- **Type**: entier de 1 octet.  Le 'type' de tâche.  Voir [[Types de tâches et codes](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#task-types-and-codes)].
- **Code**: entier de 1 octet.  Un 'sous-code' pour le Type donné.  Voir [[Types de tâches et codes](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#task-types-and-codes)].
- **Flags**: entier de 2 octets.  Un ensemble de drapeaux binaires décrivant l'état du message.  Voir [[Drapeaux de tâche](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#task-flags)].
- **Label**: entier de 4 octets.  Une étiquette unique pour corréler plusieurs messages liés à la même tâche.
- **Identifier**: entier de 4 octets.  Un identifiant séquentiel utilisé pour reconstruire les messages fragmentés dans le bon ordre.
- **Length**: entier de 4 octets.  La longueur totale des données de la tâche.

## Types de tâches et codes```text
|------------------|--------------------------|
| Type             | Code                     |
|------------------|--------------------------|
| 0 - NOP          | 0                        |
|------------------|--------------------------|
| 1 - Exit         | 0                        |
|------------------|--------------------------|
| 2 - Set          | 0 - Sleep/Jitter         |
|                  | 1 - SpawnTo              |
|                  | 2 - BlockDLLs            |
|                  | 3 - PPID                 |
|------------------|--------------------------|
| 3 - File         | 0 - Copy                 |
|                  | 1 - Move                 |
|                  | 2 - Delete               |
|                  | 3 - Upload               |
|                  | 4 - Download             |
|------------------|--------------------------|
| 4 - Directory    | 0 - Print                |
|                  | 1 - Change               |
|                  | 2 - Create               |
|                  | 3 - Copy                 |
|                  | 4 - Move                 |
|                  | 5 - List                 |
|                  | 6 - Delete               |
|------------------|--------------------------|
| 5 - WhoAmI       | 0                        |
|------------------|--------------------------|
| 6 - Process      | 0 - List                 |
|                  | 1 - Kill                 |
|                  | 2 - Inject Spawn         |
|                  | 3 - Inject Explicit      |
|------------------|--------------------------|
| 7 - Registry     | 0 - Query                |
|                  | 1 - Add                  |
|                  | 2 - Delete               |
|------------------|--------------------------|
| 8 - RPortFwd     | 0 - Start                |
|                  | 1 - Data                 |
|------------------|--------------------------|
| 9 - Environment  | 0 - Get                  |
|                  | 1 - Set                  |
|------------------|--------------------------|
| 10 - SOCKS       | 0 - Connect              |
|                  | 1 - Data                 |
|                  | 2 - Close                |
|------------------|--------------------------|
| 11 - Tokens      | 0 - List                 |
|                  | 1 - Make                 |
|                  | 2 - Steal                |
|                  | 3 - Use                  |
|                  | 4 - Revert               |
|                  | 5 - Delete               |
|                  | 6 - Purge                |
|------------------|--------------------------|
| 12 - Run         | 0                        |
|------------------|--------------------------|
| 13 - ItemStore   | 0 - List                 |
|                  | 1 - Add                  |
|                  | 2 - Delete               |
|                  | 3 - Purge                |
|------------------|--------------------------|
| 14 - LocalExec   | 0 - .NET                 |
|                  | 1 - BOF                  |
|                  | 2 - Managed PowerShell   |
|                  | 3 - Unmanaged PowerShell |
|------------------|--------------------------|
| 15 - PrintScreen | 0                        |
|------------------|--------------------------|
| 16 - RemoteExec  | 0 - WinRM                |
|                  | 1 - WMI                  |
|                  | 2 - PsExec               |
|                  | 3 - SSH                  |
|------------------|--------------------------|
| 17 - Link        | 1 - Link SMB             |
|                  | 2 - Link TCP             |
|------------------|--------------------------|
| 18 - Unlink      | 0                        |
|------------------|--------------------------|
| 19 - P2P         | 0 - Acknowledge          |
|                  | 1 - PassThru             |
|------------------|--------------------------|
| 20 - Jobs        | 0 - List                 |
|                  | 1 - Kill                 |
|---------------------------------------------|

## Données de tâche

Les données de tâche sont ajoutées à l'en-tête et consistent en une structure binaire, selon le type et le code de tâche spécifiques.  Chaque type de message de requête et de réponse de tâche est défini dans [[Message Definitions](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#message-definitions)].

