CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

sliver

Sliver Sliver is an open-source, cross-platform adversary emulation and red team framework designed for organizations of all sizes to perform authorized security testing. Sliver implants support command-and-control C2 over Mutual TLS mTLS, WireGuard, HTTPS, and DNS. Implants are dynamically...

smtpshell

smtpshell A simple Reverse Shell that can communicate through Gmail SMTP or any other SMTP to evade network restrictions Note: This reverse shell communicates Via Gmail SMTP or u can use any other smtps as well but Gmail SMTP is valid because most of the companies block unknown traffic so gmail...

Phoenix-Framework

Phoenix-Framework Phoenix is an async based post exploitation framework that abuses trusted sites for C2. Supported Platforms Phoenix currently supports the following platforms via their Bot APIs: Discord Telegram Reddit Coming soon Phoenix offers the basic following features : String Obfuscation...

DNSStager

What is DNSStager? DNSStager is an open-source project based on Python used to hide and transfer your payload using DNS. DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as AAAA or TXT...

WSC2

WSC2 LAST/CURRENT VERSION: 0.1 Author: Arno0x0x - @Arno0x0x WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. The tool is distributed under the terms o...

SharpFtpC2

SharpFtpC2 PoC SharpFtpC2 is a small, experimental project aimed at exploring the possibility of using FTPS for relaying commands and responses between two remote computers. It employs the FTP protocol as a makeshift tunnel through which the computers, both acting as clients connected to an FTP...

wikipedia-c2

Wikipedia-C2 Wikipedia C2 ブログ記事 これは、Wikipediaを利用したC2（Command and Control）を実証するためのデモプロジェクトです。Josh Abraham氏によるSlackとICMPを利用したC2のデモを見て、インターネットの主要サイトの中に他にC2に使える選択肢があるか探ってみようと思いました。WikipediaのAPIを確認したところ、user-jsarbitraryKeyNameに「任意の値」を設定できるユーザーオプションがあることを発見しました。その後、最大長が65535文字であることもわかり、C2には十分すぎる容量です。...

external_c2_framework

externalc2 framework Cobalt Strike의 External C2 사양사양 참조과 함께 사용하기 위한 Python 프레임워크입니다. 주요 설계 목표는 Cobalt Strike용 C2 채널을 쉽게 구현할 수 있을 만큼 충분한 추상화를 제공하는, 외부 C2 사양의 매우 모듈식 구현체를 만드는 것입니다. 이상적으로, 사용자는 새 채널을 구현하기 위해 transport 모듈, encoder 모듈을 만들고 구성 파일을 채우기만 하면 됩니다. Dropbox Transport 구성 실행하기 전에 몇 가지 구성 변경을...

OneDrive-UDC2

OneDrive UDC2 OneDrive를 전송 계층으로 사용하는 Cobalt Strike 사용자 정의 C2 채널입니다. 필요한 것 OneDrive for Business를 사용하는 사용자가 있는 Microsoft Entra ID 테넌트. Files.ReadWrite.All 애플리케이션 권한이 있는 앱 등록. 설정 1. 애플리케이션 등록 Azure Portal에서 App registrations 로 이동하여 새 앱을 만듭니다: Account type: Single tenant. Redirect URI: 비워 둡니다. 개요...

WebDavC2

WebDAVC2 LAST/CURRENT VERSION: 0.3 Author: Arno0x0x - @Arno0x0x WebDavC2 is a PoC of using the WebDAV protocol with PROPFIND only requests to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. The tool is distribute...

BlockchainC2

BlockchainC2 BlockchainC2は、攻撃者がC2にブロックチェーン（特にEthereumのスマートコントラクト機能）をどのように利用できるかを評価するための小さなPOCサーバー/エージェントです。 このアプリケーションの詳細はこちらで確認できます。 スマートコントラクト このPOC内で使用されるスマートコントラクトは非常にシンプルです: pragma solidity ^0.5.0; contract EventC2 address owner; event ServerDatabool f, bool enc, int seq, string agentID,...

Powershell-C2

Powershell-C2 이 공격은 제 Powershell Payload Excel Delivery에서 파생된 것으로, 대상 시스템에서 C2Command and Control/지속성persistence을 위한 매우 멋진 방법을 사용합니다. 워크스루는 여기에서 확인할 수 있습니다: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/ 이 방법에 대한 크레딧은 @obscuresec와...

secret_handshake

Secret Handshake - mTLS를 통한 x509 인증서를 사용하는 악성코드 C2 채널 동기 먼저, 왜 이것을 오픈소스로 공개하는가? MITRE ATT&CK는 탈취되거나 자체 서명된 인증서에 대해서만 다루며, NDR네트워크 탐지 및 대응은 내가 아는 한 x509 인증서의 내용에 대해 발급 CA가 누구인지 외에는 거의 주의를 기울이지 않는다. 일반적으로 x509 인증서는 신뢰되며 우리 방화벽을 아무런 제재 없이 통과하도록 허용된다. 그러나 본질적으로 인증서는 다른 파일과 마찬가지로 악성 페이로드를 쉽게 포함할 수 있는...

siphondns

SiphonDNS この研究で説明されている技術のPoCです。 DNSの非標準セクションを介したデータ外部送信（exfiltration）を実装します。 サーバー: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving data............................................................................ Response: uid=1000kali gid=1000kali...

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

MAL-2026-13955 Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Malicious code in 7miners (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7501eb0620c75479fa4614362aaa6c5766c8cc2f3b4d8829db6a44ca086cc374 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...

Malicious code in trustwallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ffef6e3541d5ab62ee32f0d44e9da05c6e495c15a4c9a9d9a4866e40ae502604 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...