- **Type**: 1バイト整数。このタスクの「タイプ」です。[[Task Types and Codes](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#task-types-and-codes)] を参照してください。
- **Code**: 1バイト整数。指定されたTypeに対する「サブコード」です。[[Task Types and Codes](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#task-types-and-codes)] を参照してください。
- **Flags**: 2バイト整数。メッセージの状態を表すビット単位のフラグのセットです。[[Task Flags](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#task-flags)] を参照してください。
- **Label**: 4バイト整数。同じタスクに関連する複数のメッセージを関連付けるための一意のラベルです。
- **Identifier**: 4バイト整数。断片化されたメッセージを正しい順序で構築するために使用される連続識別子です。
- **Length**: 4バイト整数。タスクデータの全長です。

## タスクタイプとコード```text
|------------------|--------------------------|
| Type             | Code                     |
|------------------|--------------------------|
| 0 - NOP          | 0                        |
|------------------|--------------------------|
| 1 - Exit         | 0                        |
|------------------|--------------------------|
| 2 - Set          | 0 - Sleep/Jitter         |
|                  | 1 - SpawnTo              |
|                  | 2 - BlockDLLs            |
|                  | 3 - PPID                 |
|------------------|--------------------------|
| 3 - File         | 0 - Copy                 |
|                  | 1 - Move                 |
|                  | 2 - Delete               |
|                  | 3 - Upload               |
|                  | 4 - Download             |
|------------------|--------------------------|
| 4 - Directory    | 0 - Print                |
|                  | 1 - Change               |
|                  | 2 - Create               |
|                  | 3 - Copy                 |
|                  | 4 - Move                 |
|                  | 5 - List                 |
|                  | 6 - Delete               |
|------------------|--------------------------|
| 5 - WhoAmI       | 0                        |
|------------------|--------------------------|
| 6 - Process      | 0 - List                 |
|                  | 1 - Kill                 |
|                  | 2 - Inject Spawn         |
|                  | 3 - Inject Explicit      |
|------------------|--------------------------|
| 7 - Registry     | 0 - Query                |
|                  | 1 - Add                  |
|                  | 2 - Delete               |
|------------------|--------------------------|
| 8 - RPortFwd     | 0 - Start                |
|                  | 1 - Data                 |
|------------------|--------------------------|
| 9 - Environment  | 0 - Get                  |
|                  | 1 - Set                  |
|------------------|--------------------------|
| 10 - SOCKS       | 0 - Connect              |
|                  | 1 - Data                 |
|                  | 2 - Close                |
|------------------|--------------------------|
| 11 - Tokens      | 0 - List                 |
|                  | 1 - Make                 |
|                  | 2 - Steal                |
|                  | 3 - Use                  |
|                  | 4 - Revert               |
|                  | 5 - Delete               |
|                  | 6 - Purge                |
|------------------|--------------------------|
| 12 - Run         | 0                        |
|------------------|--------------------------|
| 13 - ItemStore   | 0 - List                 |
|                  | 1 - Add                  |
|                  | 2 - Delete               |
|                  | 3 - Purge                |
|------------------|--------------------------|
| 14 - LocalExec   | 0 - .NET                 |
|                  | 1 - BOF                  |
|                  | 2 - Managed PowerShell   |
|                  | 3 - Unmanaged PowerShell |
|------------------|--------------------------|
| 15 - PrintScreen | 0                        |
|------------------|--------------------------|
| 16 - RemoteExec  | 0 - WinRM                |
|                  | 1 - WMI                  |
|                  | 2 - PsExec               |
|                  | 3 - SSH                  |
|------------------|--------------------------|
| 17 - Link        | 1 - Link SMB             |
|                  | 2 - Link TCP             |
|------------------|--------------------------|
| 18 - Unlink      | 0                        |
|------------------|--------------------------|
| 19 - P2P         | 0 - Acknowledge          |
|                  | 1 - PassThru             |
|------------------|--------------------------|
| 20 - Jobs        | 0 - List                 |
|                  | 1 - Kill                 |
|---------------------------------------------|

