Releases: InjectionSoftwareandSecurityLLC/lupo
Releases · InjectionSoftwareandSecurityLLC/lupo
Release list
Lupo v1.3.3
431 header response hotfix
Lupo v1.3.2
- Adds lupo_implant_browser.js — browser-side JavaScript Lupo implant using fetch() over HTTP or HTTPS
- Fixes HTTPServerHandler missing CORS headers — adds Access-Control-Allow-Origin: *, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and OPTIONS preflight handling so browser implants can read cross-origin responses
- Also goes stoopy with the Golang cross-compilation and new automated Github Actions build workflow for releases. Now you can curl a Lupo server/client binary from your ARMv5 based potato if you want 🤷.
v1.3.1
- Adds bof_loader session subcommand to deliver and execute BOF/COFF object file payloads synchronously on a target implant, with typed argument passing via -a flag using a type-prefix syntax (wstring:, string:, int:, short:)
- Adds bof_loader_async session subcommand (Experimental) to deliver and execute BOF/COFF object file payloads in a non-blocking background goroutine; results are queued on the implant and returned to all connected operators on the next check-in after completion
- Adds pe_loader session subcommand to deliver and execute PE (portable executable) payloads in-memory on a target implant with optional argument passing
- Adds stager command with start, show, and kill subcommands for hosting a static HTTP or HTTPS file server from a local directory directly within the Lupo CLI — useful for multi-stage implant delivery and DLL staging
- Adds BroadcastSessionData() helper in sessions.go to broadcast session output data to all connected Wolfpack operators
- Updates api.md with bof_loader, bof_loader_async, and pe_loader endpoint specifications for HTTP(S), TCP, and DNS listeners
- Updates general_cli.md with stager command documentation and bof_loader, bof_loader_async, and pe_loader session subcommand documentation
- Updates docs/IMPLANT_GENERATION_TEMPLATE.md to document in-memory state management, the three new command handler cases, BOF argument packing, and the async result queue pattern
v1.3.0
- Adds DNS C2 protocol support with TXT record-based command and control using base64-encoded, chunked payloads
- Adds complete DNS API documentation with query/response formats, parameter definitions, and practical examples
- Adds LLM-compatible API specification with structured parameter definitions for programmatic implant generation
- Fixes TCP API parameter naming (PSK, SessionID, UUID, ImplantArch, Update, Data, etc.) to align with actual server implementation
- Fixes DNS API parameter naming to match server struct fields for consistency across protocols
- Adds mem_inject and pid_inject feature documentation for in-memory and remote process code injection
- Adds DNS protocol examples demonstrating registration, command execution, and data transmission workflows
v1.2.0
- Fixes bug caused by nested grumble session management. If a user started Lupo and entered the Session sub-shell they would break the Wolfpack server due to a global variable that saved the state of the Session sub-shell in memory even after the shell was destroyed when backing out. This was fixed by introducing a new global that can be managed separately from the server's CLI state.
- Implements new multi session execution feature - run a command across multiple sessions using the interact cmd sub command. This new sub command allow you execute a command across one, many, or all sessions and can be filtered using comma separated sessions, a range, or by filtering on the Arch (OS) field.
- Improves automation with the new interact cmd subcommand allowing operators to more easily automate post-exploitation commands using the resource file feature. Previously not possible due to the nested Session sub-shell conflicting with the run automation for the resource file within the Grumble CLI.