geacon

Geacon Использование Go для реализации Beacon от CobaltStrike Этот проект предназначен только для изучения анализа протоколов и обратной разработки. Если чьи-то права были нарушены, пожалуйста, свяжитесь со мной для удаления проекта. И последнее: НЕ ИСПОЛЬЗУЙТЕ ЕГО НЕЗАКОННО Как играть 1. Настрой...

SourcePoint

SourcePoint SourcePoint — это полиморфный генератор профилей C2 для Cobalt Strike C2, написанный на Go. SourcePoint позволяет создавать уникальные профили C2 на лету, что помогает уменьшить наши индикаторы компрометации «IoCs» и позволяет оператору создавать сложные профили с минимальными усилиям...

Malleable-C2-Randomizer

Malleable-C2-Randomizer Этот скрипт рандомизирует Malleable C2 профили Cobalt Strike с помощью метаязыка, что, надеемся, снизит вероятность срабатывания сигнатурных средств обнаружения. Вкратце, скрипт разбирает предоставленный шаблон, заменяет переменные на случайные значения из предоставленного...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

httpx

httpx 이것은 httpx라는 Mythic C2 프로필입니다. 더 동적이고 구성 가능한 HTTP 프로필을 제공하는 Mythic용 커뮤니티 요청 C2 프로필입니다. 이 프로필은 다음과 같은 기능을 제공합니다: 콜백 도메인 값의 배열 도메인 로테이션 장애 조치 및 라운드 로빈 도메인 폴백 임계값 장애 조치 시 다음 도메인으로 넘어가기 전까지의 실패 시도 횟수 암호화된 키 교환 및 AES256 키드 HMAC 콜백 지터 및 슬립 간격 빌드 시 JSON 또는 TOML 파일을 통해 제공되는 에이전트 메시지 및 서버 응답 구성: 쿠키,...

lldp

lldp Профиль C2 для Mythic, обеспечивающий одноранговую связь peer-to-peer через IEEE 802.1AB LLDP. Данные C2 передаются внутри организационно-специфичных TLV Type 127 с настраиваемым OUI, благодаря чему кадры сливаются с вендорскими расширениями LLDP в трафике. LLDP — протокол только второго...

AI-FILE

AIfile aifile은 공개적으로 문서화된 OpenAI Files API를 사용하여 기존의 HTTP/S 리스너 대신 jsonl 파일을 통해 임플란트 메시지를 교환하는 Mythic C2 프로파일입니다. 이는 OpenAI가 공개 문서에서 정의한 Files API 동작에 의존합니다: https://developers.openai.com/api/docs/guides/file-inputs?api-mode=responses. 리스너는 /v1/files 엔드포인트를 폴링하여 purpose=batch인 .jsonl 파일을 찾고, 각 요청...

CVE-2026-57952

Mythic before 3.4.0.60 contains an authorization bypass in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpo...

CVE-2026-57952 Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

CVE-2026-57952: Missing Authorization

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check

0x00 Introduction Tool introduction RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex re...

PickleC2 - A Post-Exploitation And Lateral Movements Framework

PickleC2 is a post-exploitation and lateral movements framework. Documentation ReadTheDocs Overview PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements. PickleC2 has the ability to import your own PowerShell modul...

Nimplant - A Cross-Platform Implant Written In Nim

Nimplant is a cross-platform Linux & Windows implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated...

APT29 Re-Emerges After 2 Years with Widespread Espionage Campaign

A phishing campaign bent on espionage, believed to be launched by the nation-state threat group known as APT29, is targeting high-value targets across the think-tank, law enforcement, media, U.S. military, imagery, transportation, pharmaceutical, national government and defense contracting sector...