## タスクデータ

タスクデータはヘッダーに追加され、特定のタスクタイプとコードに応じたバイナリ構造で構成されます。  各タスク要求および応答メッセージタイプは、[[メッセージ定義](https://github.com/rasta-mouse/ost-c2-spec?tab=readme-ov-file#message-definitions)]で定義されています。

不要な場合、タスク要求または応答にデータを付与することは必須ではありません。

## 暗号化タスクメッセージ

送信前に、タスクヘッダーとタスクデータが結合され、インプラントのセッションキーでAES暗号化されます。```text
| Byte | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| ------------------------------------ |
|  0   |            Iv                 |
|  8   |                               |
| ------------------------------------ |
|  16  |          Checksum             |
|  24  |                               |
|  32  |                               |
|  40  |                               |
| ------------------------------------ |
|  48  |           Data                |
|  ..  |                               |
| ------------------------------------ |

### IPV4-ADDRESS```text
IPV4-ADDRESS {
  address  [1]  SEQUENCE of Byte (4)
}

IP アドレスはネットワークバイトオーダーで送信されなければなりません。

### プラットフォーム```text
Platform {
  Linux   = 0,
  MacOS   = 1,
  Windows = 2
}

## NOP 定義

### NOP```text
NOP {
  padding  [1]  SEQUENCE of Byte  OPTIONAL
}

### SET-SPAWNTO-REQ```text
SET-SPAWNTO-REQ {
  spawnto  [1]  String  OPTIONAL
}

`blockdlls` フィールドが*設定されていない*場合、インプラントは既定の構成に戻るべきである。

### SET-PPID-REQ```text
SET-PPID-REQ {
  ppid  [1]  UInt32  OPTIONAL
}

### FILE-MOVE-REQ```text
FILE-MOVE-REQ {
  source       [1]  String
  destination  [2]  String
}

### FILE-UPLOAD-REQ```text
FILE-UPLOAD-REQ {
  destination  [1]  String
  content      [2]  SEQUENCE of Byte
}

### FILE-DOWNLOAD-REP```text
FILE-DOWNLOAD-REP {
  current-chuck  [1]  UInt16
  total-chunks   [2]  UInt16
  chunk-content  [3]  SEQUENCE of Byte
}

### DIR-CHANGE-REQ```text
DIR-CHANGE-REQ {
  path  [1]  String  OPTIONAL
}

### DIR-CREATE-REP```text
DIR-CREATE-REP {
  entry  [1]  [FileSystemEntry]
}

### DIR-MOVE-REQ```text
DIR-MOVE-REQ {
  source       [1]  String
  destination  [2]  String
}

`path` フィールドが *設定されていない* 場合、インプラントは現在の作業ディレクトリを一覧表示すべきです（SHOULD）。

### DIR-LIST-REP```text
DIR-LIST-REP {
  entries  [1]  SEQUENCE of [FileSystemEntry]
}

### FileSystemEntry```text
FileSystemEntry {
  path            [1]  String
  length          [2]  UInt32                      OPTIONAL
  attributes      [3]  [FileAttributes]            OPTIONAL
  owner           [4]  String                      OPTIONAL
  created         [5]  Timestamp                   OPTIONAL
  last-accessed   [6]  Timestamp                   OPTIONAL
  last-written    [7]  Timestamp                   OPTIONAL
  access-control  [8]  SEQUENCE of [FileSecurity]  OPTIONAL
}

### FileSecurity```text
FileSecurity {
  identity     [1]  String
  access-mask  [2]  Int32
  inheritance  [3]  [Inheritance]  OPTIONAL
  propagation  [4]  [Propagation]  OPTIONAL
}

### 伝播

ビット単位のフラグ。```text
Propagation {
  None               = 0,
  NoPropagateInherit = 1,
  InheritOnly        = 2,
}

