Embed AES-256-GCM encrypted data inside packets indistinguishable from real OS pings. Multi-packet stealth reassembly, bidirectional C2 shell, timing profiles, OS signature mimicry - built for authorized red team operations.
ICMP as a covert channel: AES-256-GCM / ChaCha20-Poly1305 / XOR-CFB-HMAC encryption with per-session algorithm rotation and full evasion stack.
Three AEAD algorithms (AES-256-GCM, ChaCha20-Poly1305, XOR-CFB-HMAC) with PBKDF2-SHA256 key derivation. Fixed per-algorithm salts enable deterministic key generation from a shared password — no key exchange needed.
Replicates byte patterns of real Linux ping (56-byte sequential) or Windows ping (32-byte alphabetic). Encrypted data is XOR-embedded into the authentic pattern. From the network, it looks like a standard ping.
Interactive shell over ICMP. Operator sends CMD:<id>:<command> packets; agent executes and replies RESP:<id>:<rc>:<stdout>. Entire exchange is encrypted.
Chunks any file into encrypted ICMP packets with ±25% size jitter per chunk. When stealth mode is active, each chunk is split across multiple 64-byte pings (indistinguishable from ping -s 56) with a 4-byte hidden fragment header. The listener reassembles all fragments before decryption.
Lazarus (5 min–1 hr), APT29 (30 min–2 hr), APT28 (10–30 min), Equation Group (1–3 days). Per-chunk adaptive delay blends long-running exfiltration into legitimate background traffic.
Checks system uptime, process count, and available resources on startup. Aborts before sending a single packet if sandbox indicators are detected. Thresholds configurable via config/ping-007.yml.
Requires Go 1.25+ and elevated privileges for raw ICMP sockets.
| Platform | Requirement | Workaround | Note |
|---|---|---|---|
| Linux / macOS | sudo or CAP_NET_RAW |
sudo setcap cap_net_raw+ep ./ping-007 |
OPSEC setcap writes a readable xattr on the binary — defenders scan for it. Use sudo in real ops. |
| Windows | Administrator (elevated terminal) | None — no capability system on Windows | Inbound ICMP blocked by Windows Defender by default (see below). Loopback testing doesn't work on Windows raw sockets. |
Windows — listener setup
On Windows, the host firewall (Windows Defender) blocks inbound ICMP echo by default. The sender works without changes, but the listener won't receive packets until you open it:
On enterprise networks, this is usually not needed — ICMP is almost universally allowed on corporate LANs because network teams rely on it for troubleshooting (ping, traceroute, path MTU discovery). The Windows Defender rule above only applies to the local host firewall, not to network-level policy. This is what makes ICMP a reliable lateral movement channel: the traffic blends with normal infrastructure monitoring.
Build
Send an encrypted message
Without -p — what NOT to do
| Command | Flag | Default | Description |
|---|---|---|---|
| global | -p / --password | — | Shared password — required for interoperable crypto |
| global | --no-banner | false | Suppress JSON logs and startup banner |
| global | -c / --config | ./config/ping-007.yml | Config file path — explicit path bypasses the default search order |
| global | --allow-all-targets | false | Bypass authorized_targets / forbidden_targets CIDR validation — use in lab or red team ops where the config whitelist blocks the actual target |
| basic | -t / --target | required | Target IP address |
| basic | -d / --data | — | Inline data to transmit |
| basic | --signature | linux | OS ping pattern: linux, windows, none |
| basic | --delay | 0 | Pre-send delay: 2s, 500ms |
| basic | --human-timing | false | Random 1–5s intervals between packets |
| basic | --ultra-stealth | false | All evasion techniques combined (timing + size + pattern) |
| basic | --decoy-pings | 0 | Send N clean OS-pattern pings before data to blend into traffic |
| basic | --after-pings | 0 | Send N clean pings after data to close session naturally |
| basic | --ping-interval | 1s | Interval between pings in a sequence (mirrors real ping) |
| basic | --icmp-id | os | ICMP identifier override: os (PID on Linux / 0x0001 on Windows), random, or a numeric 0–65535 value |
| basic | --no-encrypt | false | Send plaintext — no encryption, no encoding (raw bytes in ICMP) |
| basic | --encode | false | Base64-encode payload only (lower entropy than AES, no confidentiality) |
| exfil | -f / --file | required | File to exfiltrate |
| exfil | --mode | stealth | stealth (5–30s gap), fast (no delay), covert (30–120s gap) |
| exfil | --chunk-size | 512 | Base chunk size in bytes (±25% jitter applied per chunk) |
| exfil | --no-encrypt | false | Plaintext payload (no crypto) |
| exfil | --signature | linux | OS signature for TTL mimicry: linux (TTL=64), windows (TTL=128), none |
| exfil | --icmp-id | os | ICMP identifier override: os (PID on Linux / 0x0001 on Windows), random, or a numeric 0–65535 value |
| shell | --mode | interactive | interactive (C2 over ICMP) or batch (local execution only) |
| shell | --jitter | 0 | Max random delay before each command packet (e.g. 3s); breaks metronomic C2 beacon detection |
| listen | -o / --output | ./received | Output directory for received files |
| listen | --method | icmp_tunnel | icmp_tunnel (default) or icmp_payload |
| listen | --timeout | 60 | Timeout in seconds |
| listen | -q / --quiet | false | Suppress per-packet output (for real ops — verbose logging is an OPSEC risk) |
| apt | -r / --profile | required | lazarus | apt29 | apt28 | equation |
| apt | --duration | 60 | Simulation duration in seconds |
| apt | --list | false | Print all available timing profiles with intervals and exit (no root required) |
Three AEAD algorithms with deterministic PBKDF2 key derivation. Algorithm auto-detected by receiver from 4-byte wire header.
| Algorithm | Key | Auth | Salt (fixed) | Status |
|---|---|---|---|---|
| AES-256-GCM | 256-bit | AEAD | ping007-aes-salt-v1 |
Active |
| ChaCha20-Poly1305 | 256-bit | AEAD | ping007-chacha20-salt-v1 |
Active |
| XOR-CFB + HMAC-SHA256 | 256-bit | HMAC | ping007-xor-salt-v1 |
Active |
| ECDH P-256 key exchange | — | — | — | TODO |
The salt is fixed and baked into the binary. Security relies entirely on password strength — a weak password is weak regardless of 100k PBKDF2 iterations. Use at least 20 random characters. Rotate between operations.
