Embed AES-256-GCM encrypted data inside packets indistinguishable from real OS pings. Multi-packet stealth reassembly, bidirectional C2 shell, APT timing profiles, OS signature mimicry — built for authorized red team operations.
ICMP as a covert channel with military-grade crypto and SOC-grade evasion.
Three AEAD algorithms (AES-256-GCM, ChaCha20-Poly1305, XOR-CFB-HMAC) with PBKDF2-SHA256 key derivation. Fixed per-algorithm salts enable deterministic key generation from a shared password — no key exchange needed.
Replicates byte patterns of real Linux ping (56-byte sequential) or Windows ping (32-byte alphabetic). Encrypted data is XOR-embedded into the authentic pattern. From the network, it looks like a standard ping.
Interactive shell over ICMP. Operator sends CMD:<id>:<command> packets; agent executes and replies RESP:<id>:<rc>:<stdout>. Entire exchange is encrypted.
Chunks any file into encrypted ICMP packets with ±25% size jitter per chunk. When stealth mode is active, each chunk is split across multiple 64-byte pings (indistinguishable from ping -s 56) with a 4-byte hidden fragment header. The listener reassembles all fragments before decryption.
Lazarus (5 min–1 hr), APT29 (30 min–2 hr), APT28 (10–30 min), Equation Group (1–3 days). Per-chunk adaptive delay blends long-running exfiltration into legitimate background traffic.
Checks system uptime, process count, and available resources on startup. Aborts before sending a single packet if sandbox indicators are detected. Thresholds configurable via config/ping-007.yml.
Requires Go 1.25+ and elevated privileges for raw ICMP sockets.
| Platform | Requirement | Workaround | Note |
|---|---|---|---|
| Linux / macOS | sudo or CAP_NET_RAW |
sudo setcap cap_net_raw+ep ./ping-007 |
OPSEC setcap writes a readable xattr on the binary — defenders scan for it. Use sudo in real ops. |
| Windows | Administrator (elevated terminal) | None — no capability system on Windows | Inbound ICMP blocked by Windows Defender by default (see below). Loopback testing doesn't work on Windows raw sockets. |
Windows — listener setup
On Windows, the host firewall (Windows Defender) blocks inbound ICMP echo by default. The sender works without changes, but the listener won't receive packets until you open it:
On enterprise networks, this is usually not needed — ICMP is almost universally allowed on corporate LANs because network teams rely on it for troubleshooting (ping, traceroute, path MTU discovery). The Windows Defender rule above only applies to the local host firewall, not to network-level policy. This is what makes ICMP a reliable lateral movement channel: the traffic blends with normal infrastructure monitoring.
Build
Send an encrypted message
Without -p — what NOT to do
| Command | Flag | Default | Description |
|---|---|---|---|
| global | -p / --password | — | Shared password — required for interoperable crypto |
| global | --no-banner | false | Suppress JSON logs and startup banner |
| basic | -t / --target | required | Target IP address |
| basic | -d / --data | — | Inline data to transmit |
| basic | --signature | linux | OS ping pattern: linux, windows, none |
| basic | --delay | 0 | Pre-send delay: 2s, 500ms |
| basic | --human-timing | false | Random 1–5s intervals between packets |
| basic | --ultra-stealth | false | All evasion techniques combined (timing + size + pattern) |
| basic | --decoy-pings | 0 | Send N clean OS-pattern pings before data to blend into traffic |
| basic | --after-pings | 0 | Send N clean pings after data to close session naturally |
| basic | --ping-interval | 1s | Interval between pings in a sequence (mirrors real ping) |
| basic | --no-encrypt | false | Send plaintext — no encryption, no encoding (raw bytes in ICMP) |
| basic | --encode | false | Base64-encode payload only (lower entropy than AES, no confidentiality) |
| exfil | -f / --file | required | File to exfiltrate |
| exfil | --mode | stealth | stealth (5–30s gap), fast (no delay), covert (30–120s gap) |
| exfil | --chunk-size | 512 | Base chunk size in bytes (±25% jitter applied per chunk) |
| exfil | --no-encrypt | false | Plaintext payload (no crypto) |
| exfil | --signature | linux | OS signature for TTL mimicry: linux (TTL=64), windows (TTL=128), none |
| shell | --mode | interactive | interactive (C2 over ICMP) or batch (local execution only) |
| shell | --jitter | 0 | Max random delay before each command packet (e.g. 3s); breaks metronomic C2 beacon detection |
| listen | -o / --output | ./received | Output directory for received files |
| listen | --method | icmp_tunnel | icmp_tunnel or shell (C2 agent mode) |
| listen | --timeout | 60 | Timeout in seconds |
| listen | -q / --quiet | false | Suppress per-packet output (for real ops — verbose logging is an OPSEC risk) |
| apt | -r / --profile | required | lazarus | apt29 | apt28 | equation |
| apt | --duration | 60 | Simulation duration in seconds |
Three AEAD algorithms with deterministic PBKDF2 key derivation. Algorithm auto-detected by receiver from 4-byte wire header.
| Algorithm | Key | Auth | Salt (fixed) | Status |
|---|---|---|---|---|
| AES-256-GCM | 256-bit | AEAD | ping007-aes-salt-v1 |
Active |
| ChaCha20-Poly1305 | 256-bit | AEAD | ping007-chacha20-salt-v1 |
Active |
| XOR-CFB + HMAC-SHA256 | 256-bit | HMAC | ping007-xor-salt-v1 |
Active |
| ECDH P-256 key exchange | — | — | — | TODO |
The salt is fixed and baked into the binary. Security relies entirely on password strength — a weak password is weak regardless of 100k PBKDF2 iterations. Use at least 20 random characters. Rotate between operations.
