pingback

Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...

RogueSliver

RogueSliver Un conjunto de herramientas para interrumpir campañas que utilizan el framework Sliver C2. Esta herramienta, sus usos y cómo fue creada se cubrirán en profundidad en ACEResponder.com Esta herramienta es solo para fines educativos...

MrRAT

MrRAT This is a cross-platform Python 2.x Remote Access Trojan RAT, MrRAT was created to maintain a clean design full-featured Python RAT. Currently a work in progress and still being actively hacked on. Disclaimer: This RAT is for research purposes only, and should only be used on authorized...

BabyShark

INTRODUCCIÓN Este es un servidor C2 genérico básico escrito en Python y Flask. Este código tiene la idea base de GTRS, que utiliza Google Translator como proxy para enviar comandos al host infectado. El proyecto BabyShark tiene como objetivo centralizar conexiones inversas con agentes, creando un...

fronthunter

FrontHunter FrontHunter es una herramienta para probar grandes listas de dominios e identificar candidatos para domain fronting. ¿Domain Fronting? ¿En serio? Lo sé, lo sé… el domain fronting es bastante viejo. Pero la verdad es que sigue siendo útil como una característica más para incluir en tu...

Maestro

Maestro Maestro is a post-exploitation tool designed to interact with Intune/EntraID from a C2 agent on a user's workstation without requiring knowledge of the user's password or Azure authentication flows, token manipulation, and web-based administration console. Maestro makes interacting with...

1135-CobaltStrike-ToolKit

1135-CobaltStrike-ToolKit Malleable C2 Files Cobalt Strike's Malleable C2 profiles are designed to counter traffic analysis. Cobalt Strike's Malleable C2 profiles define the "communication format specifications and methods" of C2 traffic between the victim and the team server. By disguising C2...

InfraGuard

Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes...

endgame

ENDGAME C2 FRAMEWORK ENDGAME is a professional command and control framework built for authorized red team engagements, penetration testing, and educational security research. Designed to simulate realistic adversary techniques, assess detection coverage, and help security teams understand their...

Powershell-C2

Powershell-C2 This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box. A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/...

conquest

Conquest is a feature-rich, extensible and malleable command & control/post-exploitation framework developed for penetration testing and adversary simulation. Conquest's team server, operator client and agent have all been developed using the Nim programming language and are designed with...

pwnlift

pwnlift Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis such as Code Integrity Policy files. Building Build the projec...

Sleight

Sleight Empire HTTPS C2 redirector setup script. Usage: Sleight can be used in 3 ways: 1 Setup HTTP Redirector: 1. Run Sleight and feed it an Empire communication profile. 2. Input your Empire C2's IP address and listening port. 3. Say no to the HTTPS prompt. 4. Input a site to redirect all inval...

ICMP-Ghost-A-Fileless-x64-Assembly-C2-Agent

root@kitploit: |\ |\ |\ |\ |\ |\ \ |\ |\ \ \ \ | \ \ \\ \ \ |\ \ \ || \ | \ \ |||\ \ \ \ \ \ \ \ \ \\ \ \ \ \ \ \ \ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ ||\ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ \ \ \ \ \\ ||||||||\ || ||| || Fileless, pure x64 Assembly C2 implant utilizing a...

ThreatKB

NOTE: THIS REPO IS IN AN ALPHA STATE ThreatKB is a knowledge base workflow management dashboard for YARA rules and C2 artifacts. Rules are categorized and used to denote intent, severity, and confidence in accumulated artifacts. To start using ThreatKB, check out our wiki. Installing by Docker is...

Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons Este proyecto es principalmente un escáner de callstack que intenta identificar IOCs que indican un agente C2 desempaquetado o inyectado. Todas las comprobaciones se basan en la observación de que los agentes C2 esperan entre sus callbacks, lo que provoca que el hilo del...

meteor

Meteor A cross-platform C2/teamserver supporting multiple transport protocols, written in Go. Note: This is in development and as such is not exactly stable. Documentation is also lacking, but will be improved gradually over time. General The Meteor system is split into several parts: Core : the...

Invoke-SelfSignedWebRequest

Invoke-SelfSignedWebRequest For InfoSec work, using HTTPS is an incredibly handy mechanism for C2 and maneuver within target network space. Further PowerShell is an amazing productivity tool that can help an operator achieve dynamic results. A natural next conclusion is to combine the C2 channel...

DaaC2

DaaC2 - Discord como un C2 Escribí esto porque estaba aburrido y quería jugar con un bot de Discord, para ver si podía construir una línea de comunicación entre un servidor C2 y un agente a través de Discord. Resulta que funciona bastante bien. Idealmente, con más tiempo, usaría esto como un...

Absolutely-Positively-NOT-Hacking-Back-with-Pcap

Absolutely Positively NOT Hacking Back with Pcap Streaming Unexpected Network Byte Sequences with High Probability of Blue Screening or Otherwise Crashing Attacker Command-and-Control Nodes This was presented at TheSAS2019: https://www.youtube.com/watch?v=Z1-4-amGdaM...