state.ts•11.7 kB
/**
* Beacon state management-related MCP tools
*/
import { Tool } from '@modelcontextprotocol/sdk/types.js';
import { CobaltStrikeClient } from '../api/client.js';
export function createStateTools(client: CobaltStrikeClient): Tool[] {
return [
{
name: 'set_beacon_sleep',
description: 'Set the sleep time and jitter for a beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
sleep: {
type: 'number',
description: 'Sleep time in seconds between check-ins',
minimum: 0,
},
jitter: {
type: 'number',
description: 'Jitter percentage (0-99)',
minimum: 0,
maximum: 99,
},
},
required: ['beaconId', 'sleep'],
},
},
{
name: 'set_beacon_spawnto',
description: 'Set the spawn-to process for a beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
arch: {
type: 'string',
description: 'Architecture (x86 or x64)',
enum: ['x86', 'x64'],
},
path: {
type: 'string',
description: 'Path to the process (e.g., %windir%\\sysnative\\rundll32.exe)',
},
},
required: ['beaconId', 'arch', 'path'],
},
},
{
name: 'set_beacon_ppid',
description: 'Set the parent process ID for a beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
pid: {
type: 'number',
description: 'Parent process ID',
minimum: 0,
},
},
required: ['beaconId', 'pid'],
},
},
{
name: 'set_beacon_syscall_method',
description: 'Set the system call method for a beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
method: {
type: 'string',
description: 'System call method',
enum: ['None', 'Direct', 'Indirect'],
},
},
required: ['beaconId', 'method'],
},
},
{
name: 'get_beacon_jobs',
description: 'Get jobs running on a beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
},
required: ['beaconId'],
},
},
{
name: 'set_beacon_dns_mode',
description: 'Set DNS mode for beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
mode: {
type: 'string',
description: 'DNS mode',
enum: ['auto', 'dns', 'dns6'],
},
},
required: ['beaconId', 'mode'],
},
},
{
name: 'set_beacon_block_dlls',
description: 'Enable or disable block DLLs',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
enable: {
type: 'boolean',
description: 'Enable (true) or disable (false) block DLLs',
},
},
required: ['beaconId', 'enable'],
},
},
{
name: 'set_beacon_beacon_gate',
description: 'Enable or disable beacon gate',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
enable: {
type: 'boolean',
description: 'Enable (true) or disable (false) beacon gate',
},
},
required: ['beaconId', 'enable'],
},
},
{
name: 'set_beacon_c2_host',
description: 'Set C2 host for beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
host: {
type: 'string',
description: 'C2 host address',
},
},
required: ['beaconId', 'host'],
},
},
{
name: 'set_beacon_c2_host_hold',
description: 'Hold C2 host (prevent failover)',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
},
required: ['beaconId'],
},
},
{
name: 'set_beacon_c2_host_release',
description: 'Release C2 host (allow failover)',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
},
required: ['beaconId'],
},
},
{
name: 'set_beacon_c2_host_reset',
description: 'Reset C2 host',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
},
required: ['beaconId'],
},
},
{
name: 'get_beacon_c2_host_profiles',
description: 'Get available C2 profiles for beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
},
required: ['beaconId'],
},
},
{
name: 'set_beacon_spoofed_arguments',
description: 'Set spoofed arguments for beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
arguments: {
type: 'string',
description: 'Spoofed arguments',
},
},
required: ['beaconId', 'arguments'],
},
},
{
name: 'set_beacon_c2_failover_notification',
description: 'Enable or disable C2 failover notification',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
enable: {
type: 'boolean',
description: 'Enable (true) or disable (false) failover notification',
},
},
required: ['beaconId', 'enable'],
},
},
{
name: 'get_beacon_tokenStore',
description: 'Get token store state for beacon',
inputSchema: {
type: 'object',
properties: {
beaconId: {