## プロセス定義

### PROC-LIST-REP```text
PROC-LIST-REP {
  processes  [1]  SEQUENCE of [ProcessEntry]
}

### PROC-INJ-REQ```text
PROC-INJ-REQ {
  shellcode   [1]  SEQUENCE of Byte
  capability  [2]  SEQUENCE of Byte
  process-id  [3]  UInt32            OPTIONAL
}

### アーキテクチャ```text
Architecture {
  X86   = 0,  // 32-bit Intel
  X64   = 1,  // 64-bit Intel
  Arm   = 2,  // 32-bit ARM
  Arm64 = 3,  // 64-bit ARM
  Wasm  = 4   // WebAssembly
}

## レジストリ定義

### REG-QUERY-REQ```text
REG-QUERY-REQ {
  hive            [1]  [RegistryHive]
  key             [2]  String          OPTIONAL
  value           [3]  String          OPTIONAL
  access-control  [4]  Boolean         OPTIONAL
}

### REG-ADD-REQ```text
REG-ADD-REQ {
  hive   [1]  [RegistryHive]
  key    [2]  String
  name   [3]  String               OPTIONAL
  kind   [4]  [RegistryValueKind]  OPTIONAL
  value  [5]  SEQUENCE of Byte     OPTIONAL
}

### RegistryHive```text
RegistryHive {
  ClassesRoot   = 0,
  CurrentUser   = 1,
  LocalMachine  = 2,
  Users         = 3,
  CurrentConfig = 4
}

### RegistryValue```text
RegistryValue {
  name            [1]  String
  type            [2]  [RegistryValueKind]
  data            [3]  SEQUENCE of Byte
  access-control  [4]  SEQUENCE of [RegistrySecurity]  OPTIONAL
}

### RegistrySecurity```text
RegistrySecurity {
  identity     [1]  String
  access-mask  [2]  Int32
  inheritance  [3]  [Inheritance]  OPTIONAL
  propagation  [4]  [Propagation]  OPTIONAL
}

### RPORTFWD-DATA```text
RPORTFWD-DATA {
  data  [1]  SEQUENCE of Byte
}

### ENV-GET-REP```text
ENV-GET-REP {
  value  [1]  String
}

## SOCKS 定義

### SOCKS-CONNECT-REQ```text
SOCKS-CONNECT-REQ {
  id      [1]  UInt32
  target  [2]  SEQUENCE of Byte (4)
  port    [3]  UInt16
}

### SOCKS-CLOSE-REQ```text
SOCKS-CLOSE-REQ {
  id  [1]  UInt32
}

## Token Definitions

### TOKEN-LIST-REP

```text
TOKEN-LIST-REP {
  tokens  [1]  SEQUENCE of [TokenEntry]
}```

### TOKEN-CREATE-REQ

```text
TOKEN-CREATE-REQ {
  username  [1]  String
  domain    [2]  String  OPTIONAL
  password  [3]  String  OPTIONAL
}```

### TOKEN-STEAL-REQ

```text
TOKEN-STEAL-REQ {
  process-id   [1]  UInt32
  access-mask  [2]  UInt32  OPTIONAL
}```

### TOKEN-USE-REQ

```text
TOKEN-USE-REQ {
  index  [1]  Byte
}```

### TOKEN-DELETE-REQ

```text
TOKEN-DELETE-REQ {
  index  [1]  Byte
}```

### TokenEntry

```text
Token {
  index       [1]  Byte
  username    [2]  String
  handle      [3]  String  OPTIONAL
  process-id  [4]  UInt32  OPTIONAL
}```

## Implant Store Definitions

### STORE-LIST-REP

```text
STORE-LIST-REP {
  items  [1]  SEQUENCE of [StoreItem]
}```

### STORE-ADD-ITEM Definition

```text
STORE-ADD-ITEM-REQ {
  item  [1]  SEQUENCE of Byte
  name  [2]  String
  type  [3]  [StoreItemType]
}```

