43 lines
1.2 KiB
Go
43 lines
1.2 KiB
Go
package client
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
)
|
|
|
|
// DNSConfig is a T1016 System Network Configuration Discovery snapshot.
|
|
// It captures the resolvers that are actually in use at probe time so the
|
|
// C2 server can detect drift between heartbeats (e.g. DHCP rogue resolver,
|
|
// or a post-compromise /etc/resolv.conf rewrite).
|
|
type DNSConfig struct {
|
|
Servers []string `json:"servers"`
|
|
SearchDomains []string `json:"search_domains,omitempty"`
|
|
}
|
|
|
|
// parseDNSJSON parses the compact JSON emitted by the Windows PS probe.
|
|
// Expected shape: {"servers":"1.1.1.1,8.8.8.8","search":"corp.local"}
|
|
func parseDNSJSON(raw string) *DNSConfig {
|
|
cfg := &DNSConfig{}
|
|
var m map[string]interface{}
|
|
if err := json.Unmarshal([]byte(raw), &m); err != nil {
|
|
return cfg
|
|
}
|
|
if s, ok := m["servers"].(string); ok && s != "" {
|
|
for _, addr := range strings.Split(s, ",") {
|
|
addr = strings.TrimSpace(addr)
|
|
if addr != "" {
|
|
cfg.Servers = append(cfg.Servers, addr)
|
|
}
|
|
}
|
|
}
|
|
if s, ok := m["search"].(string); ok && s != "" {
|
|
for _, d := range strings.Split(s, ",") {
|
|
d = strings.TrimSpace(d)
|
|
if d != "" {
|
|
cfg.SearchDomains = append(cfg.SearchDomains, d)
|
|
}
|
|
}
|
|
}
|
|
return cfg
|
|
}
|