feat: Trigger C2 — authenticated UDP wake + ad-hoc exec for dormant implants#2270
Open
0x90pkt wants to merge 7 commits into
Open
feat: Trigger C2 — authenticated UDP wake + ad-hoc exec for dormant implants#22700x90pkt wants to merge 7 commits into
0x90pkt wants to merge 7 commits into
Conversation
Adds the trigger wire protocol library (HMAC-SHA256 authenticated JSON-over-UDP) to both server and implant vendor trees. Includes TriggerMessage, TriggerResponse types, canonical JSON signing, response encode/decode/verify, replay cache, rate limiter, and audit sink. Server vendor includes the full listener + handler framework; implant vendor includes only the protocol package (minimal footprint).
- TriggerListenerReq/TriggerListenerJob for listener lifecycle - TriggerFireReq/TriggerFireResp for bidirectional exec - TriggerDispatchTaskReq for server-side task dispatch - TriggerIntentBinding oneof for task configuration - ImplantConfig fields: IncludeTriggerWake, TriggerWakeBindAddr, TriggerWakeSecret, TriggerWakeAllowedClientIDs, TTL fields - Four new gRPC methods: TriggerListener, TriggerFire, TriggerDispatchTask, TriggerListenerStop
Server-side trigger C2 implementation: - TriggerListener: UDP listener with configurable task bindings, HMAC validation, replay protection, rate limiting, audit logging - Handlers: wake-session, stop-job, exec, reverse-shell with concurrency caps and context deadlines - DB models: TriggerListener persistence for daemon restore, ImplantConfig trigger-wake/TTL field round-trip, TriggerActivity for tracking implant last-seen state - TTL reaper: background sweep fires self-destruct at expired trigger implants as server-side fallback (1hr cooldown) - RPC: TriggerFire (bidirectional exec with response), TriggerDispatchTask, TriggerListener start/stop - Daemon restore: trigger listeners survive server restart
Implant-side trigger-wake implementation: - triggerwake: passive UDP listener with HMAC validation, replay cache, client allowlist. Three fixed intents: wake (session callback with transport selection), exec (bidirectional command execution, concurrency cap=3), self-destruct - Wake loop: trigger implants block on WakeChannel, establish session, return to dormant on session kill. Re-wakeable indefinitely without process restart. - Transport selection: wake packet carries preferred transport hint (mtls/wg); C2Generator reorders URI list to prioritize it - TTL watchdog: runtime countdown (not build-time), resets on every authenticated trigger packet via burn.ResetTTL() - Kill handler: template-gated os.Exit for trigger implants -- gracefully closes session instead of terminating process - Response source address validation in FireTriggerPacket
Client-side trigger C2 commands: - generate trigger: builds trigger implants with --trigger-wake-bind required. No beacon flags -- wake always establishes a session. Warns if only TCP or only UDP transport specified. - triggers: indexed list of all trigger-enabled implant builds - triggers target: associate deployment IP with a trigger index - trigger send: send signed UDP packets to implants by index or IP. Auto-populates port/secret/target from stored config. --comms flag selects wake transport (mtls/wg). --output/-o exports exec results to file. - trigger dispatch: server-side task dispatch on running trigger listener jobs - secretinput: three-tier secret resolution (env var, direct value with ps-visibility warning, stdin prompt). Template injection validation for secrets embedded in implant binaries.
- Trigger C2.md: complete feature documentation covering architecture (ad-hoc exec + wake session), quickstart, intent kinds, command reference, configuration flags, implant-side intents, TTL deadman switch (runtime + server-side reaper), security model, wire protocol - .gitignore: resolved merge conflict markers, added editor swap file patterns
Remove files that were used during local development and are not part of the trigger C2 feature.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Trigger C2 — an authenticated, signed-UDP task dispatcher enabling
two operational modes for dormant implants:
signed packet with a command, implant executes it and returns output
over UDP. No C2 session needed.
transport hint), implant establishes an interactive session over mTLS
or WireGuard.
Trigger implants are completely silent until woken — zero network traffic.
What's included
generate trigger,triggers(indexed list + target tracking),trigger send(by index or IP,--commstransport selection,--outputfile export),trigger dispatch,secretinput(3-tier secret resolution)Design highlights
sessions -kdoes NOT kill the process — the implant re-enters the wake-wait loop and can be woken again.github.com/0x90pkt/triggerwith locked wire-compat regression vectors.Testing
Commits
Organized per contribution guidelines:
vendor:— trigger protocol library (separate from code changes)proto:— protobuf schema + generated codefeat(server):— DB models, listener, handlers, RPC, TTL reaperfeat(implant):— triggerwake transport, wake loop, TTL, kill handlerfeat(client):— generate trigger, triggers list, trigger send, secretinputdocs:— Trigger C2.md + .gitignorechore:— remove dev artifactsAll commits GPG-signed.
Closes #2269