Implemented techniques only. Nothing here is theoretical.
Enterprise DLP solutions (Symantec, Forcepoint, Microsoft Purview) are L7 application proxies targeting HTTP/S, SMTP, FTP and cloud APIs. ICMP is a network-layer diagnostic protocol with no application session — most DLP appliances do not decode ICMP payloads at all.
ping -c N targeticmpsh · ptunnel · PingPull · Pingback — they all work. None of them try to look like a real ping.
| ASPECT | icmpsh / ptunnel | Pingback / PingPull | PING-007 |
|---|---|---|---|
| Packet size | Arbitrary — 200–1500B | Fixed 788B / oversized blob | 64B (Linux) / 40B (Windows) — exact OS |
| Payload content | Raw bytes / plaintext | Plaintext struct / [8B prefix]+b64 | XOR'd into real OS ping pattern |
| TTL | Kernel default (unset) | Kernel default (unset) | setsockopt: 64 (Linux) or 128 (Windows) |
| ICMP identifier | PID or static constant | Arbitrary constant | getpid() & 0xFFFF (Linux) / 0x0001 (Windows) — matches real OS |
| Sequence number | Starts at 0 | Fixed {1234,1235,1236} / from 0 | Starts at 1, +1 per packet — matches real OS ping |
| Timing | Burst / fixed interval | Fixed / none documented | 1s ± 10% jitter + inter-chunk gap |
| Fragmentation | Oversized single packet or IP frag | Single oversized packet | N × 64B echo requests — each looks like real ping |
| Decoy traffic | None | None | --decoy-pings / --after-pings |
| Encryption | None (icmpsh: plaintext) | None / AES-CBC hardcoded keys | AES-256-GCM / ChaCha20 / XOR-CFB-HMAC + PBKDF2 |
| Flagged by size rule? | Yes — always | Yes — always | No — identical to ping -s 56 |
Two tools with published technical analysis used ICMP as primary C2. Same premise — ICMP bypasses DLP. Neither asked the next question: "does my packet actually look like a real OS ping?" They stuffed data into the payload field and shipped it. Both were caught for avoidable reasons. PING-007 was built to answer that question correctly.
Sources: Trustwave SpiderLabs (Pingback, 2021) · Unit42 / Palo Alto (PingPull, 2022) · Corelight Zeek detection
itype:8; dsize:788; → 100% catch"shell\x00..."[8B: 03 41 40 7E 04 37 24 70]R[seq].[PROJECT_EXE_HOST_HEXIP]\r\ntotal=[n]\r\ncurrent=[n]\r\n[b64(AES-CBC(cmd))]03 41 40 7E 04 37 24 70R[n].PROJECT_... visibleP29456789A1234sS (recovered by Unit42)dC@133321Ikd!D^iPROJECT_HOST_IP leaks asset fingerprint| ASPECT | Pingback | PingPull (GALLIUM) | PING-007 |
|---|---|---|---|
| Packet size | 788B fixed — no OS does this | Variable, oversized blob | 64B (Linux) / 40B (Windows) — exact OS |
| Payload content | Plaintext C struct, "shell\x00..." |
8B prefix + ASCII header + b64-AES | XOR into OS ping pattern (timeval / abcdefgh...) |
| TTL | Kernel default | Kernel default | setsockopt: 64 (Linux) / 128 (Windows) |
| Sequence numbers | {1234, 1235, 1236} — always | Incremental from 0 | Starts at 1, +1 per packet — identical to OS ping |
| ICMP identifier | Not randomized | Constant per session | getpid() & 0xFFFF (Linux) / 0x0001 (Windows) — matches real OS |
| Encryption | None | AES-256-CBC, key in binary | PBKDF2(100k) → AES-256-GCM / ChaCha20 |
| Key in binary? | N/A | Yes — recoverable by reversing | No — runtime PBKDF2 from password |
| Asset fingerprint leak | None | Hostname + exe + IP in every packet | Nothing — OS ping pattern only |
| Minimal catch rule | itype:8; dsize:788; |
content:"PROJECT_"; |
No static indicator — OS-native id+seq, XOR'd OS pattern, variable size |
Linux: 56-byte, 0x10,0x11,…
Windows: 32-byte, abcdefgh…
Data XOR'd into real pattern
Always 64/40 bytes on the wire
Large payloads → N×64-byte pings
4-byte frag header hidden in XOR zone
[0xA7][session][frag_id][total]
Receiver reassembles before decrypt
TTL: 64 (Linux) / 128 (Windows)
ICMP ID: getpid() (Linux) / 0x0001 (Windows)
Seq: starts at 1, +1 per packet
Identical to real OS ping
--human-timing / --jitter
Random 1–5s between packets
1s ±10% jitter within frags
Looks like admin doing ping -c N
--decoy-pings / --after-pings
Clean OS pings wrap the data
Makes isolated ICMP events disappear
Shell: --jitter breaks beacon timing
Algorithm random at session start
AES / ChaCha20 / XOR-CFB-HMAC
First ciphertext byte varies
Breaks cross-session PCAP correlation
All technical claims verified against published security research.