Il n'est PAS OBLIGATOIRE qu'une requête ou une réponse de tâche contienne des données si cela n'est pas requis.

## Message de tâche chiffré

Avant la transmission, l'en-tête de tâche et les données de tâche sont combinés puis chiffrés avec AES avec la clé de session de l'implant.```text
| Byte | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| ------------------------------------ |
|  0   |            Iv                 |
|  8   |                               |
| ------------------------------------ |
|  16  |          Checksum             |
|  24  |                               |
|  32  |                               |
|  40  |                               |
| ------------------------------------ |
|  48  |           Data                |
|  ..  |                               |
| ------------------------------------ |

### IPV4-ADDRESS```text
IPV4-ADDRESS {
  address  [1]  SEQUENCE of Byte (4)
}

Les adresses IP DOIVENT être transmises dans l'ordre des octets du réseau.

### Platform```text
Platform {
  Linux   = 0,
  MacOS   = 1,
  Windows = 2
}

## Définitions NOP

### NOP```text
NOP {
  padding  [1]  SEQUENCE of Byte  OPTIONAL
}

### SET-SPAWNTO-REQ```text
SET-SPAWNTO-REQ {
  spawnto  [1]  String  OPTIONAL
}

Si le champ `blockdlls` n'est *pas* défini, l'implant DEVRAIT revenir à sa configuration par défaut.

### SET-PPID-REQ```text
SET-PPID-REQ {
  ppid  [1]  UInt32  OPTIONAL
}

### FILE-MOVE-REQ```text
FILE-MOVE-REQ {
  source       [1]  String
  destination  [2]  String
}

### FILE-UPLOAD-REQ```text
FILE-UPLOAD-REQ {
  destination  [1]  String
  content      [2]  SEQUENCE of Byte
}

### FILE-DOWNLOAD-REP```text
FILE-DOWNLOAD-REP {
  current-chuck  [1]  UInt16
  total-chunks   [2]  UInt16
  chunk-content  [3]  SEQUENCE of Byte
}

### DIR-CHANGE-REQ```text
DIR-CHANGE-REQ {
  path  [1]  String  OPTIONAL
}

### DIR-CREATE-REP```text
DIR-CREATE-REP {
  entry  [1]  [FileSystemEntry]
}

### DIR-MOVE-REQ```text
DIR-MOVE-REQ {
  source       [1]  String
  destination  [2]  String
}

Si le champ `path` n'est *pas* défini, l'implant DEVRAIT lister son répertoire de travail courant.

### DIR-LIST-REP```text
DIR-LIST-REP {
  entries  [1]  SEQUENCE of [FileSystemEntry]
}

### FileSystemEntry```text
FileSystemEntry {
  path            [1]  String
  length          [2]  UInt32                      OPTIONAL
  attributes      [3]  [FileAttributes]            OPTIONAL
  owner           [4]  String                      OPTIONAL
  created         [5]  Timestamp                   OPTIONAL
  last-accessed   [6]  Timestamp                   OPTIONAL
  last-written    [7]  Timestamp                   OPTIONAL
  access-control  [8]  SEQUENCE of [FileSecurity]  OPTIONAL
}

### FileSecurity```text
FileSecurity {
  identity     [1]  String
  access-mask  [2]  Int32
  inheritance  [3]  [Inheritance]  OPTIONAL
  propagation  [4]  [Propagation]  OPTIONAL
}

### Propagation

Drapeaux binaires.```text
Propagation {
  None               = 0,
  NoPropagateInherit = 1,
  InheritOnly        = 2,
}

