package c2

Get desktop application:
View/edit binary Protocol Buffers messages

• rpc ClaimTasks (ClaimTasksRequest, ClaimTasksResponse)

  c2.proto:139

  Contact the server for new tasks to execute.

  message ClaimTasksRequest

  c2.proto:76

  RPC Messages

  • optional Beacon beacon = 1

  message ClaimTasksResponse

  c2.proto:79

  • repeated Task tasks = 1

• rpc FetchAsset (FetchAssetRequest, stream FetchAssetResponse)

  c2.proto:150

  Fetch an asset from the server, returning one or more chunks of data. The maximum size of these chunks is determined by the server. The server should reply with two headers: - "sha3-256-checksum": A SHA3-256 digest of the entire file contents. - "file-size": The number of bytes contained by the file. If no associated file can be found, a NotFound status error is returned.

  message FetchAssetRequest

  c2.proto:83

  • string name = 1

  message FetchAssetResponse

  c2.proto:86

  • bytes chunk = 1

• rpc ReportCredential (ReportCredentialRequest, ReportCredentialResponse)

  c2.proto:155

  Report a credential from the host to the server.

  message ReportCredentialRequest

  c2.proto:90

  • int64 task_id = 1

  • optional eldritch.Credential credential = 2

  message ReportCredentialResponse

  c2.proto:94

  (message has no fields)

• rpc ReportFile (stream ReportFileRequest, ReportFileResponse)

  c2.proto:165

  Report a file from the host to the server. Providing content of the file is optional. If content is provided: - Hash will automatically be calculated and the provided hash will be ignored. - Size will automatically be calculated and the provided size will be ignored. Content is provided as chunks, the size of which are up to the agent to define (based on memory constraints). Any existing files at the provided path for the host are replaced.

  message ReportFileRequest

  c2.proto:96

  • int64 task_id = 1

  • optional eldritch.File chunk = 2

  message ReportFileResponse

  c2.proto:101

  (message has no fields)

• rpc ReportProcessList (ReportProcessListRequest, ReportProcessListResponse)

  c2.proto:171

  Report the active list of running processes. This list will replace any previously reported lists for the same host.

  message ReportProcessListRequest

  c2.proto:103

  • int64 task_id = 1

  • optional eldritch.ProcessList list = 2

  message ReportProcessListResponse

  c2.proto:107

  (message has no fields)

• rpc ReportTaskOutput (ReportTaskOutputRequest, ReportTaskOutputResponse)

  c2.proto:176

  Report execution output for a task.

  message ReportTaskOutputRequest

  c2.proto:109

  • optional TaskOutput output = 1

  message ReportTaskOutputResponse

  c2.proto:113

  (message has no fields)

• rpc ReverseShell (stream ReverseShellRequest, stream ReverseShellResponse)

  c2.proto:181

  Open a reverse shell bi-directional stream.

  message ReverseShellRequest

  c2.proto:121

  • ReverseShellMessageKind kind = 1

  • bytes data = 2

  • int64 task_id = 3

  message ReverseShellResponse

  c2.proto:126

  • ReverseShellMessageKind kind = 1

  • bytes data = 2

Agent information to identify the type of beacon.

Used in: Beacon

• string identifier = 1

Beacon information that is unique to the current running beacon.

Used in: ClaimTasksRequest

• string identifier = 1

• string principal = 2

• optional Host host = 3

• optional Agent agent = 4

• uint64 interval = 5

  Duration until next callback, in seconds.

Host information for the system a beacon is running on.

Used in: Beacon

• string identifier = 1

• string name = 2

• Host.Platform platform = 3

• string primary_ip = 4

Used in: Host

• PLATFORM_UNSPECIFIED = 0

• PLATFORM_WINDOWS = 1

• PLATFORM_LINUX = 2

• PLATFORM_MACOS = 3

• PLATFORM_BSD = 4

Used in: ReverseShellRequest, ReverseShellResponse

• REVERSE_SHELL_MESSAGE_KIND_UNSPECIFIED = 0

• REVERSE_SHELL_MESSAGE_KIND_DATA = 1

• REVERSE_SHELL_MESSAGE_KIND_PING = 2

Task instructions for the beacon to execute.

Used in: ClaimTasksResponse

• int64 id = 1

• optional eldritch.Tome tome = 2

• string quest_name = 3

TaskError provides information when task execution fails.

Used in: TaskOutput

• string msg = 1

TaskOutput provides information about a running task.

Used in: ReportTaskOutputRequest

• int64 id = 1

• string output = 2

• optional TaskError error = 3

• optional google.protobuf.Timestamp exec_started_at = 4

  Indicates the UTC timestamp task execution began, set only in the first message for reporting.

• optional google.protobuf.Timestamp exec_finished_at = 5

  Indicates the UTC timestamp task execution completed, set only in last message for reporting.