diff --git a/Payload_Type/poseidon/poseidon/agent_code/nslookup/nslookup.go b/Payload_Type/poseidon/poseidon/agent_code/nslookup/nslookup.go new file mode 100644 index 00000000..80534815 --- /dev/null +++ b/Payload_Type/poseidon/poseidon/agent_code/nslookup/nslookup.go @@ -0,0 +1,54 @@ +package nslookup + +import ( + "encoding/json" + "errors" + "net" + "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/utils/structs" +) + +type Arguments struct { + Type string `json:"type"` + Address string `json:"address"` +} + +func Run(task structs.Task) { + msg := task.NewResponse() + var args Arguments + + err := json.Unmarshal([]byte(task.Params), &args) + if err != nil { + msg.SetError(err.Error()) + task.Job.SendResponses <- msg + return + } + address := args.Address + reqType := args.Type + + var result any + + if reqType == "A" { + result, err = net.LookupHost(address) + } else if reqType == "PTR" { + result, err = net.LookupAddr(address) + } else if reqType == "TXT" { + result, err = net.LookupTXT(address) + } else if reqType == "MX" { + result, err = net.LookupMX(address) + } else if reqType == "CNAME" { + result, err = net.LookupCNAME(address) + } else if reqType == "NS" { + result, err = net.LookupNS(address) + } else { + err = errors.New("invalid request type") + } + + if err != nil { + msg.SetError(err.Error()) + } else { + data, _ := json.Marshal(result) + msg.UserOutput = string(data) + msg.Completed = true + } + task.Job.SendResponses <- msg +} diff --git a/Payload_Type/poseidon/poseidon/agent_code/pkg/tasks/newTasking.go b/Payload_Type/poseidon/poseidon/agent_code/pkg/tasks/newTasking.go index 44dd271f..b2b1d397 100644 --- a/Payload_Type/poseidon/poseidon/agent_code/pkg/tasks/newTasking.go +++ b/Payload_Type/poseidon/poseidon/agent_code/pkg/tasks/newTasking.go @@ -32,6 +32,7 @@ import ( "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/lsopen" "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/mkdir" "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/mv" + "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/nslookup" "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/persist_launchd" "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/persist_loginitem" "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/utils/runtimeMainThread" @@ -201,6 +202,8 @@ func listenForNewTask() { go ifconfig.Run(task) case "caffeinate": go caffeinate.Run(task) + case "nslookup": + go nslookup.Run(task) case "lsopen": go lsopen.Run(task) case "chmod": diff --git a/Payload_Type/poseidon/poseidon/agentfunctions/nslookup.go b/Payload_Type/poseidon/poseidon/agentfunctions/nslookup.go new file mode 100644 index 00000000..e1d3c443 --- /dev/null +++ b/Payload_Type/poseidon/poseidon/agentfunctions/nslookup.go @@ -0,0 +1,67 @@ +package agentfunctions + +import ( + "errors" + + agentstructs "github.com/MythicMeta/MythicContainer/agent_structs" +) + +func init() { + agentstructs.AllPayloadData.Get("poseidon").AddCommand(agentstructs.Command{ + Name: "nslookup", + Description: "resolve using the local resolver", + HelpString: "nslookup A domain.local", + Version: 1, + Author: "", + MitreAttackMappings: []string{}, + SupportedUIFeatures: []string{}, + CommandAttributes: agentstructs.CommandAttribute{ + SupportedOS: []string{}, + }, + CommandParameters: []agentstructs.CommandParameter{ + { + Name: "address", + ModalDisplayName: "Hostname or address to resolve", + ParameterType: agentstructs.COMMAND_PARAMETER_TYPE_STRING, + ParameterGroupInformation: []agentstructs.ParameterGroupInfo{ + { + ParameterIsRequired: true, + UIModalPosition: 1, + }, + }, + Description: "Hostname or address to resolve", + }, + { + Name: "type", + DefaultValue: "A", + ModalDisplayName: "Type of request", + ParameterType: agentstructs.COMMAND_PARAMETER_TYPE_CHOOSE_ONE, + Choices: []string{"A", "PTR", "MX", "TXT", "CNAME", "NS"}, + ParameterGroupInformation: []agentstructs.ParameterGroupInfo{ + { + ParameterIsRequired: false, + UIModalPosition: 2, + }, + }, + Description: "Type of request", + }, + }, + TaskFunctionCreateTasking: func(taskData *agentstructs.PTTaskMessageAllData) agentstructs.PTTaskCreateTaskingMessageResponse { + response := agentstructs.PTTaskCreateTaskingMessageResponse{ + Success: true, + TaskID: taskData.Task.ID, + } + return response + }, + TaskFunctionParseArgDictionary: func(args *agentstructs.PTTaskMessageArgsData, input map[string]interface{}) error { + return args.LoadArgsFromDictionary(input) + }, + TaskFunctionParseArgString: func(args *agentstructs.PTTaskMessageArgsData, input string) error { + if len(input) > 0 { + return args.LoadArgsFromJSONString(input) + } else { + return errors.New("Must supply arguments") + } + }, + }) +}