Implemented techniques only. Nothing here is theoretical.
Enterprise DLP solutions (Symantec, Forcepoint, Microsoft Purview) are L7 application proxies targeting HTTP/S, SMTP, FTP and cloud APIs. ICMP is a network-layer diagnostic protocol with no application session — most DLP appliances do not decode ICMP payloads at all.
ping -c N targeticmpsh · ptunnel · Hans · icmptunnel · Cobalt Strike ICMP beacon — they all work. None of them try to look like a real ping.
| ASPECT | icmpsh / ptunnel | CS ICMP beacon | PING-007 |
|---|---|---|---|
| Packet size | Arbitrary — 200–1500B | Non-standard fixed | 64B (Linux) / 40B (Windows) — exact OS |
| Payload content | Raw bytes / plaintext | Encrypted blob | XOR'd into real OS ping pattern |
| TTL | Kernel default (unset) | Uncontrolled | setsockopt: 64 (Linux) or 128 (Windows) |
| ICMP identifier | PID or static constant | Session-based constant | crypto/rand 16-bit per session |
| Sequence number | Starts at 0 | Counter from 0 | crypto/rand random start |
| Timing | Burst / fixed interval | Configurable beacon | 1s ± 10% jitter + inter-chunk gap |
| Fragmentation | Oversized single packet or IP frag | Single large packet | N × 64B echo requests — each looks like real ping |
| Decoy traffic | None | None | --decoy-pings / --after-pings |
| Encryption | None (icmpsh: plaintext) | XOR or AES payload only | AES-256-GCM / ChaCha20 / XOR-CFB-HMAC + PBKDF2 |
| Flagged by size rule? | Yes — always | Yes — always | No — identical to ping -s 56 |
Two tools with published technical analysis used ICMP as primary C2. Same premise — ICMP bypasses DLP. Neither asked the next question: "does my packet actually look like a real OS ping?" They stuffed data into the payload field and shipped it. Both were caught for avoidable reasons. PING-007 was built to answer that question correctly.
Sources: Trustwave SpiderLabs (Pingback, 2021) · Unit42 / Palo Alto (PingPull, 2022) · Corelight Zeek detection
itype:8; dsize:788; → 100% catch"shell\x00..."[8B: 03 41 40 7E 04 37 24 70]R[seq].[PROJECT_EXE_HOST_HEXIP]\r\ntotal=[n]\r\ncurrent=[n]\r\n[b64(AES-CBC(cmd))]03 41 40 7E 04 37 24 70R[n].PROJECT_... visibleP29456789A1234sS (recovered by Unit42)dC@133321Ikd!D^iPROJECT_HOST_IP leaks asset fingerprint| ASPECT | Pingback | PingPull (GALLIUM) | PING-007 |
|---|---|---|---|
| Packet size | 788B fixed — no OS does this | Variable, oversized blob | 64B (Linux) / 40B (Windows) — exact OS |
| Payload content | Plaintext C struct, "shell\x00..." |
8B prefix + ASCII header + b64-AES | XOR into OS ping pattern (timeval / abcdefgh...) |
| TTL | Kernel default | Kernel default | setsockopt: 64 (Linux) / 128 (Windows) |
| Sequence numbers | {1234, 1235, 1236} — always | Incremental from 0 | crypto/rand start per session |
| ICMP identifier | Not randomized | Constant per session | crypto/rand 16-bit per session |
| Encryption | None | AES-256-CBC, key in binary | PBKDF2(100k) → AES-256-GCM / ChaCha20 |
| Key in binary? | N/A | Yes — recoverable by reversing | No — runtime PBKDF2 from password |
| Asset fingerprint leak | None | Hostname + exe + IP in every packet | Nothing — OS ping pattern only |
| Minimal catch rule | itype:8; dsize:788; |
content:"PROJECT_"; |
No static indicator — random size, seq, id, pattern |
Linux: 56-byte, 0x08,0x09,…
Windows: 32-byte, abcdefgh…
Data XOR'd into real pattern
Always 64/40 bytes on the wire
Large payloads → N×64-byte pings
4-byte frag header hidden in XOR zone
[0xA7][session][frag_id][total]
Receiver reassembles before decrypt
TTL: 64 (Linux) / 128 (Windows)
ICMP ID: crypto/rand per session
Seq: crypto/rand start
Breaks OS fingerprinting
--human-timing / --jitter
Random 1–5s between packets
1s ±10% jitter within frags
Looks like admin doing ping -c N
--decoy-pings / --after-pings
Clean OS pings wrap the data
Makes isolated ICMP events disappear
Shell: --jitter breaks beacon timing
Algorithm random at session start
AES / ChaCha20 / XOR-CFB-HMAC
First ciphertext byte varies
Breaks cross-session PCAP correlation
All technical claims verified against published security research.