Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/_docs/dev-guide/eldritch.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ For all non supported OSes return an error with a message explaining which OSes
---
The `Dict` type requires dynamic memory allocation in starlark. In order to achieve this we can leverage the `starlark::Heap` and push entries onto it. It's pretty simple to implement and starlark does some magic to streamline the process. To make the heap available to your function simply add it as an argument to your function.

## Different function decelerations
## Different function declarations
`implants/lib/eldritch/src/module.rs`

```rust
Expand Down
6 changes: 3 additions & 3 deletions docs/_docs/dev-guide/introduction.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@ All code changes to Tavern must be tested. Below are some standards for test wri
* Conventionally, please colocate your test code with the code it is testing and include it in the `<packagename>_test` package
* We rely on the standard [testify](https://github.com/stretchr/testify) assert & require libraries for ensuring expected values (or errors) are returned
* To enable a variety of inputs for a test case, we rely on closure-driven testing for Golang, you can read more about it [here](https://medium.com/@cep21/closure-driven-tests-an-alternative-style-to-table-driven-tests-in-go-628a41497e5e)
* Reuseable test code should go in a sub-package suffixed with test
* For example, reuseable test code for the `ent` package would be located in the `ent/enttest` package
* Reusable test code should go in a sub-package suffixed with test
* For example, reusable test code for the `ent` package would be located in the `ent/enttest` package
* This convention is even used in the Golang standard library (e.g. [net/http](https://pkg.go.dev/net/http/httptest))
* Please use existing tests as a reference for writing new tests

Expand Down Expand Up @@ -71,7 +71,7 @@ A Task represents a set of instructions for an Agent to perform. For example, li
Eldritch is our Pythonic Domain Specific Language (DSL), which can be used to progammatically define red team operations. Many of the language's built-in features do not rely on system binaries. For more information, please see the [Eldritch section](/user-guide/eldritch) of the documentation.

### Tome
A Tome is a prebuilt Eldritch bundle, which provides execution instructions to a Beacon. Tomes can embed files and accept parameters to change their behaviour at runtime. Tavern's built-in Tomes are defined [here](https://github.com/spellshift/realm/tree/main/tavern/tomes).
A Tome is a prebuilt Eldritch bundle, which provides execution instructions to a Beacon. Tomes can embed files and accept parameters to change their behavior at runtime. Tavern's built-in Tomes are defined [here](https://github.com/spellshift/realm/tree/main/tavern/tomes).

# Project Structure
* **[.devcontainer](https://github.com/spellshift/realm/tree/main/.devcontainer)** contains settings required for configuring a VSCode dev container that can be used for Realm development
Expand Down
28 changes: 14 additions & 14 deletions docs/_docs/user-guide/eldritch.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ Eldritch currently only supports the [default starlark data types.](https://gith

Eldritch doesn't implement any form of error handling. If a function fails it will stop the tome from completing execution. There is no way to recover after a function has errored.

If you're using a functions that has a chance to error (functions that do file / network IO) test preemptively with function like `is_file`, `is_dir`, `is_windows`, etc.
If you're using a function that has a chance to error (functions that do file / network IO) test preemptively with function like `is_file`, `is_dir`, `is_windows`, etc.

For example:

Expand Down Expand Up @@ -124,7 +124,7 @@ for user_home_dir in file.list("/home/"):
`assets.copy(src: str, dst: str) -> None`

The <b>assets.copy</b> method copies an embedded file from the agent to disk.
The `srt` variable will be the path from the `embed_files_golem_prod` as the root dir.
The `src` variable will be the path from the `embed_files_golem_prod` as the root dir.
For example `embed_files_golem_prod/sliver/agent-x64` can be referenced as `sliver/agent-x64`.
If `dst` exists it will be overwritten. If it doesn't exist the function will fail.

Expand Down Expand Up @@ -239,7 +239,7 @@ crypto.to_json({"foo": "bar"})

`file.append(path: str, content: str) -> None`

The <b>file.append</b> method appends the `content` to file at `path`. If no file exists at path create the file with the contents content.
The <b>file.append</b> method appends the `content` to file at `path`. If no file exists at path create the file with the content.

### file.compress

Expand Down Expand Up @@ -321,13 +321,13 @@ Here is an example of the Dict layout:

`file.mkdir(path: str) -> None`

The <b>file.mkdir</b> method is make a new dirctory at `path`. If the parent directory does not exist or the directory cannot be otherwise be created, it will creat an error.
The <b>file.mkdir</b> method will make a new directory at `path`. If the parent directory does not exist or the directory cannot be created, it will error.

### file.moveto

`file.moveto(src: str, dst: str) -> None`

The <b>file.moveto</b> method moves a file or directory from src to `dst`. If the `dst` directory or file exists it will be deleted before being replaced to ensure consistency across systems.
