Malleable-C2-Randomizer

Malleable-C2-Randomizer このスクリプトは、メタ言語を通して Cobalt Strike の Malleable C2 プロファイルをランダム化し、シグネチャベースの検知コントロールにフラグを立てられる可能性を減らすことを目的としています。簡単に言うと、スクリプトは指定されたテンプレートを解析し、提供されたワードリストまたは内蔵ワードリストからランダムな値を変数に代入し、 c2lint で新しいテンプレートをテストし、 c2lint エラーがない場合 新しい Malleable C2 プロファイルを出力します。 このスクリプトと互換性のあるサンプルの Malleab...

SourcePoint

SourcePoint SourcePoint는 Go로 작성된 Cobalt Strike C2용 다형성 C2 프로필 생성기입니다. SourcePoint는 즉석에서 고유한 C2 프로필을 생성할 수 있게 해주어 우리의 침해 지표"IoCs"를 줄이는 데 도움을 주며, 운영자가 최소한의 노력으로 복잡한 프로필을 생성할 수 있게 합니다. 이는 핵심 기능과 수정 가능한 기능을 식별하기 위해 문서와 패치 노트를 광범위하게 검토함으로써 이루어졌습니다. SourcePoint는 우리의 C2 활동을 탐지하기 더 어렵게 만드는 문제를 해결하려는 의도로...

httpx

httpx これはhttpxと呼ばれるMythic C2プロファイルです。これはMythic向けのコミュニティリクエストC2プロファイルであり、より動的で設定可能なHTTPプロファイルを提供します。 このプロファイルは以下の機能を提供します: コールバックドメイン値の配列 ドメインローテーションフェイルオーバーおよびラウンドロビン ドメインフォールバックしきい値フェイルオーバー時に、次のドメインに移るまでに何回失敗するか 暗号化キー交換およびAES256キー付きHMAC コールバックのジッターとスリープ間隔...

geacon

Geacon Go를 사용하여 CobaltStrike의 Beacon 구현 이 프로젝트는 프로토콜 분석 및 리버스 엔지니어링 학습 목적으로만 사용되며, 누군가의 권리를 침해한 경우 프로젝트를 삭제할 수 있도록 연락해 주시기 바랍니다. 마지막으로, 불법적으로 사용하지 마십시오 사용 방법 1. 팀서버를 설정하고 HTTP 리스너를 시작하면, 팀서버가 .cobaltstrike.beaconkeys 파일을 생성합니다. 2. Jetbrains Idea로 BeaconTool을 컴파일하고, java -jar BeaconTool.jar 명령어를...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

lldp

lldp IEEE 802.1AB（LLDP）を介したピアツーピア通信用の Mythic C2 プロファイル。C2 データは、設定可能な OUI を持つ Organizationally Specific TLV（タイプ 127）内に格納され、フレームがネットワーク上でベンダー固有の LLDP 拡張に紛れるようにします。 LLDP はレイヤー 2 のみです。両方のエージェントが同じブロードキャストドメインを共有している必要があります。egress エージェント（HTTP/HTTPX）は、SMB および TCP P2P プロファイルと同様に、LLDP でリンクされたエージェントを Myth...

CVE-2026-57952

Mythic before 3.4.0.60 contains an authorization bypass in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpo...

CVE-2026-57952 Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

CVE-2026-57952: Missing Authorization

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check

0x00 Introduction Tool introduction RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex re...

PickleC2 - A Post-Exploitation And Lateral Movements Framework

PickleC2 is a post-exploitation and lateral movements framework. Documentation ReadTheDocs Overview PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements. PickleC2 has the ability to import your own PowerShell modul...

Nimplant - A Cross-Platform Implant Written In Nim

Nimplant is a cross-platform Linux & Windows implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated...

APT29 Re-Emerges After 2 Years with Widespread Espionage Campaign

A phishing campaign bent on espionage, believed to be launched by the nation-state threat group known as APT29, is targeting high-value targets across the think-tank, law enforcement, media, U.S. military, imagery, transportation, pharmaceutical, national government and defense contracting sector...