "{\"response\":\""},
43-
{"action": "append", "value": "\"}"}
48+
{
49+
"action": "xor",
50+
"value": "keyHere"
51+
},
52+
{
53+
"action": "base64url",
54+
"value": ""
55+
},
56+
{
57+
"action": "prepend",
58+
"value": "{\"response\":\""
59+
},
60+
{
61+
"action": "append",
62+
"value": "\"}"
63+
},
64+
{
65+
"action": "netbios",
66+
"value": ""
67+
}
4468
]
4569
}
4670
},
4771
"post": {
4872
"verb": "POST",
49-
"uri": "/my/other/path",
73+
"uris": [
74+
"/my/other/path"
75+
],
5076
"client": {
5177
"headers": {
5278
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
5379
},
80+
"parameters": null,
81+
"domain_specific_headers": null,
5482
"message": {
55-
83+
"location": "",
84+
"name": ""
5685
},
5786
"transforms": [
58-
{"action": "xor", "value": "keyHere"},
59-
{"action": "netbios", "value": ""}
87+
{
88+
"action": "xor",
89+
"value": "keyHere"
90+
},
91+
{
92+
"action": "base64url",
93+
"value": ""
94+
}
6095
]
6196
},
6297
"server": {
6398
"headers": {
6499
"Keep-Alive": "true"
65100
},
66-
"transforms": [
67-
]
101+
"transforms": null
68102
}
69103
}
70104
}

‎Payload_Type/poseidon/poseidon/agentfunctions/head.go

-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package agentfunctions
22

33
import (
44
"fmt"
5-
65
agentstructs "github.com/MythicMeta/MythicContainer/agent_structs"
76
)
87

0 commit comments

Comments
 (0)