modulepackage
0.0.0-20240331230914-07d7928002d6
Repository: https://github.com/redcode-labs/coldfire.git
Documentation: pkg.go.dev
# README
ColdFire II
Golang malware development framework
Table of Contents
- Table of Contents
- Introduction
- Installation
- Types of functions included
- Requirements
- Disclaimer
- License
Introduction
ColdFire II provides various methods useful for malware and security infra development in Golang.
Most functions are compatible with both Linux and Windows operating systems.
Installation
go get github.com/redcode-labs/Coldfire
Docs
Coming soon
Types of functions included (for maldev)
- Logging
- Auxiliary
- Reconnaissance
- Evasion
- Administration
- Sandbox detection
- Disruptive
- Low-level
Types of functions included (for infra)
- Network manipulations
- Cryptography
- IO with specialized readers
- Tunneling
- Target processing
Requirements
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
"github.com/robfig/cron"
"github.com/anvie/port-scanner"
"github.com/matishsiao/goInfo"
"github.com/fatih/color"
"github.com/minio/minio/pkg/disk"
"github.com/dustin/go-humanize"
"github.com/mitchellh/go-ps"
"github.com/GeertJohan/yubigo"
"github.com/go-sql-driver/mysql"
"github.com/ztrue/tracerr"
"github.com/yalue/elf_reader"
Disclaimer
Developers are not responsible for any misuse regarding this tool. Use it only against systems that you are permitted to attack.
License
This software is under MIT license
# Functions
AddPersistentCommand creates a task that runs a given command on startup.
Allocates anonymous memory without using it.
Launches live documentation of the library on port 8080 or arbitrary.
B64D decodes a given string encoded in Base64.
B64E encodes a string in Base64.
BannerGrab returns a service banner string from a given port.
Bind tells the process to listen to a local port for commands.
Generic boolean truth checker.
No description provided by the author
Basic error handilng and reporting Similar to exitOnError() but more verbose and does not exit.
Checks if an SSH client connection has a root context.
Removes logfiles within the machine.
Gracefully closes an instance of net.Listener.
CmdBlind runs a command without any side effects.
CmdDir executes commands which are mapped to a string indicating the directory where the command is executed.
CmdOut executes a given command and returns its output.
CmdOutPlatform executes a given set of commands based on the OS of the machine.
CmdRun executes a command and writes output as well as error to STDOUT.
Contains is used to check if an element exists in an array type agnostically.
Checks if a string exists within a list of strings.
CopyFile copies a file from one directory to another.
CreateWordList generates possible variations of each word in the wordlist.
No description provided by the author
No description provided by the author
Disks returns a list of storage drives within the machine.
DnsLookup returns the list of Ip adddress associated with the given hostname.
Download downloads a file from a url.
No description provided by the author
No description provided by the author
No description provided by the author
EraseMbr zeroes out the Master Boot Record.
Exists checks if a given file is in the system.
ExitOnError prints a given error and then stops execution of the process.
ExpandCidr returns a list of Ip addresses within a given CIDR.
ExtractIntFromString extracts a list of possible integers from a given string.
F is a wrapper for the Sprintf function.
File2Slice reads a textfile and returns all lines as an array.
FilePermissions checks if a given file has read and write permissions.
FilesPattern is used to return data mapped to files where their filenames match a given pattern.
Forkbomb spawns goroutines in order to crash the machine.
FullRemove removes all instances of a string from another string.
GenCpuLoad gives the Cpu work to do by spawning goroutines.
No description provided by the author
No description provided by the author
GetGatewayIP returns the Ip address of the gateway in the network where the machine resides.
GetGlobalIp is used to return the global Ip address of the machine.
GetLocalIp is used to get the local Ip address of the machine.
GetNgrokURL returns the URL of the Ngrok tunnel exposing the machine.
No description provided by the author
Exfiltrates data slowly from either MySQL or Postgres.
Iface returns the currently used wireless interface and its MAC address.
Returns an IP address of a given interface.
Ifaces returns the names of all local interfaces.
Info is used to return basic system information.
IntToStr converts an integer into a string.
Interval2Seconds converts a human friendly string indicating time into a proper integer.
Returns names of fields and their values in struct + names of fields with unitialized/empty values -1 value is treated as unitialized int field - you can change "val == -1" according to your needs.
No description provided by the author
Converts an IPv4 address to hex .
IpIncrement increments an IP address by 1.
Checks if an ELF file is designed for AMD x86_64 .
No description provided by the author
No description provided by the author
Returns true if a file is executable.