The <b>file.moveto</b> method moves a file or directory from `src` to `dst`. If the `dst` directory or file exists it will be deleted before being replaced to ensure consistency across systems.

### file.read

Expand Down Expand Up @@ -378,7 +378,7 @@ If a file or directory already exists at this path, the method will fail.

`file.find(path: str, name: Option<str>, file_type: Option<str>, permissions: Option<int>, modified_time: Option<int>, create_time: Option<int>) -> Vec<str>`

The <b>file.find</b> method finds all files matching the used paramters. Returns file path for all matching items.
The <b>file.find</b> method finds all files matching the used parameters. Returns file path for all matching items.

- name: Checks if file name contains provided input
- file_type: Checks for 'file' or 'dir' for files or directories, respectively.
Expand All @@ -394,7 +394,7 @@ The <b>file.find</b> method finds all files matching the used paramters. Returns

`pivot.arp_scan(target_cidrs: List<str>) -> List<str>`

The <b>pivot.arp_scan</b> method is being proposed to allow users to enumerate hosts on their network without using TCP connect or ping.
The <b>pivot.arp_scan</b> method is for enumerating hosts on the agent network without using TCP connect or ping.

- `target_cidrs` must be in a CIDR format eg. `127.0.0.1/32`. Domains and single IPs `example.com` / `127.0.0.1` cannot be passed.
- Must be running as `root` to use.
Expand Down Expand Up @@ -473,7 +473,7 @@ A ports status can be open, closed, or timeout:
| timeout | udp | Connection was refused, dropped, or didn't respond. |

Each IP in the specified CIDR will be returned regardless of if it returns any open ports.
Be mindful of this when scanning large CIDRs as it may create largo return objects.
Be mindful of this when scanning large CIDRs as it may create large return objects.

NOTE: Windows scans against `localhost`/`127.0.0.1` can behave unexpectedly or even treat the action as malicious. Eg. scanning ports 1-65535 against windows localhost may cause the stack to overflow or process to hang indefinitely.

Expand All @@ -489,9 +489,9 @@ The <b>pivot.smb_exec</b> method is being proposed to allow users a way to move

The <b>pivot.ssh_copy</b> method copies a local file to a remote system. If no password or key is specified the function will error out with:
`Failed to run handle_ssh_exec: Failed to authenticate to host`
If the connection is successful but the copy writes a file error will be returend.
If the connection is successful but the copy writes a file error will be returned.

ssh_copy will first delete the remote file and then write to it's location.
ssh_copy will first delete the remote file and then write to its location.
The file directory the `dst` file exists in must exist in order for ssh_copy to work.

### pivot.ssh_exec
Expand Down Expand Up @@ -635,10 +635,10 @@ The <b>sys.dll_inject</b> method will attempt to inject a dll on disk into a rem

`sys.dll_reflect(dll_bytes: List<int>, pid: int, function_name: str) -> None`

The <b>sys.dll_reflcet</b> method will attempt to inject a dll from memory into a remote process by using the loader defined in `realm/bin/reflective_loader`.
The <b>sys.dll_reflect</b> method will attempt to inject a dll from memory into a remote process by using the loader defined in `realm/bin/reflective_loader`.

The ints in dll_bytes will be cast down from int u32 ---> u8 in rust.
If your dll_bytes array contains a value greater than u8::MAX it will cause the function to fail. If you're doing any decryption in starlark be sure careful of the u8::MAX bound for each byte.
If your dll_bytes array contains a value greater than u8::MAX it will cause the function to fail. If you're doing any decryption in starlark make sure to be careful of the u8::MAX bound for each byte.

### sys.exec

Expand Down Expand Up @@ -935,7 +935,7 @@ True

The <b>time.format_to_epoch</b> method returns the seconds since epoch for the given UTC timestamp of the provided format. Input must include date and time components.

Some common formating methods are:
Some common formatting methods are:

- "%Y-%m-%d %H:%M:%S" (24 Hour Time)
- "%Y-%m-%d %I:%M:%S %P" (AM/PM)
Expand All @@ -948,7 +948,7 @@ For reference on all available format specifiers, see <https://docs.rs/chrono/la

The <b>time.format_to_readable</b> method returns the timestamp in the provided format of the provided UTC timestamp.

Some common formating methods are:
Some common formatting methods are:

- "%Y-%m-%d %H:%M:%S" (24 Hour Time)
- "%Y-%m-%d %I:%M:%S %P" (AM/PM)
Expand Down
8 changes: 4 additions & 4 deletions docs/_docs/user-guide/imix.md
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,10 @@ The imix config is as follows:
## Installation

The install subcommand executes embedded tomes similar to golem.
It will loop through all embedded files looking for main.eldritch
It will loop through all embedded files looking for main.eldritch.
Each main.eldritch will execute in a new thread. This is done to allow imix to install redundantly or install additional (non dependent) tools.

The install subcommand makes allows some variables to be passed form the user into the tomes through the -c flag.
The install subcommand allows some variables to be passed from the user into the tomes through the -c flag.
When specified input_params['custom_config'] is set to the file path of the config specified Eg.
./imix install -c /tmp/imix-config.json will result in input_params['custom_config'] = "/tmp/imix-config.json

Expand All @@ -85,7 +85,7 @@ def main():
main()
```

