package ghost.core

Get desktop application:
View/edit binary Protocol Buffers messages

cd

• uint32 GhostID = 1

• string Path = 2

• string Path = 1

• string Encoder = 2

• bool Exists = 3

• bytes Content = 9

download

• uint32 GhostID = 1

• string Path = 2

• bool Success = 1

• string Err = 2

elevate

• uint32 GhostID = 1

• int32 Timeout = 2

Environment - Provides the set of Environment variables on a remote host

Used in: Info, server.Session

• uint32 HostID = 1

  Maybe a bit of OS info can be useful

• string OSName = 2

• string OSSp = 3

• map<string, string> Vars = 4

  Actual variables

• string Error = 1

• string Result = 2

• string Output = 1

• string Error = 2

execute-assembly

• uint32 GhostID = 1

• bytes HostingDLL = 2

• bytes Assembly = 3

• repeated string Arguments = 4

• string Process = 5

• int32 Timeout = 6

execute

• uint32 GhostID = 1

• string Path = 2

• repeated string Args = 3

• bool output = 4

Used in: Ls

• string Name = 1

• bool IsDir = 2

• int64 Size = 3

• int32 FileMode = 4

  User and permission bits

• string ModTime = 5

  Last modification timestamp

• string Output = 1

getsystem

• uint32 GhostID = 1

• string HostingProcess = 2

• bytes Shellcode = 3

• repeated NetInterface NetInterfaces = 1

• uint32 GhostID = 1

• string Err = 1

impersonate

• uint32 GhostID = 1

• string Username = 2

Info - Send back multiple informations to the server at once.

Used in: Register

• string Name = 1

• string Username = 3

• string UID = 4

• string GID = 5

• string OS = 6

• string Arch = 7

• int32 PID = 8

• string Filename = 9

• string Version = 10

• uint32 WorkspaceID = 12

• repeated transport.Transport Transports = 14

  Available C2 transports

• repeated NetInterface Interfaces = 15

  Network

• repeated SocketTabEntry Netstat = 18

  Maybe we can use this to automatically devise some better ports to use for routing/etc

• repeated transport.route.Route Routes = 19

  We might send current route listeners, in case.

• optional Environment Environment = 20

  Environment variables

Kill - Sends back status on implant kill

• bool Success = 1

• string Warning = 2

  If force kill, will kill anyway but send a warning instead of an error

• string Err = 3

  Sends an error if kill was not force and there things still running

KillRequest - Kills the ghost executable and connection

• uint32 GhostID = 1

• bool Force = 2

• string Path = 1

• bool Exists = 2

• repeated FileInfo Files = 3

ls

• uint32 GhostID = 1

• string Path = 2

• bool Success = 1

• string Err = 2

migrate

• uint32 GhostID = 1

• int32 PID = 2

• bytes Shellcode = 3

• bool Success = 1

• string Path = 2

• string Err = 3

mkdir

• uint32 GhostID = 1

• string Path = 2

NetInterface - A network interface on the implant's target

Used in: IfConfig, Info

• int32 Index = 1

• string Name = 2

• string MAC = 3

• repeated db.Address IPAddresses = 4

  When server receives them, it parses them into net.IPAddr objects before using them.

• repeated SocketTabEntry Entries = 1

• uint32 GhostID = 9

• bool TCP = 1

• bool UDP = 2

• bool IP4 = 3

• bool IP6 = 4

• bool Listening = 5

  Maybe we can grab the REUSEPORT/REUSEADDR option value

Ping - Test ghost connection

• int32 Nonce = 1

Process is a process running on the target

Used in: Ps, SocketTabEntry

• int32 PID = 1

• int32 PPID = 2

• string Executable = 3

• string Owner = 4

• bytes Memory = 1

• string Err = 2

procdump

• uint32 GhostID = 1

• int32 PID = 2

• int32 Timeout = 3

• repeated Process Processes = 1

ps

• uint32 GhostID = 1

• string Path = 1

• string Err = 2

pwd

• uint32 GhostID = 1

Register - Implant calls back to C2 Server and sends its information.

• optional Info Information = 1

• string Encoder = 1

• bool RWXPages = 2

• uint32 PID = 3

• bytes Shellcode = 4

• string Err = 1

rev-to-self

• uint32 GhostID = 1

• bool Success = 1

• string Path = 2

• string Err = 3

rm

• uint32 GhostID = 1

• string Path = 2

• string Output = 1

• string Err = 2

run-as

• uint32 GhostID = 1

• string Username = 2

• string Process = 3

• repeated string Args = 4

• bytes Screenshot = 1

Screenshot

• uint32 GhostID = 1

• bytes ScreenshotDetails = 2

• bool Success = 1

• string Err = 2

• uint64 TunnelID = 9

• uint32 GhostID = 1

• string Path = 2

• bool EnablePTY = 3

• uint64 TunnelID = 9

• string Output = 1

• string Error = 2

sideload-dll

• uint32 GhostID = 1

• bytes DLL = 2

• string Process = 3

Used in: SocketTabEntry

• string IP = 1

• uint32 Port = 2

netstat

Used in: Info, Netstat

• optional SocketAddr LocalAddr = 1

• optional SocketAddr RemoteAddr = 2

• string State = 3

• uint32 UID = 4

• optional Process Process = 5

  The process owning the socket

• string Protocol = 6

• string Output = 1

• string Error = 2

spawn-dll

• uint32 GhostID = 1

• bytes DLL = 2

• string Process = 3

• string Offset = 4

• repeated string Args = 5

shellcode task

• string Encoder = 1

• bool RWXPages = 2

• uint32 PID = 3

• bytes Shellcode = 4

• string Err = 1

terminate

• uint32 GhostID = 1

• int32 PID = 2

• bool Success = 1

• string Path = 2

• string Err = 3

upload

• uint32 GhostID = 1

• string Path = 2

• string Encoder = 3

• bytes Content = 4