type: 'string',
description: 'The ID of the beacon',
},
},
required: ['beaconId'],
},
},
];
}
export async function handleStateTool(
name: string,
args: any,
client: CobaltStrikeClient
): Promise<string> {
switch (name) {
case 'set_beacon_sleep':
const sleepResult = await client.setBeaconSleep(args.beaconId, args.sleep, args.jitter);
return JSON.stringify({ success: sleepResult, message: sleepResult ? 'Sleep time updated' : 'Failed to update sleep time' }, null, 2);
case 'set_beacon_spawnto':
const spawntoResult = await client.setBeaconSpawnTo(args.beaconId, args.arch, args.path);
return JSON.stringify({ success: spawntoResult, message: spawntoResult ? 'Spawn-to updated' : 'Failed to update spawn-to' }, null, 2);
case 'set_beacon_ppid':
const ppidResult = await client.setBeaconPPID(args.beaconId, args.pid);
return JSON.stringify({ success: ppidResult, message: ppidResult ? 'PPID updated' : 'Failed to update PPID' }, null, 2);
case 'set_beacon_syscall_method':
const syscallResult = await client.setBeaconSyscallMethod(args.beaconId, args.method);
return JSON.stringify({ success: syscallResult, message: syscallResult ? 'Syscall method updated' : 'Failed to update syscall method' }, null, 2);
case 'get_beacon_jobs':
const jobs = await client.getBeaconJobs(args.beaconId);
return JSON.stringify(jobs, null, 2);
case 'set_beacon_dns_mode':
const dnsModeResult = await client.setBeaconDNSMode(args.beaconId, args.mode);
return JSON.stringify({ success: dnsModeResult, message: dnsModeResult ? 'DNS mode updated' : 'Failed to update DNS mode' }, null, 2);
case 'set_beacon_block_dlls':
const blockDllsResult = await client.setBeaconBlockDLLs(args.beaconId, args.enable);
return JSON.stringify({ success: blockDllsResult, message: blockDllsResult ? 'Block DLLs updated' : 'Failed to update block DLLs' }, null, 2);
case 'set_beacon_beacon_gate':
const beaconGateResult = await client.setBeaconBeaconGate(args.beaconId, args.enable);
return JSON.stringify({ success: beaconGateResult, message: beaconGateResult ? 'Beacon gate updated' : 'Failed to update beacon gate' }, null, 2);
case 'set_beacon_c2_host':
const c2HostResult = await client.setBeaconC2Host(args.beaconId, args.host);
return JSON.stringify({ success: c2HostResult, message: c2HostResult ? 'C2 host updated' : 'Failed to update C2 host' }, null, 2);
case 'set_beacon_c2_host_hold':
const c2HostHoldResult = await client.setBeaconC2HostHold(args.beaconId);
return JSON.stringify({ success: c2HostHoldResult, message: c2HostHoldResult ? 'C2 host held' : 'Failed to hold C2 host' }, null, 2);
case 'set_beacon_c2_host_release':
const c2HostReleaseResult = await client.setBeaconC2HostRelease(args.beaconId);
return JSON.stringify({ success: c2HostReleaseResult, message: c2HostReleaseResult ? 'C2 host released' : 'Failed to release C2 host' }, null, 2);
case 'set_beacon_c2_host_reset':
const c2HostResetResult = await client.setBeaconC2HostReset(args.beaconId);
return JSON.stringify({ success: c2HostResetResult, message: c2HostResetResult ? 'C2 host reset' : 'Failed to reset C2 host' }, null, 2);
case 'get_beacon_c2_host_profiles':
const c2Profiles = await client.getBeaconC2HostProfiles(args.beaconId);
return JSON.stringify(c2Profiles, null, 2);
case 'set_beacon_spoofed_arguments':
const spoofedArgsResult = await client.setBeaconSpoofedArguments(args.beaconId, args.arguments);
return JSON.stringify({ success: spoofedArgsResult, message: spoofedArgsResult ? 'Spoofed arguments updated' : 'Failed to update spoofed arguments' }, null, 2);
case 'set_beacon_c2_failover_notification':
const failoverNotifResult = await client.setBeaconC2FailoverNotification(args.beaconId, args.enable);
return JSON.stringify({ success: failoverNotifResult, message: failoverNotifResult ? 'Failover notification updated' : 'Failed to update failover notification' }, null, 2);
case 'get_beacon_tokenStore':
const tokenStore = await client.getBeaconTokenStore(args.beaconId);
return JSON.stringify(tokenStore, null, 2);
default:
throw new Error(`Unknown state tool: ${name}`);
}
}