Einstein

PoC Go C2 server that mimics Mattermost HTTP traffic

Important Things To Note

• Untested and unpolished code
• No help menu
• No exception handling
• No corresponding client provided
• No functionality to customize Einstein's configuration
• Filenames don't really mean anything
• Intentionally free of external packages/dependencies

Running

Clone the repository and go run Einstein.go.

Details

Commands

Command	Purpose
list	List registered clients
select	Select client
unselect	Unselect client
current	Print currently-selected client
up	Upload file to client
ex	Execute system command on client
persist	Install persistence on client
down	Download file from client
snap	Take screenshot of client
exit/quit	Shutdown server

Endpoints

Method	Path	Purpose
GET	/api/v<>/plugins/webapp	Initial beacon to register client & commence checking for pulses/heartbeats
POST	/api/v<>/users/status/ids	Poll for and retrieve jobs for client + register pulse
POST	/api/v<>/users/ids?since=<unix_timestamp_in_milliseconds>	Retrieve job results from client
GET	/static/<>.js	File transfer to client

Misc

• Coded against Mattermost Server 6.6.1
• Client's unique ID and name is transmitted through a combination of the MMAUTHTOKEN, MMUSERID, and MMCSRF HTTP Cookie values
• Data transmitted is usually AES-128-GCM-encrypted and then ZBase32-encoded except in the case of file transfers where it is Base64-encoded after encryption instead
  • For file transfers, the final encoded data is smuggled via a minified JavaScript file used by Mattermost
  • For job retrieval for client, the final encoded data is split into chunks across multiple Mattermost status structures where the data resides in the UserId field and the Status field will discreetly indicate the type of job to the client