vvx7 / nicodemus

A cross-platform Nim implant for Prelude Operator

Nicodemus

Nicodemus is a cross-platform Nim implant for the Prelude Operator adversary emulation platform.

It's a port of Pneuma and intended as a reference implementation for those thinking about writing their own Operator agent in Nim. Where possible, Nicodemus' code closely resembles that of Pneuma.

Getting started

Use build.sh to compile Nicodemus for the host OS and Windows build target.

Run the compiled agent to connect on the default TCP address. For help use the -h command switch.

Linux

1. Install Nim.
2. Install dependencies with Nimble.
   • cd nicodemus/ && nimble install
3. Install MinGW-w64 toolchain.
   • Ubuntu: apt install mingw-w64
4. Compile agent for build targets.
   • ./build.sh

MacOS

1. Install Nim.
2. Install dependencies with Nimble.
   • cd nicodemus/ && nimble install
3. Install MinGW-w64 toolchain.
   • OSX: brew install mingw-w64
4. Compile agent for build targets.
   • ./build.sh

Cross-compiling

Nim cross-compiling is documented here.

Check out this Docker image for easy cross-compiling. You'll need to install any nimble packages required by this project first.

You can use the docker-build.sh script to automatically cross-compile amd64 versions for Mac, Linux, and Windows through the docker using this:

docker run --rm -v `pwd`:/usr/local/src \
  chrishellerappsian/docker-nim-cross:latest ./build-docker.sh

Use without Operator

Nicodemus is a port of Pneuma so it's meant to be used with Prelude Operator. If you want to use a different C2 you'll need to structure messages so that Nicodemus understands. See Pneuma beacon documentation for more detail.

C2 Instruction

{
  ID: "067e99fb-f88f-49a8-aadc-b5cadf3438d4",
  ttp: "0b726950-11fc-4b15-a7d3-0d6e9cfdbeab",
  tactic: "discovery",
  Executor: "sh",
  Request: "whoami",
  Payload: "https://s3.amazonaws.com/operator.payloads/demo.exe",
}

Agent Beacon

{
  "Name": "test",
  "Location": "/tmp/me.go"
  "Platform": "darwin",
  "Executors": ["sh"],
  "Range": "red",
  "Pwd": "/tmp",
  "Links": []
}

Links

{
  "ID": "123",
  "Executor": "sh",
  "Payload: "",
  "Request": "whoami",
  "Response: "",
  "Status: 0,
  "Pid": 0
}

Channel selection

Nicodemus currently supports TCP, UDP and HTTP.

TCP

./main --contact=tcp --address=127.0.0.1 --port=2323

UDP

./main --contact=udp --address=127.0.0.1 --port=4545

HTTP

./main --contact=http --address=http://127.0.0.1 --port=3391

Coming soon

nicodemus's Issues

Add compile step

I'm new to Nim and it took me a hot minute to realize I needed the compile step before running the agent start command. I'd toss this into the README to help other newbies like myself.

Executors using macOS instead of darwin

I could be missing a reference after a quick glance at the executors file - but it looks like its using "macos" instead of "darwin' as the platform name. As a result, I'm getting "no executors found" for Mac TTPs.

Make compatible for Operator ingestion

This agent is a GREAT first agent we'd (Prelude) be interested in making available by default within Operator via the AgentLibrary plugin.

If you'd be willing, we just need to you make 2 changes to this code to make it work:

1. Add a build.sh file at the project root, with the command which will compile the agent into an executable (check Pneuma for an example, for each supported OS).

@khyberspache this is all that needs to be done from the agent-side, correct?