An00bRektn/gopher47

Get Process Elevated, Architecture, and Domain data for registration

An00bRektn opened this issue · 0 comments

Part of the registration spec on Havoc is to provide the following information:

                # Register info:
                #   - AgentID           : int [needed]
                #   - Hostname          : str [needed]
                #   - Username          : str [needed]
                #   - Domain            : str [optional]
                #   - InternalIP        : str [needed]
                #   - Process Path      : str [needed]
                #   - Process Name      : str [needed]
                #   - Process ID        : int [needed]
                #   - Process Parent ID : int [optional]
                #   - Process Arch      : str [needed]
                #   - Process Elevated  : int [needed]
                #   - OS Build          : str [needed]
                #   - OS Version        : str [needed]
                #   - OS Arch           : str [optional]
                #   - Sleep             : int [optional]

While developing, I forgot to implement checks for the following:

  • Process Elevated
  • Process Arch
  • Domain

We might need to create some additional enumeration functions for the domain check, and I have yet to look into the process elevated/arch stuff.