## Définitions de processus

### PROC-LIST-REP```text
PROC-LIST-REP {
  processes  [1]  SEQUENCE of [ProcessEntry]
}

### PROC-INJ-REQ```text
PROC-INJ-REQ {
  shellcode   [1]  SEQUENCE of Byte
  capability  [2]  SEQUENCE of Byte
  process-id  [3]  UInt32            OPTIONAL
}

### Architecture```text
Architecture {
  X86   = 0,  // 32-bit Intel
  X64   = 1,  // 64-bit Intel
  Arm   = 2,  // 32-bit ARM
  Arm64 = 3,  // 64-bit ARM
  Wasm  = 4   // WebAssembly
}

## Définitions du registre

### REG-QUERY-REQ```text
REG-QUERY-REQ {
  hive            [1]  [RegistryHive]
  key             [2]  String          OPTIONAL
  value           [3]  String          OPTIONAL
  access-control  [4]  Boolean         OPTIONAL
}

### REG-ADD-REQ```text
REG-ADD-REQ {
  hive   [1]  [RegistryHive]
  key    [2]  String
  name   [3]  String               OPTIONAL
  kind   [4]  [RegistryValueKind]  OPTIONAL
  value  [5]  SEQUENCE of Byte     OPTIONAL
}

### RegistryHive```text
RegistryHive {
  ClassesRoot   = 0,
  CurrentUser   = 1,
  LocalMachine  = 2,
  Users         = 3,
  CurrentConfig = 4
}

### RegistryValue```text
RegistryValue {
  name            [1]  String
  type            [2]  [RegistryValueKind]
  data            [3]  SEQUENCE of Byte
  access-control  [4]  SEQUENCE of [RegistrySecurity]  OPTIONAL
}

### RegistrySecurity```text
RegistrySecurity {
  identity     [1]  String
  access-mask  [2]  Int32
  inheritance  [3]  [Inheritance]  OPTIONAL
  propagation  [4]  [Propagation]  OPTIONAL
}

### RPORTFWD-DATA```text
RPORTFWD-DATA {
  data  [1]  SEQUENCE of Byte
}

### ENV-GET-REP```text
ENV-GET-REP {
  value  [1]  String
}

## SOCKS Définitions

### SOCKS-CONNECT-REQ```text
SOCKS-CONNECT-REQ {
  id      [1]  UInt32
  target  [2]  SEQUENCE of Byte (4)
  port    [3]  UInt16
}

### SOCKS-CLOSE-REQ```text
SOCKS-CLOSE-REQ {
  id  [1]  UInt32
}

## Token Definitions

### TOKEN-LIST-REP

```text
TOKEN-LIST-REP {
  tokens  [1]  SEQUENCE of [TokenEntry]
}```

### TOKEN-CREATE-REQ

```text
TOKEN-CREATE-REQ {
  username  [1]  String
  domain    [2]  String  OPTIONAL
  password  [3]  String  OPTIONAL
}```

### TOKEN-STEAL-REQ

```text

### TOKEN-USE-REQ

```text
TOKEN-USE-REQ {
  index  [1]  Byte
}```

### TOKEN-DELETE-REQ

```text
TOKEN-DELETE-REQ {
  index  [1]  Byte
}```

### TokenEntry

```text
Token {
  index       [1]  Byte
  username    [2]  String
  handle      [3]  String  OPTIONAL
  process-id  [4]  UInt32  OPTIONAL
}```

## Implant Store Definitions

### STORE-LIST-REP

```text
```
STORE-LIST-REP {
  items  [1]  SEQUENCE of [StoreItem]
}

STORE-ADD-ITEM-REQ {
  item  [1]  SEQUENCE of Byte
  name  [2]  String
  type  [3]  [StoreItemType]
}```

