CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

Villain

Villain Purpose Villain is a high-level Stage 0/1 C2 framework that can handle multiple reverse TCP and HoaxShell-based shells, enhance their functionality with additional features commands, utilities, and share them among connected sibling servers Villain instances running on different machines...

GRAT2

GRAT2 C2 root@kitploit: c.-.c c.-.c c.-.c c.-.c c.-.c / .. \ / .. \ / .. \ / .. \ / .. \ \ Y / \ Y / \ Y / \ Y / \ Y / .-/'-'-..-/'-'-..-/'-'-..-/'-'-..-/'-'-. || G || || R || || A || || T || || 2 || .' -' '. .' -' '. .' -' '. .' -' '. .' -' '. .-./-'.-..-./-.-..-./-'.-..-./-'.-..-./-'.-...

geacon

Geacon Utilisation de Go pour implémenter le Beacon de CobaltStrike Ce projet est uniquement destiné à l'apprentissage de l'analyse de protocole et du reverse engineering. Si des droits ont été violés, veuillez me contacter pour retirer le projet. Enfin, NE L'UTILISEZ PAS ILLÉGALEMENT Comment jou...

CobaltStrike-BOF

CobaltStrike BOF Collection of beacon BOF. 1 DCOM Lateral Movement A quick PoC that uses DCOM ShellWindows via beacon object files for lateral movement.You can either specify credentials or use the current user. To use the current user, just leave the domain, username, and password empty. A short...

ExternalC2

ExternalC2 Cobalt Strike External C2 서버와 통신 채널을 통합하기 위한 라이브러리 이 라이브러리는 Cobalt Strike External C2 사양의 구현을 제공하며, 기본 웹 채널과 웹소켓 채널을 포함합니다. 코드베이스는 문서화되어 있으며 추가 채널을 쉽게 추가할 수 있도록 설계되었습니다. 이 readme는 아직 완성되지 않았습니다. 코딩이 문서 작성보다 더 즐겁기 때문입니다. 하지만 코드에는 주석이 상세히 달려 있으니 그것을 먼저 읽어야 하겠죠? 솔루션을 빌드하고 테스트를 단계별로 실행해 보시...

SQLC2

SQLC2 SQLC2 — это скрипт PowerShell для развертывания и управления системой управления и контроля C2, которая использует SQL Server как в качестве сервера управления, так и в качестве агента. По сути, SQLC2 — это просто скрипт PowerShell, скрипт TSQL и несколько таблиц в экземпляре SQL Server,...

BadOutlook

Bad Outlook A simple PoC which leverages the Outlook Application Interface COM Interface to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application or at least...

RogueSliver

RogueSliver A suite of tools to disrupt campaigns using the Sliver C2 framework. This tool, its uses, and how it was created will be covered in depth on ACEResponder.com This tool is for educational purposes only...

twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

trevorc2

trevorc2 TrevorC2 - Commandement et Contrôle via un Comportement Légitime sur HTTP Écrit par : Dave Kennedy @HackingDave Site Web : https://www.trustedsec.com Notez qu'il s'agit d'une version très précoce - une forte randomisation et un chiffrement seront bientôt ajoutés. TrevorC2 est un modèle...

blue-pigeon

Blue Pigeon: Bluetooth-based Data Exfiltration and Proxy Tool for Red Teamers 1. The Motivation | Birth of the Bird ​ How does Blue Pigeon work? ​ The Pigeon's Key Requirements 2. The Components | Dissecting the Pidgey apart ​ 1. Blue Pigeon - The Mobile Applicaton ​ 2. Blue Beak - Custom...

chalumeau

Chalumeau Chalumeau - это автоматизированный, расширяемый и настраиваемый инструмент для извлечения учетных данных на основе PowerShell и Python. Основные возможности Создавайте свои собственные пейлоады Выполнение в памяти Извлечение списка паролей Панель отчетов / Веб-интерфейс Парсинг Mimikatz...

raven

Raven Внешний C2 для CobaltStrike поверх Websockets Дополнительная информация: https://www.cobaltstrike.com/help-externalc2 Сборка сервера Ubuntu Скопируйте папку сервера на ваш VPS. Запустите ./setup.sh от имени root или через sudo Сборка клиента Windows Скопируйте папку клиента на хост разработ...

doublepulsar-c2-traffic-decryptor

Author: Luke Jennings [email protected] - @jukelennings Company: Countercept @countercept Website: https://countercept.com A python2 script for decrypting the C2 traffic used by the DOUBLEPULSAR SMB implant from a PCAP file. The encryption used is a simple 4-byte XOR, which you can often see...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

GraphStrike

GraphStrike Release blog: GraphStrike: Using Microsoft Graph API to Make Beacon Traffic Disappear Developer blog: GraphStrike: Anatomy of Offensive Tool Development Introduction GraphStrike is a suite of tools that enables Cobalt Strike's HTTPS Beacon to use Microsoft Graph API for C2...

ligolo-ng

Ligolo-ng : Tunneling like a VPN An advanced, yet simple, tunneling tool that uses TUN interfaces. 📑 Ligolo-ng Documentation Setup/Quickstart !TIP Ligolo-ng 0.8 added a lot of new features, including: 🌐 API and a beautiful Web Interface thanks to L'ami du Raisin, allowing multiplayer! ⚙️ Simple...

gdog

Gdog Un backdoor Windows furtif basé sur Python qui utilise Gmail comme serveur de commande et de contrôle Ce projet a été inspiré par gcat https://github.com/byt3bl33d3r/gcat de byt3bl33d3r. Prérequis Python 2.x Module PyCrypto Module WMI Module Enum34 Module Netifaces Fonctionnalités Messages d...

c2-cloud

À propos du projet Le C2 Cloud est un framework C2 web robuste, conçu pour simplifier la vie des testeurs d'intrusion. Il permet un accès facile aux backdoors compromises, tout comme l'accès à une instance EC2 dans le cloud AWS. Il peut gérer plusieurs sessions de backdoor simultanément avec une...