[FEATURE] Configurable Implant Startup [retry & die timeouts] [OPSEC]
polarlotus opened this issue · comments
Is your feature request related to a problem? Please describe.
No
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
The existing solution of editing the dropper.cs. and dropper.ps1 templates do not effect the startup and die timeouts in the (full implants). However do filter into the donut and small dropper.exe payload. (albeit without the ETW and AMSI bypasses)
These un configurable and noisy retries have OPSEC implications. Both in network activity and "process" live time.
A implant that cannot reach the C2 during startup should be able to die immediately if so desired. Currently a network isolated C# implant will die only after 25 minutes, 2x 10 minute retries + 1x 5 minute retry.
Describe the solution you'd like
A configurable option in config.yaml which completely disables retries.
StartupRetry = yes or no
A configurable timeout value. (If StartupRetry=yes)
StartRetryTimeout = 10m
A configurable retry count. (If StartupRetry=yes)
StartRetryCount = 3
Describe alternatives you've considered
As the dropper.cs modification don't translate into the full. (ETW+AMSI) Shellcode payloads. I have resorted to decompiling the Full C# Implant ShellCode in IDA and then patching out the startup retry instruction for every C2 instance.
Additional context
Add any other context, files or screenshots about the feature request here.
Added #196