### STORE-DELETE-ITEM Definition

```text
STORE-DELETE-ITEM-REQ {
  index  [1]  Byte
}```

### StoreItem

```text
StoreItem {
  index  [1]  Byte
  name   [2]  String
  type   [3]  [StoreItemType]
}```

### StoreItemType

```text
StoreItemType {
  Assembly = 0,
  BOF      = 1,
  Script   = 2,
  Generic  = 3
}```

## Local Execution Definitions

### RUN-REQ

```text
RUN-REQ {
  program    [1]  String
  arguments  [2]  String  OPTIONAL
  token      [3]  Byte    OPTIONAL
}```

### RUN-REP

```text
RUN-REP {
  output  [1]  String
}```

### EXEC-ASM-REQ

Either store-index or assembly MUST be provided.

```text
EXEC-ASM-REQ {
  store-index  [1]  Byte                OPTIONAL
  assembly     [2]  SEQUENCE of Byte    OPTIONAL
  arguments    [3]  SEQUENCE of String  OPTIONAL
  bypass-amsi  [4]  Boolean             OPTIONAL
  bypass-etw   [5]  Boolean             OPTIONAL
}```

### EXEC-ASM-REP

```text
EXEC-ASM-REP {
  output  [1]  String
}```

### EXEC-BOF-REQ

Either store-index or bof MUST be provided.

```text
EXEC-BOF-REQ {
  store-index  [1]  Byte              OPTIONAL
  bof          [2]  SEQUENCE of Byte  OPTIONAL
  arguments    [3]  SEQUENCE of Byte  OPTIONAL
  bypass-amsi  [4]  Boolean           OPTIONAL
  bypass-etw   [5]  Boolean           OPTIONAL
}```

### EXEC-BOF-REP

```text
EXEC-BOF-REP {
  output  [1]  String
}```

### EXEC-POSH-REQ

Either store-index or script MUST be provided.

```text
EXEC-POSH-REQ {
  cmdlet       [1]  String
  store-index  [2]  Byte              OPTIONAL
  script       [3]  SEQUENCE of Byte  OPTIONAL
  bypass-amsi  [3]  Boolean           OPTIONAL
  bypass-etw   [4]  Boolean           OPTIONAL
}```

### EXEC-POSH-REP

```text
EXEC-POSH-REP {
  output  [1]  String
}```

## Screenshot Definitions

### SCRNSHOT-REP

```text
SCRNSHOT-REP {
  data  [1]  SEQUENCE of Byte
}```

## Remote Execution Definitions

### WINRM-REQ

```text
WINRM-REQ {
  target     [1]  String
  program    [2]  String
  arguments  [3]  String  OPTIONAL
}```

### WMI-REQ

```text
WMI-REQ {
  target     [1]  String
  program    [2]  String
  arguments  [3]  String  OPTIONAL
}```

### PSEXEC-REQ

```text
PSEXEC-REQ {
  target               [1]  String
  service-name         [2]  String
  service-description  [3]  String  OPTIONAL
  bin-path             [4]  String
}```

## Peer-to-Peer Definitions

### LINK-SMB-REQ

```text
LINK-SMB-REQ {
  target    [1]  String
  pipename  [2]  String
}```

### LINK-TCP-REQ

```text
LINK-TCP-REQ {
  target  [1]  String
  port    [2]  UInt32
}```

### LINK-REP

```text
LINK-SMB-REP {
  child-metadata  [1]  SEQUENCE of Byte
}```

### LINK-ACK

```text
LINK-ACK {
  child-id  [1]  UInt32
}```

### LINK-PASS-THRU

```text
LINK-PASS-THRU {
  child-id  [1]  UInt32
  message   [2]  SEQUENCE of Byte
}```

## JOB Definitions

### JOB-LIST-REP

```text
jobs  [1]  [JobEntry] のシーケンス```

### JOB-KILL-REQ

```text
index  [1]  UInt32```

### JobEntry
```text
index  [1]  UInt32
  type   [2]  Byte
  code   [3]  Byte```