package transport

Get desktop application:
View/edit binary Protocol Buffers messages

• bool Success = 1

• string Err = 2

Essentially, a transport request is either starting a reverse or a bind handler with different proto/address

• uint32 GhostID = 1

• optional Transport Transport = 2

  HTTP Http = 3; // Either of these fields can be empty, except one. DNS Dns = 4; // They are used to share protocol-specific details QUIC Quic = 5; KCP Kcp = 6; MTLS Mtls = 7; NamedPipe Pipe = 8;

• bool Success = 1

• string Warning = 2

  If force true, send a warning message (other routes passing through)

• string Err = 3

  If force false, send the warning as an error, and Success false

ChangeTransportRequest - Request an implant to connect with new transport settings At the server, we should check the transport type, and if reverse, check a listener is running, otherwise return error and do not ask implant to change its transport.

• uint32 GhostID = 1

• uint32 TransportID = 2

• bool Force = 5

Used in: DNSPoll

• string ID = 1

• uint32 Size = 2

• repeated DNSBlockHeader Blocks = 1

DNSSessionInit - Sends the key bytes for authentication.

• bytes Key = 1

• bool Success = 1

• string Err = 2

DeleteTransportRequest - Delete one or more transports from the implant transport list

• uint32 GhostID = 1

• int32 TransportID = 5

  If TransportID != 0 delete based on ID

• string Protocol = 2

  Else, kill all matches

• string LHost = 3

• string LPort = 4

All messages are sent in an Envelope, giving Type of Request, Ghost ID, etc...

• uint32 Type = 1

  Type of Request

• uint64 ID = 2

  Unique ID of the envelope

• int64 Timeout = 3

  Command timeout

• string Err = 4

  Error Status

• bytes Content = 9

  Core of the message

• bool Success = 1

• string Err = 2

  Add needed fields here, like registration

HTTPBindRequest - Connect to a ghost implant running remotely

• string Domain = 1

• string RHost = 2

• int32 RPort = 3

• bool Secure = 4

  Enable HTTPS

• bytes Cert = 6

• bytes Key = 7

  Maybe not needed

• bool Success = 1

• int32 JobID = 2

  Job BackgroundJob = 3; // Pass an entire job object.

HTTPListenerRequest - Start a HTTP listener for incoming ghost connections

• string Domain = 1

• string LHost = 2

• int32 LPort = 3

• bool Secure = 4

  Enable HTTPS

• string Website = 5

• bytes Cert = 6

• bytes Key = 7

• bool ACME = 8

HTTPSessionInit - Sends the key bytes for authentication.

• bytes Key = 1

• repeated Transport Transports = 1

ListTransportsRequest - List available transports for a ghost implant

• uint32 GhostID = 1

Listener - A reverse handler, for any protocol and source

Used in: StartReverseHandlerRequest

• Protocol Protocol = 1

• string LHost = 2

• uint32 LPort = 3

• string RHost = 4

• uint32 RPort = 5

• uint32 GhostID = 6

  In case two same addresses for two ghosts

• uint32 OwnerID = 7

• Permissions Permissions = 8

  server.User Owner = 7;

• optional google.protobuf.Timestamp CreatedAt = 38

  Timestamp

• optional google.protobuf.Timestamp UpdatedAt = 39

• bool Success = 1

• string Err = 2

NamedPipeRequest - Start a name pipe listener

• uint32 GhostID = 1

• string PipeName = 2

Permissions - Who has the right to kill a listener

Used in: Listener

• OWNER = 0

• ADMIN = 1

• ALL = 2

Protocol - Protocol used for comms

Identify Protocol

Used in: Listener, StartBindHandlerRequest, Transport

• MTLS = 0

• DNS = 1

• HTTP = 2

• QUIC = 3

• KCP = 4

• PIPE = 5

Used in: Transport

• SINGLE = 0

  The connection does not serve any addition payload.

• STAGER = 1

  The connection will serve some payload.

• bool Success = 1

• string Err = 2

Bind to a reverse listener runned by an implant

• Protocol Protocol = 1

• string RHost = 2

• uint32 RPort = 3

• uint32 GhostID = 4

  In case two same addresses for two ghosts

• bool Success = 1

• int32 JobID = 2

  Job BackgroundJob = 3; // Pass an entire job object.

StartDNSListenerRequest - Start a DNS listener for implant C2

• repeated string Domains = 1

• bool Canaries = 2

(message has no fields)

(message has no fields)

• bool Success = 1

• string Err = 2

Start a listener either on the server, or on an implant

• optional Listener Listener = 1

• bool Persist = 2

(message has no fields)

(message has no fields)

• bool Success = 1

• string Err = 2

Stop a reverse handler listener on the server or implant

• uint32 ID = 1

Transport - A transport is just a structure used by implants to receive/send/use transport configurations.

Used in: ghost.Ghost, ghost.core.Info, server.GhostBuild, AddTransportRequest, ListTransports

• int64 ID = 1

• string LHost = 2

• int32 LPort = 3

• string RHost = 4

• int32 RPort = 5

• Protocol Protocol = 6

• int32 WFSDelay = 7

  Wait for session delay

• Type Type = 8

• StagingType StagingType = 9

• bool Default = 10

Type - // Do we start a listener on the implant, or do we reach back another address ?

Used in: Transport

• REVERSE = 0

  DIALER

• BIND = 1

  LISTENER