feat: T1016 dns_config probe + server-side drift detection + Crucible DNS DRIFT badge

agent/client/dns_config.go

@@ -0,0 +1,42 @@
+package client
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+// DNSConfig is a T1016 System Network Configuration Discovery snapshot.
+// It captures the resolvers that are actually in use at probe time so the
+// C2 server can detect drift between heartbeats (e.g. DHCP rogue resolver,
+// or a post-compromise /etc/resolv.conf rewrite).
+type DNSConfig struct {
+	Servers       []string `json:"servers"`
+	SearchDomains []string `json:"search_domains,omitempty"`
+}
+
+// parseDNSJSON parses the compact JSON emitted by the Windows PS probe.
+// Expected shape: {"servers":"1.1.1.1,8.8.8.8","search":"corp.local"}
+func parseDNSJSON(raw string) *DNSConfig {
+	cfg := &DNSConfig{}
+	var m map[string]interface{}
+	if err := json.Unmarshal([]byte(raw), &m); err != nil {
+		return cfg
+	}
+	if s, ok := m["servers"].(string); ok && s != "" {
+		for _, addr := range strings.Split(s, ",") {
+			addr = strings.TrimSpace(addr)
+			if addr != "" {
+				cfg.Servers = append(cfg.Servers, addr)
+			}
+		}
+	}
+	if s, ok := m["search"].(string); ok && s != "" {
+		for _, d := range strings.Split(s, ",") {
+			d = strings.TrimSpace(d)
+			if d != "" {
+				cfg.SearchDomains = append(cfg.SearchDomains, d)
+			}
+		}
+	}
+	return cfg
+}