joshrendek/threat.gg-agent

Log commands used by attacker

Closed this issue · 0 comments

Already working on this but a snippet for anyone else who wants to tinker:

                go func(in <-chan *ssh.Request) {
                    for req := range in {
                        ok := false
                        logfile.Println("[request type]: " + req.Type)
                        logfile.Println("[request payload]: " + string(req.Payload))
                        switch req.Type {
                        case "shell":
                            ok = true
                            if len(req.Payload) > 0 {
                                // We don't accept any
                                // commands, only the
                                // default shell.
                                ok = false
                            }
                        }
                        ok = true
                        req.Reply(ok, nil)
                    }
                }(requests)

                term := terminal.NewTerminal(channel, "> ")

                go func() {
                    defer channel.Close()
                    for {
                        line, err := term.ReadLine()
                        if err != nil {
                            break
                        }
                        term.Write([]byte("resp written"))
                        fmt.Println(line)
                    }
                }()