How z3vxo/goblinloader works
GoblinLoader combines an operator-facing C2 service with Windows agents and memory-loading components. Operators log in, manage campaigns and files, and receive live updates; agents check in and obtain campaign tasking and payloads. The backend’s route registration, authentication, file handling, task storage, and protocol parsing are sampled; agent-handler and loader internals are represented at the documented subsystem level where source excerpts were not provided.
Main entry points: server.go HTTP server and routes · Dashboard.jsx Dashboard · agent_handlers.go Agent handlers · comms.c C2 communications
Components 26
Operator interface
- Web application
server/frontend/src/App.jsx - Login page
server/frontend/src/pages/Login.jsx - Dashboard
server/frontend/src/pages/Dashboard.jsx - Campaign controls
server/frontend/src/pages/tabs/CampaignTab.jsx - File controls
server/frontend/src/pages/tabs/FilesTab.jsx - Agent and users view
server/frontend/src/pages/tabs/UsersTab.jsx - Live socket context
server/frontend/src/context/SocketContext.jsx - Campaign context
server/frontend/src/context/CampaignContext.jsx
C2 backend
- HTTP server and routes
server/backend/internal/server/server.go - Login and auth
server/backend/internal/server/auth_handlers.go - Agent handlers
server/backend/internal/server/agent_handlers.go - Campaign handlers
server/backend/internal/server/campaing_handlers.go - File handling
server/backend/internal/server/file_handlers.go - WebSocket hub
server/backend/internal/ws/ws.go - SQLite persistence
server/backend/internal/database/database.go - Task persistence
server/backend/internal/database/db_tasks.go - Agent protocol parser
server/backend/internal/parser/parser_read.go
Core implant
- Windows agent
ldr/src/entry.c - C2 communications
ldr/src/comms/comms.c - Binary protocol parser
ldr/src/parser/parser.c - Custom modules
modules/ls.c
Loading components
- Reflective DLL loader
rLdr/core/loader.c - Direct syscalls
rLdr/core/syscalls.c - EXE process mapping
exemap/core/loader.c
Other components
- Operator
- Payload file
Connections 30
- Operator → Web application: uses
- Web application → Login page: routes to
- Web application → Dashboard: routes to
- Dashboard → Campaign controls: renders
- Dashboard → File controls: renders
- Dashboard → Agent and users view: renders
- Login page → HTTP server and routes: logs in via
- HTTP server and routes → Login and auth: dispatches
- Login and auth → SQLite persistence: verifies credentials
- Campaign controls → HTTP server and routes: manages campaigns
- File controls → HTTP server and routes: manages files
- HTTP server and routes → Campaign handlers: dispatches
- HTTP server and routes → File handling: dispatches
- File handling → SQLite persistence: stores metadata
- File handling → Payload file: writes file
- HTTP server and routes → Agent handlers: dispatches
- Agent handlers → Agent protocol parser: parses messages
- Agent handlers → Task persistence: reads and creates tasks
- HTTP server and routes → WebSocket hub: serves socket
- WebSocket hub → Live socket context: pushes updates
- Live socket context → Campaign context: provides events
- Windows agent → C2 communications: uses
- C2 communications → HTTP server and routes: checks in and requests tasks
- C2 communications → Binary protocol parser: encodes and parses
- Agent handlers → C2 communications: returns tasking
- Windows agent → Custom modules: loads modules
- Payload file → Windows agent: is tasked to
- Payload file → Reflective DLL loader: DLL input
- Reflective DLL loader → Direct syscalls: uses
- Payload file → EXE process mapping: EXE input