Listener Plugin (SC)

This page covers authoring choices for a listener plugin delivered as shellcode (SC). For ExecUnit formats, responsibilities, and platform differences, start with Listener ExecUnits.

Authoring options

When creating listener plugin shellcode, you have two options:

1. Write Native Shellcode: Develop the shellcode directly using assembly language and C.
2. Convert Executable to Shellcode: Write the code in C/C++ or C# and convert the resulting executable to shellcode using tools like Donut.

The original listener example uses C#.

Shellcode main activities

The listener receives configuration from its server-side plugin and carries communication between that plugin and the agent core. Its responsibilities include relaying agent metadata and upstream data to the server, and passing received server data to the agent.

See Listener ExecUnits for these responsibilities in context. Type-Length-Value (TLV) encoding and the listener message definitions are maintained under Architecture > Protocols.

Examples

The sections below point to the protocol reference for the subjects covered by the original examples.

Data packets exchanged between shellcode and agents

See the listener protocol's packet framing and the shared TLV encoding.

When shellcode starts

The listener's server plugin supplies its configuration. See Listener ExecUnits for the role's responsibilities and the configuration-change messages for the corresponding protocol reference.

Sequence number on some requests from shellcode to agent

The metadata and upstream-data references describe their request and response fields.

Asking metadata

See Get metadata for the message definitions.

Asking upstream data to send

See Get next message to send to C2 for the message definitions. C2 means Command and Control.

Relay data from server to agent

See Give agent core a new message received from C2 for the message definition and response behavior.