Checks if a generic is iterable and non-emptty.
IsRoot checks if the current user is the administrator of the machine.
KillProcByPID kills a process given its PID.
Lists remote SQL databases.
MakeZip packs a list of given files within a zip archive.
MD5Hash hashes a given string using the MD5.
Networks returns a list of nearby wireless networks.
F is a wrapper for the Println function.
Returns true if host is alive .
PkillAv kills Anti-Virus processes that may run within the machine.
PkillName kills a process by its name.
PkillPid kills a process by its PID.
Converts a port to hex.
Returns a random free port .
No description provided by the author
Portscan checks for open ports in a given target.
PortscanSingle checks if a specific port is open in a given target.
PortscanSingleTimeout checks if a specific port is open in a given target.
PrintError is used to print output indicating failure.
PrintGood is used to print output indicating success.
PrintInfo is used to print output containing information.
PrintWarning is used to print output indicating potential failure.
Processes returns a map of a PID to its respective process name.
Returns a random true/false.
No description provided by the author
RandomInt returns an integer within a given range.
Creates and populates a slice with random numeric values up to 1000.
RandomSelectInt returns an integer that was randomly selected from a list of integers.
RandomSelectStr returns a string that was randomly selected from a list of strings.
RandomSelectStrNested returns a string array that was randomly selected from a nested list of strings.
RandomString randomly generates an alphabetic string of a given length.
RandomStringCharset returns a string of a given length from provided charset.
RdnsLookup returns the list of hostnames associated with the given Ip address.
ReadFile is used to read a given file and return its data as a string.
Checks if a string contains valuable information through regex.
Remove is used to self delete.
RemoveDuplicatesInt returns an array of integers that are unique to each other.
RemoveDuplicatesStr returns an array of strings that are unique to each other.
RemoveFromSlice removes a string from a list of strings if it exists.
Removes hosts from slice that did not respond to a ping request.
RemoveInt removes a given integer from a list of integers.
RemoveNewLines removes possible newlines from a string.
Removes Nth index from generic slice if idx != 0; removes last element otherwise.
RemoveStr removes a given string from a list of strings.
Reverse initiates a reverse shell to a given host:port.
Revert returns a reversed string.
RevertSlice reverses a slice type agnostically.
No description provided by the author
Injects a bytearray into current process and executes it.
SandboxAll is used to check if an environment is virtualized by testing all sandbox checks.
SandboxAlln checks if an environment is virtualized by testing all sandbox checks and checking if the number of successful checks is equal or greater to a given integer.
SandboxCpu is used to check if the environment's cores are less than a given integer.
SandboxFilePath checks if the process is being run inside a virtualized environment.
SandboxMac is used to check if the environment's MAC address matches standard MAC adddresses of virtualized environments.
SandboxProc checks if there are processes that indicate a virtualized environment.
SandboxProcnum is used to check if the environment has processes less than a given integer.
SandboxRam is used to check if the environment's RAM is less than a given size.
SandboxSleep is used to check if the virtualized environment is speeding up the sleeping process.
SandboxTmp is used to check if the environment's temporary directory has less files than a given integer.
SandboxUtc is used to check if the environment is in a properly set Utc timezone.
SendDataTCP sends data to a given host:port using the TCP protocol.
SendDataUDP sends data to a given host:port using the UDP protocol.
Unified serializer/deserializer for structs - logic is based on whether a .gob file already exists .
SHA1Hash hashes a given string using the SHA1.
No description provided by the author
ShuffleSlice randomly shuffles a list of strings.
ShuffleSliceInt randomly shuffles a list of integers.
Shutdown forces the machine to shutdown.
Size2Bytes converts a human friendly string indicating size into a proper integer.
Applies a function to each element of a generic slice.
Split string to a slice with chunks of desired length.
SplitJoin splits a string then joins them using given delimiters.
Split a string by multiple sepaators to a single slice.
StartNgrokHTTP exposes a web server on a given port.
StartNgrokTCP exposes a TCP server on a given port.
Str2Int converts a string into an integer.
Str2Words returns a list of strings which was split by spaces.
Obtains current time from NTP server.
TraverseCurrentDir lists all files that exist within the current directory.
TraverseDir lists all files that exist within a given directory.
No description provided by the author
Returns a slice with lines of file from URL.
Users returns a list of known users within the machine.
No description provided by the author
Wait uses a human friendly string that indicates how long a system should wait.
WifiDisconnect is used to disconnect the machine from a wireless network.
Deletes all data in the machine.
WriteFile is used to write data into a given file.
Verifies Yubico OTP.