### STORE-DELETE-ITEM Definition

```text
STORE-DELETE-ITEM-REQ {
  index  [1]  Byte
}```

### StoreItem

```text
StoreItem {
  index  [1]  Byte
  name   [2]  String
  type   [3]  [StoreItemType]
}```

### StoreItemType

```text
StoreItemType {
  Assembly = 0,
  BOF      = 1,
  Script   = 2,
  Generic  = 3
}```

## Local Execution Definitions

### RUN-REQ

```text
RUN-REQ {
  program    [1]  String
  arguments  [2]  String  OPTIONAL
  token      [3]  Byte    OPTIONAL
}```

### RUN-REP

```text
RUN-REP {
  output  [1]  String
}```

### EXEC-ASM-REQ

Either store-index or assembly MUST be provided.

```text
EXEC-ASM-REQ {
  store-index  [1]  Byte                OPTIONAL
  assembly     [2]  SEQUENCE of Byte    OPTIONAL
  arguments    [3]  SEQUENCE of String  OPTIONAL
  bypass-amsi  [4]  Boolean             OPTIONAL
  bypass-etw   [5]  Boolean             OPTIONAL
}```

### EXEC-ASM-REP

```text
EXEC-ASM-REP {
  output  [1]  String
}```

### EXEC-BOF-REQ

Either store-index or bof MUST be provided.

```text
EXEC-BOF-REQ {
  store-index  [1]  Byte              OPTIONAL
  bof          [2]  SEQUENCE of Byte  OPTIONAL
  arguments    [3]  SEQUENCE of Byte  OPTIONAL
  bypass-amsi  [4]  Boolean           OPTIONAL
  bypass-etw   [5]  Boolean           OPTIONAL
}```

### EXEC-BOF-REP

```text
EXEC-BOF-REP {
  output  [1]  String
}```

### EXEC-POSH-REQ

Either store-index or script MUST be provided.

```text
EXEC-POSH-REQ {
  cmdlet       [1]  String
  store-index  [2]  Byte              OPTIONAL
  script       [3]  SEQUENCE of Byte  OPTIONAL
  bypass-amsi  [3]  Boolean           OPTIONAL
  bypass-etw   [4]  Boolean           OPTIONAL
}```

### EXEC-POSH-REP

```text
EXEC-POSH-REP {
  output  [1]  String
}```

## Screenshot Definitions

### SCRNSHOT-REP

```text
SCRNSHOT-REP {
  data  [1]  SEQUENCE of Byte
}```

## Remote Execution Definitions

### WINRM-REQ

```text
WINRM-REQ {
  target     [1]  String
  program    [2]  String
  arguments  [3]  String  OPTIONAL
}```

### WMI-REQ

```text
WMI-REQ {
  target     [1]  String
  program    [2]  String
  arguments  [3]  String  OPTIONAL
}```

### PSEXEC-REQ

```text
PSEXEC-REQ {
  target               [1]  String
  service-name         [2]  String
  service-description  [3]  String  OPTIONAL
  bin-path             [4]  String
}```

## Peer-to-Peer Definitions

### LINK-SMB-REQ

```text
LINK-SMB-REQ {
  target    [1]  String
  pipename  [2]  String
}```

### LINK-TCP-REQ

```text
LINK-TCP-REQ {
  target  [1]  String
  port    [2]  UInt32
}```

### LINK-REP

```text
LINK-SMB-REP {
  child-metadata  [1]  SEQUENCE of Byte
}```

### LINK-ACK

```text
LINK-ACK {
  child-id  [1]  UInt32
}```

### LINK-PASS-THRU

```text
LINK-PASS-THRU {
  child-id  [1]  UInt32
  message   [2]  SEQUENCE of Byte
}```

## JOB Definitions

### JOB-LIST-REP

```text
jobs  [1]  Séquence de [JobEntry]```

### JOB-KILL-REQ

```text
index  [1]  UInt32```

### JobEntry
```text
index  [1]  UInt32
  type   [2]  Byte
  code   [3]  Byte```