updating tcp profile definition

Author: its-a-feature

Payload_Type/poseidon/poseidon/agent_code/CHANGELOG.MD

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [2.3.1] - 2026-03-23
+
+### Changed
+
+- Added `localhost_only` `tcp` option to match updated `tcp` c2 profile
+
 ## [2.3.0] - 2026-03-17
 
 ### Changed

Payload_Type/poseidon/poseidon/agent_code/pkg/profiles/tcp.go

@@ -33,6 +33,7 @@ type TCPInitialConfig struct {
 	Killdate               string
 	EncryptedExchangeCheck bool
 	AESPSK                 string
+	LocalhostOnly          bool
 }
 
 func (e *TCPInitialConfig) UnmarshalJSON(data []byte) error {
@@ -53,6 +54,9 @@ func (e *TCPInitialConfig) UnmarshalJSON(data []byte) error {
 	if v, ok := alias["AESPSK"]; ok {
 		e.AESPSK = v.(string)
 	}
+	if v, ok := alias["localhost_only"]; ok {
+		e.LocalhostOnly = v.(bool)
+	}
 
 	return nil
 }
@@ -71,6 +75,7 @@ type C2PoseidonTCP struct {
 	PushChannel          chan structs.MythicMessage
 	stopListeningChannel chan bool
 	chunkSize            uint32
+	LocalhostOnly        bool
 }
 
 func (e C2PoseidonTCP) MarshalJSON() ([]byte, error) {
@@ -79,6 +84,7 @@ func (e C2PoseidonTCP) MarshalJSON() ([]byte, error) {
 		"RsaPrivateKey": e.RsaPrivateKey,
 		"Port":          e.Port,
 		"Killdate":      e.Killdate,
+		"LocalhostOnly": e.LocalhostOnly,
 	}
 	return json.Marshal(alias)
 }
@@ -112,6 +118,7 @@ func init() {
 		PushChannel:          make(chan structs.MythicMessage, 1000),
 		stopListeningChannel: make(chan bool, 1),
 		chunkSize:            poseidonChunkSize,
+		LocalhostOnly:        initialConfig.LocalhostOnly,
 	}
 	// these two functions only need to happen once, not each time the profile is started
 	go profile.CreateMessagesForEgressConnections()
@@ -141,7 +148,11 @@ func (c *C2PoseidonTCP) Start() {
 		c.stoppedChannel <- true
 	}()
 	for {
-		listen, err = net.Listen("tcp", fmt.Sprintf("0.0.0.0:%s", c.Port))
+		listenAddress := fmt.Sprintf("0.0.0.0:%s", c.Port)
+		if c.LocalhostOnly {
+			listenAddress = fmt.Sprintf("127.0.0.1:%s", c.Port)
+		}
+		listen, err = net.Listen("tcp", listenAddress)
 
 		if err != nil {
 			utils.PrintDebug(fmt.Sprintf("Failed to bind: %v\n", err))

Payload_Type/poseidon/poseidon/agent_code/test_agent_config_tcp.json

@@ -2,5 +2,6 @@
   "port": 8085,
   "killdate": "2026-12-31",
   "encrypted_exchange_check": true,
-  "AESPSK": "dNpxaDKHQiOF1v7BpqJHoNWcwZGItdNo99O9KzFr5xc="
+  "AESPSK": "dNpxaDKHQiOF1v7BpqJHoNWcwZGItdNo99O9KzFr5xc=",
+  "localhost_only": false
 }

Payload_Type/poseidon/poseidon/agentfunctions/builder.go

@@ -21,7 +21,7 @@ import (
 	"golang.org/x/exp/slices"
 )
 
-const version = "2.3.0"
+const version = "2.3.1"
 
 type sleepInfoStruct struct {
 	Interval int       `json:"interval"`
@@ -359,7 +359,7 @@ func build(payloadBuildMsg agentstructs.PayloadBuildMessage) agentstructs.Payloa
 				}
 
 				//ldflags += fmt.Sprintf(" -X '%s.%s_%s=%v'", poseidon_repo_profile, payloadBuildMsg.C2Profiles[index].Name, key, val)
-			} else if slices.Contains([]string{"encrypted_exchange_check"}, key) {
+			} else if slices.Contains([]string{"encrypted_exchange_check", "localhost_only"}, key) {
 				val, err := payloadBuildMsg.C2Profiles[index].GetBooleanArg(key)
 				if err != nil {
 					stringVal, err := payloadBuildMsg.C2Profiles[index].GetStringArg(key)