Installation scripts are specified in the `realm/implants/imix/install_scripts` directeroy.
Installation scripts are specified in the `realm/implants/imix/install_scripts` directory.

## Functionality

Expand All @@ -97,7 +97,7 @@ See the [Eldritch User Guide](/user-guide/eldritch) for more information.
Imix can execute up to 127 threads concurrently after that the main imix thread will block behind other threads.
Every callback interval imix will query each active thread for new output and rely that back to the c2. This means even long running tasks will report their status as new data comes in.

## Static cross compiliation
## Static cross compilation

### Linux

Expand Down
23 changes: 14 additions & 9 deletions docs/_docs/user-guide/tavern.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,17 +21,11 @@ Quests by default are group actions so scaling your activity is easy and built-i
Each quest is made up of three main parts:
- Beacons - What you'll be executing on
- Tomes - What you'll be executing
- Input parametrs - arguments passed to the tome and eldritch interperet as `input_params{}`
- Input parameters - arguments passed to the tome and eldritch interpreter as `input_params{}`

To start click "Create new quest"
#### To start click "Create new quest"

Give your quest a descriptive name so you can reference back to it later if you need to lookup the information again. (We recommend this so you can avoid duplicating work and exposrue on the system).

Select the tome you want to run.

If the tome has parameters you'll be prompted. Consult the placeholder text if you're unsure how to format the input.

Click next to start selecting beacons.
First you'll be prompted to select beacons you want this quest to apply to.

Beacons can be searched by name, group tag, and service tag.

Expand All @@ -41,6 +35,17 @@ Now you can select individual beacons or use the "Select all" button to add ever

*Note: `Service + group` searches are and'd while `service + service` or `group + group` searches are or'd.*

#### Next select the tome you want to run.

Tomes can be searched by name

If the tome has parameters you'll be prompted. Consult the placeholder text if you're unsure how to format the input.

#### Finally review and confirm your quest

The final page gives an overview of what beacons, tome and parameters have been selected.

Lastly give your quest a descriptive name so you can reference back to it later if you need to lookup the information again. (We recommend this so you can avoid duplicating work and exposure on the system).

## Deployment

Expand Down