an00brektn/gopher47

A third-party Gopher Assassin for the Havoc Framework.

hello!

🖊️ | 🐘 | 🐦 | 📧

whoami

• graduated in computer science and math, still trying to figure stuff out though
• wannabe red teamer, actual wizard toad
• ctf addict _{no seriously someone help}

Projects

• 💻 I photoshopped the Golang gopher into something much funnier
• 🚩 I made a local CTF event - it went well
• 👾 I analyze malware, and when I feel especially bored, I write full reports
• 📜 I write sometimes - mostly for myself but there's stuff there

Last Found: grind for certs. secret project. doing the thing.

gopher47's Issues

Websocket error

any suggestion?

Nicify the Windows `ls` output

Windows stores permissions data via ACLs, so it's not exactly easy to get permission information through regular file checks. The current output of the agent when listing on files on Windows kinda sucks.

[14/01/2023 22:00:13] Agent 76796869 authenticated from as transistor\kali :: [Internal: 10.10.69.24] [Process: Gopher47\42151] [Arch: x64] [Pivot: Direct]
[+] Gopher47 agent 76796869 registered

14/01/2023 22:00:29 [an00b] Gopher47 » ls C:\Users\sreisz\test
[+] Received Output:
1.txt
2.txt
folder

Having output that is similar to what modern C2's display that has a little bit more information would be pog, but maybe we don't want that idk

Do you have an archive available havoc 0.7

#5 (comment)

Do you have an archive available?(https://github.com/HavocFramework/Havoc/blob/main/client/src/global.cc) Although it is consistent with the 0.7 version you mentioned. But it failed.

Get Process Elevated, Architecture, and Domain data for registration

Part of the registration spec on Havoc is to provide the following information:

                # Register info:
                #   - AgentID           : int [needed]
                #   - Hostname          : str [needed]
                #   - Username          : str [needed]
                #   - Domain            : str [optional]
                #   - InternalIP        : str [needed]
                #   - Process Path      : str [needed]
                #   - Process Name      : str [needed]
                #   - Process ID        : int [needed]
                #   - Process Parent ID : int [optional]
                #   - Process Arch      : str [needed]
                #   - Process Elevated  : int [needed]
                #   - OS Build          : str [needed]
                #   - OS Version        : str [needed]
                #   - OS Arch           : str [optional]
                #   - Sleep             : int [optional]

While developing, I forgot to implement checks for the following:

• Process Elevated
• Process Arch
• Domain

We might need to create some additional enumeration functions for the domain check, and I have yet to look into the process elevated/arch stuff.

Known Issue: SIGSEGV when using os.Process.Kill() on Linux

Although the kill function works, it's a bit buggy when tested on Linux, and can cause the whole program to SIGSEGV.

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x668cb5]

goroutine 1 [running]:
main.RunCommand({0xc00001ba73?, 0xc000014020?})
        /home/kali/go/src/github.com/An00bRektn/gopher47/gopher47.go:159 +0xd5
main.main()
        /home/kali/go/src/github.com/An00bRektn/gopher47/gopher47.go:186 +0x265

I'm not sure why this is, even after spamming recover(). Below are a couple of links that are somewhat related to this, but I cannot spend this long trying to fix this right now.

• StackOverflow Post
• Maybe a Related Issue?